@miphamai/cli 0.22.0 → 0.24.0

package/src/core/engine.ts

@@ -3,6 +3,7 @@ import type {
   ToolDefinition,
   ToolResult,
   InferenceHookConfig,
+  CrsiConfig,
 } from '../shared/index.ts'
 import { ProviderRegistry } from '../providers/registry'
 import { ContextManager } from './context'
@@ -16,8 +17,13 @@ import type { AgentViewManager } from '../agent-view/agent-view-manager'
 import type { SkillsLoader } from '../skills/loader'
 import { getBackgroundAgentRegistry } from '../agent/background-registry'
 import { RulesLoader } from './rules-loader'
+import { ExperienceRuleEngine } from './rule-engine.js'
+import { PatternAnalyzer } from '../agent/pattern-analyzer.js'
+import { EffectivenessTracker } from '../agent/effectiveness-tracker.js'
 import { UsageTracker } from './usage-tracker'
 import { buildRequest, sendInferenceCheck, isInferenceHookEnabled } from './inference-hook'
+import { getFileInboxTransport } from '../agent/cross-session/file-inbox'
+import { getMessageBus } from '../agent/message-bus'
 import { createT } from '../i18n-core/t'
 import enUS from '../i18n-core/locales/en-US.json'
 import zhCN from '../i18n-core/locales/zh-CN.json'
@@ -35,6 +41,9 @@ export class QueryEngine {
   private agentRegistry?: AgentRegistry
   private agentViewManager?: AgentViewManager
   private skillsLoader?: SkillsLoader
+  private ruleEngine?: ExperienceRuleEngine
+  private _patternAnalyzer?: PatternAnalyzer
+  private _effectivenessTracker?: EffectivenessTracker
   private goal?: string
   private maxGoalLoops = 20
   private lastAssistantContent?: string
@@ -52,7 +61,40 @@ export class QueryEngine {
     private context: ContextManager,
     private tools: Map<string, ToolDefinition>,
     private permission: PermissionSystem = new PermissionSystem('default'),
-  ) {}
+    ruleEngine?: ExperienceRuleEngine,
+  ) {
+    this.ruleEngine = ruleEngine
+  }
+
+  /** Session identifier for cross-session messaging. Set by the app startup via setSessionId(). */
+  private sessionId: string = 'session-1'
+
+  /** Set the session identifier (called from index.tsx at startup with the actual session name). */
+  setSessionId(id: string): void {
+    this.sessionId = id
+  }
+
+  /** Get the current session identifier. */
+  getSessionId(): string {
+    return this.sessionId
+  }
+
+  /** Poll the cross-session file inbox for messages addressed to this session. */
+  async pollCrossSessionInbox(): Promise<void> {
+    try {
+      const transport = getFileInboxTransport()
+      const messages = await transport.poll(this.sessionId)
+      if (messages.length > 0) {
+        const bus = getMessageBus()
+        for (const msg of messages) {
+          bus.post(msg.from, msg.to, msg.summary, msg.message, msg.type)
+        }
+      }
+    } catch (err) {
+      // Best-effort: don't let a failed inbox poll break the turn
+      console.warn('Cross-session inbox poll failed:', err)
+    }
+  }
 
   /** Register a hook engine for pre/post tool-use lifecycle events. */
   setHookEngine(hooks: HookEngine): void {
@@ -96,6 +138,8 @@ export class QueryEngine {
   private usageTracker = new UsageTracker()
   /** Inference hook (DLP) configuration. */
   private inferenceHookConfig?: InferenceHookConfig
+  /** CRSI feature flags. */
+  private crsiConfig?: Partial<CrsiConfig>
 
   /** Register the rules loader. */
   setRulesLoader(loader: RulesLoader): void {
@@ -108,6 +152,11 @@ export class QueryEngine {
     this.inferenceHookConfig = config
   }
 
+  /** Register CRSI feature flags. */
+  setCrsiConfig(config: Partial<CrsiConfig> | undefined): void {
+    this.crsiConfig = config
+  }
+
   /** Pending task notifications from background agents (cleared after draining). */
   private pendingTaskNotifications: Array<StreamChunk> = []
 
@@ -255,9 +304,12 @@ export class QueryEngine {
   }
 
   async *process(userInput: string, signal?: AbortSignal): AsyncGenerator<StreamChunk> {
+    // Poll for cross-session messages before each turn
+    await this.pollCrossSessionInbox()
+
     // Fire UserPromptSubmit hooks before processing
     if (this.hookEngine) {
-      const submitResult = await this.hookEngine.executeUserPromptSubmit(userInput, 'session-1')
+      const submitResult = await this.hookEngine.executeUserPromptSubmit(userInput, this.sessionId)
       if (submitResult.additionalContext) {
         this.context.addMessage({
           role: 'user',
@@ -292,7 +344,7 @@ export class QueryEngine {
       const model = this.registry.getActiveModel()
       const request = buildRequest(
         messages,
-        'session-1',
+        this.sessionId,
         provider,
         model,
         hookConfig.organization_id,
@@ -587,7 +639,7 @@ export class QueryEngine {
         const model = this.registry.getActiveModel()
         const request = buildRequest(
           messages,
-          'session-1',
+          this.sessionId,
           provider,
           model,
           hookConfig.organization_id,
@@ -761,8 +813,9 @@ export class QueryEngine {
 
     // Run PreToolUse hooks
     let effectiveParams = params
+    let hookWarnings: string[] = []
     if (this.hookEngine) {
-      const preResult = await this.hookEngine.executePreToolUse(name, params, 'session-1')
+      const preResult = await this.hookEngine.executePreToolUse(name, params, this.sessionId)
       if (!preResult.allowed) {
         return {
           success: false,
@@ -775,10 +828,21 @@ export class QueryEngine {
       }
     }
 
+    // CRSI RuleEngine intercept — gated by crsi.preToolHook feature flag
+    if (this.crsiConfig?.preToolHook !== false && this.ruleEngine) {
+      const ruleResult = this.ruleEngine.intercept(name, effectiveParams)
+      if (Object.keys(ruleResult.modified).length > 0) {
+        effectiveParams = ruleResult.modified
+      }
+      if (ruleResult.warnings.length > 0) {
+        hookWarnings = ruleResult.warnings
+      }
+    }
+
     try {
       const result = await tool.execute(effectiveParams, {
         cwd: process.cwd(),
-        sessionId: 'session-1',
+        sessionId: this.sessionId,
         provider: this.registry.getActive().config.id,
         model: this.registry.getActiveModel(),
         skillsLoader: this.skillsLoader,
@@ -788,14 +852,33 @@ export class QueryEngine {
         agentRegistry: this.agentRegistry,
         backgroundAgentRegistry: getBackgroundAgentRegistry(),
         permissionSystem: this.permission,
+        ruleEngine: this.ruleEngine,
       })
 
       // Track touched files for rules matching
       this.trackTouchedFile(name, effectiveParams)
 
+      // Prepend CRSI warnings to result content
+      if (hookWarnings.length > 0 && result.success) {
+        result.content = hookWarnings.join('\n') + '\n' + (result.content || '')
+      }
+
       // Run PostToolUse hooks
       if (this.hookEngine) {
-        await this.hookEngine.executePostToolUse(name, effectiveParams, result, 'session-1')
+        await this.hookEngine.executePostToolUse(name, effectiveParams, result, this.sessionId)
+      }
+
+      // CRSI: Track rule effectiveness after tool execution
+      if (hookWarnings.length > 0) {
+        const tracker = this.getEffectivenessTracker()
+        for (const warning of hookWarnings) {
+          const match = warning.match(/^\[rule:([^\]]+)\]/)
+          const ruleId = match?.[1]
+          if (ruleId) {
+            tracker.recordApplication(ruleId, result.success)
+          }
+        }
+        tracker.persist()
       }
 
       return result
@@ -829,6 +912,27 @@ export class QueryEngine {
     return this.tools
   }
 
+  getRuleEngine(): ExperienceRuleEngine | undefined {
+    return this.ruleEngine
+  }
+
+  /** Lazily-initialized PatternAnalyzer singleton. */
+  getPatternAnalyzer(): PatternAnalyzer {
+    if (!this._patternAnalyzer) {
+      this._patternAnalyzer = new PatternAnalyzer()
+    }
+    return this._patternAnalyzer
+  }
+
+  /** Lazily-initialized EffectivenessTracker singleton. */
+  getEffectivenessTracker(): EffectivenessTracker {
+    if (!this._effectivenessTracker) {
+      this._effectivenessTracker = new EffectivenessTracker()
+      this._effectivenessTracker.load()
+    }
+    return this._effectivenessTracker
+  }
+
   /** Register a tool dynamically (used by MCP auto-registration). */
   registerTool(tool: ToolDefinition): void {
     if (this.tools.has(tool.name)) {
@@ -867,7 +971,7 @@ export class QueryEngine {
   /** Wrap context compaction with PreCompact/PostCompact hooks. */
   private async compactWithHooks(heading: string): Promise<void> {
     if (this.hookEngine) {
-      const preResult = await this.hookEngine.executePreCompact('session-1')
+      const preResult = await this.hookEngine.executePreCompact(this.sessionId)
       if (preResult.additionalContext) {
         this.context.addMessage({
           role: 'user',
@@ -879,7 +983,7 @@ export class QueryEngine {
     await this.context.compact(heading)
 
     if (this.hookEngine) {
-      const postResult = await this.hookEngine.executePostCompact('session-1')
+      const postResult = await this.hookEngine.executePostCompact(this.sessionId)
       if (postResult.additionalContext) {
         this.context.addMessage({
           role: 'user',
@@ -893,7 +997,7 @@ export class QueryEngine {
   private async *checkStopHook(signal?: AbortSignal): AsyncGenerator<StreamChunk> {
     if (!this.hookEngine) return
 
-    const stopResult = await this.hookEngine.executeStop('session-1')
+    const stopResult = await this.hookEngine.executeStop(this.sessionId)
     if (stopResult.decision === 'block') {
       // Feed the block reason back to the AI and continue
       this.context.addMessage({

package/src/core/rule-engine.ts

@@ -0,0 +1,179 @@
+import type { ExperienceRule } from '../agent/experience-rules.js'
+import { mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+
+export interface ToolRule {
+  id: string
+  toolName: string
+  category: string
+  match: (params: Record<string, unknown>) => boolean
+  fix: (params: Record<string, unknown>) => {
+    modified: Record<string, unknown>
+    warning: string
+  }
+  source: 'builtin' | 'pattern-analyzer' | 'manual'
+  enabled: boolean
+}
+
+const BUILTIN_RULES: ToolRule[] = [
+  {
+    id: 'rule-timeout-bash-heavy',
+    toolName: 'Bash',
+    category: 'timeout',
+    match: (p: Record<string, unknown>) => {
+      const cmd = String(p.command ?? '')
+      const heavy = /npm (install|ci|test)|docker build|pnpm install|cargo build|brew install/.test(
+        cmd,
+      )
+      if (!heavy) return false
+      const timeout = (p as Record<string, unknown>).timeout as number | undefined
+      return !timeout || timeout < 300_000
+    },
+    fix: (p: Record<string, unknown>) => {
+      const prevTimeout = (p as Record<string, unknown>).timeout as number | undefined
+      return {
+        modified: { ...p, timeout: 300_000 },
+        warning: `⏱️ timeout 已从 ${prevTimeout || 'default'}ms 自动提升至 300000ms（该命令类型历史超时率 > 50%）`,
+      }
+    },
+    source: 'builtin',
+    enabled: true,
+  },
+  {
+    id: 'rule-git-force-protection',
+    toolName: 'Bash',
+    category: 'tool-params',
+    match: (p: Record<string, unknown>) => {
+      const cmd = String(p.command ?? '')
+      return /git (push|reset) .*--force/.test(cmd) && !p.dangerouslyDisableSandbox
+    },
+    fix: (p: Record<string, unknown>) => ({
+      modified: p,
+      warning: '⚠️ 检测到 git --force 操作。如需执行请设置 dangerouslyDisableSandbox: true',
+    }),
+    source: 'builtin',
+    enabled: true,
+  },
+]
+
+export class ExperienceRuleEngine {
+  private rules: ToolRule[]
+  private storePath: string
+
+  constructor(storeDir: string = join(process.env.HOME || '~', '.mipham', 'rule-engine')) {
+    this.rules = [...BUILTIN_RULES.map((r) => ({ ...r }))]
+    this.storePath = join(storeDir, 'rules.json')
+    this.load()
+  }
+
+  register(rule: ToolRule): void {
+    // Replace if same ID exists, otherwise append
+    const idx = this.rules.findIndex((r) => r.id === rule.id)
+    if (idx !== -1) {
+      this.rules[idx] = rule
+    } else {
+      this.rules.push(rule)
+    }
+    this.persist()
+  }
+
+  intercept(
+    toolName: string,
+    params: Record<string, unknown>,
+  ): { modified: Record<string, unknown>; warnings: string[] } {
+    let modified = params
+    const warnings: string[] = []
+
+    for (const rule of this.rules) {
+      if (!rule.enabled) continue
+      if (rule.toolName !== toolName) continue
+
+      try {
+        if (rule.match(modified)) {
+          const result = rule.fix(modified)
+          modified = result.modified
+          if (result.warning) {
+            warnings.push(`[rule:${rule.id}] ${result.warning}`)
+          }
+        }
+      } catch {
+        // Rule match/fix failures never block execution
+      }
+    }
+
+    return { modified, warnings }
+  }
+
+  convertFromExperienceRules(experienceRules: ExperienceRule[]): ToolRule[] {
+    return experienceRules.map((er): ToolRule => {
+      // Map experience rule category to tool name
+      const toolNameMap: Record<string, string> = {
+        timeout: 'Bash',
+        'tool-params': 'Bash',
+        import: 'Write',
+        search: 'Grep',
+        semantic: 'Bash',
+      }
+      const toolName = toolNameMap[er.category] || 'Bash'
+
+      return {
+        id: er.id,
+        toolName,
+        category: er.category,
+        match: (p: Record<string, unknown>): boolean => {
+          if (er.category === 'timeout') {
+            const cmd = String(p.command ?? '')
+            const heavy = /npm|docker|pnpm|cargo|brew|install|build/.test(cmd)
+            if (!heavy) return false
+            const timeout = (p as Record<string, unknown>).timeout as number | undefined
+            return !timeout || timeout < 300_000
+          }
+          // Default: always match for the given tool
+          return true
+        },
+        fix: (p: Record<string, unknown>) => ({
+          modified: { ...p, timeout: 300_000 },
+          warning: `⏱️ [auto-rule] ${er.action} (${er.evidence.failureCount} 次历史失败)`,
+        }),
+        source: 'pattern-analyzer',
+        enabled: true,
+      }
+    })
+  }
+
+  getActiveRules(): ToolRule[] {
+    return this.rules.filter((r) => r.enabled)
+  }
+
+  setRuleEnabled(id: string, enabled: boolean): void {
+    const rule = this.rules.find((r) => r.id === id)
+    if (rule) {
+      rule.enabled = enabled
+      this.persist()
+    }
+  }
+
+  /** Persist non-builtin rules to disk. */
+  persist(): void {
+    const nonBuiltin = this.rules.filter((r) => r.source !== 'builtin')
+    const dir = dirname(this.storePath)
+    mkdirSync(dir, { recursive: true })
+    writeFileSync(this.storePath, JSON.stringify(nonBuiltin, null, 2), 'utf-8')
+  }
+
+  /** Load persisted non-builtin rules from disk. Rejects rules whose IDs conflict with builtins. */
+  load(): void {
+    if (!existsSync(this.storePath)) return
+    try {
+      const raw = JSON.parse(readFileSync(this.storePath, 'utf-8')) as ToolRule[]
+      const builtinIds = new Set(BUILTIN_RULES.map((r) => r.id))
+      for (const rule of raw) {
+        // Reject if a builtin with the same ID exists (builtins always win)
+        if (builtinIds.has(rule.id)) continue
+        this.rules.push(rule)
+      }
+    } catch {
+      // Corrupt file — start fresh with only builtins
+    }
+  }
+}

package/src/core/session-store.ts

@@ -9,6 +9,7 @@ import {
   statSync,
 } from 'node:fs'
 import { join } from 'node:path'
+import { createHash } from 'node:crypto'
 import type { Message } from '../shared/types'
 
 export interface SessionMetadata {
@@ -50,7 +51,15 @@ function ensureDir(): void {
 
 function filePath(name: string): string {
   // Sanitize name for filesystem
-  const safe = name.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 100)
+  const safe = name.replace(/[^a-zA-Z0-9_-]/g, '_')
+
+  // For very long names (>100 chars), use SHA-256 hash suffix to prevent collision
+  if (safe.length > 100) {
+    const hash = createHash('sha256').update(safe).digest('hex').slice(0, 16)
+    const truncated = safe.slice(0, 80)
+    return join(SESSIONS_DIR, `${truncated}-${hash}.jsonl`)
+  }
+
   return join(SESSIONS_DIR, `${safe}.jsonl`)
 }
 
@@ -233,7 +242,11 @@ export class SessionStore {
     ensureDir()
     mkdirSync(SUMMARIES_DIR, { recursive: true })
 
-    const safe = name.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 100)
+    const safeRaw = name.replace(/[^a-zA-Z0-9_-]/g, '_')
+    const safe =
+      safeRaw.length > 100
+        ? `${safeRaw.slice(0, 80)}-${createHash('sha256').update(safeRaw).digest('hex').slice(0, 16)}`
+        : safeRaw
     const summaryPath = join(SUMMARIES_DIR, `${safe}.md`)
     writeFileSync(summaryPath, `# ${name}\n\n${summary}\n\nTags: ${tags.join(', ')}\n`, 'utf-8')
 

package/src/index.tsx

@@ -3,12 +3,24 @@ import { join } from 'node:path'
 import { existsSync } from 'node:fs'
 import { render } from 'ink'
 import { App } from './ui/app'
-import { loadConfig, loadInferenceHookConfig, loadCredentialMaskingConfig } from './config/loader'
+import {
+  loadConfig,
+  loadInferenceHookConfig,
+  loadCredentialMaskingConfig,
+  loadCrossSessionConfig,
+} from './config/loader'
+import {
+  registerActiveSession,
+  heartbeatSession,
+  unregisterSession,
+  createSessionInfo,
+} from './agent/cross-session/discovery'
 import { bootstrapProviders } from './providers/bootstrap'
 import { InstructionsLoader } from './core/instructions'
 import { loadSessionMemories, getMemoryManager } from './core/memory/memory-loader'
 import { ContextManager } from './core/context'
 import { QueryEngine } from './core/engine'
+import { ExperienceRuleEngine } from './core/rule-engine.js'
 import { SessionStore } from './core/session-store'
 import type { PermissionLevel } from './shared/types'
 import { SkillsLoader } from './skills/loader'
@@ -236,7 +248,8 @@ export async function runApp(options: RunOptions): Promise<void> {
   const artifactServer = new ArtifactServer(artifactsDir, ARTIFACT_PORT)
 
   // Create query engine
-  const engine = new QueryEngine(registry, context, tools)
+  const ruleEngine = new ExperienceRuleEngine()
+  const engine = new QueryEngine(registry, context, tools, undefined, ruleEngine)
   engine.setHookEngine(hookEngine)
   engine.setArtifactServer(artifactServer)
   engine.setAgentViewManager(agentViewManager)
@@ -246,6 +259,10 @@ export async function runApp(options: RunOptions): Promise<void> {
   const inferenceHookConfig = loadInferenceHookConfig()
   engine.setInferenceHookConfig(inferenceHookConfig)
 
+  // Initialize credential masking pipeline (strategies: Full, Extract, JWT)
+  const { initializePipeline } = await import('./core/credential-masker/index')
+  initializePipeline()
+
   // Wire credential masking configuration into tools
   const credentialMaskingConfig = loadCredentialMaskingConfig()
   const { setCredentialMaskingConfigForRead } = await import('./tools/file/read')
@@ -280,10 +297,36 @@ export async function runApp(options: RunOptions): Promise<void> {
 
   engine.setupContextSummarizer()
 
+  // ── Cross-session messaging: register session, heartbeat, shutdown ──
+  engine.setSessionId(sessionName)
+  const sessionInfo = createSessionInfo(
+    sessionName,
+    sessionName,
+    process.cwd(),
+    defaultProvider,
+    defaultModel,
+  )
+  registerActiveSession(sessionInfo)
+
+  // 30-second heartbeat to keep the session file mtime fresh
+  const heartbeatInterval = setInterval(() => {
+    heartbeatSession(sessionName)
+  }, 30_000)
+
+  // Allow heartbeat to not keep the process alive
+  if (heartbeatInterval.unref) {
+    heartbeatInterval.unref()
+  }
+
+  // Load cross-session config (available for MessageRouter and future consumers)
+  loadCrossSessionConfig()
+
   // Auto-save session on exit
   let saved = false
   const saveAndExit = () => {
     saved = true
+    clearInterval(heartbeatInterval)
+    unregisterSession(sessionName)
     artifactServer.stop()
     if (context.getMessageCount() > 0) {
       SessionStore.save(sessionName, context.getMessages(), {
@@ -300,6 +343,8 @@ export async function runApp(options: RunOptions): Promise<void> {
 
   // Safety net: auto-save on exit for paths that bypass saveAndExit
   process.on('exit', () => {
+    clearInterval(heartbeatInterval)
+    unregisterSession(sessionName)
     if (!saved && context.getMessageCount() > 0) {
       SessionStore.autoSave(context.getMessages(), {
         provider: defaultProvider,

package/src/shared/types.ts

@@ -72,6 +72,7 @@ export interface ToolContext {
   agentRegistry?: import('../agent/agent-registry').AgentRegistry
   backgroundAgentRegistry?: import('../agent/background-registry').BackgroundAgentRegistry
   permissionSystem?: import('../core/permission').PermissionSystem
+  ruleEngine?: import('../core/rule-engine').ExperienceRuleEngine
 }
 
 // ── Artifact Types ──
@@ -162,6 +163,8 @@ export interface MiphamConfig {
   }
   /** Phase 9 feature flags. All default to true. */
   features?: Partial<FeatureFlags>
+  /** Phase 10 CRSI feature flags. All default to true. */
+  crsi?: Partial<CrsiConfig>
 }
 
 export interface FeatureFlags {
@@ -169,6 +172,17 @@ export interface FeatureFlags {
   context: { useRealTokenizer: boolean; adaptiveThresholds: boolean }
 }
 
+export interface CrsiConfig {
+  /** Extract and inject experience rules into agent system prompts. */
+  ruleInjection: boolean
+  /** Intercept tool calls and auto-fix known failure patterns before execution. */
+  preToolHook: boolean
+  /** Analyze agent outcomes for recurring failure patterns. */
+  autoPatternAnalysis: boolean
+  /** Auto-degrade/disable low-effectiveness rules based on success-rate tracking. */
+  autoRuleManagement: boolean
+}
+
 export interface McpServerConfig {
   name: string
   command: string
@@ -375,17 +389,44 @@ export interface CredentialFullMaskRule {
   mode: 'full'
 }
 
+/** Per-extract-pattern configuration with optional field-based extraction. */
+export interface CredentialExtractPattern {
+  /** Regex pattern to match. When `field` is set, applied to field value only. */
+  pattern: string
+  /** Optional replacement string. Defaults to CREDENTIAL_SENTINEL. */
+  replacement?: string
+  /** 🆕 JSON key to extract before applying pattern. If unset, pattern runs against full content. */
+  field?: string
+}
+
 /** Extract-based masking rule: only regex-matched tokens are replaced. */
 export interface CredentialExtractRule {
   path: string
   mode: 'extract'
-  extract: Array<{
-    pattern: string
-    replacement?: string
-  }>
+  extract: CredentialExtractPattern[]
+  /** 🆕 Behavior when no extract pattern matches: 'mask' (replace all) or 'passthrough' (keep). Default: 'mask'. */
+  onExtractNoMatch?: 'mask' | 'passthrough'
+}
+
+/** 🆕 JWT-aware masking rule: decode payload and mask specified claims. */
+export interface JwtMaskingRule {
+  path: string
+  type: 'jwt'
+  decode: 'jwt'
+  /** Claim names to mask in the JWT payload (e.g. ["sub", "email"]). */
+  maskClaims: string[]
+}
+
+/** 🆕 AWS credential pair masking rule: detect key pairs and optionally re-sign. */
+export interface AwsMaskingRule {
+  path: string
+  type: 'aws'
+  awsPairs: boolean
+  sigv4: boolean
 }
 
-export type CredentialFileRule = CredentialFullMaskRule | CredentialExtractRule
+export type CredentialFileRule =
+  CredentialFullMaskRule | CredentialExtractRule | JwtMaskingRule | AwsMaskingRule
 
 /** Configuration for credential masking, loaded from config.yml. */
 export interface CredentialMaskingConfig {
@@ -401,6 +442,29 @@ export interface CredentialMaskingConfig {
   }
 }
 
+// ── Cross-Session Messaging Types ──
+
+/** Controls how inbound cross-session messages are handled. */
+export type CrossSessionInbound = 'allow' | 'ask' | 'deny'
+
+/** 🆕 Configuration for cross-session messaging. */
+export interface CrossSessionConfig {
+  crossSessionInbound: CrossSessionInbound
+  dialogExpiry: number // seconds
+}
+
+/** Session information exposed via ListAgents. */
+export interface SessionInfo {
+  id: string
+  name: string
+  machine: string
+  pid: number
+  startedAt: string
+  cwd?: string
+  provider?: string
+  model?: string
+}
+
 // ── Background Agent Types ──
 
 export interface BackgroundAgentConfig {

package/src/tools/agent/agent.ts

@@ -60,7 +60,13 @@ export const agentTool: ToolDefinition = {
     const agentDef = ctx.agentRegistry?.resolve(agentType)
 
     try {
-      const sub = new SubAgent(registry, toolRegistry, ctx.permissionSystem)
+      const sub = new SubAgent(
+        registry,
+        toolRegistry,
+        ctx.permissionSystem,
+        undefined,
+        ctx.ruleEngine,
+      )
       const result = await sub.execute(prompt, description, {
         type: agentType,
         agentDef,