@sema-agent/core 7.1.0 → 7.2.0

package/dist/core/task-notification.d.ts

@@ -140,6 +140,38 @@ export interface TaskNotificationPayload {
     peer?: {
         hopChain: string[];
     };
+    /**
+     * design/385 §1.4 d1 — the delegated-child → parent UPLINK carrier (`SendMessage("main")`). Its
+     * PRESENCE is the render discriminator: the frame reaches the parent's model as a top-level
+     * `<agent-message from="…">` user frame (the same-process lane's carrier, distinct from both the
+     * `<task-notification>` shell and the cross-session envelope) followed by the peer discipline block.
+     * `body` is the child's message as bounded by the producer (no discipline block inside it — the
+     * block is frame-adjacent by rule). The classic members (`summary`/`result`) stay filled beside it
+     * for wire consumers that project the frame as a card; they are not what the model reads.
+     * Minted ONLY by the SendMessage uplink leg (engine-side); an external `notify()` cannot wear it.
+     */
+    agentMessage?: {
+        from: string;
+        body: string;
+    };
+    /**
+     * design/385 §1.4 d1 — the engine-minted PROVENANCE side record of an agent-message frame, a typed
+     * key (never model text) so a host can attribute and correlate the injection on the wire:
+     * `kind` names the lane, `from` is the sender label the frame's attribute spells, `taskId` the
+     * sender's run/agent id, `seq` the producer's per-frame counter (= this payload's `seq`),
+     * `agentType` the sender's resolved agent type when the producer knows it. Present exactly when
+     * {@link agentMessage} is.
+     */
+    _sema_provenance?: SemaProvenance;
+}
+/** design/385 §1.4 d1 — see {@link TaskNotificationPayload._sema_provenance}. `kind` is a closed set
+ *  with one member today; a future lane adds a member, never a second key. */
+export interface SemaProvenance {
+    kind: "agent_message";
+    from: string;
+    taskId: string;
+    seq: number;
+    agentType?: string;
 }
 /**
  * design/144 §2 — the caller-facing input of `TaskStream.notify()`: a STRUCTURED external event to inject
@@ -229,6 +261,23 @@ export declare function attrEscape(value: string): string;
 /** Max rendered length of an untrusted attribution label (the external `from="…"` header and the
  *  design/171 speaker envelope share it — same concern: a display label, not a payload). */
 export declare const EXTERNAL_SOURCE_MAX = 120;
+/** design/385 §1.4 d1 — the same-process lane's carrier tag (CC `iTe`). */
+export declare const AGENT_MESSAGE_TAG = "agent-message";
+/**
+ * design/385 §1.4 d1 — render the child → parent uplink as CC's same-process form: a top-level
+ * `<agent-message from="…">` frame (CC `ZSe`: attribute-escaped sender, nested-tag-neutralized body,
+ * no header prose — the attribution IS the attribute) followed by the peer discipline block OUTSIDE
+ * the frame (design/176 §3.4 placement: a sender-embedded copy inside the body arrives neutralized,
+ * so position distinguishes the real block). The body first passes the harness AUTHORITY-family
+ * neutralization ({@link neutralizePeerBody}: every engine envelope a model reads as harness speech —
+ * `task-notification`, `user_memory`, `skills`, … — not the reminder tag alone), because the child's
+ * text is model output; the pre-carrier `<task-notification>` shell entity-escaped every byte of it,
+ * and the carrier form must contain at least as much.
+ */
+export declare function renderAgentMessageFrame(frame: {
+    from: string;
+    body: string;
+}): string;
 export declare function renderTaskNotificationXml(n: TaskNotificationPayload): string;
 /**
  * The BETWEEN-TURNS pending lane. A task notification born while NO turn is
@@ -341,11 +390,21 @@ export declare class PendingSessionNotifications {
     get size(): number;
 }
 /**
- * Delivery-side overflow disclosure: fold the per-task drop counts into the drained payloads. The first
- * surviving payload of a task that lost events gets a `[task_id]`-prefixed disclosure line prepended to its
- * summary (backgroundTasks 同规: the id keeps the loss addressable via TaskOutput). A task whose EVERY
- * pending item was evicted still gets one honest synthetic `event` payload saying so — a fully silent loss
- * is never allowed.
+ * Delivery-side overflow disclosure: fold the per-task drop counts into the drained payloads. Two
+ * carrier shapes, chosen per survivor:
+ *  · a CLASSIC survivor (renders through the `<task-notification>` shell) is annotated IN PLACE — the
+ *    first surviving payload of a task that lost events gets a `[task_id]`-prefixed disclosure line
+ *    prepended to its summary (backgroundTasks 同规: the id keeps the loss addressable via TaskOutput);
+ *  · an AGENT-MESSAGE survivor (design/385 §1.4 d1; renders as the `<agent-message>` carrier, its
+ *    `summary` wire-only) is left byte-unchanged, and the disclosure rides as a SEPARATE engine-authored
+ *    `event` payload inserted immediately AHEAD of it (engine speech never goes inside a peer frame;
+ *    peer speech never goes inside the authority shell that line renders through).
+ * The returned array is therefore NOT a 1:1 image of `drained.items`: it can be longer (one inserted
+ * line per disclosed agent-message lane, plus the per-lane "nothing survived" lines and the
+ * whole-session line below) — consume it by iteration, never by index-pairing against `items`. The
+ * zero-disclosure path returns `drained.items` itself (identity, no allocation). A task whose EVERY
+ * pending item was evicted still gets one honest synthetic `event` payload saying so — a fully silent
+ * loss is never allowed.
  */
 export declare function discloseDroppedPending(drained: DrainedPendingNotifications): TaskNotificationPayload[];
 export declare class SystemInjectionQueue<TPayload = TaskNotificationPayload> {

package/dist/core/task-notification.js

@@ -1,4 +1,6 @@
-import { inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { escapeEnvelopeTag, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { PEER_MESSAGE_NOTICE } from "../agents/peer-admission.js";
+import { neutralizePeerBody } from "../agents/cross-session-envelope.js";
 export const SYSTEM_INJECTION_PRIORITIES = ["now", "next", "later"];
 export function isSystemInjectionPriority(value) {
     return typeof value === "string" && SYSTEM_INJECTION_PRIORITIES.includes(value);
@@ -46,7 +48,14 @@ export function attrEscape(value) {
     return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 export const EXTERNAL_SOURCE_MAX = 120;
+export const AGENT_MESSAGE_TAG = "agent-message";
+export function renderAgentMessageFrame(frame) {
+    const body = escapeEnvelopeTag(AGENT_MESSAGE_TAG, neutralizePeerBody(frame.body));
+    return `<${AGENT_MESSAGE_TAG} from="${attrEscape(frame.from)}">\n${body}\n</${AGENT_MESSAGE_TAG}>\n\n${PEER_MESSAGE_NOTICE}`;
+}
 export function renderTaskNotificationXml(n) {
+    if (n.agentMessage !== undefined)
+        return renderAgentMessageFrame(n.agentMessage);
     const usage = n.usage === undefined
         ? undefined
         : (() => {
@@ -196,12 +205,24 @@ export function discloseDroppedPending(drained) {
     if (drained.dropped.size === 0)
         return [...drained.items, ...sessionLine];
     const disclosed = new Set();
-    const out = drained.items.map((n) => {
+    const out = drained.items.flatMap((n) => {
         const lane = taskNotificationLaneKey(n);
         const dropped = drained.dropped.get(lane);
         if (dropped === undefined || disclosed.has(lane))
-            return n;
+            return [n];
         disclosed.add(lane);
+        if (n.agentMessage !== undefined) {
+            const line = {
+                task_id: n.task_id,
+                task_type: n.task_type,
+                status: "event",
+                summary: `[${n.task_id}] ${dropped.count} earlier pending notification(s) from this task were dropped (pending-queue overflow); its latest message follows.`,
+            };
+            const linePriority = drained.priorities?.get(n);
+            if (linePriority !== undefined)
+                drained.priorities?.set(line, linePriority);
+            return [line, n];
+        }
         const annotated = {
             ...n,
             summary: `[${n.task_id}] ${dropped.count} earlier pending notification(s) from this task were dropped (pending-queue overflow). ${n.summary}`,
@@ -209,7 +230,7 @@ export function discloseDroppedPending(drained) {
         const priority = drained.priorities?.get(n);
         if (priority !== undefined)
             drained.priorities?.set(annotated, priority);
-        return annotated;
+        return [annotated];
     });
     for (const [lane, dropped] of drained.dropped) {
         if (disclosed.has(lane))

package/dist/core/tool-policy.d.ts

@@ -1058,6 +1058,17 @@ export interface AskRequest {
      * from it across a coverage change — harmlessly, since the record is what gets confirmed.
      */
     readonly ruleOffers?: readonly import("./permission-rule-model.js").RuleOffer[];
+    /**
+     * design/382 §2.4 (adversarial-review r3, additive) — the RELATIVE-CD RESOLUTION BASE the offers
+     * above were minted with: the live tracked working directory at adjudication time (the RB-108
+     * value; equal to the task root until an observable `cd` moves the tracker). Present only beside
+     * {@link ruleOffers} when the run has a tracked cwd. A consumer preparing the AUTHORITATIVE
+     * consent record threads it as `prepareCardApproval`'s `execCwd`, so the record re-mints the SAME
+     * directory member this projection displayed — without it, a moved tracker would make the record
+     * resolve `cd ./x` from the task root and persist a rule for a directory the command never
+     * enters. Display/reconstruction context only, never adjudication input.
+     */
+    readonly execCwd?: string;
     /**
      * #490 修② — WHY {@link ruleOffers} is absent, when the rule-offer lane is in play and has nothing
      * to give. A CLOSED set, mutually exclusive with {@link ruleOffers} (never both, never neither once

package/dist/core/types.d.ts

@@ -3539,6 +3539,16 @@ export interface TaskResult {
      * gate): a halt landing AFTER the abort signal already fired neither cut nor stopped anything —
      * that ending belongs to the abort, and this seat stays ABSENT rather than signing someone
      * else's stop with the halt caller's name. Absent everywhere else; never `false`.
+     *
+     * design/384 slice 2 (TRANSITIONAL narrowing): a `"suspended"` / `"needs_review"` terminal does
+     * NOT carry this seat even when a halt was accepted — those statuses mean a durable park WON its
+     * race with the halt (the row is committed and redeemable; the run is waiting to continue), and
+     * "stopped by the person" beside "waiting to resume" was a self-contradictory pair. The halt's
+     * own receipt (`{turnCut}`) and the `task.turn_interrupted` notice still stand — a seat WAS cut.
+     * Transitional: once halt-boundary source accounting lands (slice 3), the boundary-CONSUMED
+     * suspension arms flip to signing (a probe pinning today's suppressed shape goes red then, by
+     * design). The pass-through law is untouched for every OTHER terminal: a halt racing a real
+     * failure/limit — including one that outranks a committed park — still signs.
      */
     haltedByUser?: true;
     /**
@@ -5138,6 +5148,15 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      * steer-family `steering.not_running` once the task has finished (teardown included); a halt
      * issued BEFORE the run's first prompt polls the same bounded birth window as {@link steer} and
      * then stops the run before its first model turn (an empty, cleanly-halted completed run).
+     *
+     * **Receipt tension, stated (design/384 slice 2):** `{turnCut:true}` and the
+     * `task.turn_interrupted` notice assert facts about the CUT — a seat was cut, no new model turn
+     * starts — and both stay true even when the gate's durable leg still collects to `suspended`:
+     * a park whose store commit was already in flight (or committed) when the cut landed WINS the
+     * fence race, the row is redeemable, and the result then reads `status:"suspended"` WITHOUT
+     * {@link TaskResult.haltedByUser} (the transitional narrowing documented on that seat). A cut
+     * observed BEFORE the commit makes the park concede instead — no row, no card, and the ordinary
+     * halted ending.
      */
     halt(): Promise<{
         turnCut: boolean;
@@ -5791,6 +5810,10 @@ export interface EngineNotice {
      *        `detail: { cause: "user_halt", sessionId, runId, taskId? }` — no `inputId` and no
      *        `actorId`, because no text entered the model and the verb carries no caller identity. A
      *        consumer keying `detail.inputId` off this row must treat it as ABSENT on this lane.
+     *        Fence tension (design/384 slice 2): this notice asserts THE CUT only — when the cut
+     *        raced a durable park whose commit was already in flight, the gate's durable leg may
+     *        still collect to `suspended` (park wins, row redeemable, no `haltedByUser`); the notice
+     *        stands beside that terminal without contradiction, because a seat really was cut.
      *    In both lanes: one notice per REAL cut (a `now` that found nothing in flight or whose frame
      *    already rode the imminent boundary, and a halt with nothing in flight, announce nothing — no
      *    false interrupt claims); `runId` (#499) is the INVOCATION that was cut (the other two ids are

package/dist/core/untrusted-text.js

@@ -196,7 +196,23 @@ export const ENGINE_ENVELOPES = Object.freeze([
         tag: "teammate-message",
         kind: "framing",
         mint: "agents/send-message-tool.ts (INTERPOLATED tag — invisible to the literal census)",
-        guard: "escapeEnvelopeTag(TEAMMATE_MESSAGE_TAG, …) on body/summary + escapeAttributeValue on attributes",
+        guard: "body through neutralizePeerBody (the authority family, ENGINE_AUTHORITY_ENVELOPE_TAGS) + escapeEnvelopeTag(TEAMMATE_MESSAGE_TAG, …); summary/teammate_id through escapeAttributeValue",
+        fenced: false,
+        disclosed: false,
+    },
+    {
+        tag: "agent-message",
+        kind: "framing",
+        mint: "core/task-notification.ts renderAgentMessageFrame (INTERPOLATED tag — invisible to the literal census; the child → parent uplink carrier)",
+        guard: "body through neutralizePeerBody (the authority family, ENGINE_AUTHORITY_ENVELOPE_TAGS — the one helper the three peer carriers share) + escapeEnvelopeTag(AGENT_MESSAGE_TAG, …); the from attribute through attrEscape",
+        fenced: false,
+        disclosed: false,
+    },
+    {
+        tag: "cross-session-message",
+        kind: "framing",
+        mint: "agents/cross-session-envelope.ts buildCrossSessionEnvelope / encodeCcPeerFrame (INTERPOLATED tag — invisible to the literal census)",
+        guard: "model-face body through neutralizePeerBody (the authority family, ENGINE_AUTHORITY_ENVELOPE_TAGS) + escapeEnvelopeTag(CROSS_SESSION_MESSAGE_TAG, …); every attribute value typed + under its own regex grammar at build, and the parser rebuilds-and-compares (round trip) before accepting any field. The CC wire codec carries bytes as-is (containment is applied at injection when the model face is re-minted)",
         fenced: false,
         disclosed: false,
     },

package/dist/index.d.ts

@@ -95,7 +95,7 @@ export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY
 export { deploymentReadFaceClampNotice, resolveReadFace, type ReadFace, type ReadFaceInputs } from "./tools/fs/index.js";
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
@@ -118,7 +118,7 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
@@ -166,7 +166,7 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { InMemorySessionRuleOverlay, type SessionRuleOverlay, type SessionRuleOverlayAdd, type SessionRuleOverlayApplyResult, } from "./core/permission-rule-session.js";
@@ -252,6 +252,9 @@ export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE,
 export { getSessionRetainLedger, releaseSessionRetainLedger, } from "./agents/retain-ledger.js";
 export { createSendMessageTool, createAgentContinuationVerb, SEND_MESSAGE_TOOL_NAME, type SendMessageToolOptions, type AgentContinuationReceipt } from "./agents/send-message-tool.js";
 export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerAdmissionConfig, PEER_ADMISSION_DEFAULTS, PEER_HOP_CHAIN_WINDOW, PEER_MESSAGE_NOTICE, createPeerSelfRef, createPeerInboundChainRef, peerAxisToken, appendHopToken, type PeerAdmission, type PeerAdmissionConfig, type PeerAdmissionOptions, type PeerAdmissionRequest, type PeerAdmissionVerdict, type PeerAdmissionRefusal, type PeerRefusalCode, type PeerAxisTag, type PeerIdentity, type PeerSelfRef, type PeerInboundChainRef, } from "./agents/peer-admission.js";
+export { CROSS_SESSION_MESSAGE_TAG, CROSS_SESSION_MESSAGE_NOTICE, PERMISSION_MODE_CLASSES, isPermissionModeClass, CrossSessionCodecError, PEER_HOP_TOKEN_HEX, PEER_HOP_CHAIN_CARRY_WINDOW, encodePeerAddress, isCanonicalPeerAddress, encodeScopeAttribute, decodeScopeAttribute, canonicalPeerDisplayName, buildCrossSessionEnvelope, parseCrossSessionEnvelope, clampHopChain, encodeCcPeerFrame, decodeCcPeerFrame, type PermissionModeClass, type CrossSessionEnvelopeFields, type CrossSessionEnvelopeParse, type CrossSessionEnvelopeRefusal, type CcPeerFrameFields, type CcPeerFrameParse, } from "./agents/cross-session-envelope.js";
+export { CROSS_SESSION_INBOUND_SETTINGS, isCrossSessionInboundSetting, resolveCrossSessionInboundSetting, CROSS_SESSION_HOLD_CAUSES, describeCrossSessionHoldCause, judgeCrossSessionInbound, foldPermissionModeClass, PEER_SEND_VERDICT_CODES, peerSendVerdictSeverity, type CrossSessionInboundSetting, type CrossSessionSettingSource, type CrossSessionInboundSettingLayers, type ResolvedCrossSessionInboundSetting, type CrossSessionHoldCause, type CrossSessionInboundVerdict, type CrossSessionInboundInput, type PeerSendVerdictCode, type PeerSendVerdict, } from "./agents/cross-session-judge.js";
+export { PEER_REF_MIN, PEER_REF_MAX, PEER_REF_RE, mintPeerRef, formatPeerNameRef, parsePeerNameRef, normalizePeerName, PEER_ADDRESS_PREFIXES, reservedPeerNameReason, type PeerRefEntry, } from "./agents/cross-session-ref.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, type AgentTranscriptToolOptions, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";
 export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_USE, EXPLORE_WHEN_TO_USE_LEAN, PLAN_WHEN_TO_USE, EXPLORE_SYSTEM_PROMPT, PLAN_SYSTEM_PROMPT, } from "./agents/builtin-agents.js";

package/dist/index.js

@@ -95,7 +95,7 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, } from "./core/park-selfcheck.js";
 export {} from "./core/checkpoint-store.js";
@@ -126,7 +126,7 @@ export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/au
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { InMemorySessionRuleOverlay, } from "./core/permission-rule-session.js";
@@ -209,6 +209,9 @@ export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE,
 export { getSessionRetainLedger, releaseSessionRetainLedger, } from "./agents/retain-ledger.js";
 export { createSendMessageTool, createAgentContinuationVerb, SEND_MESSAGE_TOOL_NAME } from "./agents/send-message-tool.js";
 export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerAdmissionConfig, PEER_ADMISSION_DEFAULTS, PEER_HOP_CHAIN_WINDOW, PEER_MESSAGE_NOTICE, createPeerSelfRef, createPeerInboundChainRef, peerAxisToken, appendHopToken, } from "./agents/peer-admission.js";
+export { CROSS_SESSION_MESSAGE_TAG, CROSS_SESSION_MESSAGE_NOTICE, PERMISSION_MODE_CLASSES, isPermissionModeClass, CrossSessionCodecError, PEER_HOP_TOKEN_HEX, PEER_HOP_CHAIN_CARRY_WINDOW, encodePeerAddress, isCanonicalPeerAddress, encodeScopeAttribute, decodeScopeAttribute, canonicalPeerDisplayName, buildCrossSessionEnvelope, parseCrossSessionEnvelope, clampHopChain, encodeCcPeerFrame, decodeCcPeerFrame, } from "./agents/cross-session-envelope.js";
+export { CROSS_SESSION_INBOUND_SETTINGS, isCrossSessionInboundSetting, resolveCrossSessionInboundSetting, CROSS_SESSION_HOLD_CAUSES, describeCrossSessionHoldCause, judgeCrossSessionInbound, foldPermissionModeClass, PEER_SEND_VERDICT_CODES, peerSendVerdictSeverity, } from "./agents/cross-session-judge.js";
+export { PEER_REF_MIN, PEER_REF_MAX, PEER_REF_RE, mintPeerRef, formatPeerNameRef, parsePeerNameRef, normalizePeerName, PEER_ADDRESS_PREFIXES, reservedPeerNameReason, } from "./agents/cross-session-ref.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";
 export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_USE, EXPLORE_WHEN_TO_USE_LEAN, PLAN_WHEN_TO_USE, EXPLORE_SYSTEM_PROMPT, PLAN_SYSTEM_PROMPT, } from "./agents/builtin-agents.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.1.0",
+  "version": "7.2.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",