@sema-agent/core 7.1.0 → 7.3.0

package/dist/core/runner/prepare-workspace-restore.d.ts

@@ -32,7 +32,12 @@ export declare function remoteEnvFailureNote(op: RemoteEnvFailureNote["op"], err
  * decides. A code outside the retryable family (`unsupported`, `auth_failed`) returns on the first
  * attempt — `withRetry` will not spend a second call on a permanent refusal.
  */
-export declare function restoreWorkspaceWithRetry(env: RemoteExecutionEnv, snapshotId: SnapshotId, options: VmLifecycleOptions): Promise<{
+export declare function restoreWorkspaceWithRetry(env: RemoteExecutionEnv, snapshotId: SnapshotId, options: VmLifecycleOptions, 
+/** design/384 slice 2 (additive): observe each attempt AS IT STARTS. The returned `attempts` is
+ *  only readable after settlement, and a caller whose wait on this promise is BOUNDED (the park
+ *  compensation) must report the live attempt count when its bound fires mid-call — without this
+ *  seat a deaf second attempt was reported as `attempts: 1`. */
+onAttempt?: (attempt: number) => void): Promise<{
     outcome: Awaited<ReturnType<RemoteExecutionEnv["resumeVM"]>>;
     attempts: number;
 }>;

package/dist/core/runner/prepare-workspace-restore.js

@@ -19,10 +19,11 @@ export function remoteEnvFailureNote(op, error, attempts) {
 }
 const REMOTE_RESTORE_MAX_ATTEMPTS = 2;
 const REMOTE_RESTORE_BACKOFF_MS = 200;
-export async function restoreWorkspaceWithRetry(env, snapshotId, options) {
+export async function restoreWorkspaceWithRetry(env, snapshotId, options, onAttempt) {
     let attempts = 0;
     const outcome = await withRetry(async (attempt) => {
         attempts = attempt;
+        onAttempt?.(attempt);
         return env.resumeVM(snapshotId, options);
     }, { retryableCodes: RETRYABLE_REMOTE_ERROR_CODES, maxAttempts: REMOTE_RESTORE_MAX_ATTEMPTS, backoffMs: () => REMOTE_RESTORE_BACKOFF_MS }, { ...(options.abortSignal !== undefined ? { signal: options.abortSignal } : {}) });
     return { outcome, attempts };

package/dist/core/runner/runtask.js

@@ -21,6 +21,7 @@ import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permissi
 import { emitTaskOutcome } from "../task-outcome.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { primaryActivityArg } from "../arg-summary.js";
+import { redactThenCut } from "../../agents/subagent-steps.js";
 import { resolveReasoning } from "../../brain/reasoning.js";
 import { adjudicateDerivedRoute, authCarrierFingerprint, fallbackToPrimaryNotice, normalizeBaseUrl, sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { readDegradation } from "../../brain/degrading.js";
@@ -773,7 +774,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                     boundaryAttachmentBytes += Buffer.byteLength(a.body, "utf8");
                 rs.attach.attachmentsInjected += due.length;
                 for (const a of due) {
-                    queue.push({ type: "steering_injected", source: a.source, preview: a.body.slice(0, 220), ...ident() });
+                    queue.push({ type: "steering_injected", source: a.source, preview: redactThenCut(a.body, 220), ...ident() });
                 }
             }
         }
@@ -3821,7 +3822,7 @@ export class Runner {
                     }
                     for (const f of firstFrames) {
                         f.commit();
-                        queue.push({ type: "steering_injected", source: f.source, preview: f.body.slice(0, 220), ...ident() });
+                        queue.push({ type: "steering_injected", source: f.source, preview: redactThenCut(f.body, 220), ...ident() });
                     }
                     rs.attach.attachmentsInjected += firstFrames.length;
                     if (firstFrames.length > 0)
@@ -5080,12 +5081,22 @@ export class Runner {
                 await recheckGovernanceWindow();
         }
         this.locallyClaimedTokens.add(token);
-        const won = await store.resolve(token, cp.scope, outcomeForStore, { rev: cp.rev ?? 0 });
+        let won;
+        let claimLossStatus;
+        if (store.claimTerminal !== undefined) {
+            const claim = await store.claimTerminal(token, cp.scope, { kind: "resolve", outcome: outcomeForStore, expect: { rev: cp.rev ?? 0 } });
+            won = claim.claimed;
+            if (!claim.claimed)
+                claimLossStatus = claim.current.status;
+        }
+        else {
+            won = await store.resolve(token, cp.scope, outcomeForStore, { rev: cp.rev ?? 0 });
+        }
         if (!won)
             this.locallyClaimedTokens.delete(token);
         if (!won) {
-            const live = await store.get(token);
-            if (live?.status === "pending") {
+            const stillPending = claimLossStatus !== undefined ? claimLossStatus === "pending" : (await store.get(token))?.status === "pending";
+            if (stillPending) {
                 throw new CheckpointError("checkpoint.reopened_concurrently", "checkpoint changed concurrently (its revision advanced via a resolve/reopen cycle since this resume validated) — not executed; re-resume against the current state");
             }
             this.parentConstraintRegistry.delete(token);

package/dist/core/runner/tool-output-projection.js

@@ -64,6 +64,7 @@ const CC_DETAIL_TYPES = new Set([
     "task-stop", "tool-search", "repo-map", "fork", "enter-plan-mode", "exit-plan-mode",
     "monitor-start", "path_not_in_root", "read_path_denied", "readonly_out_of_root", "bash_invalid_timeout",
     "report-findings", "schedule-wakeup", "send-message", "agent-transcript", "a2a", "document",
+    "list-agents",
 ]);
 export const structuredFrom = (result) => {
     const details = result !== null && typeof result === "object" ? result.details : undefined;

package/dist/core/store-contracts/mailbox-store-contract.d.ts

@@ -46,6 +46,29 @@ export declare function mailboxAckOwnershipContract(mk: () => MailboxStore, runA
  * 放宽」:核心层没有一条为了任何后端而弱化。第三方后端若有租户轴,应当也挂这一层。
  */
 export declare function mailboxBundledOnlyContract(mk: () => MailboxStore, runAssertion?: ContractAssertionRunner): Promise<void>;
+export interface MailboxCrossProcessContractHooks {
+    /** Open ONE fresh, empty storage location TWICE: `local` in this process and `peer` served by ANOTHER
+     *  OS process over the same storage (the peer is a real second process — an in-process second
+     *  instance proves nothing here). `dispose` closes both and may remove the storage. The kit calls it
+     *  once per case. */
+    openPair: () => Promise<{
+        local: MailboxStore;
+        peer: MailboxStore;
+        dispose: () => Promise<void>;
+    }>;
+    runAssertion?: ContractAssertionRunner;
+}
+/**
+ * T2 可选能力层(cross-process 分册,design/385 §1.2⑥ / G11)—— 声明 `crossProcessSafe: true` 的后端必须
+ * 过的全套判据。钉的是**整套**(跨进程 seq 单铸 + lease/ack 不交叉 + 一方的 housekeeping 不丢另一方的
+ * 已落盘 append + reap/drop 的 seq 语义跨进程成立),不是「有锁」:一把锁配一份陈旧缓存照样在锁内铸
+ * 重号、照样把别人的消息压缩掉——所以每一条都从**对方进程的视角**回读。
+ *
+ * 受众:文件后端(本仓捆绑)、SQL 后端(事务天然过)。进程内 Map 的参照实现与 CC inbox 适配器不声明,
+ * 也不挂——它们不是「没做到所以放宽」,而是根本不在跨进程车道上(挂载判据 `mailboxCrossProcessMountVerdict`
+ * 对未声明的后端响亮拒)。
+ */
+export declare function mailboxCrossProcessContract(hooks: MailboxCrossProcessContractHooks): Promise<void>;
 export interface MailboxTombstonedRecipientContractHooks {
     /** Put `(scope, handle)` into the deployment's PRE-DELETE state — whatever that is for this
      *  backend (a cascade marking the session row, a `deleting` column, a tombstone table). Core does

package/dist/core/store-contracts/mailbox-store-contract.js

@@ -1,5 +1,5 @@
 import { strict as assert } from "node:assert";
-import { MAILBOX_TOMBSTONED_RECIPIENT_CODE } from "../mailbox-store.js";
+import { MAILBOX_INVALID_PEER_META_CODE, MAILBOX_TOMBSTONED_RECIPIENT_CODE } from "../mailbox-store.js";
 import { beginContract } from "./contract-harness.js";
 export const MAILBOX_CONTRACT_SCOPE = "default";
 const msg = (content, sentAt = 1000) => ({ content, sentAt });
@@ -112,6 +112,75 @@ export async function mailboxStoreContract(mk, runAssertion) {
         const after = await s.claimLease(S, "a1", "rival", 60_000, 12_000);
         assert.deepEqual(after?.messages.map((m) => m.seq), [1], "归还后同一条按原 seq 回可见");
     });
+    run("peerMeta 回环:典型 typed 记录逐字节回读;缺席保持缺席(pre-385/foreign 记录语义);空对象也是「在场」", async (make) => {
+        const s = make();
+        const full = {
+            fromSession: "sess_1",
+            fromMode: "prompting",
+            senderKey: "k-1",
+            kind: "peer_message",
+            fromScope: "team/a b",
+            gateReceiptId: "gr-9",
+        };
+        await s.append(S, "a1", { content: "typed", sentAt: 1_000, peerMeta: full });
+        await s.append(S, "a1", { content: "plain", sentAt: 1_001 });
+        await s.append(S, "a1", { content: "empty-meta", sentAt: 1_002, peerMeta: {} });
+        const lease = await s.claimLease(S, "a1", "w1", 60_000, 10_000);
+        assert.deepEqual(lease.messages.map((m) => m.content), ["typed", "plain", "empty-meta"]);
+        assert.deepEqual(lease.messages[0].peerMeta, full, "六字段逐字节回读");
+        assert.equal("peerMeta" in lease.messages[1], false, "未带 peerMeta 的记录回读时该键必须缺席(不是 undefined 值)");
+        assert.deepEqual(lease.messages[2].peerMeta, {}, "空对象=在场但无字段,与缺席区分");
+    });
+    run("peerMeta 坏值响亮:garbage 以具名码拒 append,且零副作用(不入箱、不耗 seq、不动租约)", async (make) => {
+        const s = make();
+        const seqBefore = await s.append(S, "a1", { content: "anchor", sentAt: 1_000 });
+        const held = await s.claimLease(S, "a1", "holder", 60_000, 10_000);
+        assert.equal(held?.messages.length, 1);
+        const codeOf = (e) => e?.code;
+        class Meta {
+            fromSession = "s";
+        }
+        const hiddenKey = { fromSession: "s" };
+        Object.defineProperty(hiddenKey, "bogus", { value: 1, enumerable: false });
+        for (const [label, bad] of [
+            ["fromMode 集外值", { fromMode: "root" }],
+            ["kind 集外值", { kind: "gossip" }],
+            ["未知键", { fromSession: "s", bogus: 1 }],
+            ["空字符串", { senderKey: "" }],
+            ["非字符串", { gateReceiptId: 7 }],
+            ["数组", ["fromSession"]],
+            ["null", null],
+            ["字符串", "fromSession=x"],
+            ["Date", new Date(0)],
+            ["Map", new Map()],
+            ["class 实例", new Meta()],
+            ["symbol 键", { fromSession: "s", [Symbol("hidden")]: 1 }],
+            ["不可枚举的未知键", hiddenKey],
+        ]) {
+            let thrown;
+            try {
+                await s.append(S, "a1", { content: `bad:${label}`, sentAt: 2_000, peerMeta: bad });
+            }
+            catch (e) {
+                thrown = e;
+            }
+            assert.notEqual(thrown, undefined, `${label}:必须拒`);
+            assert.equal(codeOf(thrown), MAILBOX_INVALID_PEER_META_CODE, `${label}:拒必须带码`);
+        }
+        assert.equal(await s.peekCount(S, "a1"), 1, "被拒的 append 不得入箱");
+        assert.equal(await s.claimLease(S, "a1", "rival", 60_000, 11_000), null, "被拒的 append 不得动活租约");
+        await s.ack(S, "a1", "holder", held.maxSeq);
+        assert.equal(await s.append(S, "a1", { content: "next", sentAt: 3_000 }), seqBefore + 1, "被拒的 append 不得消耗 seq");
+    });
+    run("peerMeta 不串引用:消费者改写租约批里的 peerMeta,不得改到下次投递的记录", async (make) => {
+        const s = make();
+        await s.append(S, "a1", { content: "m1", sentAt: 1_000, peerMeta: { fromMode: "bypass", fromSession: "sess_1" } });
+        const first = await s.claimLease(S, "a1", "w1", 1_000, 10_000);
+        first.messages[0].peerMeta.fromSession = "forged";
+        await s.releaseLease(S, "a1", "w1");
+        const again = await s.claimLease(S, "a1", "w2", 1_000, 20_000);
+        assert.deepEqual(again.messages[0].peerMeta, { fromMode: "bypass", fromSession: "sess_1" }, "重投的记录必须是原样");
+    });
     await settle();
 }
 export async function mailboxAckOwnershipContract(mk, runAssertion) {
@@ -192,6 +261,93 @@ export async function mailboxBundledOnlyContract(mk, runAssertion) {
     });
     await settle();
 }
+export async function mailboxCrossProcessContract(hooks) {
+    const { run: runRaw, settle } = beginContract(hooks.runAssertion);
+    const run = (name, fn) => runRaw(name, async () => {
+        const pair = await hooks.openPair();
+        try {
+            await fn(pair.local, pair.peer);
+        }
+        finally {
+            await pair.dispose();
+        }
+    });
+    const S = MAILBOX_CONTRACT_SCOPE;
+    const H = "session.shared";
+    const range = (n) => Array.from({ length: n }, (_, i) => i + 1);
+    run("跨进程 seq 单铸:两个进程交错 append N+N ⇒ seq 恰为 1..2N(无重复无空洞),每条消息在任一方视角都可见", async (local, peer) => {
+        const N = 40;
+        const seqs = [];
+        for (let i = 0; i < N; i++) {
+            const [a, b] = await Promise.all([local.append(S, H, msg(`local-${i}`, 1_000 + i)), peer.append(S, H, msg(`peer-${i}`, 2_000 + i))]);
+            seqs.push(a, b);
+        }
+        assert.deepEqual([...seqs].sort((x, y) => x - y), range(2 * N), "两方拿到的回执合起来必须恰是 1..2N");
+        assert.equal(await peer.peekCount(S, H), 2 * N, "对方进程的观察面必须看到本方的 append");
+        assert.equal(await local.peekCount(S, H), 2 * N);
+        const lease = await local.claimLease(S, H, "cycle-1", 60_000, 10_000);
+        assert.deepEqual(lease.messages.map((m) => m.seq), range(2 * N), "本方 claim 必须按 seq 序取到全部 2N 条");
+        assert.equal(lease.maxSeq, 2 * N);
+        const contents = new Set(lease.messages.map((m) => m.content));
+        for (let i = 0; i < N; i++) {
+            assert.ok(contents.has(`local-${i}`), `local-${i} 不得丢`);
+            assert.ok(contents.has(`peer-${i}`), `peer-${i} 不得丢`);
+        }
+    });
+    run("lease/ack 不跨进程交叉:一方的活租约 fence 住另一方的 claim;非持有方的 ack 是 no-op;持有方的 ack 对另一方立即可见;高水位跨对方的 ack 存活", async (local, peer) => {
+        await local.append(S, H, msg("m1", 1));
+        await peer.append(S, H, msg("m2", 2));
+        const held = await peer.claimLease(S, H, "cycle-peer", 60_000, 10_000);
+        assert.deepEqual(held.messages.map((m) => m.seq), [1, 2]);
+        assert.equal(await local.claimLease(S, H, "cycle-local", 60_000, 11_000), null, "对方进程的活租约必须 fence 住本方");
+        await local.ack(S, H, "cycle-local", held.maxSeq);
+        assert.equal(await peer.peekCount(S, H), 2, "非持有方的 ack 不得动持有方手上的批");
+        await peer.ack(S, H, "cycle-peer", held.maxSeq);
+        assert.equal(await local.peekCount(S, H), 0, "持有方的 ack 必须被本方看见");
+        assert.equal(await local.claimLease(S, H, "cycle-local", 60_000, 12_000), null);
+        assert.equal(await local.append(S, H, msg("m3", 3)), 3, "seq 高水位必须跨对方进程的 ack 存活(永不复用)");
+        await peer.append(S, H, msg("m4", 4));
+        const held2 = await peer.claimLease(S, H, "cycle-peer-2", 1_000, 20_000);
+        assert.deepEqual(held2.messages.map((m) => m.seq), [3, 4]);
+        const takeover = await local.claimLease(S, H, "cycle-local-2", 60_000, 30_000);
+        assert.deepEqual(takeover.messages.map((m) => m.seq), [3, 4], "过期租约的接管跨进程成立,seq 原样");
+    });
+    run("一方的 housekeeping 不丢另一方的 append:两进程各自反复压缩/重写期间交错写入 120 条,任一方视角都完整", async (local, peer) => {
+        const N = 60;
+        for (let i = 0; i < N; i++) {
+            await Promise.all([local.append(S, H, msg(`L${i}`, 1_000 + i)), peer.append(S, H, msg(`P${i}`, 2_000 + i))]);
+        }
+        const fromPeer = await peer.claimLease(S, H, "cycle-peer", 60_000, 10_000);
+        assert.deepEqual(fromPeer.messages.map((m) => m.seq), range(2 * N), "对方视角:seq 1..2N 全在");
+        await peer.releaseLease(S, H, "cycle-peer");
+        const fromLocal = await local.claimLease(S, H, "cycle-local", 60_000, 11_000);
+        assert.deepEqual(fromLocal.messages.map((m) => m.seq), range(2 * N), "本方视角:seq 1..2N 全在");
+        const contents = fromLocal.messages.map((m) => m.content).sort();
+        assert.deepEqual(contents, [...range(N).map((i) => `L${i - 1}`), ...range(N).map((i) => `P${i - 1}`)].sort());
+        await local.ack(S, H, "cycle-local", fromLocal.maxSeq);
+        assert.equal(await peer.peekCount(S, H), 0, "本方的 ack 对方可见");
+    });
+    run("reap 看得见对方进程的旧消息,哪怕本方缓存里这个箱是空的(已加载的空缓存不得替对方的旧消息说「没有」)", async (local, peer) => {
+        await local.append(S, H, msg("mine", 1_000));
+        const held = await local.claimLease(S, H, "cycle-local", 60_000, 1_000);
+        await local.ack(S, H, "cycle-local", held.maxSeq);
+        await peer.append(S, H, msg("old-from-peer", 2_000));
+        assert.equal(await local.reap(S, 100_000, { maxAgeMs: 50_000 }), 1, "对方写的过期消息必须被本方 reap 看见并老化");
+        assert.equal(await peer.peekCount(S, H), 0);
+        assert.equal(await peer.append(S, H, msg("after", 200_000)), 3, "高水位跨 reap 存活(对方视角)");
+    });
+    run("reap 与 drop 的 seq 语义跨进程:一方 reap 后另一方继续高水位;一方 drop 后另一方从 1 重铸", async (local, peer) => {
+        await peer.append(S, H, msg("old", 1_000));
+        assert.equal(await local.reap(S, 100_000, { maxAgeMs: 50_000 }), 1, "本方 reap 必须看见对方写的旧消息");
+        assert.equal(await peer.peekCount(S, H), 0);
+        assert.equal(await peer.append(S, H, msg("after-reap", 200_000)), 2, "reap 清箱但保高水位(RB-90 跨进程)");
+        await local.drop(S, H);
+        assert.equal(await peer.peekCount(S, H), 0, "本方 drop 对方可见");
+        assert.equal(await peer.append(S, H, msg("after-drop", 300_000)), 1, "drop 结束箱的一生:对方从 1 重铸");
+        assert.equal(await local.peekCount(S, H), 1);
+    });
+    await settle();
+}
 export async function mailboxTombstonedRecipientContract(mk, hooks) {
     const { run: runRaw, settle } = beginContract(hooks.runAssertion);
     const run = (name, fn) => runRaw(name, () => withStores(mk, fn));

package/dist/core/task-notification.d.ts

@@ -140,6 +140,60 @@ export interface TaskNotificationPayload {
     peer?: {
         hopChain: string[];
     };
+    /**
+     * design/385 §1.4 d1 — the delegated-child → parent UPLINK carrier (`SendMessage("main")`). Its
+     * PRESENCE is the render discriminator: the frame reaches the parent's model as a top-level
+     * `<agent-message from="…">` user frame (the same-process lane's carrier, distinct from both the
+     * `<task-notification>` shell and the cross-session envelope) followed by the peer discipline block.
+     * `body` is the child's message as bounded by the producer (no discipline block inside it — the
+     * block is frame-adjacent by rule). The classic members (`summary`/`result`) stay filled beside it
+     * for wire consumers that project the frame as a card; they are not what the model reads.
+     * Minted ONLY by the SendMessage uplink leg (engine-side); an external `notify()` cannot wear it.
+     */
+    agentMessage?: {
+        from: string;
+        body: string;
+    };
+    /**
+     * design/385 §4.1 — the CROSS-SESSION carrier (a peer session's message drained from this session's
+     * own box). Its PRESENCE is the render discriminator: the model reads a top-level
+     * `<cross-session-message from="…" …>` envelope (design/385 §4.2 model-face codec — from-session /
+     * from-name / from-mode / from-scope as the typed record carried them; the hop chain never appears)
+     * followed by the cross-session discipline block, never a `<task-notification>` shell. The
+     * attributes are a PROJECTION of the store record's typed `peerMeta` — the text is presentation,
+     * the typed side record ({@link _sema_provenance}) is the authority. Minted ONLY by the engine's
+     * session-box drain; an external `notify()` cannot wear it.
+     */
+    crossSessionMessage?: import("../agents/cross-session-envelope.js").CrossSessionEnvelopeFields & {
+        body: string;
+    };
+    /**
+     * design/385 §1.4 d1 / §4.1 — the engine-minted PROVENANCE side record of an engine-injected peer
+     * frame, a typed key (never model text) so a host can attribute and correlate the injection on the
+     * wire. Present exactly when {@link agentMessage} OR {@link crossSessionMessage} is — one record
+     * per carrier, `kind` naming which. Its fields are read per `kind` (see {@link SemaProvenance}):
+     * on the agent-message lane `from` is the sender label the frame's attribute spells, `taskId` the
+     * sender's run/agent id, `seq` the producer's per-frame counter (= this payload's `seq`) and
+     * `agentType` the sender's resolved agent type when the producer knows it; on the cross-session
+     * lane `from` is the sender's ADDRESS, `taskId` the recipient's own box handle, `seq` the box seq,
+     * and the typed peer record rides in `peerMeta`.
+     */
+    _sema_provenance?: SemaProvenance;
+}
+/** design/385 §1.4 d1 / §4.1 — see {@link TaskNotificationPayload._sema_provenance}. `kind` is a
+ *  closed set of the two engine lanes that mint the record; a future lane adds a member, never a
+ *  second key. */
+export interface SemaProvenance {
+    /** `agent_message` = the same-process uplink (§1.4 d1); `cross_session_message` = the session-box
+     *  drain (§4.1) — `from` is then the sender's ADDRESS, `taskId` the recipient's own box handle,
+     *  `seq` the box seq, and the typed peer record rides in `peerMeta`. */
+    kind: "agent_message" | "cross_session_message";
+    from: string;
+    taskId: string;
+    seq: number;
+    agentType?: string;
+    /** cross_session_message only — the store record's typed peer metadata, verbatim (authority). */
+    peerMeta?: import("./mailbox-store.js").MailboxPeerMeta;
 }
 /**
  * design/144 §2 — the caller-facing input of `TaskStream.notify()`: a STRUCTURED external event to inject
@@ -229,6 +283,30 @@ export declare function attrEscape(value: string): string;
 /** Max rendered length of an untrusted attribution label (the external `from="…"` header and the
  *  design/171 speaker envelope share it — same concern: a display label, not a payload). */
 export declare const EXTERNAL_SOURCE_MAX = 120;
+/** design/385 §1.4 d1 — the same-process lane's carrier tag (CC `iTe`). */
+export declare const AGENT_MESSAGE_TAG = "agent-message";
+/**
+ * design/385 §1.4 d1 — render the child → parent uplink as CC's same-process form: a top-level
+ * `<agent-message from="…">` frame (CC `ZSe`: attribute-escaped sender, nested-tag-neutralized body,
+ * no header prose — the attribution IS the attribute) followed by the peer discipline block OUTSIDE
+ * the frame (design/176 §3.4 placement: a sender-embedded copy inside the body arrives neutralized,
+ * so position distinguishes the real block). The body first passes the harness AUTHORITY-family
+ * neutralization ({@link neutralizePeerBody}: every engine envelope a model reads as harness speech —
+ * `task-notification`, `user_memory`, `skills`, … — not the reminder tag alone), because the child's
+ * text is model output; the pre-carrier `<task-notification>` shell entity-escaped every byte of it,
+ * and the carrier form must contain at least as much.
+ */
+export declare function renderAgentMessageFrame(frame: {
+    from: string;
+    body: string;
+}): string;
+/**
+ * design/385 §4.1 — render a drained peer-session message as the model-face envelope (the §4.2
+ * codec: canonical attribute order, neutralized body) followed by the cross-session discipline block
+ * OUTSIDE the envelope. Distinct from {@link renderAgentMessageFrame}: another lane, another trust
+ * level, another block — sharing either would blur the classifier's lane judgment.
+ */
+export declare function renderCrossSessionMessageFrame(frame: NonNullable<TaskNotificationPayload["crossSessionMessage"]>): string;
 export declare function renderTaskNotificationXml(n: TaskNotificationPayload): string;
 /**
  * The BETWEEN-TURNS pending lane. A task notification born while NO turn is
@@ -341,11 +419,21 @@ export declare class PendingSessionNotifications {
     get size(): number;
 }
 /**
- * Delivery-side overflow disclosure: fold the per-task drop counts into the drained payloads. The first
- * surviving payload of a task that lost events gets a `[task_id]`-prefixed disclosure line prepended to its
- * summary (backgroundTasks 同规: the id keeps the loss addressable via TaskOutput). A task whose EVERY
- * pending item was evicted still gets one honest synthetic `event` payload saying so — a fully silent loss
- * is never allowed.
+ * Delivery-side overflow disclosure: fold the per-task drop counts into the drained payloads. Two
+ * carrier shapes, chosen per survivor:
+ *  · a CLASSIC survivor (renders through the `<task-notification>` shell) is annotated IN PLACE — the
+ *    first surviving payload of a task that lost events gets a `[task_id]`-prefixed disclosure line
+ *    prepended to its summary (backgroundTasks 同规: the id keeps the loss addressable via TaskOutput);
+ *  · an AGENT-MESSAGE survivor (design/385 §1.4 d1; renders as the `<agent-message>` carrier, its
+ *    `summary` wire-only) is left byte-unchanged, and the disclosure rides as a SEPARATE engine-authored
+ *    `event` payload inserted immediately AHEAD of it (engine speech never goes inside a peer frame;
+ *    peer speech never goes inside the authority shell that line renders through).
+ * The returned array is therefore NOT a 1:1 image of `drained.items`: it can be longer (one inserted
+ * line per disclosed agent-message lane, plus the per-lane "nothing survived" lines and the
+ * whole-session line below) — consume it by iteration, never by index-pairing against `items`. The
+ * zero-disclosure path returns `drained.items` itself (identity, no allocation). A task whose EVERY
+ * pending item was evicted still gets one honest synthetic `event` payload saying so — a fully silent
+ * loss is never allowed.
  */
 export declare function discloseDroppedPending(drained: DrainedPendingNotifications): TaskNotificationPayload[];
 export declare class SystemInjectionQueue<TPayload = TaskNotificationPayload> {

package/dist/core/task-notification.js

@@ -1,4 +1,6 @@
-import { inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { escapeEnvelopeTag, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { PEER_MESSAGE_NOTICE } from "../agents/peer-admission.js";
+import { buildCrossSessionEnvelope, CROSS_SESSION_MESSAGE_NOTICE, neutralizePeerBody } from "../agents/cross-session-envelope.js";
 export const SYSTEM_INJECTION_PRIORITIES = ["now", "next", "later"];
 export function isSystemInjectionPriority(value) {
     return typeof value === "string" && SYSTEM_INJECTION_PRIORITIES.includes(value);
@@ -46,7 +48,20 @@ export function attrEscape(value) {
     return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 export const EXTERNAL_SOURCE_MAX = 120;
+export const AGENT_MESSAGE_TAG = "agent-message";
+export function renderAgentMessageFrame(frame) {
+    const body = escapeEnvelopeTag(AGENT_MESSAGE_TAG, neutralizePeerBody(frame.body));
+    return `<${AGENT_MESSAGE_TAG} from="${attrEscape(frame.from)}">\n${body}\n</${AGENT_MESSAGE_TAG}>\n\n${PEER_MESSAGE_NOTICE}`;
+}
+export function renderCrossSessionMessageFrame(frame) {
+    const { body, ...fields } = frame;
+    return `${buildCrossSessionEnvelope(fields, body)}\n\n${CROSS_SESSION_MESSAGE_NOTICE}`;
+}
 export function renderTaskNotificationXml(n) {
+    if (n.agentMessage !== undefined)
+        return renderAgentMessageFrame(n.agentMessage);
+    if (n.crossSessionMessage !== undefined)
+        return renderCrossSessionMessageFrame(n.crossSessionMessage);
     const usage = n.usage === undefined
         ? undefined
         : (() => {
@@ -196,12 +211,24 @@ export function discloseDroppedPending(drained) {
     if (drained.dropped.size === 0)
         return [...drained.items, ...sessionLine];
     const disclosed = new Set();
-    const out = drained.items.map((n) => {
+    const out = drained.items.flatMap((n) => {
         const lane = taskNotificationLaneKey(n);
         const dropped = drained.dropped.get(lane);
         if (dropped === undefined || disclosed.has(lane))
-            return n;
+            return [n];
         disclosed.add(lane);
+        if (n.agentMessage !== undefined || n.crossSessionMessage !== undefined) {
+            const line = {
+                task_id: n.task_id,
+                task_type: n.task_type,
+                status: "event",
+                summary: `[${n.task_id}] ${dropped.count} earlier pending notification(s) from this task were dropped (pending-queue overflow); its latest message follows.`,
+            };
+            const linePriority = drained.priorities?.get(n);
+            if (linePriority !== undefined)
+                drained.priorities?.set(line, linePriority);
+            return [line, n];
+        }
         const annotated = {
             ...n,
             summary: `[${n.task_id}] ${dropped.count} earlier pending notification(s) from this task were dropped (pending-queue overflow). ${n.summary}`,
@@ -209,7 +236,7 @@ export function discloseDroppedPending(drained) {
         const priority = drained.priorities?.get(n);
         if (priority !== undefined)
             drained.priorities?.set(annotated, priority);
-        return annotated;
+        return [annotated];
     });
     for (const [lane, dropped] of drained.dropped) {
         if (disclosed.has(lane))

package/dist/core/tool-policy.d.ts

@@ -1058,6 +1058,17 @@ export interface AskRequest {
      * from it across a coverage change — harmlessly, since the record is what gets confirmed.
      */
     readonly ruleOffers?: readonly import("./permission-rule-model.js").RuleOffer[];
+    /**
+     * design/382 §2.4 (adversarial-review r3, additive) — the RELATIVE-CD RESOLUTION BASE the offers
+     * above were minted with: the live tracked working directory at adjudication time (the RB-108
+     * value; equal to the task root until an observable `cd` moves the tracker). Present only beside
+     * {@link ruleOffers} when the run has a tracked cwd. A consumer preparing the AUTHORITATIVE
+     * consent record threads it as `prepareCardApproval`'s `execCwd`, so the record re-mints the SAME
+     * directory member this projection displayed — without it, a moved tracker would make the record
+     * resolve `cd ./x` from the task root and persist a rule for a directory the command never
+     * enters. Display/reconstruction context only, never adjudication input.
+     */
+    readonly execCwd?: string;
     /**
      * #490 修② — WHY {@link ruleOffers} is absent, when the rule-offer lane is in play and has nothing
      * to give. A CLOSED set, mutually exclusive with {@link ruleOffers} (never both, never neither once