@sema-agent/core 7.1.0 → 7.3.0

package/dist/core/types.d.ts

@@ -1032,7 +1032,8 @@ export interface ToolExecuteContext {
     } | undefined;
     /**
      * RB-201 FO-3 (form-one audit, CC 220 `Ipd`/`ein` parity) — the auto-mode classifier decider ARMED
-     * for THIS task (`RuntimeCaps.autoMode === true` AND `RunnerDeps.autoMode` both present; the same
+     * for THIS task (auto-mode intent ∧ `RunnerDeps.autoMode` present ∧ `RuntimeCaps.autoMode !== false`
+     * — see {@link TaskSpec.autoModeRequested}; the same
      * instance `runToolGate`'s per-call ask review already consults, carrying its own live breaker
      * state — not a fresh one built from raw config). Runner-filled, trusted, undefined when auto-mode
      * is not armed or the tool runs outside a Runner task.
@@ -2608,6 +2609,35 @@ export interface TaskSpec {
      * pending call itself runs once, having been adjudicated). Re-pass the same value the original task used.
      */
     shellGate?: "off" | "always" | "classify";
+    /**
+     * The caller's AUTO-MODE INTENT for this task — the "user turned auto on" half of the classifier
+     * arming (CC 2.1.250 polarity: auto mode is something the USER enables at the permission-mode
+     * seat, and something an ORGANIZATION may only DENY; it is never something an organization grants
+     * on a user's behalf). The engine arms its per-run classifier only when ALL THREE hold:
+     *  - this seat is `true` (intent),
+     *  - {@link RunnerDeps.autoMode} is present (the deployment is classifier-capable — the trust gate;
+     *    classifier RULES still enter ONLY through that face, never through this seat), and
+     *  - {@link RuntimeCaps.autoMode} is not `false` (the per-principal DENY bit; ABSENT is NOT a denial).
+     *
+     * **Ownership** — same split as {@link shellGate}: the service layer TRANSLATES the effective
+     * permission mode into this seat (at the same point it translates the mode into `shellGate`);
+     * core only CONSUMES it. Absent ⇒ not an auto-mode task (byte-identical to the pre-seat shape:
+     * asks flow the original chain). Only the literal `true` is a value here: any other present value
+     * (`false`, `"true"`, `1`) is refused at the door (`config.auto_mode_requested_invalid`) rather than
+     * read as either polarity — a marshalled string must never silently arm, or silently disarm, a
+     * classifier.
+     *
+     * **Inheritance**: the intent is session-wide, like a permission mode — an engine-spawned child of
+     * an auto-mode task inherits it through the trusted constraint chain
+     * (`InheritedGate.autoModeRequested`), never through a model-authored argument; the child's own
+     * deny bit and deployment face are still evaluated for the child. **On resume:** the intent the
+     * suspend leg resolved (this seat, or the bit its chain carried) is recorded on the checkpoint's
+     * data half (`CheckpointState.inheritedGate.autoModeRequested`) and read back as one more intent
+     * source, so a redemption in another process arms as the suspend leg did without re-passing the
+     * seat; re-passing it is still honoured (the sources fold by OR). Intent only — the resuming
+     * deployment's face and the resuming principal's deny bit are judged afresh on every leg.
+     */
+    autoModeRequested?: true;
     /** Task-scoped MCP servers, materialized into tools then disposed. */
     mcp?: McpServerSpec[];
     /** Task-scoped A2A peers (remote agents), whose advertised skills mount as `a2a__<peer>__<skill>`
@@ -3539,6 +3569,16 @@ export interface TaskResult {
      * gate): a halt landing AFTER the abort signal already fired neither cut nor stopped anything —
      * that ending belongs to the abort, and this seat stays ABSENT rather than signing someone
      * else's stop with the halt caller's name. Absent everywhere else; never `false`.
+     *
+     * design/384 slice 2 (TRANSITIONAL narrowing): a `"suspended"` / `"needs_review"` terminal does
+     * NOT carry this seat even when a halt was accepted — those statuses mean a durable park WON its
+     * race with the halt (the row is committed and redeemable; the run is waiting to continue), and
+     * "stopped by the person" beside "waiting to resume" was a self-contradictory pair. The halt's
+     * own receipt (`{turnCut}`) and the `task.turn_interrupted` notice still stand — a seat WAS cut.
+     * Transitional: once halt-boundary source accounting lands (slice 3), the boundary-CONSUMED
+     * suspension arms flip to signing (a probe pinning today's suppressed shape goes red then, by
+     * design). The pass-through law is untouched for every OTHER terminal: a halt racing a real
+     * failure/limit — including one that outranks a committed park — still signs.
      */
     haltedByUser?: true;
     /**
@@ -5138,6 +5178,15 @@ export interface TaskStream extends AsyncIterable<TaskEvent> {
      * steer-family `steering.not_running` once the task has finished (teardown included); a halt
      * issued BEFORE the run's first prompt polls the same bounded birth window as {@link steer} and
      * then stops the run before its first model turn (an empty, cleanly-halted completed run).
+     *
+     * **Receipt tension, stated (design/384 slice 2):** `{turnCut:true}` and the
+     * `task.turn_interrupted` notice assert facts about the CUT — a seat was cut, no new model turn
+     * starts — and both stay true even when the gate's durable leg still collects to `suspended`:
+     * a park whose store commit was already in flight (or committed) when the cut landed WINS the
+     * fence race, the row is redeemable, and the result then reads `status:"suspended"` WITHOUT
+     * {@link TaskResult.haltedByUser} (the transitional narrowing documented on that seat). A cut
+     * observed BEFORE the commit makes the park concede instead — no row, no card, and the ordinary
+     * halted ending.
      */
     halt(): Promise<{
         turnCut: boolean;
@@ -5229,9 +5278,16 @@ export interface WorkflowGovernanceBaseline {
 /**
  * design/99 §K — the per-principal runtime ENTITLEMENTS the engine enforces server-side, resolved by a
  * deployment via {@link RunnerDeps.runtimeCapsResolver} from center's `GET /api/config/effective?principal=`.
- * Every field is TIGHTEN-ONLY (a cap only ever DENIES or FORCES; `undefined` = no per-principal restriction).
- * Only the two caps the ENGINE can enforce live here; `allowUltracode`/`allowBypassPermissions` are
- * shell-UX / service-settings-layer concerns (see {@link RunnerDeps.runtimeCapsResolver}).
+ * Every field is TIGHTEN-ONLY (a cap only ever DENIES or FORCES) — but the family carries THREE
+ * polarities, and "absent" does not read the same on each:
+ *  · DENY-shaped, `false` denies / absent is no restriction: {@link allowWorkflows}, {@link allowFork},
+ *    {@link autoMode} (the per-principal deny bit of a user-enabled mode), {@link allowMemoryOptOut}
+ *    (the one member whose resolver-FAULT degrade is allow, on the privacy axis);
+ *  · GRANT-shaped, `=== true` opts in / absent is OFF: {@link allowObservers};
+ *  · FORCE-shaped, `true` mandates / absent is the caller's opt-in default: {@link forceDurableGate}
+ *    (binds only where a checkpoint store is wired; announced `config.durable_gate_unavailable` where none is).
+ * These six are the caps the ENGINE enforces; `allowUltracode`/`allowBypassPermissions` are shell-UX /
+ * service-settings-layer concerns (see {@link RunnerDeps.runtimeCapsResolver}).
  */
 export interface RuntimeCaps {
     /** `false` DENIES workflow self-orchestration for this principal server-side — even on a deployment that is
@@ -5260,18 +5316,29 @@ export interface RuntimeCaps {
     /** `true` FORCES this principal's run onto the durable-approval path: the engine synthesizes a
      *  `durableApproval{scope: principal}` so a policy `ask` suspends to the wire (a per-tool CC-faithful gate)
      *  even when the caller did not opt in — center's fleet-wide "interactive runs gate" mandate. A
-     *  caller-supplied `TaskSpec.durableApproval` always wins (it may carry a tighter scope/ttl). */
+     *  caller-supplied `TaskSpec.durableApproval` always wins (it may carry a tighter scope/ttl).
+     *  The mandate binds only where a {@link RunnerDeps.checkpointStore} is wired — the park facility it
+     *  forces the run onto. On a store-less deployment it has no facility: the leg announces
+     *  `config.durable_gate_unavailable` once (before its first ask), every ask resolves on the live chain
+     *  (a live approver / question face in-stream, or the fail-closed deny with none), no durable record
+     *  is written, and a live question face is consulted rather than vetoed (a mandate that cannot park
+     *  must not demote a reachable person into the model answering for them). */
     forceDurableGate?: boolean;
     /**
-     * design/143 批2 (CC 2.1.207 auto mode): route a surviving permission `ask` to the
-     * small-model security CLASSIFIER before any human/durable resolution (allow → run; block → deny
-     * `source:"classifier"`; classifier failure → FAIL-CLOSED back to the original ask chain).
-     * **POLARITY: `=== true` EXPLICIT opt-in, default OFF** (same as {@link allowObservers} — auto mode
-     * hands a model the ask-resolution power for this principal's session; that is never implied).
-     * Arming ALSO requires the deployment to be classifier-capable ({@link RunnerDeps.autoMode} — the
-     * trust gate lives there: classifier RULES enter only through the deployment assembly face, never a
-     * repo-controlled plane; the CC 2.1.207 three-source invariant). `true` on an incapable
-     * deployment resolves to a no-op (asks flow the original chain; no warn — the gate, not a mistake).
+     * The per-principal auto-mode DENY bit (CC 2.1.250 polarity — the mirror of the settings-plane
+     * `permissions.disableAutoMode` ratchet: an organization may only take auto mode AWAY; it is the
+     * USER who turns it on, at the task's intent seat {@link TaskSpec.autoModeRequested}).
+     *
+     * **POLARITY: `=== false` DENIES; ABSENT IS NOT A DENIAL.** This is the family's deny-shaped
+     * member (like {@link allowWorkflows} / {@link allowFork}), NOT a grant-shaped one like
+     * {@link allowObservers}: a deployment with no entitlement source at all resolves `undefined` here
+     * and still arms on intent + capability. `true` is accepted and means the same as absent (no
+     * per-principal restriction) — it is not a grant, and it cannot arm a task whose intent seat is
+     * unset. The arming itself: intent ∧ {@link RunnerDeps.autoMode} present ∧ this bit not `false`
+     * (allow → run; block → deny `source:"classifier"`; classifier failure → FAIL-CLOSED back to the
+     * original ask chain). The trust gate is unchanged: classifier RULES enter only through the
+     * deployment assembly face, never a repo-controlled plane (the CC 2.1.207 three-source invariant).
+     * A denial resolves to a no-op (asks flow the original chain; no warn — the gate, not a mistake).
      */
     autoMode?: boolean;
     /**
@@ -5751,6 +5818,23 @@ export interface EngineNotice {
      *    `onNotice` sink per value (console arm once per process) instead of lying in wait; where the
      *    value IS in force the prepare refuses with the same code as `TaskResult.errorCode` (one
      *    fact, one code, two loudness dialects); `detail: { raw }`.
+     *  - `"config.durable_gate_unavailable"` — the per-principal `forceDurableGate` entitlement is in
+     *    force on a leg whose deployment wired NO checkpoint store. The entitlement is a mandate
+     *    ("every interactive ask of this principal gates durably"), and a mandate with no park
+     *    facility cannot be honored: no ask of the leg can suspend, so each one resolves on the LIVE
+     *    chain — a live approver / question face answers in-stream, and with none the ask is denied
+     *    fail-closed — and NO durable approval record is written. The ask routing itself is not
+     *    changed by the notice (a store-less leg never could park); the notice is the loud half of a
+     *    posture that used to degrade silently, disclosed before the first ask of the leg. Audience
+     *    `"user"` (the person whose asks will not be recorded is entitled to that; the operator hears
+     *    it through the sink as always). Once per prepared task leg — a resume or a delegated child
+     *    is its own leg and says so again; `detail: { sessionId, runId, principal?, cause, liveApprover,
+     *    liveQuestionFace }` — `cause` is `"no_deployment_store"` (the deployment wired none) or
+     *    `"task_store_null"` (`TaskSpec.checkpointStore: null`, the per-run off switch, on a leg
+     *    whose deployment may well have a store: the fix is the task's); `liveApprover` /
+     *    `liveQuestionFace`: whether a live seat will EFFECTIVELY answer the leg's permission asks /
+     *    questions in-stream (a delegated child under an inherited content mandate reads `false`
+     *    even with a face wired — the marker withholds the question), or the fail-closed deny will.
      *
      *  - `"task.user_steer_undrained"` / `"task.user_followup_undrained"` (#259) — user steers /
      *    follow-ups whose receipts said "queued" were still in their queue at agent_end: the run
@@ -5791,6 +5875,10 @@ export interface EngineNotice {
      *        `detail: { cause: "user_halt", sessionId, runId, taskId? }` — no `inputId` and no
      *        `actorId`, because no text entered the model and the verb carries no caller identity. A
      *        consumer keying `detail.inputId` off this row must treat it as ABSENT on this lane.
+     *        Fence tension (design/384 slice 2): this notice asserts THE CUT only — when the cut
+     *        raced a durable park whose commit was already in flight, the gate's durable leg may
+     *        still collect to `suspended` (park wins, row redeemable, no `haltedByUser`); the notice
+     *        stands beside that terminal without contradiction, because a seat really was cut.
      *    In both lanes: one notice per REAL cut (a `now` that found nothing in flight or whose frame
      *    already rode the imminent boundary, and a halt with nothing in flight, announce nothing — no
      *    false interrupt claims); `runId` (#499) is the INVOCATION that was cut (the other two ids are
@@ -5998,6 +6086,24 @@ export interface EngineNotice {
      *    disposition table with the error dispositions. The loser MUST NOT retry into the winner's
      *    account. A consumer diffing its own table against the catalog must not add a row for it.
      *
+     *  - `"config.peer_lane_unmounted"` (design/385 §1.2⑥) — `RunnerDeps.peerDirectory` is wired but
+     *    the cross-session lane could not mount on this leg: no `mailboxStore`, or one that does not
+     *    declare `crossProcessSafe: true` (several terminals would share one session box on luck). The
+     *    seat is inert for the run (no ListAgents, peer addresses refuse with the same reason). Once per
+     *    prepared leg; `detail: { reason, code, mailboxWired, sessionId, runId }`. Audience `"operator"`
+     *    (a wiring fact; the fix is the deployment's).
+     *  - `"peer.inbound_disposition"` (design/385 §1.2④ / §4.6) — a message parked in THIS session's
+     *    own box was settled at the drain WITHOUT reaching the model. `detail.disposition` is the arm:
+     *    `"refused"` (this session's `crossSessionInbound` setting, or a record whose typed fields
+     *    cannot be rendered canonically), `"admission_refused"` (the drain-stage admission re-check:
+     *    duplicate / hop loop / runaway — `cause` names it), `"notice_unrouted"` (a notice-kind record
+     *    — idle/delivery notice — met a build with no notice face: settled without delivery, never
+     *    ridden through the peer-message envelope), or `"held"` (mode parity held it; the
+     *    held-message review face is not mounted in this build, so the message STAYS PARKED and the
+     *    drain stops at it — disclosed once per seq per leg). `detail: { disposition, cause, seq, box,
+     *    fromSession?, sessionId, runId }`. Audience `"user"`: the session's user is the one who did
+     *    not receive it.
+     *
      *  - `"delegation.transcript_integrity"` (subagent transcript persistence) — a durable agent row
      *    with a BOUND transcript sessionId met a session store that attests `not_found` for it: the
      *    deployment's declared transcript durability is being contradicted by reality. Announced at
@@ -6638,11 +6744,15 @@ export interface RunnerDeps {
      * resolver, or an unset cap) = NO per-principal restriction (TIGHTEN-ONLY: a cap can only ever DENY or
      * FORCE; absence falls back to the deployment-level default). Symmetric with {@link sessionPolicyStore}.
      *
-     * core enforces only the caps it CAN enforce in the engine: `allowWorkflows` (the third stage of the
-     * workflows gate — task opt-in ∧ deployment capability ∧ this) and `forceDurableGate` (forces a run onto
-     * the durable-approval path so a policy `ask` suspends to the wire). `allowUltracode` is a shell/UX concern
-     * (reasoning-tier, not a core primitive); `allowBypassPermissions` is enforced at the service settings-
-     * resolution layer (the engine sees only a resolved policy, never a "this allow came from bypass" signal).
+     * core enforces the six caps it CAN enforce in the engine (polarity per member on {@link RuntimeCaps}):
+     * `allowWorkflows` (the third stage of the workflows gate — task opt-in ∧ deployment capability ∧ this),
+     * `allowFork` (the Agent-fork route), `allowObservers` (explicit opt-in for observer auto-spawn),
+     * `autoMode` (the per-principal deny bit of the user-enabled auto mode), `allowMemoryOptOut` (may this
+     * principal declare a capture opt-out), and `forceDurableGate` (forces a run onto the durable-approval
+     * path so a policy `ask` suspends to the wire — where a checkpoint store is wired; a store-less leg
+     * announces `config.durable_gate_unavailable`). `allowUltracode` is a shell/UX concern (reasoning-tier,
+     * not a core primitive); `allowBypassPermissions` is enforced at the service settings-resolution layer
+     * (the engine sees only a resolved policy, never a "this allow came from bypass" signal).
      */
     runtimeCapsResolver?: (principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>;
     /**
@@ -6711,8 +6821,10 @@ export interface RunnerDeps {
     retentionPolicy?: import("./retention.js").RetentionPolicy;
     /**
      * design/143 批2b — the auto-mode classifier's DEPLOYMENT assembly face. This is the
-     * capability half of the arming AND-gate: a run arms auto mode only when the per-principal
-     * entitlement grants it ({@link RuntimeCaps.autoMode}` === true`) AND this face is present.
+     * CAPABILITY arm of the three-arm arming: a run arms auto mode only when the task carries the
+     * auto-mode INTENT ({@link TaskSpec.autoModeRequested}, or the same bit inherited on the chain by an
+     * engine-spawned child) AND this face is present AND the per-principal DENY bit is not set
+     * ({@link RuntimeCaps.autoMode}` !== false` — absent is not a denial).
      *
      * 🔐 Trust gate (the CC 2.1.207 three-source invariant): classifier RULES enter EXCLUSIVELY
      * here — a deployment-constructed object, never a `TaskSpec` field, never a repo-file plane. The
@@ -6878,6 +6990,28 @@ export interface RunnerDeps {
      *  absent means the default table, not "guard off". Threaded into the auto-mounted SendMessage as
      *  `SendMessageToolOptions.admission`; read per call (a value change governs the next message). */
     peerAdmission?: Partial<import("../agents/peer-admission.js").PeerAdmissionConfig>;
+    /**
+     * design/385 §2.1 / §5.1 — the peer-session DIRECTORY: the discovery truth of the cross-session
+     * lane (other sessions of this engine for the same user). A HOST implements the contract (cli: the
+     * pid-keyed registration files; server: its session table) and writes the rows; the engine only
+     * reads them. Seat semantics = the mailbox seat's: NO seat, NO lane — every face stays byte-identical
+     * to a pre-385 build. With the seat wired the engine (a) mounts `ListAgents` (alias `ListPeers`),
+     * (b) opens SendMessage's `session.<id>` address arm and its last `name [ref]` rung, (c) drains this
+     * session's own `session.<sessionId>` box at every turn boundary (the mailbox contract's third
+     * consumption chain), and (d) splices the cross-session rule into the auto-mode classifier slot.
+     * HARD PRECONDITION (design/385 §1.2⑥): `mailboxStore` must be wired AND declare
+     * `crossProcessSafe: true`; otherwise the lane is REFUSED at prepare with a named
+     * `config.peer_lane_unmounted` notice (never mounted on luck), and the seat is inert for that run.
+     */
+    peerDirectory?: import("../agents/peer-directory.js").PeerDirectory;
+    /**
+     * design/385 §4.4 — this deployment's `crossSessionInbound` setting LAYERS for the drain-point
+     * judgment (managed / user / repo, resolved by `resolveCrossSessionInboundSetting` — explicit value
+     * wins, unset ⇒ mode parity, an unrecognized value forces `hold` loudly). Read at every drain, so a
+     * host that re-reads its settings files hands the current layers through a getter. Absent = unset
+     * everywhere (mode parity, the CC default). Inert without {@link peerDirectory}.
+     */
+    crossSessionInbound?: import("../agents/cross-session-judge.js").CrossSessionInboundSettingLayers | (() => import("../agents/cross-session-judge.js").CrossSessionInboundSettingLayers);
     /**
      * design/164 件五 — DEPLOYMENT-level usage governance: allowances that span TASKS, evaluated per
      * principal (or once for the whole deployment when a task declares none). A different axis from

package/dist/core/untrusted-text.js

@@ -196,7 +196,23 @@ export const ENGINE_ENVELOPES = Object.freeze([
         tag: "teammate-message",
         kind: "framing",
         mint: "agents/send-message-tool.ts (INTERPOLATED tag — invisible to the literal census)",
-        guard: "escapeEnvelopeTag(TEAMMATE_MESSAGE_TAG, …) on body/summary + escapeAttributeValue on attributes",
+        guard: "body through neutralizePeerBody (the authority family, ENGINE_AUTHORITY_ENVELOPE_TAGS) + escapeEnvelopeTag(TEAMMATE_MESSAGE_TAG, …); summary/teammate_id through escapeAttributeValue",
+        fenced: false,
+        disclosed: false,
+    },
+    {
+        tag: "agent-message",
+        kind: "framing",
+        mint: "core/task-notification.ts renderAgentMessageFrame (INTERPOLATED tag — invisible to the literal census; the child → parent uplink carrier)",
+        guard: "body through neutralizePeerBody (the authority family, ENGINE_AUTHORITY_ENVELOPE_TAGS — the one helper the three peer carriers share) + escapeEnvelopeTag(AGENT_MESSAGE_TAG, …); the from attribute through attrEscape",
+        fenced: false,
+        disclosed: false,
+    },
+    {
+        tag: "cross-session-message",
+        kind: "framing",
+        mint: "agents/cross-session-envelope.ts buildCrossSessionEnvelope / encodeCcPeerFrame (INTERPOLATED tag — invisible to the literal census)",
+        guard: "model-face body through neutralizePeerBody (the authority family, ENGINE_AUTHORITY_ENVELOPE_TAGS) + escapeEnvelopeTag(CROSS_SESSION_MESSAGE_TAG, …); every attribute value typed + under its own regex grammar at build, and the parser rebuilds-and-compares (round trip) before accepting any field. The CC wire codec carries bytes as-is (containment is applied at injection when the model face is re-minted)",
         fenced: false,
         disclosed: false,
     },

package/dist/core/wiring-manifest.d.ts

@@ -175,6 +175,21 @@ export interface WiringManifest {
         memoryAdmission: boolean;
         retention: boolean;
     };
+    /**
+     * EFFECTIVE half only, present iff the model gate trimmed a default-mounted tool from THIS run's
+     * roster: the per-session READ face of the same fact `config.tool_model_gate_removed` announces on
+     * the operator sink (one notice per sink, not per session — a client that needs "which default tools
+     * did MY session lose" reads it here). `class` = the gate class the table keyed the trim on, `removed`
+     * = the wire names not mounted, `restore` = the three valves in one sentence. Minted from the SAME
+     * gate decision the notice reads (one source, projected twice); absent = no trim on this run. A gate
+     * table with several classes trimming at once reports the FIRST class here and every removed name
+     * across classes in `removed` (the notice keeps its per-class lines).
+     */
+    modelGate?: {
+        class: string;
+        removed: readonly string[];
+        restore: string;
+    };
     /** EFFECTIVE half only — a short, non-sensitive fingerprint (sha256 prefix over the canonical
      *  JSON of this manifest's own resolved facts; every field here is an enum/boolean/count, no
      *  secrets) so an operator can correlate legs that ran under the same resolved assembly. */
@@ -231,6 +246,12 @@ export interface WiringFacts {
     complianceWired: boolean;
     memoryAdmissionWired: boolean;
     retentionPolicyWired: boolean;
+    /** Effective half only — see {@link WiringManifest.modelGate}; the static half has no roster to trim. */
+    modelGate?: {
+        class: string;
+        removed: readonly string[];
+        restore: string;
+    };
 }
 /** Named view of the deps seats the static half reads (a `Pick` of the real {@link RunnerDeps} —
  *  single-source shapes, no parallel hand-copied interface). */

package/dist/core/wiring-manifest.js

@@ -117,6 +117,7 @@ export function deriveWiringManifest(facts) {
             memoryAdmission: facts.memoryAdmissionWired,
             retention: facts.retentionPolicyWired,
         },
+        ...(facts.half === "effective" && facts.modelGate !== undefined ? { modelGate: { class: facts.modelGate.class, removed: [...facts.modelGate.removed], restore: facts.modelGate.restore } } : {}),
     };
     if (facts.half === "effective") {
         const { leg: _leg, ...assembly } = manifest;

package/dist/index.d.ts

@@ -95,7 +95,7 @@ export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY
 export { deploymentReadFaceClampNotice, resolveReadFace, type ReadFace, type ReadFaceInputs } from "./tools/fs/index.js";
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
@@ -118,14 +118,14 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
 export { type StoreFidelity } from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, type HumanInputSource, type HumanInputFrame, type HumanInputEvent, type HumanInputDelivery, } from "./core/human-input-projection.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, type SemaTaskType, type SemaTaskStatus, type SemaTaskHandle, type ParkedClaimTicket, type TaskAccess, type UnifiedTaskOutput, type TaskRetrievalStatus, type StopSource, type RegisterMonitorInput, type MonitorTimers, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
-export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, } from "./core/mailbox-store.js";
+export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease, MailboxStoreError, type MailboxStoreErrorCode, MAILBOX_TOMBSTONED_RECIPIENT_CODE, type MailboxAppendMessage, type MailboxPeerMeta, type MailboxPeerFromMode, type MailboxPeerRecordKind, MAILBOX_PEER_FROM_MODES, MAILBOX_PEER_RECORD_KINDS, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_CROSS_PROCESS_UNSAFE_CODE, readMailboxPeerMeta, mailboxCrossProcessMountVerdict, type MailboxCrossProcessVerdict, } from "./core/mailbox-store.js";
 export { FileMailboxStore, type FileMailboxStoreOptions } from "./stores/file/mailbox-store.js";
 export { createFileTaskListStore } from "./stores/file/task-list-store.js";
 export { createCcFileTaskListStore } from "./stores/cc/task-list-store.js";
@@ -166,7 +166,7 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { InMemorySessionRuleOverlay, type SessionRuleOverlay, type SessionRuleOverlayAdd, type SessionRuleOverlayApplyResult, } from "./core/permission-rule-session.js";
@@ -232,7 +232,7 @@ export { sessionRepoContract } from "./core/store-contracts/session-repo-contrac
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
 export { fileHistoryStoreContract } from "./core/store-contracts/file-history-store-contract.js";
 export { permissionRuleSyncContract, type PermissionRuleSyncContractHooks } from "./core/store-contracts/permission-rule-sync-contract.js";
-export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, type MailboxTombstonedRecipientContractHooks, } from "./core/store-contracts/mailbox-store-contract.js";
+export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, type MailboxTombstonedRecipientContractHooks, mailboxCrossProcessContract, type MailboxCrossProcessContractHooks, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
 export { type BackgroundAgentStore, type BackgroundAgentRecord, type BackgroundAgentRowSummary, type BackgroundAgentUsage, canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, type BackgroundAgentQuery, } from "./core/background-agent-store.js";
 export { serveDurableAgentRowLane, buildAgentPollDetails, type AgentPollDetailsInput, } from "./core/task-registry-agent.js";
@@ -252,6 +252,15 @@ export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE,
 export { getSessionRetainLedger, releaseSessionRetainLedger, } from "./agents/retain-ledger.js";
 export { createSendMessageTool, createAgentContinuationVerb, SEND_MESSAGE_TOOL_NAME, type SendMessageToolOptions, type AgentContinuationReceipt } from "./agents/send-message-tool.js";
 export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerAdmissionConfig, PEER_ADMISSION_DEFAULTS, PEER_HOP_CHAIN_WINDOW, PEER_MESSAGE_NOTICE, createPeerSelfRef, createPeerInboundChainRef, peerAxisToken, appendHopToken, type PeerAdmission, type PeerAdmissionConfig, type PeerAdmissionOptions, type PeerAdmissionRequest, type PeerAdmissionVerdict, type PeerAdmissionRefusal, type PeerRefusalCode, type PeerAxisTag, type PeerIdentity, type PeerSelfRef, type PeerInboundChainRef, } from "./agents/peer-admission.js";
+export { CROSS_SESSION_MESSAGE_TAG, CROSS_SESSION_MESSAGE_NOTICE, PERMISSION_MODE_CLASSES, isPermissionModeClass, CrossSessionCodecError, PEER_HOP_TOKEN_HEX, PEER_HOP_CHAIN_CARRY_WINDOW, encodePeerAddress, isCanonicalPeerAddress, encodeScopeAttribute, decodeScopeAttribute, canonicalPeerDisplayName, buildCrossSessionEnvelope, parseCrossSessionEnvelope, clampHopChain, encodeCcPeerFrame, decodeCcPeerFrame, type PermissionModeClass, type CrossSessionEnvelopeFields, type CrossSessionEnvelopeParse, type CrossSessionEnvelopeRefusal, type CcPeerFrameFields, type CcPeerFrameParse, } from "./agents/cross-session-envelope.js";
+export { CROSS_SESSION_INBOUND_SETTINGS, isCrossSessionInboundSetting, resolveCrossSessionInboundSetting, CROSS_SESSION_HOLD_CAUSES, describeCrossSessionHoldCause, judgeCrossSessionInbound, foldPermissionModeClass, PEER_SEND_VERDICT_CODES, peerSendVerdictSeverity, type CrossSessionInboundSetting, type CrossSessionSettingSource, type CrossSessionInboundSettingLayers, type ResolvedCrossSessionInboundSetting, type CrossSessionHoldCause, type CrossSessionInboundVerdict, type CrossSessionInboundInput, type PeerSendVerdictCode, type PeerSendVerdict, } from "./agents/cross-session-judge.js";
+export { PEER_REF_MIN, PEER_REF_MAX, PEER_REF_RE, mintPeerRef, formatPeerNameRef, parsePeerNameRef, normalizePeerName, PEER_ADDRESS_PREFIXES, reservedPeerNameReason, type PeerRefEntry, } from "./agents/cross-session-ref.js";
+export { PEER_SESSION_RECORD_SCHEMA_VERSION, PEER_SESSION_RECORD_MAX_BYTES, SESSION_BOX_PREFIX, peerSessionBoxHandle, isPeerSessionId, PEER_SESSION_ID_GRAMMAR, parsePeerSessionAddress, readPeerSessionRecord, defaultPeerLivenessProbe, isPeerSessionProcessAlive, mintPeerSessionCandidates, resolvePeerSessions, createInMemoryPeerDirectory, vetPeerRegistryDirectory, judgePeerRecordFile, type PeerSessionRecord, type PeerSessionLiveness, type PeerSessionTempo, type PeerSessionRecordRefusal, type PeerSessionRecordRead, type PeerLivenessProbe, type PeerDirectory, type PeerDirectoryAccess, type PeerSessionCandidate, type PeerSessionResolution, type InMemoryPeerDirectory, type PeerRegistryDirectoryRefusal, type PeerRegistryDirectoryVerdict, } from "./agents/peer-directory.js";
+export { createListAgentsTool, LIST_AGENTS_TOOL_NAME, LIST_AGENTS_TOOL_ALIAS, LIST_AGENTS_MAX_RESULT_CHARS, type ListAgentsToolOptions, type ListAgentsRow } from "./agents/list-agents-tool.js";
+export { CROSS_SESSION_CLASSIFIER_RULE } from "./agents/cross-session-envelope.js";
+export { PEER_SESSION_ID_UNGRAMMATICAL_CODE, type PeerLaneMountVerdict } from "./agents/peer-session-drain.js";
+export { renderCrossSessionMessageFrame } from "./core/task-notification.js";
+export { type PeerAdmissionStage } from "./agents/peer-admission.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, type AgentTranscriptToolOptions, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";
 export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_USE, EXPLORE_WHEN_TO_USE_LEAN, PLAN_WHEN_TO_USE, EXPLORE_SYSTEM_PROMPT, PLAN_SYSTEM_PROMPT, } from "./agents/builtin-agents.js";

package/dist/index.js

@@ -95,14 +95,14 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, } from "./core/park-selfcheck.js";
 export {} from "./core/checkpoint-store.js";
 export {} from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, } from "./core/human-input-projection.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
-export { InMemoryMailboxStore, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, } from "./core/mailbox-store.js";
+export { InMemoryMailboxStore, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, MAILBOX_PEER_FROM_MODES, MAILBOX_PEER_RECORD_KINDS, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_CROSS_PROCESS_UNSAFE_CODE, readMailboxPeerMeta, mailboxCrossProcessMountVerdict, } from "./core/mailbox-store.js";
 export { FileMailboxStore } from "./stores/file/mailbox-store.js";
 export { createFileTaskListStore } from "./stores/file/task-list-store.js";
 export { createCcFileTaskListStore } from "./stores/cc/task-list-store.js";
@@ -126,7 +126,7 @@ export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/au
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { InMemorySessionRuleOverlay, } from "./core/permission-rule-session.js";
@@ -191,7 +191,7 @@ export { sessionRepoContract } from "./core/store-contracts/session-repo-contrac
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
 export { fileHistoryStoreContract } from "./core/store-contracts/file-history-store-contract.js";
 export { permissionRuleSyncContract } from "./core/store-contracts/permission-rule-sync-contract.js";
-export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, } from "./core/store-contracts/mailbox-store-contract.js";
+export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, mailboxCrossProcessContract, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
 export { canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, } from "./core/background-agent-store.js";
 export { serveDurableAgentRowLane, buildAgentPollDetails, } from "./core/task-registry-agent.js";
@@ -209,6 +209,15 @@ export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE,
 export { getSessionRetainLedger, releaseSessionRetainLedger, } from "./agents/retain-ledger.js";
 export { createSendMessageTool, createAgentContinuationVerb, SEND_MESSAGE_TOOL_NAME } from "./agents/send-message-tool.js";
 export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerAdmissionConfig, PEER_ADMISSION_DEFAULTS, PEER_HOP_CHAIN_WINDOW, PEER_MESSAGE_NOTICE, createPeerSelfRef, createPeerInboundChainRef, peerAxisToken, appendHopToken, } from "./agents/peer-admission.js";
+export { CROSS_SESSION_MESSAGE_TAG, CROSS_SESSION_MESSAGE_NOTICE, PERMISSION_MODE_CLASSES, isPermissionModeClass, CrossSessionCodecError, PEER_HOP_TOKEN_HEX, PEER_HOP_CHAIN_CARRY_WINDOW, encodePeerAddress, isCanonicalPeerAddress, encodeScopeAttribute, decodeScopeAttribute, canonicalPeerDisplayName, buildCrossSessionEnvelope, parseCrossSessionEnvelope, clampHopChain, encodeCcPeerFrame, decodeCcPeerFrame, } from "./agents/cross-session-envelope.js";
+export { CROSS_SESSION_INBOUND_SETTINGS, isCrossSessionInboundSetting, resolveCrossSessionInboundSetting, CROSS_SESSION_HOLD_CAUSES, describeCrossSessionHoldCause, judgeCrossSessionInbound, foldPermissionModeClass, PEER_SEND_VERDICT_CODES, peerSendVerdictSeverity, } from "./agents/cross-session-judge.js";
+export { PEER_REF_MIN, PEER_REF_MAX, PEER_REF_RE, mintPeerRef, formatPeerNameRef, parsePeerNameRef, normalizePeerName, PEER_ADDRESS_PREFIXES, reservedPeerNameReason, } from "./agents/cross-session-ref.js";
+export { PEER_SESSION_RECORD_SCHEMA_VERSION, PEER_SESSION_RECORD_MAX_BYTES, SESSION_BOX_PREFIX, peerSessionBoxHandle, isPeerSessionId, PEER_SESSION_ID_GRAMMAR, parsePeerSessionAddress, readPeerSessionRecord, defaultPeerLivenessProbe, isPeerSessionProcessAlive, mintPeerSessionCandidates, resolvePeerSessions, createInMemoryPeerDirectory, vetPeerRegistryDirectory, judgePeerRecordFile, } from "./agents/peer-directory.js";
+export { createListAgentsTool, LIST_AGENTS_TOOL_NAME, LIST_AGENTS_TOOL_ALIAS, LIST_AGENTS_MAX_RESULT_CHARS } from "./agents/list-agents-tool.js";
+export { CROSS_SESSION_CLASSIFIER_RULE } from "./agents/cross-session-envelope.js";
+export { PEER_SESSION_ID_UNGRAMMATICAL_CODE } from "./agents/peer-session-drain.js";
+export { renderCrossSessionMessageFrame } from "./core/task-notification.js";
+export {} from "./agents/peer-admission.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";
 export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_USE, EXPLORE_WHEN_TO_USE_LEAN, PLAN_WHEN_TO_USE, EXPLORE_SYSTEM_PROMPT, PLAN_SYSTEM_PROMPT, } from "./agents/builtin-agents.js";

package/dist/stores/cc/mailbox-store.d.ts

@@ -1,4 +1,4 @@
-import type { MailboxStore } from "../../core/mailbox-store.js";
+import { type MailboxStore } from "../../core/mailbox-store.js";
 /** CC's path-component sanitize rule (README §一 Jeo/UJt): non-alphanumerics → "-", lowercased. */
 export declare function sanitizeCcAgentName(name: string): string;
 export interface CcFileMailboxStoreOptions {

package/dist/stores/cc/mailbox-store.js

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
+import { readMailboxPeerMeta } from "../../core/mailbox-store.js";
 import { atomicWriteFile, canonicalStoreKey } from "../file/fs-atomic.js";
 import { withCcLock } from "./lockfile.js";
 const INBOX_FILE_EXT = ".json";
@@ -94,6 +95,15 @@ export function createCcFileMailboxStore(opts) {
             note(path, `${dropped} malformed inbox entries skipped (first: ${firstReason})`);
         return kept;
     };
+    const readBackPeerMeta = (raw) => {
+        try {
+            const meta = readMailboxPeerMeta(raw);
+            return meta === undefined ? {} : { peerMeta: meta };
+        }
+        catch {
+            return {};
+        }
+    };
     const saveBox = (path, box) => {
         atomicWriteFile(inboxDir, path, JSON.stringify(box, null, 2));
     };
@@ -136,6 +146,7 @@ export function createCcFileMailboxStore(opts) {
     return {
         append: (scope, handle, msg) => {
             requireDefaultScope(scope);
+            const peerMeta = readMailboxPeerMeta(msg.peerMeta);
             mkdirSync(inboxDir, { recursive: true });
             const path = inboxPath(handle);
             const notes = deferredNotes();
@@ -150,6 +161,7 @@ export function createCcFileMailboxStore(opts) {
                     msg_id: randomUUID(),
                     read: false,
                     ...(msg.hopChain !== undefined ? { hopChain: [...msg.hopChain] } : {}),
+                    ...(peerMeta !== undefined ? { peerMeta } : {}),
                 });
                 saveBox(path, box);
                 return box.length;
@@ -178,6 +190,7 @@ export function createCcFileMailboxStore(opts) {
                 ...(Array.isArray(e.hopChain) && e.hopChain.every((h) => typeof h === "string")
                     ? { hopChain: e.hopChain.filter((h) => typeof h === "string") }
                     : {}),
+                ...readBackPeerMeta(e.peerMeta),
             }));
             if (pending.length === 0)
                 return Promise.resolve(null);

package/dist/stores/file/adoption/marker.d.ts

@@ -209,7 +209,7 @@ export declare function writeRootAdoptionFile(root: string, content: RootAdoptio
  * and it is the ONLY thing this function does — it never reaches an object that already exists. So a
  * store instance constructed BEFORE the marker landed keeps writing for as long as it is held, in
  * ANOTHER OS process (cross-process sharing of one data dir is the file family's documented
- * UNSUPPORTED shape — task-list F-14, mailbox RB-249) and, symmetrically, in THIS one (an independent
+ * UNSUPPORTED shape for the task-list store — F-14; the mailbox store is the exception since its per-box lock upgrade, see `stores/file/mailbox-store.ts`) and, symmetrically, in THIS one (an independent
  * store face built before the adoption started; the arc's `LOCK` acquisition excludes a live
  * `FileStorageBackend`, which is the only shape that takes that lock). Adoption adds no new promise on
  * either side of that seam — see the freeze note on `adoptLocalDataRoot` for the full division.