@sema-agent/core 7.2.0 → 7.3.0

package/dist/agents/send-message-tool.d.ts

@@ -3,6 +3,8 @@ import type { Runner } from "../core/runner/runtask.js";
 import type { TaskNotificationPayload } from "../core/task-notification.js";
 import { type ToolCtxEnricher } from "../core/tools.js";
 import { type TaskAccess } from "../core/task-registry.js";
+import type { PermissionModeClass } from "./cross-session-envelope.js";
+import { type PeerDirectory } from "./peer-directory.js";
 import { SubagentRetainLedger } from "./retain-ledger.js";
 import { type SubagentSteerHandle } from "./subagent.js";
 import { type PeerAdmissionConfig, type PeerInboundChainRef, type PeerSelfRef } from "./peer-admission.js";
@@ -164,6 +166,35 @@ export interface SendMessageToolOptions {
      * per-call honest refusal is the only loudness (unchanged behavior).
      */
     onTranscriptIntegrityGap?: (handle: string, scope: string | undefined) => void;
+    /**
+     * design/385 §2 — the peer-session DIRECTORY ({@link import("../core/types.js").RunnerDeps.peerDirectory}):
+     * opens the cross-session lane's two rungs on this face — the explicit `session.<id>` address arm
+     * (ranked beside the precise a* id) and the LAST name rung (`name [ref]` over the directory's full
+     * set, after every agent rung missed). Needs {@link mailbox} beside it AND that store's
+     * `crossProcessSafe: true` declaration: with the directory wired but either missing, the lane stays
+     * closed and every peer-addressed send refuses with the named reason (never a silent fall-through to
+     * "no agent matches"). Absent ⇒ byte-identical pre-385 behavior.
+     */
+    peerDirectory?: PeerDirectory;
+    /**
+     * design/385 — THIS session's own identity on the cross-session lane: its session id (the sender's
+     * `from-session` / reply address, and the self-target guard), the scope its directory rows live in,
+     * its display name (the `from-name` attestation), and the live fold of its own permission-mode class
+     * ({@link import("./cross-session-judge.js").foldPermissionModeClass} over the wiring manifest's
+     * `ask.effective`) — read at SEND time, attested on the parked record's typed `peerMeta.fromMode`.
+     * The Runner mount fills it; a direct mount without it sends with no session attestation (the
+     * recipient then judges it as "no class asserted").
+     */
+    peerSelfSession?: {
+        sessionId: string;
+        scope?: string;
+        name?: string;
+        modeClass?: () => PermissionModeClass | "unknown";
+    };
+    /** design/385 §5.1 — is `ListAgents` mounted beside this tool? Drives the "list them with ListAgents"
+     *  phrase (a face never names a tool the roster does not carry — an `excludeTools` may drop one of the
+     *  pair). Absent = unknown ⇒ the phrase is hedged. */
+    peerListingMounted?: boolean;
 }
 /** RB-382 — max chars of the `summary` arg (the short recap label, distinct from `message`'s much
  *  larger {@link UPLINK_RESULT_MAX}) before ITS OWN truncation. Exported for direct unit-testing only

package/dist/agents/send-message-tool.js

@@ -3,7 +3,9 @@ import { defineTool } from "../core/tools.js";
 import { normalizeAgentName, DURABLE_AGENT_HANDLE_RE, DURABLE_AGENT_HEARTBEAT_MS } from "../core/task-registry.js";
 import { announceTranscriptIntegrityGapOnce, canAccessAgentRecord, clearRevivedRowTerminalPayload } from "../core/background-agent-store.js";
 import { uuidv7 } from "../internal/harness.js";
-import { MAILBOX_TOMBSTONED_RECIPIENT_CODE } from "../core/mailbox-store.js";
+import { MAILBOX_TOMBSTONED_RECIPIENT_CODE, mailboxCrossProcessMountVerdict } from "../core/mailbox-store.js";
+import { peerSendVerdictSeverity } from "./cross-session-judge.js";
+import { parsePeerSessionAddress, peerSessionBoxHandle, resolvePeerSessions } from "./peer-directory.js";
 import { escapeAttributeValue, escapeEnvelopeTag, isObserverTaskId, OBSERVER_SENDMESSAGE_SENDER_REFUSAL, OBSERVER_SENDMESSAGE_TARGET_REFUSAL, } from "./observer.js";
 import { inlineUntrusted } from "../core/untrusted-text.js";
 import { neutralizePeerBody } from "./cross-session-envelope.js";
@@ -29,6 +31,7 @@ function frameTeammateMessage(args) {
     return `<${TEAMMATE_MESSAGE_TAG} teammate_id="${escapeAttributeValue(args.from)}"${summaryAttr}>\n${body}\n</${TEAMMATE_MESSAGE_TAG}>`;
 }
 const REVIVE_LEASE_TTL_MS = 5 * 60_000;
+const PEER_REFUSAL_TEXT_MAX = 1200;
 const sendMessageTargetLanes = new Map();
 function withTargetLane(key, fn) {
     const prev = sendMessageTargetLanes.get(key) ?? Promise.resolve();
@@ -47,6 +50,14 @@ function targetLaneKey(scope, targetId) {
 const OPERATOR_CONTINUATION_CTX = Symbol("sema.operator_continuation");
 export function createSendMessageTool(opts) {
     const tier3Capable = opts.agentStore !== undefined && opts.mailbox !== undefined && opts.reviveSpawn !== undefined;
+    const peerLane = (() => {
+        if (opts.peerDirectory === undefined)
+            return { active: false };
+        if (opts.mailbox === undefined)
+            return { active: false, reason: "a peer-session directory is wired but no mailbox store is (the lane parks messages in the recipient's durable session box)" };
+        const verdict = mailboxCrossProcessMountVerdict(opts.mailbox);
+        return verdict.ok ? { active: true } : { active: false, reason: verdict.reason };
+    })();
     const retrievalMounted = opts.retrievalToolMounted;
     const retrievalHedge = retrievalMounted === undefined ? " (where that tool is mounted)" : "";
     const RETRIEVE_NOW = retrievalMounted === false
@@ -129,7 +140,10 @@ export function createSendMessageTool(opts) {
             (tier3Capable
                 ? `Continuing a finished agent works for agents with a durable record — by name or task_id, even across restarts — and for runs that retain sub-agent sessions; when neither covers it you get an honest error and should launch a new agent with the needed context instead.`
                 : `Continuing a finished agent requires the run to retain sub-agent sessions; when the session was not ` +
-                    `retained (or is no longer held) you get an honest error and should launch a new agent with the needed context instead.`),
+                    `retained (or is no longer held) you get an honest error and should launch a new agent with the needed context instead.`) +
+            (peerLane.active
+                ? ` Peer SESSIONS — other sessions of this engine for the same user${opts.peerListingMounted === false ? "" : opts.peerListingMounted === true ? " (list them with ListAgents)" : " (list them with ListAgents where that tool is mounted)"} — are addressed by name, by \`name [ref]\` when a name is ambiguous, or by their \`session.<id>\` address. A message to a peer is parked durably in its session box and read at its next turn boundary (an offline peer reads it when it next runs); the receipt confirms the box accepted it, not that the peer acted on it.`
+                : ""),
         parameters: Type.Object({
             to: Type.String({ description: 'Recipient: the agent\'s name, or its task_id (a…) returned by the Agent tool with run_in_background. "main" is reserved for the spawning conversation.' }),
             message: Type.String({ description: "The follow-up request. The agent continues from its full prior context." }),
@@ -179,9 +193,9 @@ export function createSendMessageTool(opts) {
                 return { content: OBSERVER_SENDMESSAGE_TARGET_REFUSAL, details: { error: "observer_target", to }, isError: true };
             }
             const admissionConfig = resolvePeerAdmissionConfig(opts.admission);
-            const guardScope = ctx.principal ?? opts.scope;
+            const guardScope = ctx.principal ?? opts.scope ?? opts.peerSelfSession?.scope;
             const selfRef = ctx.peerSelfRef ?? opts.peerSelf;
-            const directMountSessionId = ctx.sessionId ?? opts.sessionId;
+            const directMountSessionId = ctx.sessionId ?? opts.sessionId ?? opts.peerSelfSession?.sessionId;
             const directMountTaskId = ctx.taskId ?? opts.owner;
             const senderKey = selfRef?.current.key ??
                 (directMountSessionId !== undefined
@@ -203,6 +217,125 @@ export function createSendMessageTool(opts) {
                             : `this message's forwarding chain is too long (runaway relay) — stop relaying it; act on it or drop it.`;
                 return { content: `Message not sent: ${text}`, details: { error: reason, code: reason, to }, isError: true };
             };
+            const peerRefusal = (code, text, extra) => {
+                const verdict = { ok: false, code, severity: peerSendVerdictSeverity(code), message: text };
+                return { content: `Message not sent: ${text.slice(0, PEER_REFUSAL_TEXT_MAX)}`, details: { error: code, code, to, verdict, ...extra }, isError: true };
+            };
+            const peerSelfSessionId = opts.peerSelfSession?.sessionId ?? directMountSessionId;
+            const peerScope = guardScope ?? opts.peerSelfSession?.scope;
+            let ownRowName;
+            const resolvePeerTarget = async () => {
+                try {
+                    const rows = await opts.peerDirectory.listPeerSessions({ scope: peerScope ?? "" });
+                    if (peerSelfSessionId !== undefined)
+                        ownRowName = rows.find((r) => r.sessionId.toLowerCase() === peerSelfSessionId.toLowerCase())?.name;
+                    return resolvePeerSessions(rows, to, peerSelfSessionId !== undefined ? { sessionId: peerSelfSessionId } : undefined);
+                }
+                catch (e) {
+                    return { status: "directory_fault", message: e instanceof Error ? e.message : String(e) };
+                }
+            };
+            const deliverToPeerSession = async (c) => {
+                const record = c.record;
+                const handle = peerSessionBoxHandle(record.sessionId);
+                const peerLabel = `peer session "${inlineUntrusted(record.name, 64)}" (${handle})`;
+                if (peerScope === undefined)
+                    return peerRefusal("peer_send.other", `this mount has no scope axis, so ${peerLabel}'s box cannot be addressed.`);
+                if (record.inboundPosture === "unavailable") {
+                    return peerRefusal("peer_send.recipient_refuses", `${peerLabel} advertises that it does not accept cross-session messages (its crossSessionInbound is "refuse"). Nothing was parked.`);
+                }
+                const recipientKey = peerAxisToken(peerScope, "s", record.sessionId);
+                const storedContent = `[${summary}] ${clipCarrierMessage(message)}`;
+                const sendVerdict = judgePeerAdmission(peerScope, recipientKey, { senderKey, body: storedContent, prospectiveChain, ownTokens: [recipientKey] }, admissionConfig, undefined, "send");
+                if (!sendVerdict.ok)
+                    return admissionRefusal(sendVerdict.reason, peerLabel);
+                let boxFull = false;
+                try {
+                    boxFull = (await opts.mailbox.peekCount(peerScope, handle)) >= admissionConfig.maxQueuedPeerMessages;
+                }
+                catch {
+                }
+                if (boxFull) {
+                    return { content: `Message not sent: ${inlineUntrusted(peerLabel, 200)}'s session box is at its queued-message limit (${admissionConfig.maxQueuedPeerMessages.toFixed(0)}) — the message was NOT queued; it drains the box at its next turn. Resend later. ${DEDUP_RETRY_NOTE.slice(0, 200)}`, details: { error: "queue_full", code: "queue_full", to }, isError: true };
+                }
+                const modeClass = opts.peerSelfSession?.modeClass?.();
+                const peerMeta = {
+                    ...(peerSelfSessionId !== undefined ? { fromSession: peerSelfSessionId } : {}),
+                    ...(modeClass === "bypass" || modeClass === "prompting" ? { fromMode: modeClass } : {}),
+                    ...(senderKey !== undefined ? { senderKey } : {}),
+                    kind: "peer_message",
+                };
+                const now = Date.now();
+                let seq;
+                try {
+                    seq = await opts.mailbox.append(peerScope, handle, { from: ownRowName ?? opts.peerSelfSession?.name ?? senderLabel, content: storedContent, sentAt: now, hopChain: prospectiveChain, peerMeta });
+                }
+                catch (e) {
+                    if (e?.code === MAILBOX_TOMBSTONED_RECIPIENT_CODE) {
+                        return peerRefusal("peer_send.invalid_target", `${peerLabel} is being deleted — its box no longer accepts messages. Nothing was parked; do not retry.`);
+                    }
+                    return peerRefusal("peer_send.other", `the session box refused the message (${e instanceof Error ? e.message : String(e)}) — nothing was parked. ${DEDUP_RETRY_NOTE}`);
+                }
+                let rowRestored = "present";
+                try {
+                    const rowsNow = await opts.peerDirectory.listPeerSessions({ scope: peerScope });
+                    const nowRow = rowsNow.find((r) => r.sessionId.toLowerCase() === record.sessionId.toLowerCase());
+                    if (nowRow?.liveness === "deleted")
+                        rowRestored = "deleted_meanwhile";
+                    else if (nowRow === undefined) {
+                        rowRestored = opts.peerDirectory.restorePeerSession !== undefined && (await opts.peerDirectory.restorePeerSession(record)) ? "restored" : "unrestorable";
+                    }
+                }
+                catch {
+                }
+                const rowNote = rowRestored === "unrestorable"
+                    ? " Note: the peer's directory row disappeared while this message was being parked and this directory cannot restore it — the message is safe in the box (it drains by session id), but the name may not resolve until that session next registers; its session.<id> address still does."
+                    : rowRestored === "deleted_meanwhile"
+                        ? " Note: that session was DELETED while this message was being parked — its box is being retired and this message will not be read; do not resend to it."
+                        : "";
+                const offline = record.liveness !== "live";
+                const verdict = { ok: true, disposition: offline ? "parked_offline" : "queued", via: "store" };
+                return {
+                    content: offline
+                        ? `Message parked for ${peerLabel}: that session is offline, so the message was parked durably in its session box (seq ${seq}) and will be delivered when it next runs — subject to the deployment's mailbox retirement policy, which does not notify you. Continue with your task; do not resend the same content.${rowNote}`
+                        : `Message queued for ${peerLabel} (seq ${seq}): it is parked durably in that session's box and will be read at its next turn boundary. This receipt confirms acceptance into the box, not the peer's judgment of the message. Continue with your task; do not resend the same content.${rowNote}`,
+                    details: { type: "send-message", status: offline ? "peer_parked_offline" : "peer_queued", to, address: handle, seq, verdict, ...(rowRestored !== "present" ? { directoryRow: rowRestored } : {}) },
+                };
+            };
+            const settlePeerResolution = async (r) => {
+                switch (r.status) {
+                    case "directory_fault":
+                        return peerRefusal("peer_send.other", `the peer-session directory could not be read (${r.message}) — nothing was sent.`);
+                    case "not_found":
+                        return undefined;
+                    case "self":
+                        return peerRefusal("peer_send.invalid_target", `"${inlineUntrusted(to, 120)}" is this session — a session cannot send a cross-session message to itself.`);
+                    case "deleted":
+                        return peerRefusal("peer_send.invalid_target", `peer session "${inlineUntrusted(r.candidate.record.name, 64)}" was deleted — its address no longer accepts messages. Nothing was parked.`);
+                    case "stale_ref":
+                        return peerRefusal("peer_send.invalid_target", `the ref [${r.ref}] no longer resolves (the peer set changed since you listed it) — re-run ListAgents and re-send with a current ref.`);
+                    case "ambiguous":
+                        return { content: `Message not sent: ${inlineUntrusted(r.message, 1000)}`, details: { error: "ambiguous", to, candidates: r.candidates.map((c) => ({ name: c.record.name, ref: c.ref, address: peerSessionBoxHandle(c.record.sessionId), liveness: c.record.liveness })) }, isError: true };
+                    case "found": {
+                        const guard = pinGuard(peerSessionBoxHandle(r.candidate.record.sessionId), r.candidate.record.name, r.rung === "name" ? "name" : "ref", to);
+                        if (guard !== undefined)
+                            return guard;
+                        return await withTargetLane(targetLaneKey(peerScope, peerSessionBoxHandle(r.candidate.record.sessionId)), () => deliverToPeerSession(r.candidate));
+                    }
+                    default: {
+                        const _exhaustive = r;
+                        void _exhaustive;
+                        return undefined;
+                    }
+                }
+            };
+            if (parsePeerSessionAddress(to) !== undefined) {
+                if (!peerLane.active) {
+                    return peerRefusal("peer_send.invalid_target", peerLane.reason !== undefined ? `cross-session addressing is unavailable on this mount — ${peerLane.reason}. Nothing was sent.` : `cross-session addressing is not mounted here (no peer-session directory), so "${inlineUntrusted(to, 120)}" cannot be delivered.`);
+                }
+                const settled = await settlePeerResolution(await resolvePeerTarget());
+                return settled ?? peerRefusal("peer_send.invalid_target", `no session is registered at "${inlineUntrusted(to, 120)}" — nothing was parked (a message is only ever parked for a session that exists or existed).`);
+            }
             if (normalizeAgentName(to) === "main") {
                 if (opts.uplink && senderId !== undefined) {
                     const uplinkIdentity = opts.uplinkRecipient?.current;
@@ -618,6 +751,14 @@ export function createSendMessageTool(opts) {
                     const labels = parentAccess !== undefined
                         ? [...ownLabels, ...opts.registry.runningBackgroundAgentLabels(parentAccess).filter((l) => !ownLabels.includes(l))]
                         : ownLabels;
+                    if (peerLane.active) {
+                        const settled = await settlePeerResolution(await resolvePeerTarget());
+                        if (settled !== undefined)
+                            return settled;
+                    }
+                    else if (peerLane.reason !== undefined) {
+                        return peerRefusal("peer_send.other", `no agent matches "${inlineUntrusted(to, 120)}", and the cross-session lane that could reach a peer session by that name is unavailable on this mount — ${peerLane.reason}.`);
+                    }
                     if (DURABLE_AGENT_HANDLE_RE.test(to)) {
                         return {
                             content: `Message not sent: no transcript found for agent ${to} — launch a new agent with the needed context instead.`,

package/dist/agents/subagent-steps.d.ts

@@ -41,6 +41,17 @@ export interface SubagentEditedFile {
 }
 /** Keep the last N tool steps (CC's tail is ~this deep; older steps are rarely load-bearing for resume). */
 export declare const STEP_CAP = 10;
+/** Hard-bound a line to `max` UTF-16 units — a pure prefix, no marker appended. When the cut would split a
+ *  redaction marker, it moves back to the marker's start (the bound holds, and the output never shows a
+ *  marker fragment); when it would split a surrogate pair, it moves back one unit (never a lone surrogate). */
+export declare function cutAt(line: string, max: number): string;
+/**
+ * Redact, THEN bound — the order every display cut in this module (and the runner's `steering_injected`
+ * previews) uses. Exported so a preview minted elsewhere gets the same marker-aware cut rather than a
+ * raw `slice` that can leave a half marker at the bound. Keeps newlines: a multi-line body is the
+ * caller's shape; only the bound and the redaction are this function's.
+ */
+export declare function redactThenCut(s: string, max: number): string;
 /** The tool's primary argument as a single short line (best-effort; unknown shapes → a compact JSON head). */
 export declare function extractTarget(args: unknown): string;
 /**

package/dist/agents/subagent-steps.js

@@ -1,3 +1,4 @@
+import { redactSecrets } from "../core/untrusted-egress.js";
 export const STEP_CAP = 10;
 const FIELD_MAX = 80;
 const EDITED_FILES_CAP = 32;
@@ -6,9 +7,31 @@ function firstLine(s) {
     const nl = s.indexOf("\n");
     return nl === -1 ? s : s.slice(0, nl);
 }
+const REDACTION_MARKER_RE = /\[redacted(?:-[a-z]+)?\]/g;
+export function cutAt(line, max) {
+    if (line.length <= max)
+        return line;
+    let at = max;
+    for (const m of line.matchAll(REDACTION_MARKER_RE)) {
+        const start = m.index;
+        const end = start + m[0].length;
+        if (start < at && at < end) {
+            at = start;
+            break;
+        }
+        if (start >= at)
+            break;
+    }
+    const lead = line.charCodeAt(at - 1);
+    if (at > 0 && lead >= 0xd800 && lead <= 0xdbff)
+        at -= 1;
+    return line.slice(0, at);
+}
+export function redactThenCut(s, max) {
+    return cutAt(redactSecrets(s), max);
+}
 function clip(s) {
-    const line = firstLine(s).trim();
-    return line.length > FIELD_MAX ? line.slice(0, FIELD_MAX) : line;
+    return redactThenCut(firstLine(s).trim(), FIELD_MAX);
 }
 export function extractTarget(args) {
     if (args === null || typeof args !== "object")
@@ -109,7 +132,7 @@ export class SubagentStepRecorder {
                 const tool = start?.tool ?? e.label ?? e.toolName;
                 const target = start?.target ?? "";
                 const body = outputFirstLine(e.output);
-                const outcome = e.isError ? `error: ${body}`.slice(0, FIELD_MAX) : body;
+                const outcome = e.isError ? cutAt(`error: ${body}`, FIELD_MAX) : body;
                 this.steps.push({ tool, target, outcome });
                 if (this.steps.length > STEP_CAP)
                     this.steps.shift();
@@ -156,7 +179,7 @@ export function stepsFromMessages(messages, lastN) {
             if (b.type !== "toolCall" || typeof b.name !== "string")
                 continue;
             const res = typeof b.id === "string" ? results.get(b.id) : undefined;
-            const outcome = res ? (res.isError ? `error: ${res.body}`.slice(0, FIELD_MAX) : res.body) : "";
+            const outcome = res ? (res.isError ? cutAt(`error: ${res.body}`, FIELD_MAX) : res.body) : "";
             steps.push({ tool: b.name, target: extractTarget(b.arguments), outcome });
         }
     }

package/dist/core/auto-mode-arming.d.ts

@@ -29,6 +29,14 @@ export interface AutoModeArmingRecipe {
     timeoutMs?: number;
     /** Consecutive-failure threshold opening the one-way breaker (floored, as the decider itself floors it). */
     failureThreshold?: number;
+    /**
+     * The cross-session lane's classifier rule was spliced into the assembled prompt (the lane was
+     * mounted on the arming leg). Part of the PROMPT BODY: the rebuild re-splices the same engine
+     * constant when the bit is set, so the recorded `promptDigest` is reproducible, and the fold treats
+     * the bit as body (a rebuild under a deployment whose own face does not declare it refuses as
+     * `settings_moved` — the two prompts differ by a rule block). Absent = the rule was not spliced.
+     */
+    crossSessionMessagesRule?: true;
     /**
      * A digest of the EXACT classifier system prompt this arming assembled (see
      * `rebuildAutoModeDecider`). The recipe records the deployment's OVERRIDES; the bulk of the criteria —
@@ -57,6 +65,9 @@ export interface AutoModeArmingFace {
     timeoutMs?: number;
     failureThreshold?: number;
     settingsEpoch?: string;
+    /** `true` when the cross-session lane's classifier rule is spliced into this deployment's classifier
+     *  prompt (the Runner sets it from its own lane mount; a redeeming host declares it from its). */
+    crossSessionMessagesRule?: boolean;
 }
 /**
  * Canonicalize + VALIDATE an arming recipe: the plain-data form that persists, or `undefined` when the

package/dist/core/auto-mode-arming.js

@@ -81,9 +81,13 @@ export function sanitizeAutoModeArmingRecipe(value) {
     const promptDigest = value.promptDigest;
     if (promptDigest !== undefined && (typeof promptDigest !== "string" || promptDigest === ""))
         return undefined;
+    const crossSessionMessagesRule = value.crossSessionMessagesRule;
+    if (crossSessionMessagesRule !== undefined && typeof crossSessionMessagesRule !== "boolean")
+        return undefined;
     return {
         v: AUTO_MODE_ARMING_RECIPE_VERSION,
         ...(promptDigest !== undefined ? { promptDigest } : {}),
+        ...(crossSessionMessagesRule === true ? { crossSessionMessagesRule: true } : {}),
         ...(rules !== undefined ? { rules } : {}),
         ...(settingsDenyRules !== undefined ? { settingsDenyRules } : {}),
         ...(sessionContext !== undefined ? { sessionContext } : {}),
@@ -104,6 +108,7 @@ export function autoModeArmingRecipeOf(face, bind) {
         ...(face.timeoutMs !== undefined ? { timeoutMs: face.timeoutMs } : {}),
         ...(face.failureThreshold !== undefined ? { failureThreshold: face.failureThreshold } : {}),
         ...(face.settingsEpoch !== undefined ? { settingsEpoch: face.settingsEpoch } : {}),
+        ...(face.crossSessionMessagesRule !== undefined ? { crossSessionMessagesRule: face.crossSessionMessagesRule } : {}),
     });
 }
 function sameArmingBody(a, b) {
@@ -116,6 +121,7 @@ function sameArmingBody(a, b) {
         r.sessionContext ?? null,
         r.window?.maxEntries ?? null,
         r.window?.maxCharsPerEntry ?? null,
+        r.crossSessionMessagesRule === true,
     ]);
     return body(a) === body(b);
 }
@@ -160,7 +166,7 @@ export function foldAutoModeArming(recorded, current) {
                 ok: false,
                 reason: "settings_moved",
                 message: "the auto-mode settings moved between the recorded arming and this deployment's current ones (rule sections / settings-deny rules / " +
-                    "session context / window bounds differ), and free-text rule sets have no sound stricter-than ordering — refusing to rebuild " +
+                    "session context / window bounds / the cross-session lane rule differ), and free-text rule sets have no sound stricter-than ordering — refusing to rebuild " +
                     "(the strictest decidable answer: the inherited ask flows the original chain to a human)",
             };
     }

package/dist/core/auto-mode-prompt.d.ts

@@ -22,6 +22,11 @@ export interface BuildAutoModePromptOptions {
     /** Extra session-context facts (e.g. the CC user-identity line) — appended as a
      *  `## Session Context` bullet block after the assembled document. */
     sessionContext?: readonly string[];
+    /** design/385 §4.5 — the text spliced into the `<cross_session_messages_rule>` slot. Absent (the
+     *  default, and every deployment without the cross-session lane) ⇒ the slot is blanked exactly as
+     *  before; the lane mount passes `CROSS_SESSION_CLASSIFIER_RULE`. Callback form at the splice (the
+     *  text may carry `$`). */
+    crossSessionMessagesRule?: string;
 }
 /**
  * Assemble the classifier SYSTEM prompt (CC `KRg`, content-equivalent single string — CC splits the

package/dist/core/auto-mode-prompt.js

@@ -34,7 +34,8 @@ const PAIRED_SECTIONS = [
     ["environment", /<user_environment_to_replace>([\s\S]*?)<\/user_environment_to_replace>/],
 ];
 export function buildAutoModePrompt(options) {
-    let out = AUTO_MODE_BASE_PROMPT.replace("<permissions_template>", () => AUTO_MODE_PERMISSIONS_EXTERNAL).replace("<cross_session_messages_rule>", () => "");
+    const crossSessionRule = options?.crossSessionMessagesRule ?? "";
+    let out = AUTO_MODE_BASE_PROMPT.replace("<permissions_template>", () => AUTO_MODE_PERMISSIONS_EXTERNAL).replace("<cross_session_messages_rule>", () => crossSessionRule);
     for (const [key, re] of PAIRED_SECTIONS) {
         out = out.replace(re, (_m, inner) => mergeRuleSection(options?.rules?.[key], inner));
     }

package/dist/core/auto-mode-rebuild.d.ts

@@ -58,7 +58,8 @@ export type AutoModeRebuildResult = {
  * Rebuild a decider with a PARKED ancestor's criteria from its recorded recipe plus a fresh model leg.
  *
  * What is reproduced: the assembled system prompt (`buildAutoModePrompt` over the recorded rule
- * overrides / settings-deny rules / session context), the transcript-window bounds, the round-trip
+ * overrides / settings-deny rules / session context, plus the engine's cross-session lane rule when
+ * the recipe says the arming leg spliced it), the transcript-window bounds, the round-trip
  * timeout and the breaker threshold — i.e. every input the ancestor's own `createAutoModeDecider` call
  * had except the model leg and the alarm closure.
  *

package/dist/core/auto-mode-rebuild.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { createAutoModeDecider } from "./auto-mode.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "./auto-mode-prompt.js";
 import { foldAutoModeArming, } from "./auto-mode-arming.js";
+import { CROSS_SESSION_CLASSIFIER_RULE } from "../agents/cross-session-envelope.js";
 export function rebuildAutoModeDecider(opts) {
     const folded = foldAutoModeArming(opts.recorded, opts.current);
     if (!folded.ok)
@@ -11,6 +12,7 @@ export function rebuildAutoModeDecider(opts) {
         ...(effective.rules !== undefined ? { rules: effective.rules } : {}),
         ...(effective.settingsDenyRules !== undefined ? { settingsDenyRules: effective.settingsDenyRules } : {}),
         ...(effective.sessionContext !== undefined ? { sessionContext: effective.sessionContext } : {}),
+        ...(effective.crossSessionMessagesRule === true ? { crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : {}),
     };
     const systemPrompt = buildAutoModePrompt(promptOptions);
     const assembledDigest = `apv1:${createHash("sha256").update(systemPrompt).digest("hex")}`;

package/dist/core/checkpoint-store.d.ts

@@ -1065,6 +1065,20 @@ export interface CheckpointState {
             rules: SessionPermissionRules;
         }>;
         shellGate?: "off" | "always" | "classify";
+        /** The chain's AUTO-MODE INTENT at suspend (data half, same law as `shellGate`): `true` when the
+         *  suspended leg was an auto-mode task — its own seat, the bit its live chain carried, or the bit
+         *  an earlier suspend of the same chain recorded (carried forward across a re-suspend). A resume
+         *  leg reads it as one more INTENT source beside the re-supplied seat and the waking chain, so a
+         *  redemption in another process (no seat re-passed, no live chain) still arms exactly as the
+         *  suspend leg did. It is a MEMORY of intent, never an authorization: the resuming deployment's
+         *  face (`RunnerDeps.autoMode`) and the resuming principal's deny bit (`RuntimeCaps.autoMode`)
+         *  are judged afresh on every leg — a bit on the row cannot arm where the redeeming deployment
+         *  would not. Follows the classifier's latch: a leg armed here writes it only while its own breaker
+         *  is untripped and untouched (a session that fell back to non-auto hands nothing forward); a leg
+         *  never armed here carries the memory as is. Absent on older checkpoints and on non-auto tasks
+         *  (byte-identical to the pre-bit row); an older worker that ignores it resumes un-armed, the
+         *  narrower direction. */
+        autoModeRequested?: true;
         /** Org-memory admission freeze (ruled 2026-08-05): the chain's admitted org-scope set at
          *  suspend (data half, plain strings). The resume leg folds it seed ∩ live (tighten-only) and
          *  re-runs admission under it — a resume must never widen the delegation freeze. Absent on

package/dist/core/checkpoint-store.js

@@ -2,7 +2,8 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
-import { renderUntrustedCommandText } from "./permission-rule-model.js";
+import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
+import { redactSecrets } from "./untrusted-egress.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 export function mintCheckpointToken() {
     return randomBytes(16).toString("hex");
@@ -124,7 +125,7 @@ export function buildRiskDescriptor(input) {
         if (shell || toolName === "Bash") {
             const cmd = isPlainRecord(args) ? safeDataValue(args, "command") : undefined;
             if (typeof cmd === "string" && cmd.length > 0)
-                summary = renderUntrustedCommandText(cmd, SUMMARY_CMD_MAX);
+                summary = renderUntrustedCommandText(redactSecrets(stripFormatCharacters(cmd)), SUMMARY_CMD_MAX);
             const bg = isPlainRecord(args) ? safeDataValue(args, "run_in_background") : undefined;
             if (bg === true)
                 summary = `[background persistent process — no per-step recheck] ${summary ?? ""}`.trimEnd();
@@ -139,7 +140,7 @@ export function buildRiskDescriptor(input) {
                     if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
                         const encDigest = (s) => s.replace(/%/g, "%25").replace(/=/g, "%3D").replace(/ /g, "%20");
                         const k = encDigest(renderUntrustedCommandText(key, 40));
-                        const val = encDigest(renderUntrustedCommandText(String(v), SUMMARY_VALUE_MAX));
+                        const val = encDigest(renderUntrustedCommandText(redactSecrets(stripFormatCharacters(String(v))), SUMMARY_VALUE_MAX));
                         parts.push(`${k}=${val}`);
                     }
                 }

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.durable_gate_unavailable", "config.peer_lane_unmounted", "peer.inbound_disposition", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -101,6 +101,9 @@ export const ENGINE_NOTICE_CODES = [
     "config.tool_model_gate_removed",
     "config.tool_model_gate_unknown_class",
     "config.tool_model_gate_env_invalid",
+    "config.durable_gate_unavailable",
+    "config.peer_lane_unmounted",
+    "peer.inbound_disposition",
     "delegation.transcript_integrity",
     "mcp.revocation_probe_failed",
     "workflow.governance_key_stripped",
@@ -143,6 +146,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "steering.parked_input_blocked": "user",
     "task.halt_unconsumed": "user",
     "task.late_approval": "user",
+    "config.durable_gate_unavailable": "user",
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
     "memory.consolidation_withheld": "user",
@@ -154,6 +158,8 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.tool_model_gate_removed": "operator",
     "config.tool_model_gate_unknown_class": "operator",
     "config.tool_model_gate_env_invalid": "operator",
+    "config.peer_lane_unmounted": "operator",
+    "peer.inbound_disposition": "user",
     "delegation.transcript_integrity": "operator",
     "mcp.revocation_probe_failed": "operator",
     "workflow.governance_key_stripped": "operator",