@sema-agent/core 7.2.0 → 7.3.0

package/dist/core/runner/prepare-task.js

@@ -83,6 +83,8 @@ import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.j
 import { createTaskOutputTool, createTaskStopTool, defaultTaskRegistry } from "../task-registry.js";
 import { createMonitorTool } from "../../tools/monitor.js";
 import { createWorktreeTools } from "../../tools/worktree.js";
+import { announcePeerLaneMount, bindPeerLaneDrain, listAgentsMountable, mountListAgents, peerLaneSendMessageSeats } from "../../agents/peer-session-drain.js";
+import { CROSS_SESSION_CLASSIFIER_RULE } from "../../agents/cross-session-envelope.js";
 import { applyCompactionToReadFileState, isReadDedupStubResult, FULL_SHELL_CONTRACT_ID, HAND_TOOL_EFFECTS } from "../../tools/fs/index.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
 import { ASK_USER_QUESTION_TOOL_NAME, createAskUserQuestionTool, classifyQuestionOutcome, isLiveQuestionFace, validateAskQuestions, } from "../ask-question.js";
@@ -198,6 +200,20 @@ function announceToolModelGate(onNotice, modelId, gate) {
         }
     }
 }
+export const TOOL_MODEL_GATE_RESTORE_SENTENCE = "restore via TaskSpec.restoreGatedTools, SEMA_TOOL_MODEL_GATE=off, or RunnerDeps.toolModelGate: false";
+function toolModelGateManifest(gate) {
+    let firstClass;
+    const removed = [];
+    for (const [gateClass, names] of gate.removedByClass) {
+        if (names.length === 0)
+            continue;
+        firstClass ??= gateClass;
+        for (const n of names)
+            if (!removed.includes(n))
+                removed.push(n);
+    }
+    return firstClass === undefined ? undefined : { class: firstClass, removed, restore: TOOL_MODEL_GATE_RESTORE_SENTENCE };
+}
 function announceDeclaredMcpContentClasses(args) {
     for (const entry of args.entries ?? []) {
         const declaredClass = entry.contentOrigin;
@@ -1161,14 +1177,101 @@ function refuseRequireExistingWithoutSession(spec) {
         throw e;
     }
 }
+function screenAutoModeCap(caps, onError, sessionId) {
+    if (caps === undefined)
+        return { caps, faulted: false };
+    if (typeof caps !== "object" || caps === null || Array.isArray(caps)) {
+        onError?.(new Error(`runtimeCapsResolver returned a non-record value (${JSON.stringify(caps)}) — read as a resolver fault: every per-principal capability is DENIED for this run (auto mode is not armed; asks flow the original chain). Return a RuntimeCaps object or undefined.`), { phase: "config", sessionId });
+        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, faulted: true };
+    }
+    const record = caps;
+    if (record.autoMode === undefined || typeof record.autoMode === "boolean")
+        return { caps: record, faulted: false };
+    onError?.(new Error(`runtimeCapsResolver returned a non-boolean autoMode (${JSON.stringify(record.autoMode)}) — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the original chain). Return true, false, or omit the key.`), { phase: "config", sessionId });
+    return { caps: { ...record, autoMode: false }, faulted: true };
+}
+function mintPersistedArming(am, laneRule, classifierSystemPrompt, onError, sessionId) {
+    const arming = autoModeArmingRecipeOf(laneRule ? { ...am, crossSessionMessagesRule: true } : am, {
+        promptDigest: `apv1:${createHash("sha256").update(classifierSystemPrompt).digest("hex")}`,
+    });
+    if (arming === undefined) {
+        onError?.(new Error("RunnerDeps.autoMode.persistArming is set but the auto-mode face did not canonicalize into an arming recipe " +
+            "(a rule list carrying a non-string, or a non-finite/out-of-range timeoutMs / failureThreshold / window bound) — " +
+            "NO arming recipe is recorded on this run's parked constraint chain, and a cross-process redemption keeps the " +
+            "conservative behavior (the ancestor classifier answers unavailable and the inherited ask flows to a human)"), { phase: "config", sessionId });
+    }
+    return arming;
+}
+function autoModeLatchHealthy(d) {
+    try {
+        return d.breakerOpen() !== true && typeof d.consecutiveFailures === "function" && d.consecutiveFailures() === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function refuseInvalidAutoModeSeat(spec) {
+    if (spec.autoModeRequested !== undefined && spec.autoModeRequested !== true) {
+        const e = new Error(`autoModeRequested must be the literal true when present (got ${JSON.stringify(spec.autoModeRequested)}) — omit it for a non-auto task; a non-boolean or false value is refused rather than read as either polarity.`);
+        e.code = "config.auto_mode_requested_invalid";
+        throw e;
+    }
+    return spec.autoModeRequested === true;
+}
+function announceDurableGateUnavailable(args) {
+    if (!args.forceDurableGate || args.storeWired)
+        return;
+    const cause = args.taskStoreNull ? "task_store_null" : "no_deployment_store";
+    const inheritedContentMandate = (args.parentConstraints ?? []).some((pc) => pc.contentMandate === true);
+    const liveQuestionFace = args.liveQuestionFace && !inheritedContentMandate;
+    deliverEngineNotice(args.onNotice, {
+        code: "config.durable_gate_unavailable",
+        message: `Durable approval gate mandated but unavailable: the runtime entitlement forceDurableGate is in force for this ` +
+            `principal, but ${cause === "task_store_null" ? "this task disabled the checkpoint store (checkpointStore: null)" : "this deployment wired no checkpoint store"}, ` +
+            `so no interactive ask of this task can be parked for a durable answer. Asks resolve on the live chain instead ` +
+            `(${args.liveApprover ? "a live approver answers permission asks in-stream" : "permission asks are denied fail-closed — no live approver is wired"}; ` +
+            `${liveQuestionFace ? "a live question face answers AskUserQuestion in-stream" : args.liveQuestionFace ? "AskUserQuestion is withheld from the live face by an inherited durable mandate and refused" : "AskUserQuestion has no live face and is refused"}) ` +
+            `and NO durable approval record is written. ${cause === "task_store_null" ? "Run this task with its store, or withdraw the entitlement for principals whose runs are machine-started." : "Wire a checkpoint store on this deployment, or withdraw the entitlement for principals served here."}`,
+        detail: {
+            sessionId: args.sessionId,
+            runId: args.runId,
+            ...(args.principal ? { principal: args.principal } : {}),
+            cause,
+            liveApprover: args.liveApprover,
+            liveQuestionFace,
+        },
+    });
+}
+function buildTier3ReviveSpawn(delegationForRevive, enrichSpecToolCtx) {
+    if (delegationForRevive === undefined)
+        return undefined;
+    return async (req) => {
+        const out = await delegationForRevive.execute({
+            description: req.row.description ?? "revived teammate",
+            prompt: req.prompt,
+            run_in_background: true,
+            ...(req.row.agentType !== undefined ? { subagent_type: req.row.agentType } : {}),
+            ...(req.row.name !== undefined ? { name: req.row.name } : {}),
+            ...(req.row.model !== undefined ? { model: req.row.model } : {}),
+        }, enrichSpecToolCtx({ toolCallId: `rv-${randomBytes(8).toString("hex")}`, reviveClaim: { row: req.row, rev: req.rev, ...(req.peerSeed !== undefined ? { peerSeed: req.peerSeed } : {}) } }));
+        const o = (typeof out === "string" ? { content: out } : out);
+        return {
+            content: typeof o.content === "string" ? o.content : JSON.stringify(o.content),
+            ...(o.isError === true ? { isError: true } : {}),
+            ...(o.details !== undefined ? { details: o.details } : {}),
+        };
+    };
+}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf, runIdSink) {
     const runId = uuidv7();
     if (runIdSink !== undefined)
         runIdSink.runId = runId;
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
+    const autoModeSeat = refuseInvalidAutoModeSeat(spec);
     const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, microCompactKnob, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
+    const modelGateManifest = toolModelGateManifest(doors.modelGate);
     const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
     let shellGatedBash = false;
     let shellGatedMonitor = false;
@@ -1188,6 +1291,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const taskScope = internals?.registryScope ?? spec.principal ?? "default";
     internals?.peerSelfRef?.addAxis("s", sessionId);
     internals?.peerSelfRef?.addAxis("t", hostTaskId);
+    const peerLaneActive = announcePeerLaneMount(deps, { sessionId, runId });
+    const peerLaneRefs = {};
+    const peerSendMessageBuiltIn = runnerSelf !== undefined && !(toolFaceSnapshot.exclude ?? []).includes(SEND_MESSAGE_TOOL_NAME) && !(spec.tools ?? []).some((t) => t.name === SEND_MESSAGE_TOOL_NAME);
     const { reminderMark, reminderDisclosureCounts } = await adoptReminderMark(session, sessionId, resume?.seed.reminderMark, internals?.reminderMark, deps.onError);
     const offloadScope = spec.principal ?? "default";
     if (internals?.registryScope !== undefined && internals.registryScope !== offloadScope) {
@@ -1575,6 +1681,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ? liveShellGate
                     : seedShellGate;
         const inheritedParentConstraints = liveInheritedGate?.parentConstraints;
+        const autoModeIntent = autoModeSeat || liveInheritedGate?.autoModeRequested === true || seedInheritedGate?.autoModeRequested === true;
         const liveAdmittedOrg = liveInheritedGate?.admittedOrgScopes;
         const seedAdmittedOrg = seedInheritedGate?.admittedOrgScopes;
         const inheritedAdmittedOrgScopes = liveAdmittedOrg === undefined ? seedAdmittedOrg : seedAdmittedOrg === undefined ? liveAdmittedOrg : liveAdmittedOrg.filter((s) => seedAdmittedOrg.includes(s));
@@ -1687,6 +1794,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             return {
                 ...(ancestorRules.length > 0 ? { ancestorRules } : {}),
                 ...(effectiveShellGate !== "off" ? { shellGate: effectiveShellGate } : {}),
+                ...(autoModeIntent ? { autoModeRequested: true } : {}),
                 ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
                 admittedOrgScopes: memoryAdmittedOrgScopesRef.current,
                 ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
@@ -1827,9 +1935,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             catch (err) {
                 deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
-                runtimeCaps = { allowWorkflows: false, allowFork: false };
+                runtimeCaps = { allowWorkflows: false, allowFork: false, autoMode: false };
                 runtimeCapsFaulted = true;
             }
+            const screened = screenAutoModeCap(runtimeCaps, deps.onError, sessionId);
+            runtimeCaps = screened.caps;
+            runtimeCapsFaulted ||= screened.faulted;
         }
         let complianceDenies = new Set();
         let complianceDegraded = false;
@@ -1866,7 +1977,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         agentForkDenial = forkGovernanceDenial(spec.enableFork, runtimeCaps?.allowFork);
         observersActive = runtimeCaps?.allowObservers === true;
-        if (runtimeCaps?.autoMode === true && deps.autoMode !== undefined) {
+        if (autoModeIntent && deps.autoMode !== undefined && runtimeCaps?.autoMode !== false) {
             const am = deps.autoMode;
             let classifierModel;
             try {
@@ -1878,7 +1989,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId, runId })) {
                 classifierModel = model;
             }
-            const classifierSystemPrompt = buildAutoModePrompt(am);
+            const classifierLaneRule = peerLaneActive && peerSendMessageBuiltIn;
+            const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
             const classifierRuntime = brainToRuntime(deps.brain);
             autoModeDecider = createAutoModeDecider({
                 ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
@@ -1901,17 +2013,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         .join("");
                 },
             });
-            if (am.persistArming === true) {
-                autoModeArming = autoModeArmingRecipeOf(am, {
-                    promptDigest: `apv1:${createHash("sha256").update(classifierSystemPrompt).digest("hex")}`,
-                });
-                if (autoModeArming === undefined) {
-                    deps.onError?.(new Error("RunnerDeps.autoMode.persistArming is set but the auto-mode face did not canonicalize into an arming recipe " +
-                        "(a rule list carrying a non-string, or a non-finite/out-of-range timeoutMs / failureThreshold / window bound) — " +
-                        "NO arming recipe is recorded on this run's parked constraint chain, and a cross-process redemption keeps the " +
-                        "conservative behavior (the ancestor classifier answers unavailable and the inherited ask flows to a human)"), { phase: "config", sessionId });
-                }
-            }
+            if (am.persistArming === true)
+                autoModeArming = mintPersistedArming(am, classifierLaneRule, classifierSystemPrompt, deps.onError, sessionId);
         }
         const deploymentWorkflowReady = runnerSelf !== undefined && isSelfOrchestrationActive(spec, deps);
         const selfOrchestrationActive = deploymentWorkflowReady && runtimeCaps?.allowWorkflows !== false;
@@ -2207,7 +2310,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         shellGatedBash = handsReadFace.shellGatedBash;
         shellGatedMonitor = handsReadFace.shellGatedMonitor;
         const delegationSurfaceActive = backgroundTaskToolsActive || workflowToolsActive;
-        if (delegationSurfaceActive || internals?.parentNotify !== undefined) {
+        if (delegationSurfaceActive || internals?.parentNotify !== undefined || peerLaneActive) {
             if (delegationSurfaceActive) {
                 toolEffects.set("TaskOutput", "read");
                 toolEffects.set("TaskStop", "write");
@@ -2217,24 +2320,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 toolEffects.set(SEND_MESSAGE_TOOL_NAME, "write");
                 axisExplicitNegatives.set(SEND_MESSAGE_TOOL_NAME, { ...axisExplicitNegatives.get(SEND_MESSAGE_TOOL_NAME), egress: false });
                 const delegationForRevive = (spec.tools ?? []).find((t) => t.agentListing !== undefined);
-                const reviveSpawn = delegationForRevive !== undefined && deps.backgroundAgentStore !== undefined && deps.mailboxStore !== undefined
-                    ? async (req) => {
-                        const out = await delegationForRevive.execute({
-                            description: req.row.description ?? "revived teammate",
-                            prompt: req.prompt,
-                            run_in_background: true,
-                            ...(req.row.agentType !== undefined ? { subagent_type: req.row.agentType } : {}),
-                            ...(req.row.name !== undefined ? { name: req.row.name } : {}),
-                            ...(req.row.model !== undefined ? { model: req.row.model } : {}),
-                        }, enrichSpecToolCtx({ toolCallId: `rv-${randomBytes(8).toString("hex")}`, reviveClaim: { row: req.row, rev: req.rev, ...(req.peerSeed !== undefined ? { peerSeed: req.peerSeed } : {}) } }));
-                        const o = (typeof out === "string" ? { content: out } : out);
-                        return {
-                            content: typeof o.content === "string" ? o.content : JSON.stringify(o.content),
-                            ...(o.isError === true ? { isError: true } : {}),
-                            ...(o.details !== undefined ? { details: o.details } : {}),
-                        };
-                    }
-                    : undefined;
+                const reviveSpawn = deps.backgroundAgentStore !== undefined && deps.mailboxStore !== undefined ? buildTier3ReviveSpawn(delegationForRevive, enrichSpecToolCtx) : undefined;
                 tools.push(firstPartyOffload(createSendMessageTool({
                     runner: runnerSelf,
                     registry: defaultTaskRegistry,
@@ -2260,6 +2346,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
                     ...(deps.mailboxStore !== undefined ? { mailbox: deps.mailboxStore } : {}),
                     ...(reviveSpawn !== undefined ? { reviveSpawn } : {}),
+                    ...(peerLaneActive ? peerLaneSendMessageSeats({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, ...(internals?.explicitAgentName !== undefined ? { name: internals.explicitAgentName } : {}), refs: peerLaneRefs, listingMounted: listAgentsMountable({ exclude: toolFaceSnapshot.exclude, specTools: spec.tools ?? [] }) }) : {}),
                     onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
                     onTranscriptIntegrityGap: (handle, scope) => deliverEngineNotice(deps.onNotice, {
                         code: "delegation.transcript_integrity",
@@ -2285,6 +2372,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             }
         }
+        const listAgents = peerLaneActive && peerSendMessageBuiltIn && listAgentsMountable({ exclude: toolFaceSnapshot.exclude, specTools: spec.tools ?? [] }) ? mountListAgents({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, hostTaskId, ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}), ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}), registry: defaultTaskRegistry, ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}), specTools: spec.tools ?? [], toolEffects }) : undefined;
+        if (listAgents !== undefined)
+            tools.push(firstPartyOffload(listAgents));
         if (backgroundTaskToolsActive) {
             toolEffects.set("Monitor", "write");
             envHandToolNames.add("Monitor");
@@ -2331,10 +2421,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const liveQuestionFace = isLiveQuestionFace(onQuestion) ? onQuestion : undefined;
         const contentAskBindings = new Map();
         const CONTENT_ASK_BINDING_CAP = 32;
+        const checkpointStore = resolveCheckpointStore(spec, deps);
+        const questionParkStoreWired = checkpointStore !== undefined;
+        const questionDurableMandateBinding = runtimeCaps?.forceDurableGate === true && questionParkStoreWired;
         const contentAskRoutable = (toolCallId) => liveQuestionFace !== undefined &&
             mountedQuestionTool !== undefined &&
             tools.includes(mountedQuestionTool) &&
-            runtimeCaps?.forceDurableGate !== true &&
+            !questionDurableMandateBinding &&
             !inheritedUnavailableAsks.has(toolCallId);
         const lateStrandedAnswers = [];
         const discloseStrandedAnswers = (records, why) => {
@@ -2361,8 +2454,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 byDelivery.set(r.deliveryId, r);
             return [...byDelivery.values()];
         };
-        const durableQuestionFace = resolveCheckpointStore(spec, deps) !== undefined &&
-            (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true);
+        const durableQuestionFace = questionParkStoreWired && (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true);
         const mountedQuestionFace = liveQuestionFace !== undefined
             ? async (req, signal) => {
                 const bound = contentAskBindings.get(req.toolCallId);
@@ -4272,7 +4364,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const usageGovernance = buildUsageGovernance(usageWindows, deps, spec.principal, sessionId);
         const platformSuspendArmed = durableSuspendInfraReady && (envLifetimeSuspendAt !== undefined || usageGovernance !== undefined);
-        const checkpointStore = resolveCheckpointStore(spec, deps);
         const durableApproval = spec.durableApproval ??
             (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
         const wiringQuestionSeam = resolveQuestionSeam(spec, deps);
@@ -4308,8 +4399,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             complianceWired: deps.compliancePostureResolver !== undefined,
             memoryAdmissionWired: deps.memoryScopeAdmission !== undefined,
             retentionPolicyWired: deps.retentionPolicy !== undefined,
+            ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
         });
+        peerLaneRefs.askEffective = wiringManifest.ask.effective;
+        if (peerLaneActive && internals?.onTaskNotification !== undefined) {
+            bindPeerLaneDrain(harness, { deps, sessionId, runId, scope: taskScope, inject: internals.onTaskNotification, ownTokens: () => internals?.peerSelfRef?.current.ownTokens ?? [], refs: peerLaneRefs });
+        }
         const parkLaneArmed = wiringManifest.parkLane.effective === true;
+        announceDurableGateUnavailable({ onNotice: deps.onNotice, forceDurableGate: runtimeCaps?.forceDurableGate === true, storeWired: checkpointStore !== undefined, taskStoreNull: spec.checkpointStore === null, liveApprover: isLiveApproverSeat(frozenOnAsk), liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
         const hookIdentity = mintHookInvocationIdentity({
             sessionId,
             taskId: hostTaskId,
@@ -4449,8 +4546,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const constraintDigest = (inheritedParentConstraints?.length ?? 0) > 0
                         ? constraintChainDigest(constraintChain)
                         : seedInheritedGate?.constraintDigest;
+                    const autoModeIntentCarried = autoModeIntent && (autoModeDecider === undefined || autoModeLatchHealthy(autoModeDecider));
                     return inheritedAncestorRules !== undefined ||
                         inheritedShellGate !== undefined ||
+                        autoModeIntentCarried ||
                         inheritedAdmittedOrgScopes !== undefined ||
                         ownOrgVerdictRef.current !== undefined ||
                         orgGovernedProvenance ||
@@ -4458,6 +4557,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         ? {
                             ...(inheritedAncestorRules !== undefined ? { ancestorRules: structuredClone(inheritedAncestorRules) } : {}),
                             ...(inheritedShellGate !== undefined ? { shellGate: inheritedShellGate } : {}),
+                            ...(autoModeIntentCarried ? { autoModeRequested: true } : {}),
                             ...(inheritedAdmittedOrgScopes !== undefined ? { admittedOrgScopes: [...inheritedAdmittedOrgScopes] } : {}),
                             ...(ownOrgVerdictRef.current !== undefined
                                 ? { ownAdmittedOrgScopes: [...ownOrgVerdictRef.current.scopes], ownAdmittedOrgWriteScope: ownOrgVerdictRef.current.writeScope }

package/dist/core/runner/runtask.js

@@ -21,6 +21,7 @@ import { ORG_ADJUDICATION_TIMEOUT_MS, settleOrgVerdictWithin } from "../permissi
 import { emitTaskOutcome } from "../task-outcome.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { primaryActivityArg } from "../arg-summary.js";
+import { redactThenCut } from "../../agents/subagent-steps.js";
 import { resolveReasoning } from "../../brain/reasoning.js";
 import { adjudicateDerivedRoute, authCarrierFingerprint, fallbackToPrimaryNotice, normalizeBaseUrl, sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { readDegradation } from "../../brain/degrading.js";
@@ -773,7 +774,7 @@ function makeTurnBoundary(prepared, stats, rs, deps) {
                     boundaryAttachmentBytes += Buffer.byteLength(a.body, "utf8");
                 rs.attach.attachmentsInjected += due.length;
                 for (const a of due) {
-                    queue.push({ type: "steering_injected", source: a.source, preview: a.body.slice(0, 220), ...ident() });
+                    queue.push({ type: "steering_injected", source: a.source, preview: redactThenCut(a.body, 220), ...ident() });
                 }
             }
         }
@@ -3821,7 +3822,7 @@ export class Runner {
                     }
                     for (const f of firstFrames) {
                         f.commit();
-                        queue.push({ type: "steering_injected", source: f.source, preview: f.body.slice(0, 220), ...ident() });
+                        queue.push({ type: "steering_injected", source: f.source, preview: redactThenCut(f.body, 220), ...ident() });
                     }
                     rs.attach.attachmentsInjected += firstFrames.length;
                     if (firstFrames.length > 0)

package/dist/core/runner/tool-output-projection.js

@@ -64,6 +64,7 @@ const CC_DETAIL_TYPES = new Set([
     "task-stop", "tool-search", "repo-map", "fork", "enter-plan-mode", "exit-plan-mode",
     "monitor-start", "path_not_in_root", "read_path_denied", "readonly_out_of_root", "bash_invalid_timeout",
     "report-findings", "schedule-wakeup", "send-message", "agent-transcript", "a2a", "document",
+    "list-agents",
 ]);
 export const structuredFrom = (result) => {
     const details = result !== null && typeof result === "object" ? result.details : undefined;

package/dist/core/store-contracts/mailbox-store-contract.d.ts

@@ -46,6 +46,29 @@ export declare function mailboxAckOwnershipContract(mk: () => MailboxStore, runA
  * 放宽」:核心层没有一条为了任何后端而弱化。第三方后端若有租户轴,应当也挂这一层。
  */
 export declare function mailboxBundledOnlyContract(mk: () => MailboxStore, runAssertion?: ContractAssertionRunner): Promise<void>;
+export interface MailboxCrossProcessContractHooks {
+    /** Open ONE fresh, empty storage location TWICE: `local` in this process and `peer` served by ANOTHER
+     *  OS process over the same storage (the peer is a real second process — an in-process second
+     *  instance proves nothing here). `dispose` closes both and may remove the storage. The kit calls it
+     *  once per case. */
+    openPair: () => Promise<{
+        local: MailboxStore;
+        peer: MailboxStore;
+        dispose: () => Promise<void>;
+    }>;
+    runAssertion?: ContractAssertionRunner;
+}
+/**
+ * T2 可选能力层(cross-process 分册,design/385 §1.2⑥ / G11)—— 声明 `crossProcessSafe: true` 的后端必须
+ * 过的全套判据。钉的是**整套**(跨进程 seq 单铸 + lease/ack 不交叉 + 一方的 housekeeping 不丢另一方的
+ * 已落盘 append + reap/drop 的 seq 语义跨进程成立),不是「有锁」:一把锁配一份陈旧缓存照样在锁内铸
+ * 重号、照样把别人的消息压缩掉——所以每一条都从**对方进程的视角**回读。
+ *
+ * 受众:文件后端(本仓捆绑)、SQL 后端(事务天然过)。进程内 Map 的参照实现与 CC inbox 适配器不声明,
+ * 也不挂——它们不是「没做到所以放宽」,而是根本不在跨进程车道上(挂载判据 `mailboxCrossProcessMountVerdict`
+ * 对未声明的后端响亮拒)。
+ */
+export declare function mailboxCrossProcessContract(hooks: MailboxCrossProcessContractHooks): Promise<void>;
 export interface MailboxTombstonedRecipientContractHooks {
     /** Put `(scope, handle)` into the deployment's PRE-DELETE state — whatever that is for this
      *  backend (a cascade marking the session row, a `deleting` column, a tombstone table). Core does

package/dist/core/store-contracts/mailbox-store-contract.js

@@ -1,5 +1,5 @@
 import { strict as assert } from "node:assert";
-import { MAILBOX_TOMBSTONED_RECIPIENT_CODE } from "../mailbox-store.js";
+import { MAILBOX_INVALID_PEER_META_CODE, MAILBOX_TOMBSTONED_RECIPIENT_CODE } from "../mailbox-store.js";
 import { beginContract } from "./contract-harness.js";
 export const MAILBOX_CONTRACT_SCOPE = "default";
 const msg = (content, sentAt = 1000) => ({ content, sentAt });
@@ -112,6 +112,75 @@ export async function mailboxStoreContract(mk, runAssertion) {
         const after = await s.claimLease(S, "a1", "rival", 60_000, 12_000);
         assert.deepEqual(after?.messages.map((m) => m.seq), [1], "归还后同一条按原 seq 回可见");
     });
+    run("peerMeta 回环:典型 typed 记录逐字节回读;缺席保持缺席(pre-385/foreign 记录语义);空对象也是「在场」", async (make) => {
+        const s = make();
+        const full = {
+            fromSession: "sess_1",
+            fromMode: "prompting",
+            senderKey: "k-1",
+            kind: "peer_message",
+            fromScope: "team/a b",
+            gateReceiptId: "gr-9",
+        };
+        await s.append(S, "a1", { content: "typed", sentAt: 1_000, peerMeta: full });
+        await s.append(S, "a1", { content: "plain", sentAt: 1_001 });
+        await s.append(S, "a1", { content: "empty-meta", sentAt: 1_002, peerMeta: {} });
+        const lease = await s.claimLease(S, "a1", "w1", 60_000, 10_000);
+        assert.deepEqual(lease.messages.map((m) => m.content), ["typed", "plain", "empty-meta"]);
+        assert.deepEqual(lease.messages[0].peerMeta, full, "六字段逐字节回读");
+        assert.equal("peerMeta" in lease.messages[1], false, "未带 peerMeta 的记录回读时该键必须缺席(不是 undefined 值)");
+        assert.deepEqual(lease.messages[2].peerMeta, {}, "空对象=在场但无字段,与缺席区分");
+    });
+    run("peerMeta 坏值响亮:garbage 以具名码拒 append,且零副作用(不入箱、不耗 seq、不动租约)", async (make) => {
+        const s = make();
+        const seqBefore = await s.append(S, "a1", { content: "anchor", sentAt: 1_000 });
+        const held = await s.claimLease(S, "a1", "holder", 60_000, 10_000);
+        assert.equal(held?.messages.length, 1);
+        const codeOf = (e) => e?.code;
+        class Meta {
+            fromSession = "s";
+        }
+        const hiddenKey = { fromSession: "s" };
+        Object.defineProperty(hiddenKey, "bogus", { value: 1, enumerable: false });
+        for (const [label, bad] of [
+            ["fromMode 集外值", { fromMode: "root" }],
+            ["kind 集外值", { kind: "gossip" }],
+            ["未知键", { fromSession: "s", bogus: 1 }],
+            ["空字符串", { senderKey: "" }],
+            ["非字符串", { gateReceiptId: 7 }],
+            ["数组", ["fromSession"]],
+            ["null", null],
+            ["字符串", "fromSession=x"],
+            ["Date", new Date(0)],
+            ["Map", new Map()],
+            ["class 实例", new Meta()],
+            ["symbol 键", { fromSession: "s", [Symbol("hidden")]: 1 }],
+            ["不可枚举的未知键", hiddenKey],
+        ]) {
+            let thrown;
+            try {
+                await s.append(S, "a1", { content: `bad:${label}`, sentAt: 2_000, peerMeta: bad });
+            }
+            catch (e) {
+                thrown = e;
+            }
+            assert.notEqual(thrown, undefined, `${label}:必须拒`);
+            assert.equal(codeOf(thrown), MAILBOX_INVALID_PEER_META_CODE, `${label}:拒必须带码`);
+        }
+        assert.equal(await s.peekCount(S, "a1"), 1, "被拒的 append 不得入箱");
+        assert.equal(await s.claimLease(S, "a1", "rival", 60_000, 11_000), null, "被拒的 append 不得动活租约");
+        await s.ack(S, "a1", "holder", held.maxSeq);
+        assert.equal(await s.append(S, "a1", { content: "next", sentAt: 3_000 }), seqBefore + 1, "被拒的 append 不得消耗 seq");
+    });
+    run("peerMeta 不串引用:消费者改写租约批里的 peerMeta,不得改到下次投递的记录", async (make) => {
+        const s = make();
+        await s.append(S, "a1", { content: "m1", sentAt: 1_000, peerMeta: { fromMode: "bypass", fromSession: "sess_1" } });
+        const first = await s.claimLease(S, "a1", "w1", 1_000, 10_000);
+        first.messages[0].peerMeta.fromSession = "forged";
+        await s.releaseLease(S, "a1", "w1");
+        const again = await s.claimLease(S, "a1", "w2", 1_000, 20_000);
+        assert.deepEqual(again.messages[0].peerMeta, { fromMode: "bypass", fromSession: "sess_1" }, "重投的记录必须是原样");
+    });
     await settle();
 }
 export async function mailboxAckOwnershipContract(mk, runAssertion) {
@@ -192,6 +261,93 @@ export async function mailboxBundledOnlyContract(mk, runAssertion) {
     });
     await settle();
 }
+export async function mailboxCrossProcessContract(hooks) {
+    const { run: runRaw, settle } = beginContract(hooks.runAssertion);
+    const run = (name, fn) => runRaw(name, async () => {
+        const pair = await hooks.openPair();
+        try {
+            await fn(pair.local, pair.peer);
+        }
+        finally {
+            await pair.dispose();
+        }
+    });
+    const S = MAILBOX_CONTRACT_SCOPE;
+    const H = "session.shared";
+    const range = (n) => Array.from({ length: n }, (_, i) => i + 1);
+    run("跨进程 seq 单铸:两个进程交错 append N+N ⇒ seq 恰为 1..2N(无重复无空洞),每条消息在任一方视角都可见", async (local, peer) => {
+        const N = 40;
+        const seqs = [];
+        for (let i = 0; i < N; i++) {
+            const [a, b] = await Promise.all([local.append(S, H, msg(`local-${i}`, 1_000 + i)), peer.append(S, H, msg(`peer-${i}`, 2_000 + i))]);
+            seqs.push(a, b);
+        }
+        assert.deepEqual([...seqs].sort((x, y) => x - y), range(2 * N), "两方拿到的回执合起来必须恰是 1..2N");
+        assert.equal(await peer.peekCount(S, H), 2 * N, "对方进程的观察面必须看到本方的 append");
+        assert.equal(await local.peekCount(S, H), 2 * N);
+        const lease = await local.claimLease(S, H, "cycle-1", 60_000, 10_000);
+        assert.deepEqual(lease.messages.map((m) => m.seq), range(2 * N), "本方 claim 必须按 seq 序取到全部 2N 条");
+        assert.equal(lease.maxSeq, 2 * N);
+        const contents = new Set(lease.messages.map((m) => m.content));
+        for (let i = 0; i < N; i++) {
+            assert.ok(contents.has(`local-${i}`), `local-${i} 不得丢`);
+            assert.ok(contents.has(`peer-${i}`), `peer-${i} 不得丢`);
+        }
+    });
+    run("lease/ack 不跨进程交叉:一方的活租约 fence 住另一方的 claim;非持有方的 ack 是 no-op;持有方的 ack 对另一方立即可见;高水位跨对方的 ack 存活", async (local, peer) => {
+        await local.append(S, H, msg("m1", 1));
+        await peer.append(S, H, msg("m2", 2));
+        const held = await peer.claimLease(S, H, "cycle-peer", 60_000, 10_000);
+        assert.deepEqual(held.messages.map((m) => m.seq), [1, 2]);
+        assert.equal(await local.claimLease(S, H, "cycle-local", 60_000, 11_000), null, "对方进程的活租约必须 fence 住本方");
+        await local.ack(S, H, "cycle-local", held.maxSeq);
+        assert.equal(await peer.peekCount(S, H), 2, "非持有方的 ack 不得动持有方手上的批");
+        await peer.ack(S, H, "cycle-peer", held.maxSeq);
+        assert.equal(await local.peekCount(S, H), 0, "持有方的 ack 必须被本方看见");
+        assert.equal(await local.claimLease(S, H, "cycle-local", 60_000, 12_000), null);
+        assert.equal(await local.append(S, H, msg("m3", 3)), 3, "seq 高水位必须跨对方进程的 ack 存活(永不复用)");
+        await peer.append(S, H, msg("m4", 4));
+        const held2 = await peer.claimLease(S, H, "cycle-peer-2", 1_000, 20_000);
+        assert.deepEqual(held2.messages.map((m) => m.seq), [3, 4]);
+        const takeover = await local.claimLease(S, H, "cycle-local-2", 60_000, 30_000);
+        assert.deepEqual(takeover.messages.map((m) => m.seq), [3, 4], "过期租约的接管跨进程成立,seq 原样");
+    });
+    run("一方的 housekeeping 不丢另一方的 append:两进程各自反复压缩/重写期间交错写入 120 条,任一方视角都完整", async (local, peer) => {
+        const N = 60;
+        for (let i = 0; i < N; i++) {
+            await Promise.all([local.append(S, H, msg(`L${i}`, 1_000 + i)), peer.append(S, H, msg(`P${i}`, 2_000 + i))]);
+        }
+        const fromPeer = await peer.claimLease(S, H, "cycle-peer", 60_000, 10_000);
+        assert.deepEqual(fromPeer.messages.map((m) => m.seq), range(2 * N), "对方视角:seq 1..2N 全在");
+        await peer.releaseLease(S, H, "cycle-peer");
+        const fromLocal = await local.claimLease(S, H, "cycle-local", 60_000, 11_000);
+        assert.deepEqual(fromLocal.messages.map((m) => m.seq), range(2 * N), "本方视角:seq 1..2N 全在");
+        const contents = fromLocal.messages.map((m) => m.content).sort();
+        assert.deepEqual(contents, [...range(N).map((i) => `L${i - 1}`), ...range(N).map((i) => `P${i - 1}`)].sort());
+        await local.ack(S, H, "cycle-local", fromLocal.maxSeq);
+        assert.equal(await peer.peekCount(S, H), 0, "本方的 ack 对方可见");
+    });
+    run("reap 看得见对方进程的旧消息,哪怕本方缓存里这个箱是空的(已加载的空缓存不得替对方的旧消息说「没有」)", async (local, peer) => {
+        await local.append(S, H, msg("mine", 1_000));
+        const held = await local.claimLease(S, H, "cycle-local", 60_000, 1_000);
+        await local.ack(S, H, "cycle-local", held.maxSeq);
+        await peer.append(S, H, msg("old-from-peer", 2_000));
+        assert.equal(await local.reap(S, 100_000, { maxAgeMs: 50_000 }), 1, "对方写的过期消息必须被本方 reap 看见并老化");
+        assert.equal(await peer.peekCount(S, H), 0);
+        assert.equal(await peer.append(S, H, msg("after", 200_000)), 3, "高水位跨 reap 存活(对方视角)");
+    });
+    run("reap 与 drop 的 seq 语义跨进程:一方 reap 后另一方继续高水位;一方 drop 后另一方从 1 重铸", async (local, peer) => {
+        await peer.append(S, H, msg("old", 1_000));
+        assert.equal(await local.reap(S, 100_000, { maxAgeMs: 50_000 }), 1, "本方 reap 必须看见对方写的旧消息");
+        assert.equal(await peer.peekCount(S, H), 0);
+        assert.equal(await peer.append(S, H, msg("after-reap", 200_000)), 2, "reap 清箱但保高水位(RB-90 跨进程)");
+        await local.drop(S, H);
+        assert.equal(await peer.peekCount(S, H), 0, "本方 drop 对方可见");
+        assert.equal(await peer.append(S, H, msg("after-drop", 300_000)), 1, "drop 结束箱的一生:对方从 1 重铸");
+        assert.equal(await local.peekCount(S, H), 1);
+    });
+    await settle();
+}
 export async function mailboxTombstonedRecipientContract(mk, hooks) {
     const { run: runRaw, settle } = beginContract(hooks.runAssertion);
     const run = (name, fn) => runRaw(name, () => withStores(mk, fn));