@sema-agent/core 7.2.0 → 7.3.1

package/dist/core/arg-summary.js

@@ -25,10 +25,10 @@ function mapBackOnePass(edits, pos) {
     return pos - delta;
 }
 const PREEXISTING_MARKER_RE = /\[redacted(?:-[a-z]+)?\]/g;
-export function runRedactionPasses(input, passes, report) {
-    if (report !== undefined && report.preexistingMarkers === undefined) {
-        report.preexistingMarkers = input.match(PREEXISTING_MARKER_RE)?.length ?? 0;
-    }
+const FORMAT_CHAR_RE = /\p{Cf}/u;
+const MAX_FORMAT_SLOT_SCANS = 64;
+const REDACTED_WHOLE = "[redacted]";
+function applyPasses(input, passes, report, toOriginal) {
     const batches = [];
     let cur = input;
     for (const pass of passes) {
@@ -51,18 +51,149 @@ export function runRedactionPasses(input, passes, report) {
                     report.findings.push({
                         kind: pass.kind,
                         confidence: pass.confidence,
-                        span: [s0, e0],
+                        span: [toOriginal(s0), toOriginal(e0)],
                         marker: pass.marker,
                         source: pass.source,
                     });
                 }
-                edits.push({ at: offset, removedLen: match.length, insertedLen: inserted.length });
+                edits.push({ at: offset, removedLen: match.length, insertedLen: inserted.length, inserted });
             }
             return inserted;
         });
         batches.push(edits);
     }
-    return cur;
+    return { out: cur, batches };
+}
+function replacedSpans(batches) {
+    const spans = [];
+    for (let j = 0; j < batches.length; j++) {
+        for (const e of batches[j]) {
+            let s0 = e.at;
+            let e0 = e.at + e.removedLen;
+            for (let i = j - 1; i >= 0; i--) {
+                s0 = mapBackOnePass(batches[i], s0);
+                e0 = mapBackOnePass(batches[i], e0);
+            }
+            if (e0 - s0 !== e.removedLen)
+                return undefined;
+            spans.push({ start: s0, end: e0, inserted: e.inserted, pass: j });
+        }
+    }
+    spans.sort((a, b) => a.start - b.start);
+    for (let i = 1; i < spans.length; i++)
+        if (spans[i].start < spans[i - 1].end)
+            return undefined;
+    return spans;
+}
+export function runRedactionPasses(input, passes, report) {
+    if (report !== undefined && report.preexistingMarkers === undefined) {
+        report.preexistingMarkers = input.match(PREEXISTING_MARKER_RE)?.length ?? 0;
+    }
+    if (!FORMAT_CHAR_RE.test(input))
+        return applyPasses(input, passes, report, (pos) => pos).out;
+    const viewChars = [];
+    const viewToOriginal = [];
+    const formatAtSlot = [];
+    const charStartOffsets = [];
+    {
+        let orig = 0;
+        let viewOff = 0;
+        let slotBuf = "";
+        for (const ch of input) {
+            if (FORMAT_CHAR_RE.test(ch)) {
+                slotBuf += ch;
+            }
+            else {
+                formatAtSlot.push(slotBuf);
+                slotBuf = "";
+                viewToOriginal.push(orig);
+                charStartOffsets.push(viewOff);
+                viewChars.push(ch);
+                viewOff += ch.length;
+            }
+            orig += ch.length;
+        }
+        formatAtSlot.push(slotBuf);
+        viewToOriginal.push(input.length);
+        charStartOffsets.push(viewOff);
+    }
+    const view = viewChars.join("");
+    const offsetToCharIndex = new Map();
+    charStartOffsets.forEach((off, idx) => offsetToCharIndex.set(off, idx));
+    const toOriginal = (pos) => {
+        const idx = offsetToCharIndex.get(pos);
+        return idx === undefined ? input.length : viewToOriginal[idx];
+    };
+    const { out, batches } = applyPasses(view, passes, report, toOriginal);
+    const viewSpans = replacedSpans(batches);
+    if (viewSpans === undefined)
+        return out;
+    const spans = viewSpans.map((sp) => {
+        const startIdx = offsetToCharIndex.get(sp.start) ?? viewChars.length;
+        const endIdx = offsetToCharIndex.get(sp.end) ?? viewChars.length;
+        const lastIdx = endIdx - 1;
+        const endOrig = lastIdx >= startIdx && lastIdx < viewChars.length ? viewToOriginal[lastIdx] + viewChars[lastIdx].length : viewToOriginal[startIdx];
+        return { start: viewToOriginal[startIdx], end: endOrig, inserted: sp.inserted };
+    });
+    const viewOffsetToOriginal = (viewStart, viewEnd) => {
+        const startIdx = offsetToCharIndex.get(viewStart) ?? viewChars.length;
+        const endIdx = offsetToCharIndex.get(viewEnd) ?? viewChars.length;
+        const lastIdx = endIdx - 1;
+        const endOrig = lastIdx >= startIdx && lastIdx < viewChars.length ? viewToOriginal[lastIdx] + viewChars[lastIdx].length : viewToOriginal[startIdx];
+        return { start: viewToOriginal[startIdx], end: endOrig };
+    };
+    const cutOffsets = [];
+    for (let k = 1; k < viewChars.length; k++)
+        if (formatAtSlot[k] !== "")
+            cutOffsets.push(charStartOffsets[k]);
+    if (cutOffsets.length > MAX_FORMAT_SLOT_SCANS)
+        return REDACTED_WHOLE;
+    const extra = [];
+    const rawSpans = replacedSpans(applyPasses(input, passes, undefined, (pos) => pos).batches);
+    if (rawSpans !== undefined)
+        extra.push(...rawSpans);
+    for (const cut of cutOffsets) {
+        const cutSpans = replacedSpans(applyPasses(view.slice(cut), passes, undefined, (pos) => pos).batches);
+        if (cutSpans === undefined)
+            continue;
+        for (const c of cutSpans) {
+            const o = viewOffsetToOriginal(c.start + cut, c.end + cut);
+            extra.push({ start: o.start, end: o.end, inserted: c.inserted, pass: c.pass });
+        }
+    }
+    extra.sort((a, b) => a.start - b.start);
+    for (const r of extra) {
+        const overlapping = spans.find((v) => r.start < v.end && v.start < r.end);
+        if (overlapping !== undefined) {
+            if (r.start < overlapping.start)
+                overlapping.start = r.start;
+            if (r.end > overlapping.end)
+                overlapping.end = r.end;
+            continue;
+        }
+        spans.push({ start: r.start, end: r.end, inserted: r.inserted });
+        if (report !== undefined) {
+            const pass = passes[r.pass];
+            report.findings.push({ kind: pass.kind, confidence: pass.confidence, span: [r.start, r.end], marker: pass.marker, source: pass.source });
+        }
+        spans.sort((a, b) => a.start - b.start);
+    }
+    for (let i = 1; i < spans.length;) {
+        if (spans[i].start < spans[i - 1].end) {
+            spans[i - 1].end = Math.max(spans[i - 1].end, spans[i].end);
+            spans.splice(i, 1);
+        }
+        else
+            i++;
+    }
+    let result = "";
+    let cursor = 0;
+    for (const sp of spans) {
+        result += input.slice(cursor, sp.start) + sp.inserted;
+        cursor = sp.end;
+    }
+    result += input.slice(cursor);
+    return result;
 }
 export const SECRET_PASSES = [
     { kind: "prefixed-token", confidence: "high", marker: "[redacted]", source: "arg-summary", re: /(?<![A-Za-z0-9])(?:sk|pk|rk|gh[opsur])[-_][A-Za-z0-9_-]{8,}/g, replace: "[redacted]" },

package/dist/core/auto-mode-arming.d.ts

@@ -29,6 +29,14 @@ export interface AutoModeArmingRecipe {
     timeoutMs?: number;
     /** Consecutive-failure threshold opening the one-way breaker (floored, as the decider itself floors it). */
     failureThreshold?: number;
+    /**
+     * The cross-session lane's classifier rule was spliced into the assembled prompt (the lane was
+     * mounted on the arming leg). Part of the PROMPT BODY: the rebuild re-splices the same engine
+     * constant when the bit is set, so the recorded `promptDigest` is reproducible, and the fold treats
+     * the bit as body (a rebuild under a deployment whose own face does not declare it refuses as
+     * `settings_moved` — the two prompts differ by a rule block). Absent = the rule was not spliced.
+     */
+    crossSessionMessagesRule?: true;
     /**
      * A digest of the EXACT classifier system prompt this arming assembled (see
      * `rebuildAutoModeDecider`). The recipe records the deployment's OVERRIDES; the bulk of the criteria —
@@ -57,6 +65,9 @@ export interface AutoModeArmingFace {
     timeoutMs?: number;
     failureThreshold?: number;
     settingsEpoch?: string;
+    /** `true` when the cross-session lane's classifier rule is spliced into this deployment's classifier
+     *  prompt (the Runner sets it from its own lane mount; a redeeming host declares it from its). */
+    crossSessionMessagesRule?: boolean;
 }
 /**
  * Canonicalize + VALIDATE an arming recipe: the plain-data form that persists, or `undefined` when the

package/dist/core/auto-mode-arming.js

@@ -81,9 +81,13 @@ export function sanitizeAutoModeArmingRecipe(value) {
     const promptDigest = value.promptDigest;
     if (promptDigest !== undefined && (typeof promptDigest !== "string" || promptDigest === ""))
         return undefined;
+    const crossSessionMessagesRule = value.crossSessionMessagesRule;
+    if (crossSessionMessagesRule !== undefined && typeof crossSessionMessagesRule !== "boolean")
+        return undefined;
     return {
         v: AUTO_MODE_ARMING_RECIPE_VERSION,
         ...(promptDigest !== undefined ? { promptDigest } : {}),
+        ...(crossSessionMessagesRule === true ? { crossSessionMessagesRule: true } : {}),
         ...(rules !== undefined ? { rules } : {}),
         ...(settingsDenyRules !== undefined ? { settingsDenyRules } : {}),
         ...(sessionContext !== undefined ? { sessionContext } : {}),
@@ -104,6 +108,7 @@ export function autoModeArmingRecipeOf(face, bind) {
         ...(face.timeoutMs !== undefined ? { timeoutMs: face.timeoutMs } : {}),
         ...(face.failureThreshold !== undefined ? { failureThreshold: face.failureThreshold } : {}),
         ...(face.settingsEpoch !== undefined ? { settingsEpoch: face.settingsEpoch } : {}),
+        ...(face.crossSessionMessagesRule !== undefined ? { crossSessionMessagesRule: face.crossSessionMessagesRule } : {}),
     });
 }
 function sameArmingBody(a, b) {
@@ -116,6 +121,7 @@ function sameArmingBody(a, b) {
         r.sessionContext ?? null,
         r.window?.maxEntries ?? null,
         r.window?.maxCharsPerEntry ?? null,
+        r.crossSessionMessagesRule === true,
     ]);
     return body(a) === body(b);
 }
@@ -160,7 +166,7 @@ export function foldAutoModeArming(recorded, current) {
                 ok: false,
                 reason: "settings_moved",
                 message: "the auto-mode settings moved between the recorded arming and this deployment's current ones (rule sections / settings-deny rules / " +
-                    "session context / window bounds differ), and free-text rule sets have no sound stricter-than ordering — refusing to rebuild " +
+                    "session context / window bounds / the cross-session lane rule differ), and free-text rule sets have no sound stricter-than ordering — refusing to rebuild " +
                     "(the strictest decidable answer: the inherited ask flows the original chain to a human)",
             };
     }

package/dist/core/auto-mode-prompt.d.ts

@@ -22,6 +22,11 @@ export interface BuildAutoModePromptOptions {
     /** Extra session-context facts (e.g. the CC user-identity line) — appended as a
      *  `## Session Context` bullet block after the assembled document. */
     sessionContext?: readonly string[];
+    /** design/385 §4.5 — the text spliced into the `<cross_session_messages_rule>` slot. Absent (the
+     *  default, and every deployment without the cross-session lane) ⇒ the slot is blanked exactly as
+     *  before; the lane mount passes `CROSS_SESSION_CLASSIFIER_RULE`. Callback form at the splice (the
+     *  text may carry `$`). */
+    crossSessionMessagesRule?: string;
 }
 /**
  * Assemble the classifier SYSTEM prompt (CC `KRg`, content-equivalent single string — CC splits the

package/dist/core/auto-mode-prompt.js

@@ -34,7 +34,8 @@ const PAIRED_SECTIONS = [
     ["environment", /<user_environment_to_replace>([\s\S]*?)<\/user_environment_to_replace>/],
 ];
 export function buildAutoModePrompt(options) {
-    let out = AUTO_MODE_BASE_PROMPT.replace("<permissions_template>", () => AUTO_MODE_PERMISSIONS_EXTERNAL).replace("<cross_session_messages_rule>", () => "");
+    const crossSessionRule = options?.crossSessionMessagesRule ?? "";
+    let out = AUTO_MODE_BASE_PROMPT.replace("<permissions_template>", () => AUTO_MODE_PERMISSIONS_EXTERNAL).replace("<cross_session_messages_rule>", () => crossSessionRule);
     for (const [key, re] of PAIRED_SECTIONS) {
         out = out.replace(re, (_m, inner) => mergeRuleSection(options?.rules?.[key], inner));
     }

package/dist/core/auto-mode-rebuild.d.ts

@@ -58,7 +58,8 @@ export type AutoModeRebuildResult = {
  * Rebuild a decider with a PARKED ancestor's criteria from its recorded recipe plus a fresh model leg.
  *
  * What is reproduced: the assembled system prompt (`buildAutoModePrompt` over the recorded rule
- * overrides / settings-deny rules / session context), the transcript-window bounds, the round-trip
+ * overrides / settings-deny rules / session context, plus the engine's cross-session lane rule when
+ * the recipe says the arming leg spliced it), the transcript-window bounds, the round-trip
  * timeout and the breaker threshold — i.e. every input the ancestor's own `createAutoModeDecider` call
  * had except the model leg and the alarm closure.
  *

package/dist/core/auto-mode-rebuild.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { createAutoModeDecider } from "./auto-mode.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "./auto-mode-prompt.js";
 import { foldAutoModeArming, } from "./auto-mode-arming.js";
+import { CROSS_SESSION_CLASSIFIER_RULE } from "../agents/cross-session-envelope.js";
 export function rebuildAutoModeDecider(opts) {
     const folded = foldAutoModeArming(opts.recorded, opts.current);
     if (!folded.ok)
@@ -11,6 +12,7 @@ export function rebuildAutoModeDecider(opts) {
         ...(effective.rules !== undefined ? { rules: effective.rules } : {}),
         ...(effective.settingsDenyRules !== undefined ? { settingsDenyRules: effective.settingsDenyRules } : {}),
         ...(effective.sessionContext !== undefined ? { sessionContext: effective.sessionContext } : {}),
+        ...(effective.crossSessionMessagesRule === true ? { crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : {}),
     };
     const systemPrompt = buildAutoModePrompt(promptOptions);
     const assembledDigest = `apv1:${createHash("sha256").update(systemPrompt).digest("hex")}`;

package/dist/core/checkpoint-store.d.ts

@@ -1065,6 +1065,20 @@ export interface CheckpointState {
             rules: SessionPermissionRules;
         }>;
         shellGate?: "off" | "always" | "classify";
+        /** The chain's AUTO-MODE INTENT at suspend (data half, same law as `shellGate`): `true` when the
+         *  suspended leg was an auto-mode task — its own seat, the bit its live chain carried, or the bit
+         *  an earlier suspend of the same chain recorded (carried forward across a re-suspend). A resume
+         *  leg reads it as one more INTENT source beside the re-supplied seat and the waking chain, so a
+         *  redemption in another process (no seat re-passed, no live chain) still arms exactly as the
+         *  suspend leg did. It is a MEMORY of intent, never an authorization: the resuming deployment's
+         *  face (`RunnerDeps.autoMode`) and the resuming principal's deny bit (`RuntimeCaps.autoMode`)
+         *  are judged afresh on every leg — a bit on the row cannot arm where the redeeming deployment
+         *  would not. Follows the classifier's latch: a leg armed here writes it only while its own breaker
+         *  is untripped and untouched (a session that fell back to non-auto hands nothing forward); a leg
+         *  never armed here carries the memory as is. Absent on older checkpoints and on non-auto tasks
+         *  (byte-identical to the pre-bit row); an older worker that ignores it resumes un-armed, the
+         *  narrower direction. */
+        autoModeRequested?: true;
         /** Org-memory admission freeze (ruled 2026-08-05): the chain's admitted org-scope set at
          *  suspend (data half, plain strings). The resume leg folds it seed ∩ live (tighten-only) and
          *  re-runs admission under it — a resume must never widen the delegation freeze. Absent on

package/dist/core/checkpoint-store.js

@@ -2,7 +2,8 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
-import { renderUntrustedCommandText } from "./permission-rule-model.js";
+import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
+import { redactSecrets } from "./untrusted-egress.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 export function mintCheckpointToken() {
     return randomBytes(16).toString("hex");
@@ -124,7 +125,7 @@ export function buildRiskDescriptor(input) {
         if (shell || toolName === "Bash") {
             const cmd = isPlainRecord(args) ? safeDataValue(args, "command") : undefined;
             if (typeof cmd === "string" && cmd.length > 0)
-                summary = renderUntrustedCommandText(cmd, SUMMARY_CMD_MAX);
+                summary = renderUntrustedCommandText(redactSecrets(stripFormatCharacters(cmd)), SUMMARY_CMD_MAX);
             const bg = isPlainRecord(args) ? safeDataValue(args, "run_in_background") : undefined;
             if (bg === true)
                 summary = `[background persistent process — no per-step recheck] ${summary ?? ""}`.trimEnd();
@@ -139,7 +140,7 @@ export function buildRiskDescriptor(input) {
                     if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
                         const encDigest = (s) => s.replace(/%/g, "%25").replace(/=/g, "%3D").replace(/ /g, "%20");
                         const k = encDigest(renderUntrustedCommandText(key, 40));
-                        const val = encDigest(renderUntrustedCommandText(String(v), SUMMARY_VALUE_MAX));
+                        const val = encDigest(renderUntrustedCommandText(redactSecrets(stripFormatCharacters(String(v))), SUMMARY_VALUE_MAX));
                         parts.push(`${k}=${val}`);
                     }
                 }

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.durable_gate_unavailable", "config.peer_lane_unmounted", "peer.inbound_disposition", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -101,6 +101,9 @@ export const ENGINE_NOTICE_CODES = [
     "config.tool_model_gate_removed",
     "config.tool_model_gate_unknown_class",
     "config.tool_model_gate_env_invalid",
+    "config.durable_gate_unavailable",
+    "config.peer_lane_unmounted",
+    "peer.inbound_disposition",
     "delegation.transcript_integrity",
     "mcp.revocation_probe_failed",
     "workflow.governance_key_stripped",
@@ -143,6 +146,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "steering.parked_input_blocked": "user",
     "task.halt_unconsumed": "user",
     "task.late_approval": "user",
+    "config.durable_gate_unavailable": "user",
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
     "memory.consolidation_withheld": "user",
@@ -154,6 +158,8 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.tool_model_gate_removed": "operator",
     "config.tool_model_gate_unknown_class": "operator",
     "config.tool_model_gate_env_invalid": "operator",
+    "config.peer_lane_unmounted": "operator",
+    "peer.inbound_disposition": "user",
     "delegation.transcript_integrity": "operator",
     "mcp.revocation_probe_failed": "operator",
     "workflow.governance_key_stripped": "operator",

package/dist/core/mailbox-store.d.ts

@@ -12,7 +12,54 @@ export interface MailboxMessage {
      *  has other writers): such records deliver with an empty chain and are never retro-admitted —
      *  cross-engine records sit outside the guard's promise domain by ruling. */
     hopChain?: string[];
+    /** design/385 — typed peer metadata the drain point's authoritative judgments read (from-mode parity,
+     *  reply routing, admission sender key, record kind, the cross-principal trust anchors). Typed side
+     *  channel, never model-facing text — encoding it into `content` would let text reach authority.
+     *  ABSENT = a pre-385 or foreign record (same semantics as an absent `hopChain`): the drain treats it
+     *  as foreign, never retro-admits it. Validated at `append` ({@link readMailboxPeerMeta}). */
+    peerMeta?: MailboxPeerMeta;
 }
+/** design/385 — the typed peer-metadata record on a parked message. ONE optional object, one-time
+ *  contract extension; every field optional. Bundled backends persist it verbatim and hand back a
+ *  detached copy. */
+export interface MailboxPeerMeta {
+    /** The sending session's id (reply routing). */
+    fromSession?: string;
+    /** The sender's permission-mode class at send time — the drain judges parity against the RECEIVER. */
+    fromMode?: MailboxPeerFromMode;
+    /** The admission gate's sender key (rate/dedup axis). */
+    senderKey?: string;
+    /** Record kind: a peer message runs the parity judgment; notices bypass it and land on the notice face. */
+    kind?: MailboxPeerRecordKind;
+    /** Cross-principal delivery only — the SENDER's scope, the typed trust anchor for attribution. */
+    fromScope?: string;
+    /** Cross-principal delivery only — the delivery gate's receipt id (audit back-reference). */
+    gateReceiptId?: string;
+}
+export declare const MAILBOX_PEER_FROM_MODES: readonly ["bypass", "prompting"];
+export type MailboxPeerFromMode = (typeof MAILBOX_PEER_FROM_MODES)[number];
+export declare const MAILBOX_PEER_RECORD_KINDS: readonly ["peer_message", "idle_notice", "delivery_notice"];
+export type MailboxPeerRecordKind = (typeof MAILBOX_PEER_RECORD_KINDS)[number];
+/** The `append` refusal code for a malformed `peerMeta` (design/385): a garbage record is refused up
+ *  front with this code, never silently stripped or stored — a drain that reads a half-typed record
+ *  would judge on fabricated inputs. */
+export declare const MAILBOX_INVALID_PEER_META_CODE = "mailbox.invalid_peer_meta";
+/** The lane-mount refusal code: the cross-session lane asked for a backend that does not declare
+ *  cross-process safety ({@link mailboxCrossProcessMountVerdict}). */
+export declare const MAILBOX_CROSS_PROCESS_UNSAFE_CODE = "mailbox.cross_process_unsafe";
+/**
+ * Validate + detach an appended `peerMeta`. `undefined` ⇒ `undefined` (absent record). Anything else
+ * must be a plain object whose keys are all known, whose present values are non-empty strings, with
+ * `fromMode`/`kind` drawn from their closed sets; an `undefined`-valued key counts as absent. Any other
+ * shape throws {@link MailboxStoreError} with {@link MAILBOX_INVALID_PEER_META_CODE} — every bundled
+ * backend calls this BEFORE touching storage, so a refused append has zero side effects. Unknown keys
+ * are refused on purpose: the object is the contract's one typed slot, and a key nobody declared is
+ * either a typo or a newer schema this engine cannot judge on — both are loud, not silent.
+ */
+export declare function readMailboxPeerMeta(raw: unknown): MailboxPeerMeta | undefined;
+/** A detached copy of a persisted record's `peerMeta` (absent stays absent) — the read-side twin of
+ *  {@link readMailboxPeerMeta}, so a lease consumer's mutation never reaches the stored record. */
+export declare function cloneMailboxPeerMeta(meta: MailboxPeerMeta | undefined): MailboxPeerMeta | undefined;
 /** The enqueue refusal code of the pre-delete clause (see {@link MailboxStore} and
  *  {@link MailboxStoreError}) — the ONE place it is spelled, so an out-of-repo store twin imports it
  *  instead of value-copying the string (same posture as `STALE_RUNNING_REAP_ATTRIBUTION`: a shared
@@ -31,9 +78,10 @@ export declare const MAILBOX_TOMBSTONED_RECIPIENT_CODE = "mailbox.recipient_tomb
  * A backend may raise the same code with a plain `Error` carrying `.code`; consumers branch on the
  * string, not on this class (a cross-process/out-of-repo store cannot hand back an instance).
  */
+export type MailboxStoreErrorCode = typeof MAILBOX_TOMBSTONED_RECIPIENT_CODE | typeof MAILBOX_INVALID_PEER_META_CODE | typeof MAILBOX_CROSS_PROCESS_UNSAFE_CODE;
 export declare class MailboxStoreError extends Error {
-    readonly code: typeof MAILBOX_TOMBSTONED_RECIPIENT_CODE;
-    constructor(code: typeof MAILBOX_TOMBSTONED_RECIPIENT_CODE, message: string);
+    readonly code: MailboxStoreErrorCode;
+    constructor(code: MailboxStoreErrorCode, message: string);
 }
 /** A leased batch: the messages a claim winner owns for delivery, plus the ack cursor. */
 export interface MailboxLease {
@@ -49,6 +97,8 @@ export interface MailboxAppendMessage {
     sentAt: number;
     /** design/176 — see {@link MailboxMessage.hopChain}. */
     hopChain?: string[];
+    /** design/385 — see {@link MailboxMessage.peerMeta}; validated by {@link readMailboxPeerMeta}. */
+    peerMeta?: MailboxPeerMeta;
 }
 /**
  * The pluggable mailbox seam (design/151 §7.1). Contract notes for implementations (file/pg):
@@ -92,8 +142,25 @@ export interface MailboxAppendMessage {
  *   lifecycle (the two bundled ones, the CC inbox adapter) has nothing to refuse and keeps accepting
  *   — the clause fixes the SPELLING of the refusal, so a deployment reads one code instead of a
  *   per-backend dialect. Acceptance kit: `mailboxTombstonedRecipientContract`.
+ * - PEER METADATA (design/385, additive): `append` takes an optional typed `peerMeta`; a backend
+ *   persists it and hands it back on `claimLease` byte-for-byte (a detached copy), absent stays absent,
+ *   and a malformed value is REFUSED with `"mailbox.invalid_peer_meta"` before any side effect
+ *   (`readMailboxPeerMeta` is the one validator; bundled backends call it first). T1 cases in
+ *   `mailboxStoreContract` cover the round trip, the refusal and the aliasing.
+ * - CROSS-PROCESS SAFETY (design/385, optional capability declared on the store): the session-box
+ *   drain shares ONE box between several OS processes. A backend that is correct under that sharing —
+ *   seq minted once across processes, lease/ack never crossing, one process's housekeeping never
+ *   discarding another's durable append — declares `crossProcessSafe: true` AFTER passing
+ *   `mailboxCrossProcessContract` (the T2 kit that pins the whole set, not "has a lock"). A backend
+ *   that does not declare it is refused by the lane at mount time with a named reason
+ *   ({@link mailboxCrossProcessMountVerdict}) — never silently mounted on luck.
  */
 export interface MailboxStore {
+    /** design/385 — cross-process safety declaration (see the interface notes). `true` = this backend
+     *  passed `mailboxCrossProcessContract` over real OS processes; `false` = deliberately process-local
+     *  (the in-memory reference); absent = undeclared (the CC inbox adapter). Read by
+     *  {@link mailboxCrossProcessMountVerdict}; any other value is a malformed declaration and refuses. */
+    readonly crossProcessSafe?: boolean;
     /** Durably park one message. Refuses `"mailbox.recipient_tombstoned"` when the backend can see
      *  that its recipient is in the deployment's pre-delete state (see the interface notes above). */
     append(scope: string, handle: string, msg: MailboxAppendMessage): Promise<number>;
@@ -110,6 +177,21 @@ export interface MailboxStore {
         maxAgeMs?: number;
     }): Promise<number>;
 }
+/** The lane-mount verdict on a backend's cross-process declaration. */
+export type MailboxCrossProcessVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    code: typeof MAILBOX_CROSS_PROCESS_UNSAFE_CODE;
+    reason: string;
+};
+/**
+ * design/385 — may the cross-session lane (several OS processes draining one session box) mount over
+ * this backend? `ok` only for an explicit `crossProcessSafe: true`. Every other shape refuses with a
+ * named reason so the host can print it: absent (undeclared), `false` (process-local by design), or a
+ * value of the wrong type (a malformed declaration is refused, not read as "probably fine").
+ */
+export declare function mailboxCrossProcessMountVerdict(store: MailboxStore): MailboxCrossProcessVerdict;
 /** RB-250② (2026-07-28) class fix — the box age for `reap` is the MAX `sentAt`, not the
  *  last array element: `sentAt` is caller-supplied, so append order need not be time order, and taking
  *  the tail let a box whose freshest message was mid-array be swept — both bundled backends discarded
@@ -118,12 +200,17 @@ export interface MailboxStore {
  *  adapter's documented posture — treating it as very old would let a malformed row delete a live
  *  box). Module-level export only; NOT re-exported from src/index.ts. */
 export declare function newestSentAt(messages: readonly MailboxMessage[]): number | undefined;
+/** A lease-facing copy of a stored record: every mutable member (hopChain, peerMeta) detached, so a
+ *  consumer's mutation can never reach the record a redelivery serves. Shared by the bundled backends. */
+export declare function detachMailboxMessage(m: MailboxMessage): MailboxMessage;
 /**
  * In-process reference implementation (single-instance / tests). Same posture as
  * {@link import("./background-agent-store.js").InMemoryBackgroundAgentStore}: not default-mounted,
  * detached copies at both boundaries, single-event-loop atomicity.
  */
 export declare class InMemoryMailboxStore implements MailboxStore {
+    /** Process-local by construction (a Map): never a cross-process box, said so explicitly. */
+    readonly crossProcessSafe = false;
     private boxes;
     private key;
     private box;

package/dist/core/mailbox-store.js

@@ -1,4 +1,52 @@
 import { assertRetentionPolicy } from "./retention-policy.js";
+export const MAILBOX_PEER_FROM_MODES = ["bypass", "prompting"];
+export const MAILBOX_PEER_RECORD_KINDS = ["peer_message", "idle_notice", "delivery_notice"];
+export const MAILBOX_INVALID_PEER_META_CODE = "mailbox.invalid_peer_meta";
+export const MAILBOX_CROSS_PROCESS_UNSAFE_CODE = "mailbox.cross_process_unsafe";
+const PEER_META_STRING_KEYS = ["fromSession", "senderKey", "fromScope", "gateReceiptId"];
+export function readMailboxPeerMeta(raw) {
+    if (raw === undefined)
+        return undefined;
+    const refuse = (why) => {
+        throw new MailboxStoreError(MAILBOX_INVALID_PEER_META_CODE, `MailboxStore.append: peerMeta ${why}`);
+    };
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return refuse("must be a plain object");
+    const proto = Object.getPrototypeOf(raw);
+    if (proto !== Object.prototype && proto !== null)
+        return refuse("must be a plain object (a class instance, Date, Map or similar is not)");
+    const out = {};
+    for (const key of Reflect.ownKeys(raw)) {
+        if (typeof key !== "string")
+            return refuse("carries a symbol-keyed member");
+        const k = key;
+        const v = raw[k];
+        if (v === undefined)
+            continue;
+        if (k === "fromMode") {
+            if (!MAILBOX_PEER_FROM_MODES.includes(v))
+                return refuse(`fromMode must be one of ${MAILBOX_PEER_FROM_MODES.join("|")}`);
+            out.fromMode = v;
+        }
+        else if (k === "kind") {
+            if (!MAILBOX_PEER_RECORD_KINDS.includes(v))
+                return refuse(`kind must be one of ${MAILBOX_PEER_RECORD_KINDS.join("|")}`);
+            out.kind = v;
+        }
+        else if (PEER_META_STRING_KEYS.includes(k)) {
+            if (typeof v !== "string" || v === "")
+                return refuse(`${k} must be a non-empty string`);
+            out[k] = v;
+        }
+        else {
+            return refuse(`carries an unknown key ${JSON.stringify(k)}`);
+        }
+    }
+    return out;
+}
+export function cloneMailboxPeerMeta(meta) {
+    return meta === undefined ? undefined : { ...meta };
+}
 export const MAILBOX_TOMBSTONED_RECIPIENT_CODE = "mailbox.recipient_tombstoned";
 export class MailboxStoreError extends Error {
     code;
@@ -8,6 +56,17 @@ export class MailboxStoreError extends Error {
         this.name = "MailboxStoreError";
     }
 }
+export function mailboxCrossProcessMountVerdict(store) {
+    const declared = store.crossProcessSafe;
+    if (declared === true)
+        return { ok: true };
+    const reason = declared === undefined
+        ? "the mailbox backend does not declare cross-process safety (crossProcessSafe is absent): several terminal sessions would share one session box on luck"
+        : declared === false
+            ? "the mailbox backend declares crossProcessSafe: false (process-local by design): it cannot serve a session box shared across OS processes"
+            : `the mailbox backend's crossProcessSafe declaration is malformed (${typeof declared}, expected a boolean)`;
+    return { ok: false, code: MAILBOX_CROSS_PROCESS_UNSAFE_CODE, reason };
+}
 export function newestSentAt(messages) {
     let newest;
     for (const m of messages) {
@@ -18,7 +77,15 @@ export function newestSentAt(messages) {
     }
     return newest;
 }
+export function detachMailboxMessage(m) {
+    return {
+        ...m,
+        ...(m.hopChain !== undefined ? { hopChain: [...m.hopChain] } : {}),
+        ...(m.peerMeta !== undefined ? { peerMeta: cloneMailboxPeerMeta(m.peerMeta) } : {}),
+    };
+}
 export class InMemoryMailboxStore {
+    crossProcessSafe = false;
     boxes = new Map();
     key(scope, handle) {
         if (handle.includes("\u0000")) {
@@ -38,9 +105,17 @@ export class InMemoryMailboxStore {
     async append(scope, handle, msg) {
         if (scope === undefined || scope === "")
             throw new Error("MailboxStore.append: refusing a message without a scope");
+        const peerMeta = readMailboxPeerMeta(msg.peerMeta);
         const b = this.box(scope, handle);
         const seq = b.nextSeq++;
-        b.messages.push({ seq, ...(msg.from !== undefined ? { from: msg.from } : {}), content: msg.content, sentAt: msg.sentAt, ...(msg.hopChain !== undefined ? { hopChain: [...msg.hopChain] } : {}) });
+        b.messages.push({
+            seq,
+            ...(msg.from !== undefined ? { from: msg.from } : {}),
+            content: msg.content,
+            sentAt: msg.sentAt,
+            ...(msg.hopChain !== undefined ? { hopChain: [...msg.hopChain] } : {}),
+            ...(peerMeta !== undefined ? { peerMeta } : {}),
+        });
         return seq;
     }
     async claimLease(scope, handle, owner, ttlMs, now = Date.now()) {
@@ -51,7 +126,7 @@ export class InMemoryMailboxStore {
             return null;
         const maxSeq = b.messages[b.messages.length - 1].seq;
         b.lease = { owner, expiresAt: now + ttlMs, maxSeq };
-        return { messages: b.messages.map((m) => ({ ...m, ...(m.hopChain !== undefined ? { hopChain: [...m.hopChain] } : {}) })), maxSeq };
+        return { messages: b.messages.map((m) => detachMailboxMessage(m)), maxSeq };
     }
     async ack(scope, handle, owner, upToSeq) {
         const b = this.boxes.get(this.key(scope, handle));

package/dist/core/permission-rule-model.d.ts

@@ -331,6 +331,15 @@ export declare const SUGGESTION_LEXICON: readonly string[];
  * through, so an ordinary rule text reads normally. The result is length-bounded.
  */
 export declare function escapeForDisclosure(value: unknown): string;
+/**
+ * The zero-width half of {@link renderUntrustedCommandText} on its own: every `\p{Cf}` character
+ * REMOVED, nothing else touched. Exposed for a seat that must run a PATTERN pass (a secret scanner)
+ * before the display render — a credential the text splits with a format character is invisible to
+ * the scanner while it runs, and the render's own strip would then glue it back together in clear
+ * AFTER the scanner missed it. Strip first, scan, then render: the render's strip is idempotent over
+ * text this already stripped, so the final bytes are the same as a single render, minus the leak.
+ */
+export declare function stripFormatCharacters(text: string): string;
 /**
  * Render raw, untrusted COMMAND text for a display surface — the minimal safe baseline for the seats
  * that carry post-rewrite command bytes verbatim ({@link SegmentRuleSuggestion.segment} is the