@sema-agent/core 7.2.0 → 7.3.1

package/dist/core/wiring-manifest.d.ts

@@ -56,6 +56,28 @@ export type QuestionChannelState = "wired" | "absent" | "stripped_bg_lane";
 export type SeamProvenance = "spec" | "deps";
 /** Machine-readable reason codes for a park lane that is not (or not provably) effective. */
 export type ParkLaneReason = "no_checkpoint_store" | "no_durable_approval_opt_in" | "no_force_durable_gate" | "no_armed_safety_vocabulary" | "await_runtime_caps" | "await_tool_vocabulary";
+/**
+ * #529 — the closed set of auto-mode ARMING outcomes a leg's manifest reports
+ * ({@link WiringManifest.autoMode}). Minted from the arming predicate's own three-arm read, as the
+ * FIRST failing arm in predicate order:
+ *  - `no_intent`      — no `TaskSpec.autoModeRequested` seat and no intent inherited on the chain /
+ *                       recorded on the resumed checkpoint (a non-auto run; byte-identical arming).
+ *  - `no_face`        — intent, but no `RunnerDeps.autoMode` deployment face (the trust gate).
+ *  - `denied`         — intent + face, but the organization's deny bit (`RuntimeCaps.autoMode:false`)
+ *                       as the resolver STATED it.
+ *  - `resolver_fault` — intent + face, and the deny bit was COINED by a resolver fault (a throw, or a
+ *                       marshalled/non-record result the value screen refused) — an outage, not a
+ *                       verdict; the same fail-closed outcome as `denied`, named apart so a consumer
+ *                       can tell "policy said no" from "the entitlement source was unreachable".
+ *  - `armed`          — all three arms held; the classifier decider was minted for this leg.
+ *  - `latch_open`     — the session's one-way "back to non-auto" breaker has tripped. A leg-START
+ *                       manifest never carries it (a decider is minted fresh at prepare and its latch
+ *                       is closed by construction; a tripped ancestor hands no intent forward, which
+ *                       reads as `no_intent`); it is in the vocabulary so a consumer switching on the
+ *                       closed set is complete for a mid-leg re-read face, which nothing mints today.
+ */
+export declare const AUTO_MODE_ARM_REASONS: readonly ["armed", "no_intent", "no_face", "denied", "resolver_fault", "latch_open"];
+export type AutoModeArmReason = (typeof AUTO_MODE_ARM_REASONS)[number];
 /**
  * design/173 §2.2/§8.4 — the wiring manifest. Consumers MUST ignore unknown fields
  * (`schemaVersion` bumps only on a semantic break of an EXISTING field). The TaskEvent face is the
@@ -175,6 +197,34 @@ export interface WiringManifest {
         memoryAdmission: boolean;
         retention: boolean;
     };
+    /**
+     * EFFECTIVE half only, present iff the model gate trimmed a default-mounted tool from THIS run's
+     * roster: the per-session READ face of the same fact `config.tool_model_gate_removed` announces on
+     * the operator sink (one notice per sink, not per session — a client that needs "which default tools
+     * did MY session lose" reads it here). `class` = the gate class the table keyed the trim on, `removed`
+     * = the wire names not mounted, `restore` = the three valves in one sentence. Minted from the SAME
+     * gate decision the notice reads (one source, projected twice); absent = no trim on this run. A gate
+     * table with several classes trimming at once reports the FIRST class here and every removed name
+     * across classes in `removed` (the notice keeps its per-class lines).
+     */
+    modelGate?: {
+        class: string;
+        removed: readonly string[];
+        restore: string;
+    };
+    /**
+     * #529 — EFFECTIVE half only, and ALWAYS present on an engine-minted effective manifest (unlike
+     * `modelGate`, which is present only when a trim happened: auto mode has an answer on every leg,
+     * so absence here means an older mint or an external derivation, never "not applicable"). The
+     * per-leg READ face of the auto-mode arming decision: `armed` ⇔ `reason === "armed"` (the
+     * classifier decider was minted for this leg), and `reason` names the first arm that failed
+     * otherwise — see {@link AUTO_MODE_ARM_REASONS}. A serving layer that used to infer the mode from
+     * spec shape reads it here instead.
+     */
+    autoMode?: {
+        armed: boolean;
+        reason: AutoModeArmReason;
+    };
     /** EFFECTIVE half only — a short, non-sensitive fingerprint (sha256 prefix over the canonical
      *  JSON of this manifest's own resolved facts; every field here is an enum/boolean/count, no
      *  secrets) so an operator can correlate legs that ran under the same resolved assembly. */
@@ -231,6 +281,18 @@ export interface WiringFacts {
     complianceWired: boolean;
     memoryAdmissionWired: boolean;
     retentionPolicyWired: boolean;
+    /** Effective half only — see {@link WiringManifest.modelGate}; the static half has no roster to trim. */
+    modelGate?: {
+        class: string;
+        removed: readonly string[];
+        restore: string;
+    };
+    /** Effective half only — see {@link WiringManifest.autoMode}; the static half has no leg to arm.
+     *  `armed` must agree with `reason` (`armed ⇔ reason === "armed"`); a contradicting pair is refused. */
+    autoMode?: {
+        armed: boolean;
+        reason: AutoModeArmReason;
+    };
 }
 /** Named view of the deps seats the static half reads (a `Pick` of the real {@link RunnerDeps} —
  *  single-source shapes, no parallel hand-copied interface). */
@@ -292,11 +354,6 @@ export declare function resolveSubagentTranscriptTier(agentStoreWired: boolean,
  *    else the headless degrade `auto_deny`.
  */
 export declare function deriveAskEffective(form: AskSeamForm, parkEffective: boolean | "unresolved"): AskEffective;
-/**
- * design/173 §2.1 — the SINGLE derivation from facts to manifest, shared by both halves. The static
- * half omits `ask.effective`, `leg` and the fingerprint; the effective half carries all three. Any
- * second construction point for {@link WiringManifest} is a defect (single-mint rule).
- */
 export declare function deriveWiringManifest(facts: WiringFacts): WiringManifest;
 /** The one ask-seat resolution (`spec` wins over `deps`), shared with the effective half so the
  *  form/provenance read cannot fork. Junk values (a JS caller passing something outside the OnAsk

package/dist/core/wiring-manifest.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { canonicalize } from "./canonical-json.js";
 import { resolveCheckpointStore } from "./checkpoint-store.js";
 import { isLiveQuestionFace } from "./ask-question.js";
+export const AUTO_MODE_ARM_REASONS = ["armed", "no_intent", "no_face", "denied", "resolver_fault", "latch_open"];
 export function resolveDeclaredDurability(store, storeName) {
     const declared = store?.durability;
     if (declared === undefined)
@@ -66,6 +67,12 @@ function deriveParkLane(facts) {
         reasons.push("no_armed_safety_vocabulary");
     return { capable: true, effective: unresolved ? "unresolved" : false, reasons, ...durability };
 }
+function readAutoModeFact(fact) {
+    if (!AUTO_MODE_ARM_REASONS.includes(fact.reason) || fact.armed !== (fact.reason === "armed")) {
+        throw new Error(`the auto-mode wiring fact is inconsistent (armed=${String(fact.armed)}, reason=${JSON.stringify(fact.reason)}) — armed must hold exactly when reason is "armed", and reason must be one of ${AUTO_MODE_ARM_REASONS.join("|")}`);
+    }
+    return { armed: fact.armed, reason: fact.reason };
+}
 export function deriveWiringManifest(facts) {
     if (facts.half === "static" && facts.leg !== undefined) {
         throw new Error("a static wiring manifest has no leg — leg identity is an effective-half fact");
@@ -117,6 +124,8 @@ export function deriveWiringManifest(facts) {
             memoryAdmission: facts.memoryAdmissionWired,
             retention: facts.retentionPolicyWired,
         },
+        ...(facts.half === "effective" && facts.modelGate !== undefined ? { modelGate: { class: facts.modelGate.class, removed: [...facts.modelGate.removed], restore: facts.modelGate.restore } } : {}),
+        ...(facts.half === "effective" && facts.autoMode !== undefined ? { autoMode: readAutoModeFact(facts.autoMode) } : {}),
     };
     if (facts.half === "effective") {
         const { leg: _leg, ...assembly } = manifest;

package/dist/engine/harness/agent-harness.d.ts

@@ -203,6 +203,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     private stallTimeoutsPerCall?;
     private abortResultDetails?;
     private loopTrace?;
+    private onToolInputValidationFault?;
     private resilience?;
     private maxToolConcurrency?;
     private streamingToolExecution?;

package/dist/engine/harness/agent-harness.js

@@ -252,6 +252,7 @@ export class AgentHarness {
     stallTimeoutsPerCall;
     abortResultDetails;
     loopTrace;
+    onToolInputValidationFault;
     resilience;
     maxToolConcurrency;
     streamingToolExecution;
@@ -285,6 +286,7 @@ export class AgentHarness {
         this.stallTimeoutsPerCall = options.stallTimeoutsPerCall;
         this.abortResultDetails = options.abortResultDetails;
         this.loopTrace = options.loopTrace;
+        this.onToolInputValidationFault = options.onToolInputValidationFault;
         this.resilience = options.resilience;
         this.maxToolConcurrency = options.maxToolConcurrency;
         this.streamingToolExecution = options.streamingToolExecution;
@@ -577,6 +579,7 @@ export class AgentHarness {
             ...(this.maxOutputTokensPerCall !== undefined ? { maxTokensPerCall: this.maxOutputTokensPerCall } : {}),
             ...(this.stallTimeoutsPerCall !== undefined ? { stallTimeoutsPerCall: this.stallTimeoutsPerCall } : {}),
             ...(this.abortResultDetails !== undefined ? { abortResultDetails: this.abortResultDetails } : {}),
+            ...(this.onToolInputValidationFault !== undefined ? { onToolInputValidationFault: this.onToolInputValidationFault } : {}),
             ...(this.resilience !== undefined ? { resilience: this.resilience } : {}),
             ...(this.maxToolConcurrency !== undefined ? { maxToolConcurrency: this.maxToolConcurrency } : {}),
             ...(this.streamingToolExecution === true && (this.getHandlers("tool_call")?.size ?? 0) === 0

package/dist/engine/harness/types.d.ts

@@ -1367,6 +1367,9 @@ export interface AgentHarnessOptions<TSkill extends Skill = Skill, TPromptTempla
      * recoveries were invisible outside display:false nudge messages). Must not throw; hot path.
      */
     loopTrace?: (step: import("../loop/agent-loop.js").LoopStep) => void;
+    /** Loop-config pass-through — see `AgentLoopConfig.onToolInputValidationFault` (a throwing
+     *  `AgentTool.validateInput` is read as no verdict and disclosed here). */
+    onToolInputValidationFault?: import("../loop/types.js").AgentLoopConfig["onToolInputValidationFault"];
     /**
      * design/131 (拍): per-task resilience intent flags, forwarded to every provider
      * call (`StreamOptions.resilience`) so the deployment's decorator stack (degrading / failover /

package/dist/engine/loop/agent-loop.d.ts

@@ -103,3 +103,10 @@ export declare const ROSTER_LISTING_MAX = 25;
  * core/tool-errors.ts, same reason).
  */
 export declare const ROSTER_SEARCH_HINT_NAME = "ToolSearch";
+/** The structured `details.code` of a tool result minted by an input pre-validation refusal (lifted onto
+ *  the wire frame's `errorCode` like every other loop-minted code, e.g. `tool.not_found`). */
+export declare const TOOL_VALIDATION_REFUSED_CODE = "tool.validation_refused";
+/** How long an asynchronous `validateInput` may take to answer before it is read as "no verdict" (and
+ *  reported on the fault seat): a validator is a precondition read, not a network call, so a single
+ *  bound serves every tool; a deployment validator that needs longer is a validator doing too much. */
+export declare const TOOL_INPUT_VALIDATION_TIMEOUT_MS = 10000;

package/dist/engine/loop/agent-loop.js

@@ -1122,6 +1122,76 @@ function formatRosterRecovery(availableTools) {
         : "";
     return ` Available tools: ${listing}${hint}`;
 }
+export const TOOL_VALIDATION_REFUSED_CODE = "tool.validation_refused";
+export const TOOL_INPUT_VALIDATION_TIMEOUT_MS = 10_000;
+async function runInputValidation(tool, args, toolCallId, signal, onFault) {
+    if (tool.validateInput === undefined)
+        return undefined;
+    try {
+        const verdict = await boundedValidatorCall(() => tool.validateInput(args, signal !== undefined ? { toolCallId, signal } : { toolCallId }), signal);
+        if (verdict !== null && typeof verdict === "object" && verdict.ok === false && typeof verdict.message === "string") {
+            return typeof verdict.code === "string" ? { message: verdict.message, code: verdict.code } : { message: verdict.message };
+        }
+        return undefined;
+    }
+    catch (error) {
+        if (signal?.aborted === true)
+            return undefined;
+        try {
+            const ret = onFault?.({ toolName: tool.name, toolCallId, error });
+            if (ret !== null && typeof ret === "object" && typeof ret.then === "function") {
+                ret.then(undefined, () => undefined);
+            }
+        }
+        catch {
+        }
+        return undefined;
+    }
+}
+function boundedValidatorCall(call, signal) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            fn();
+        };
+        const onAbort = () => finish(() => reject(Object.assign(new Error("tool input pre-validation aborted"), { name: "AbortError" })));
+        const timer = setTimeout(() => finish(() => reject(new Error(`tool input pre-validation did not answer within ${TOOL_INPUT_VALIDATION_TIMEOUT_MS}ms`))), TOOL_INPUT_VALIDATION_TIMEOUT_MS);
+        if (signal?.aborted === true) {
+            onAbort();
+            return;
+        }
+        signal?.addEventListener("abort", onAbort, { once: true });
+        let out;
+        try {
+            out = call();
+        }
+        catch (err) {
+            finish(() => reject(err));
+            return;
+        }
+        Promise.resolve(out).then((v) => finish(() => resolve(v)), (err) => finish(() => reject(err)));
+    });
+}
+function sameToolArgs(a, b) {
+    if (a === b)
+        return true;
+    const canon = (v) => JSON.stringify(v, (_k, x) => (x !== null && typeof x === "object" && !Array.isArray(x) ? Object.fromEntries(Object.keys(x).sort().map((k) => [k, x[k]])) : x));
+    return canon(a) === canon(b);
+}
+function validationRefusedOutcome(tool, refusal) {
+    return {
+        kind: "immediate",
+        result: createErrorToolResult(refusal.message, {
+            details: { code: TOOL_VALIDATION_REFUSED_CODE, toolName: tool.name, ...(refusal.code !== undefined ? { reason: refusal.code } : {}) },
+        }),
+        isError: true,
+    };
+}
 async function prepareToolCall(currentContext, assistantMessage, toolCall, config, signal) {
     const tool = findToolByName(currentContext.tools, toolCall.name);
     if (!tool) {
@@ -1135,6 +1205,10 @@ async function prepareToolCall(currentContext, assistantMessage, toolCall, confi
     try {
         const preparedToolCall = prepareToolCallArguments(tool, toolCall);
         let finalArgs = validateToolArguments(tool, preparedToolCall);
+        const refusal = await runInputValidation(tool, finalArgs, toolCall.id, signal, config.onToolInputValidationFault);
+        if (refusal !== undefined)
+            return validationRefusedOutcome(tool, refusal);
+        const validatedArgs = finalArgs;
         if (config.beforeToolCall) {
             const beforeResult = await config.beforeToolCall({
                 assistantMessage,
@@ -1161,6 +1235,11 @@ async function prepareToolCall(currentContext, assistantMessage, toolCall, confi
                     ...preparedToolCall,
                     arguments: beforeResult.updatedInput,
                 });
+                if (!sameToolArgs(validatedArgs, finalArgs)) {
+                    const rewrittenRefusal = await runInputValidation(tool, finalArgs, toolCall.id, signal, config.onToolInputValidationFault);
+                    if (rewrittenRefusal !== undefined)
+                        return validationRefusedOutcome(tool, rewrittenRefusal);
+                }
             }
         }
         if (signal?.aborted) {

package/dist/engine/loop/types.d.ts

@@ -19,6 +19,26 @@ export type StreamFn = LlmStreamFn;
  *   while tool-result message artifacts are emitted later in assistant source order.
  */
 export type ToolExecutionMode = "sequential" | "parallel";
+/**
+ * The verdict a tool's INPUT PRE-VALIDATION returns (see {@link AgentTool.validateInput}). `ok: true`
+ * (or an `undefined` return) lets the call proceed to the gate; `ok: false` refuses it BEFORE any
+ * permission question is asked — `message` is the model-facing text (the same text the tool's own
+ * execution would have produced for the same input, so the refusal reads identically either way) and
+ * `code` an optional machine-readable reason that rides the error result's structured details.
+ */
+export type ToolInputVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+    code?: string;
+};
+/** The context an input pre-validation hook receives: the call's identity and its abort signal, and
+ *  nothing else — a validator reads state, it does not act on the run. */
+export interface ToolInputValidationContext {
+    toolCallId: string;
+    signal?: AbortSignal;
+}
 /**
  * Controls how many queued user messages are injected when the agent loop reaches a queue drain point.
  *
@@ -527,6 +547,16 @@ export interface AgentLoopConfig extends SimpleStreamOptions {
      * signal re-check, which has always minted its abort result with no details.
      */
     abortResultDetails?: () => Record<string, unknown> | undefined;
+    /**
+     * Fault seat for a THROWING {@link AgentTool.validateInput}: the loop reads the throw as "no
+     * verdict" (the call proceeds to the gate as if the tool had no validator) and reports the fault
+     * here so a host can disclose it. Must not throw; a throwing sink is swallowed.
+     */
+    onToolInputValidationFault?: (info: {
+        toolName: string;
+        toolCallId: string;
+        error: unknown;
+    }) => void;
     /**
      * Called after a tool finishes executing, before `tool_execution_end` and tool-result message events are emitted.
      *
@@ -684,6 +714,18 @@ export interface AgentTool<TParameters extends TSchema = TSchema, TDetails = unk
      *  (boundInputHash binds args, never the preview). NEVER adjudication input. Mechanism-neutral:
      *  any tool may declare one (run_workflow projects its script meta). */
     approvalPreview?: (args: unknown) => unknown;
+    /**
+     * OPTIONAL input pre-validation, run by the loop AFTER schema validation and BEFORE the tool-call
+     * gate (permission hooks, policy, the human/classifier ask). A refusal is returned to the model as a
+     * typed error result and no question is ever asked for the call — the point of the seat: a call the
+     * tool would refuse on its own precondition (a file edit whose target was never read this session)
+     * must not cost the operator an approval card it can only ever fail on. Pure by contract: reads
+     * state (read-tracking, path grammar), never acts. A THROWING validator is read as "no verdict"
+     * (the call proceeds to the gate; the fault is disclosed through the loop's fault seat) — a broken
+     * validator must not refuse tools. The tool's own execution keeps validating the same precondition
+     * (the two reads are not one atomic step, and direct `execute` callers skip this seat).
+     */
+    validateInput?: (args: Static<TParameters>, ctx: ToolInputValidationContext) => Promise<ToolInputVerdict | undefined> | ToolInputVerdict | undefined;
     /** Execute the tool call. Throw on failure instead of encoding errors in `content`. */
     execute: (toolCallId: string, params: Static<TParameters>, signal?: AbortSignal, onUpdate?: AgentToolUpdateCallback<TDetails>) => Promise<AgentToolResult<TDetails>>;
     /**

package/dist/index.d.ts

@@ -119,13 +119,13 @@ export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/f
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
-export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
+export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, type AutoModeArmReason, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
 export { type StoreFidelity } from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, type HumanInputSource, type HumanInputFrame, type HumanInputEvent, type HumanInputDelivery, } from "./core/human-input-projection.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, type SemaTaskType, type SemaTaskStatus, type SemaTaskHandle, type ParkedClaimTicket, type TaskAccess, type UnifiedTaskOutput, type TaskRetrievalStatus, type StopSource, type RegisterMonitorInput, type MonitorTimers, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
-export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, } from "./core/mailbox-store.js";
+export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease, MailboxStoreError, type MailboxStoreErrorCode, MAILBOX_TOMBSTONED_RECIPIENT_CODE, type MailboxAppendMessage, type MailboxPeerMeta, type MailboxPeerFromMode, type MailboxPeerRecordKind, MAILBOX_PEER_FROM_MODES, MAILBOX_PEER_RECORD_KINDS, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_CROSS_PROCESS_UNSAFE_CODE, readMailboxPeerMeta, mailboxCrossProcessMountVerdict, type MailboxCrossProcessVerdict, } from "./core/mailbox-store.js";
 export { FileMailboxStore, type FileMailboxStoreOptions } from "./stores/file/mailbox-store.js";
 export { createFileTaskListStore } from "./stores/file/task-list-store.js";
 export { createCcFileTaskListStore } from "./stores/cc/task-list-store.js";
@@ -166,7 +166,7 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { InMemorySessionRuleOverlay, type SessionRuleOverlay, type SessionRuleOverlayAdd, type SessionRuleOverlayApplyResult, } from "./core/permission-rule-session.js";
@@ -232,7 +232,7 @@ export { sessionRepoContract } from "./core/store-contracts/session-repo-contrac
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
 export { fileHistoryStoreContract } from "./core/store-contracts/file-history-store-contract.js";
 export { permissionRuleSyncContract, type PermissionRuleSyncContractHooks } from "./core/store-contracts/permission-rule-sync-contract.js";
-export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, type MailboxTombstonedRecipientContractHooks, } from "./core/store-contracts/mailbox-store-contract.js";
+export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, type MailboxTombstonedRecipientContractHooks, mailboxCrossProcessContract, type MailboxCrossProcessContractHooks, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
 export { type BackgroundAgentStore, type BackgroundAgentRecord, type BackgroundAgentRowSummary, type BackgroundAgentUsage, canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, type BackgroundAgentQuery, } from "./core/background-agent-store.js";
 export { serveDurableAgentRowLane, buildAgentPollDetails, type AgentPollDetailsInput, } from "./core/task-registry-agent.js";
@@ -255,6 +255,12 @@ export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerA
 export { CROSS_SESSION_MESSAGE_TAG, CROSS_SESSION_MESSAGE_NOTICE, PERMISSION_MODE_CLASSES, isPermissionModeClass, CrossSessionCodecError, PEER_HOP_TOKEN_HEX, PEER_HOP_CHAIN_CARRY_WINDOW, encodePeerAddress, isCanonicalPeerAddress, encodeScopeAttribute, decodeScopeAttribute, canonicalPeerDisplayName, buildCrossSessionEnvelope, parseCrossSessionEnvelope, clampHopChain, encodeCcPeerFrame, decodeCcPeerFrame, type PermissionModeClass, type CrossSessionEnvelopeFields, type CrossSessionEnvelopeParse, type CrossSessionEnvelopeRefusal, type CcPeerFrameFields, type CcPeerFrameParse, } from "./agents/cross-session-envelope.js";
 export { CROSS_SESSION_INBOUND_SETTINGS, isCrossSessionInboundSetting, resolveCrossSessionInboundSetting, CROSS_SESSION_HOLD_CAUSES, describeCrossSessionHoldCause, judgeCrossSessionInbound, foldPermissionModeClass, PEER_SEND_VERDICT_CODES, peerSendVerdictSeverity, type CrossSessionInboundSetting, type CrossSessionSettingSource, type CrossSessionInboundSettingLayers, type ResolvedCrossSessionInboundSetting, type CrossSessionHoldCause, type CrossSessionInboundVerdict, type CrossSessionInboundInput, type PeerSendVerdictCode, type PeerSendVerdict, } from "./agents/cross-session-judge.js";
 export { PEER_REF_MIN, PEER_REF_MAX, PEER_REF_RE, mintPeerRef, formatPeerNameRef, parsePeerNameRef, normalizePeerName, PEER_ADDRESS_PREFIXES, reservedPeerNameReason, type PeerRefEntry, } from "./agents/cross-session-ref.js";
+export { PEER_SESSION_RECORD_SCHEMA_VERSION, PEER_SESSION_RECORD_MAX_BYTES, SESSION_BOX_PREFIX, peerSessionBoxHandle, isPeerSessionId, PEER_SESSION_ID_GRAMMAR, parsePeerSessionAddress, readPeerSessionRecord, defaultPeerLivenessProbe, isPeerSessionProcessAlive, mintPeerSessionCandidates, resolvePeerSessions, createInMemoryPeerDirectory, vetPeerRegistryDirectory, judgePeerRecordFile, type PeerSessionRecord, type PeerSessionLiveness, type PeerSessionTempo, type PeerSessionRecordRefusal, type PeerSessionRecordRead, type PeerLivenessProbe, type PeerDirectory, type PeerDirectoryAccess, type PeerSessionCandidate, type PeerSessionResolution, type InMemoryPeerDirectory, type PeerRegistryDirectoryRefusal, type PeerRegistryDirectoryVerdict, } from "./agents/peer-directory.js";
+export { createListAgentsTool, LIST_AGENTS_TOOL_NAME, LIST_AGENTS_TOOL_ALIAS, LIST_AGENTS_MAX_RESULT_CHARS, type ListAgentsToolOptions, type ListAgentsRow } from "./agents/list-agents-tool.js";
+export { CROSS_SESSION_CLASSIFIER_RULE } from "./agents/cross-session-envelope.js";
+export { PEER_SESSION_ID_UNGRAMMATICAL_CODE, type PeerLaneMountVerdict } from "./agents/peer-session-drain.js";
+export { renderCrossSessionMessageFrame } from "./core/task-notification.js";
+export { type PeerAdmissionStage } from "./agents/peer-admission.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, type AgentTranscriptToolOptions, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";
 export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_USE, EXPLORE_WHEN_TO_USE_LEAN, PLAN_WHEN_TO_USE, EXPLORE_SYSTEM_PROMPT, PLAN_SYSTEM_PROMPT, } from "./agents/builtin-agents.js";
@@ -271,13 +277,14 @@ export { repairTextToolCalls } from "./brain/tool-call-repair.js";
 export { createCircuitBreakerBrain, type CircuitBreakerOptions, type BreakerState, type BreakerSnapshot, type BreakerPhase, CIRCUIT_OPEN_MARKER, } from "./brain/circuit-breaker.js";
 export { createDegradingBrain, readDegradation, DEGRADED_DIAGNOSTIC_TYPE, type DegradingBrainOptions, type DegradeReason, type DegradationInfo, } from "./brain/degrading.js";
 export { retryBackoffMs, parseRetryAfter } from "./brain/retry.js";
+export { WAITING_FIRST_TOKEN_AFTER_MS, WAITING_FIRST_TOKEN_EVERY_MS } from "./brain/stream-engine.js";
 export { adjudicateModelRoute, resolveRouteCredential, routeRefusalText, routePairingStatus, normalizeBaseUrl, hasAuthCarrier, type RoutePairingStatus, } from "./brain/route-adjudicator.js";
 export type { RouteAdjudication, RouteCredential, RouteCredentialSource, RoutePairingConfig, RoutePairingPosture, RouteRefusalCode, RouteRefusalDetail, } from "./internal/llm.js";
 export { ROUTE_ADJUDICATION_CONFORMANCE_CORPUS, type RouteAdjudicationVector } from "./brain/route-conformance.js";
 export { type BrainTimeoutConfig } from "./brain/timeout.js";
 export { createAssistantMessageEventStream } from "./internal/llm.js";
 export type { AssistantMessage, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, StopReason, StreamFn, TextContent, ThinkingContent, ToolCall, ToolResultMessage, Usage, UserMessage, } from "./internal/llm.js";
-export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, TrackFileEditHook, TrackEditRequest, TrackEditResult, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, ResumePreflightInfo, ResumePreflightVerdict, EngineNotice, RuntimeCaps, BackgroundChildEvent, DelegationLifecycleEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, EffectiveMemoryScopes, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ReversibilityVerdict, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
+export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, TrackFileEditHook, TrackEditRequest, TrackEditResult, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, ResumePreflightInfo, ResumePreflightVerdict, EngineNotice, RuntimeCaps, BackgroundChildEvent, DelegationLifecycleEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, EffectiveMemoryScopes, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolInputVerdict, ToolInputValidationContext, ReversibilityVerdict, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
 export { Type } from "typebox";
 export type { TSchema, Static } from "typebox";
 export { explainPromptAssembly, describeDefaultPack, type DefaultPackDescription, type ExplainInput } from "./prompt-assembly/explain.js";

package/dist/index.js

@@ -96,13 +96,13 @@ export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
-export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, } from "./core/wiring-manifest.js";
+export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, } from "./core/park-selfcheck.js";
 export {} from "./core/checkpoint-store.js";
 export {} from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, } from "./core/human-input-projection.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
-export { InMemoryMailboxStore, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, } from "./core/mailbox-store.js";
+export { InMemoryMailboxStore, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, MAILBOX_PEER_FROM_MODES, MAILBOX_PEER_RECORD_KINDS, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_CROSS_PROCESS_UNSAFE_CODE, readMailboxPeerMeta, mailboxCrossProcessMountVerdict, } from "./core/mailbox-store.js";
 export { FileMailboxStore } from "./stores/file/mailbox-store.js";
 export { createFileTaskListStore } from "./stores/file/task-list-store.js";
 export { createCcFileTaskListStore } from "./stores/cc/task-list-store.js";
@@ -126,7 +126,7 @@ export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/au
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { InMemorySessionRuleOverlay, } from "./core/permission-rule-session.js";
@@ -191,7 +191,7 @@ export { sessionRepoContract } from "./core/store-contracts/session-repo-contrac
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
 export { fileHistoryStoreContract } from "./core/store-contracts/file-history-store-contract.js";
 export { permissionRuleSyncContract } from "./core/store-contracts/permission-rule-sync-contract.js";
-export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, } from "./core/store-contracts/mailbox-store-contract.js";
+export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, mailboxCrossProcessContract, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
 export { canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, } from "./core/background-agent-store.js";
 export { serveDurableAgentRowLane, buildAgentPollDetails, } from "./core/task-registry-agent.js";
@@ -212,6 +212,12 @@ export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerA
 export { CROSS_SESSION_MESSAGE_TAG, CROSS_SESSION_MESSAGE_NOTICE, PERMISSION_MODE_CLASSES, isPermissionModeClass, CrossSessionCodecError, PEER_HOP_TOKEN_HEX, PEER_HOP_CHAIN_CARRY_WINDOW, encodePeerAddress, isCanonicalPeerAddress, encodeScopeAttribute, decodeScopeAttribute, canonicalPeerDisplayName, buildCrossSessionEnvelope, parseCrossSessionEnvelope, clampHopChain, encodeCcPeerFrame, decodeCcPeerFrame, } from "./agents/cross-session-envelope.js";
 export { CROSS_SESSION_INBOUND_SETTINGS, isCrossSessionInboundSetting, resolveCrossSessionInboundSetting, CROSS_SESSION_HOLD_CAUSES, describeCrossSessionHoldCause, judgeCrossSessionInbound, foldPermissionModeClass, PEER_SEND_VERDICT_CODES, peerSendVerdictSeverity, } from "./agents/cross-session-judge.js";
 export { PEER_REF_MIN, PEER_REF_MAX, PEER_REF_RE, mintPeerRef, formatPeerNameRef, parsePeerNameRef, normalizePeerName, PEER_ADDRESS_PREFIXES, reservedPeerNameReason, } from "./agents/cross-session-ref.js";
+export { PEER_SESSION_RECORD_SCHEMA_VERSION, PEER_SESSION_RECORD_MAX_BYTES, SESSION_BOX_PREFIX, peerSessionBoxHandle, isPeerSessionId, PEER_SESSION_ID_GRAMMAR, parsePeerSessionAddress, readPeerSessionRecord, defaultPeerLivenessProbe, isPeerSessionProcessAlive, mintPeerSessionCandidates, resolvePeerSessions, createInMemoryPeerDirectory, vetPeerRegistryDirectory, judgePeerRecordFile, } from "./agents/peer-directory.js";
+export { createListAgentsTool, LIST_AGENTS_TOOL_NAME, LIST_AGENTS_TOOL_ALIAS, LIST_AGENTS_MAX_RESULT_CHARS } from "./agents/list-agents-tool.js";
+export { CROSS_SESSION_CLASSIFIER_RULE } from "./agents/cross-session-envelope.js";
+export { PEER_SESSION_ID_UNGRAMMATICAL_CODE } from "./agents/peer-session-drain.js";
+export { renderCrossSessionMessageFrame } from "./core/task-notification.js";
+export {} from "./agents/peer-admission.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";
 export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_USE, EXPLORE_WHEN_TO_USE_LEAN, PLAN_WHEN_TO_USE, EXPLORE_SYSTEM_PROMPT, PLAN_SYSTEM_PROMPT, } from "./agents/builtin-agents.js";
@@ -228,6 +234,7 @@ export { repairTextToolCalls } from "./brain/tool-call-repair.js";
 export { createCircuitBreakerBrain, CIRCUIT_OPEN_MARKER, } from "./brain/circuit-breaker.js";
 export { createDegradingBrain, readDegradation, DEGRADED_DIAGNOSTIC_TYPE, } from "./brain/degrading.js";
 export { retryBackoffMs, parseRetryAfter } from "./brain/retry.js";
+export { WAITING_FIRST_TOKEN_AFTER_MS, WAITING_FIRST_TOKEN_EVERY_MS } from "./brain/stream-engine.js";
 export { adjudicateModelRoute, resolveRouteCredential, routeRefusalText, routePairingStatus, normalizeBaseUrl, hasAuthCarrier, } from "./brain/route-adjudicator.js";
 export { ROUTE_ADJUDICATION_CONFORMANCE_CORPUS } from "./brain/route-conformance.js";
 export {} from "./brain/timeout.js";

package/dist/internal/harness-types.d.ts

@@ -7,7 +7,7 @@
 export type { CompactionPreparation, SummarizationClampDryRun } from "../engine/compaction/compaction.js";
 export type { InvokedSkillRetention } from "../engine/compaction/utils.js";
 export type { AgentCoreRuntimeDeps } from "../engine/loop/runtime-deps.js";
-export type { AgentMessage, AgentTool, AgentToolResult, AgentToolUpdateCallback, ThinkingLevel, ToolExecutionMode, } from "../engine/loop/types.js";
+export type { AgentMessage, AgentTool, AgentToolResult, AgentToolUpdateCallback, ThinkingLevel, ToolExecutionMode, ToolInputValidationContext, ToolInputVerdict, } from "../engine/loop/types.js";
 export type { AgentHarnessEvent, CompactionSettings, ExecutionEnv, ExecutionErrorCode, FileError, FileErrorCode, FileInfo, Result, WriteExpectation, WriteReceipt, Session, SessionMetadata, SessionRepo, SessionStorage, SessionTreeEntry, Skill, } from "../engine/harness/types.js";
 export type { ExecutionEnvExecOptions, ExecResult } from "../engine/harness/types.js";
 export type { SessionWriteOptions, CompactionEntry } from "../engine/harness/types.js";

package/dist/stores/cc/mailbox-store.d.ts

@@ -1,4 +1,4 @@
-import type { MailboxStore } from "../../core/mailbox-store.js";
+import { type MailboxStore } from "../../core/mailbox-store.js";
 /** CC's path-component sanitize rule (README §一 Jeo/UJt): non-alphanumerics → "-", lowercased. */
 export declare function sanitizeCcAgentName(name: string): string;
 export interface CcFileMailboxStoreOptions {

package/dist/stores/cc/mailbox-store.js

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
+import { readMailboxPeerMeta } from "../../core/mailbox-store.js";
 import { atomicWriteFile, canonicalStoreKey } from "../file/fs-atomic.js";
 import { withCcLock } from "./lockfile.js";
 const INBOX_FILE_EXT = ".json";
@@ -94,6 +95,15 @@ export function createCcFileMailboxStore(opts) {
             note(path, `${dropped} malformed inbox entries skipped (first: ${firstReason})`);
         return kept;
     };
+    const readBackPeerMeta = (raw) => {
+        try {
+            const meta = readMailboxPeerMeta(raw);
+            return meta === undefined ? {} : { peerMeta: meta };
+        }
+        catch {
+            return {};
+        }
+    };
     const saveBox = (path, box) => {
         atomicWriteFile(inboxDir, path, JSON.stringify(box, null, 2));
     };
@@ -136,6 +146,7 @@ export function createCcFileMailboxStore(opts) {
     return {
         append: (scope, handle, msg) => {
             requireDefaultScope(scope);
+            const peerMeta = readMailboxPeerMeta(msg.peerMeta);
             mkdirSync(inboxDir, { recursive: true });
             const path = inboxPath(handle);
             const notes = deferredNotes();
@@ -150,6 +161,7 @@ export function createCcFileMailboxStore(opts) {
                     msg_id: randomUUID(),
                     read: false,
                     ...(msg.hopChain !== undefined ? { hopChain: [...msg.hopChain] } : {}),
+                    ...(peerMeta !== undefined ? { peerMeta } : {}),
                 });
                 saveBox(path, box);
                 return box.length;
@@ -178,6 +190,7 @@ export function createCcFileMailboxStore(opts) {
                 ...(Array.isArray(e.hopChain) && e.hopChain.every((h) => typeof h === "string")
                     ? { hopChain: e.hopChain.filter((h) => typeof h === "string") }
                     : {}),
+                ...readBackPeerMeta(e.peerMeta),
             }));
             if (pending.length === 0)
                 return Promise.resolve(null);

package/dist/stores/file/adoption/marker.d.ts

@@ -209,7 +209,7 @@ export declare function writeRootAdoptionFile(root: string, content: RootAdoptio
  * and it is the ONLY thing this function does — it never reaches an object that already exists. So a
  * store instance constructed BEFORE the marker landed keeps writing for as long as it is held, in
  * ANOTHER OS process (cross-process sharing of one data dir is the file family's documented
- * UNSUPPORTED shape — task-list F-14, mailbox RB-249) and, symmetrically, in THIS one (an independent
+ * UNSUPPORTED shape for the task-list store — F-14; the mailbox store is the exception since its per-box lock upgrade, see `stores/file/mailbox-store.ts`) and, symmetrically, in THIS one (an independent
  * store face built before the adoption started; the arc's `LOCK` acquisition excludes a live
  * `FileStorageBackend`, which is the only shape that takes that lock). Adoption adds no new promise on
  * either side of that seam — see the freeze note on `adoptLocalDataRoot` for the full division.