@sema-agent/core 7.24.4 → 7.25.1

package/dist/core/task-notification.js

@@ -1,6 +1,10 @@
 import { escapeEnvelopeTag, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { PEER_MESSAGE_NOTICE } from "../agents/peer-admission.js";
 import { buildCrossSessionEnvelope, CROSS_SESSION_MESSAGE_NOTICE, neutralizePeerBody } from "../agents/cross-session-envelope.js";
+export const NOTIFICATION_INJECTION_OUTCOMES = ["queued", "parked", "parked_durably", "dropped_duplicate"];
+export function isNotificationInjectionOutcome(value) {
+    return typeof value === "string" && NOTIFICATION_INJECTION_OUTCOMES.includes(value);
+}
 export const SYSTEM_INJECTION_PRIORITIES = ["now", "next", "later"];
 export function isSystemInjectionPriority(value) {
     return typeof value === "string" && SYSTEM_INJECTION_PRIORITIES.includes(value);
@@ -107,6 +111,7 @@ const MAX_DEDUP_KEYS = 2_000;
 export const MAX_PENDING_EVENTS_PER_TASK = 50;
 export const MAX_PENDING_EVENTS_PER_SESSION = 200;
 export const MAX_PENDING_SESSIONS = 100;
+export const MAX_SESSION_BOX_BINDINGS = 4096;
 const MAX_TOMBSTONES = 5_000;
 const TERMINAL_STATUSES = new Set(["completed", "failed", "killed", "cancelled"]);
 export function isDelegatedAgentTerminal(n) {
@@ -186,6 +191,22 @@ export class PendingSessionNotifications {
     droppedSessions = 0;
     evictedSessions = new Map();
     unattributedDrops = 0;
+    sessionBoxes = new Map();
+    bindSessionBox(sessionId, box) {
+        this.sessionBoxes.delete(sessionId);
+        if (box === undefined)
+            return;
+        this.sessionBoxes.set(sessionId, box);
+        while (this.sessionBoxes.size > MAX_SESSION_BOX_BINDINGS) {
+            const oldest = this.sessionBoxes.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.sessionBoxes.delete(oldest);
+        }
+    }
+    sessionBoxFor(sessionId) {
+        return this.sessionBoxes.get(sessionId);
+    }
     pend(sessionId, n, priority) {
         let s = this.sessions.get(sessionId);
         if (s === undefined) {
@@ -251,7 +272,36 @@ export class PendingSessionNotifications {
     }
     routed = new Map();
     holdsKey(sessionId, dedupKey) {
-        return this.sessions.get(sessionId)?.keys.has(dedupKey) === true || this.routed.get(sessionId)?.has(dedupKey) === true;
+        return this.sessions.get(sessionId)?.keys.has(dedupKey) === true || this.routed.get(sessionId)?.has(dedupKey) === true || this.durable.get(sessionId)?.has(dedupKey) === true;
+    }
+    durable = new Map();
+    noteDurablePark(sessionId, dedupKey) {
+        let mine = this.durable.get(sessionId);
+        if (mine === undefined) {
+            if (this.durable.size >= MAX_PENDING_SESSIONS) {
+                const oldest = this.durable.keys().next().value;
+                if (oldest !== undefined)
+                    this.durable.delete(oldest);
+            }
+            mine = new Set();
+            this.durable.set(sessionId, mine);
+        }
+        mine.add(dedupKey);
+        if (mine.size > MAX_PENDING_EVENTS_PER_SESSION) {
+            for (const k of mine) {
+                mine.delete(k);
+                if (mine.size <= MAX_PENDING_EVENTS_PER_SESSION)
+                    break;
+            }
+        }
+    }
+    forgetDurablePark(sessionId, dedupKey) {
+        const mine = this.durable.get(sessionId);
+        if (mine === undefined)
+            return;
+        mine.delete(dedupKey);
+        if (mine.size === 0)
+            this.durable.delete(sessionId);
     }
     markDelivered(sessionId, dedupKey) {
         let mine = this.routed.get(sessionId);
@@ -285,6 +335,30 @@ export function routeOrParkNotification(store, sessionId, payload, priority, onD
     }
     const routed = store.liveLanes.deliver(sessionId, payload, priority, { ...(onDisposition !== undefined ? { onDisposition } : {}) });
     if (routed === "unavailable") {
+        const box = store.sessionBoxFor(sessionId);
+        const carrier = payload.agentMessage;
+        if (box !== undefined && carrier !== undefined) {
+            store.noteDurablePark(sessionId, dedupKey);
+            const record = sessionBoxRecordOf({ ...payload, agentMessage: carrier }, box);
+            let appended;
+            try {
+                appended = Promise.resolve(box.mailbox.append(box.scope, box.handle, record));
+            }
+            catch (e) {
+                appended = Promise.reject(e);
+            }
+            appended.then(() => onDisposition?.("parked_durably"), (e) => {
+                store.forgetDurablePark(sessionId, dedupKey);
+                try {
+                    box.onError?.(e);
+                }
+                catch {
+                }
+                store.pend(sessionId, payload, priority);
+                onDisposition?.("parked");
+            });
+            return;
+        }
         store.pend(sessionId, payload, priority);
         onDisposition?.("parked");
     }
@@ -292,6 +366,21 @@ export function routeOrParkNotification(store, sessionId, payload, priority, onD
         onDisposition?.("queued");
     }
 }
+export function sessionBoxRecordOf(payload, box) {
+    const peer = payload.peer;
+    return {
+        from: payload.agentMessage.from,
+        content: payload.agentMessage.body,
+        sentAt: Date.now(),
+        hopChain: peer !== undefined ? [...peer.hopChain] : [],
+        peerMeta: {
+            ...(peer?.fromSession !== undefined ? { fromSession: peer.fromSession } : {}),
+            ...(peer?.senderKey !== undefined ? { senderKey: peer.senderKey } : {}),
+            fromRoot: box.sessionId,
+            kind: "peer_message",
+        },
+    };
+}
 function evictOldest(s, match) {
     let idx = s.items.findIndex((i) => match(i) && !TERMINAL_STATUSES.has(i.status));
     if (idx === -1)

package/dist/core/task-registry-agent.js

@@ -419,7 +419,6 @@ export function registerBackgroundAgentLane(core, input) {
                 ...(input.agentType !== undefined ? { agentType: input.agentType } : {}),
                 ...(input.description !== undefined ? { description: input.description } : {}),
                 ...(input.model !== undefined ? { model: input.model } : {}),
-                ...(input.teamName !== undefined ? { teamName: input.teamName } : {}),
                 writerId: core.writerId,
                 writerEpoch: 1,
                 spawnedAt: now,
@@ -1236,7 +1235,7 @@ export async function deliverToRunningAgentLane(core, id, access, notification,
             let result;
             try {
                 const d = await handle.notify?.(notification, opts);
-                if (d === "parked") {
+                if (d === "parked" || d === "parked_durably") {
                     result = handle.retainedContinuation === true ? { ok: true, disposition: "parked" } : { ok: false, reason: "not_running" };
                 }
                 else {

package/dist/core/task-registry-monitor.js

@@ -1,5 +1,5 @@
 import { delimitUntrusted } from "./untrusted-text.js";
-import { assertOwnership, defaultMonitorTimers, MONITOR_MAX_TIMEOUT_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_BATCH_WINDOW_MS, MONITOR_MAX_BATCHES_PER_MINUTE, MONITOR_STORM_BURST, MONITOR_STORM_KILL_AFTER_MS, MONITOR_LINE_BUF_CAP, MONITOR_SPILL_CAP_CHARS, TASK_OUTPUT_MAX_CHARS, mintCompletionId, clipMonitorEvent, clipMonitorLine, terminalTaskSummary, accountDroppedBytes, renderSpoolBody, rollSpoolText, statusFromBackground, droppedGapNote, firstDropNote, alreadyTerminalStopNote, clipTaskOutput, sleepPollStep, } from "./task-registry-shared.js";
+import { assertOwnership, defaultMonitorTimers, MONITOR_MAX_TIMEOUT_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_BATCH_WINDOW_MS, MONITOR_MAX_BATCHES_PER_MINUTE, MONITOR_STORM_BURST, MONITOR_STORM_KILL_AFTER_MS, MONITOR_LINE_BUF_CAP, MONITOR_SPILL_CAP_CHARS, TASK_OUTPUT_MAX_CHARS, mintCompletionId, clipMonitorEvent, clipMonitorLine, terminalTaskSummary, accountDroppedBytes, renderSpoolBody, SPOOL_REPLAY, rollSpoolText, statusFromBackground, droppedGapNote, firstDropNote, alreadyTerminalStopNote, clipTaskOutput, sleepPollStep, } from "./task-registry-shared.js";
 import { buildToolResultRef, OFFLOAD_TOOL_NAME, toolResultProvenanceOf } from "./tool-result-store.js";
 import { thrownText } from "./thrown-value.js";
 export function registerMonitorLane(core, input) {
@@ -339,6 +339,7 @@ export async function pollMonitorLane(handle, filter, deadline, signal) {
             details: {
                 status: running ? "running" : handle.status,
                 exitCode: spool.exitCode,
+                replay: SPOOL_REPLAY,
                 ...(spool.droppedBytes !== undefined ? { bytesDroppedBeforeCursor: spool.droppedBytes } : {}),
                 ...(spool.timedOut === true ? { timedOut: true, ...(spool.timeoutSec !== undefined ? { timeoutSec: spool.timeoutSec } : {}) } : {}),
             },

package/dist/core/task-registry-shared.d.ts

@@ -5,6 +5,7 @@ import type { BackgroundAgentRecord, BackgroundAgentStore } from "./background-a
 import type { WorkflowHandle, WorkflowRun } from "../orchestration/workflow.js";
 import type { TaskNotificationPayload } from "./task-notification.js";
 import type { ToolResultStore } from "./tool-result-store.js";
+import type { AssertAllKeysHandled } from "./ask-origin.js";
 export type SemaTaskType = "background_bash" | "workflow" | "background_agent" | "monitor";
 /** design/134 §3.3 (R3): WHO initiated a kill — recorded at the initiation site (first-marker-wins),
  *  because the settle-side then/catch context has already lost it. OPEN ENUM on the wire, now in the
@@ -254,7 +255,7 @@ export interface BackgroundAgentTaskHandle extends SemaTaskHandle {
      *  ends park per session inside the injector itself (the lane-teardown branch). */
     notify?: (notification: import("./task-notification.js").TaskNotificationPayload, opts?: {
         priority?: import("./task-notification.js").SystemInjectionPriority;
-    }) => "queued" | "parked" | "dropped_duplicate" | Promise<"queued" | "parked" | "dropped_duplicate">;
+    }) => import("./task-notification.js").NotificationInjectionOutcome | Promise<import("./task-notification.js").NotificationInjectionOutcome>;
     /** design/147 S2a — messages that arrived in the STARTUP window (row already
      *  running, lane not yet bound). Bounded; flushed in order by attachAgentNotify. Discarded at
      *  terminal settle: a run that failed during prepare never had a lane to park through, and the
@@ -658,6 +659,54 @@ export declare function spoolDropNote(acct: {
     droppedBytes?: number;
     dropUnknown?: true;
 }): string;
+/**
+ * HOW a poll's output body may be read AGAIN — the machine word beside `details`, previously legible
+ * only from the stdout heading's prose.
+ *
+ * `full` = the whole output of the task, re-rendered from the registry's own spool on every poll: a
+ * later poll answers the same bytes plus whatever arrived, so a consumer REPLACES what it holds.
+ * `cursor` = only what is NEW since the previous read: the env cursor was consumed and those bytes
+ * cannot be served twice, so a consumer APPENDS.
+ *
+ * The distinction was machine-invisible and the one key nearby reads the two faces OPPOSITELY:
+ * `bytesDroppedBeforeCursor` rides the spool faces only when something was actually dropped, and the
+ * increment face unconditionally (value possibly 0). A consumer discriminating on that key's PRESENCE
+ * therefore reads a spool that happened to drop bytes as an increment — and appends a body that was a
+ * full re-render, printing the same text twice.
+ */
+export declare const TASK_OUTPUT_REPLAY_KINDS: readonly ["full", "cursor"];
+export type TaskOutputReplay = (typeof TASK_OUTPUT_REPLAY_KINDS)[number];
+/**
+ * The ONE table the word and the prose both come out of. Each face's stdout/stderr headings live here
+ * rather than at the three legs that render them, so the banner a person reads and the key a program
+ * reads cannot drift — the failure mode this whole field exists to end (the two spool renderers were
+ * hand-copied twins before {@link renderSpoolBody}, and their drift was three disclosure bugs).
+ *
+ * `stdoutWhenGapped` is the heading a face falls back to once a gap has been disclosed. `undefined` is
+ * a ROW, not an omission: an increment window claims nothing about completeness to begin with ("new
+ * stdout" is true whether or not bytes were lost before it), so it has no claim to downgrade — while a
+ * spool advertising itself as "full" with a disclosed gap would be saying something false.
+ */
+export declare const REPLAY_FACE: {
+    readonly full: {
+        readonly stdout: "stdout (full, re-readable)";
+        readonly stdoutWhenGapped: "stdout (re-readable spool — INCOMPLETE, see note above)";
+        readonly stderr: "stderr";
+    };
+    readonly cursor: {
+        readonly stdout: "new stdout";
+        readonly stdoutWhenGapped: undefined;
+        readonly stderr: "new stderr";
+    };
+};
+export type ReplayHeadingTableCoversEveryReplay = AssertAllKeysHandled<Exclude<TaskOutputReplay, keyof typeof REPLAY_FACE>>;
+/** The re-readable spool face: the monitor lane and the bash spool lane, both rendered by
+ *  {@link renderSpoolBody}. Named once so the three legs that report it cannot each spell it. */
+export declare const SPOOL_REPLAY = "full";
+/** The consume-once increment face: the bash blocked wait, which accumulates env-cursor increments. */
+export declare const INCREMENT_REPLAY = "cursor";
+/** The stdout heading of a face, downgraded when a gap has been disclosed (see {@link REPLAY_FACE}). */
+export declare function stdoutHeadingOf(replay: TaskOutputReplay, gapDisclosed: boolean): string;
 /** The re-readable spool fields {@link renderSpoolBody} reads — the intersection of the bash handle's
  *  optional `spool` and the monitor handle's mandatory one (both carry supersets: `mirrorFailed` is
  *  bash-only, `drainFailed`/`dropNotified` monitor-only). Declared as a named shape, not inlined, so
@@ -878,15 +927,14 @@ export interface RegisterBackgroundAgentInput extends TaskAccess {
      *  internals chain; equals parentSessionId at depth 1). Persisted on the handle, the durable row
      *  and the roster so recovery faces enumerate the whole tree under the root without alias walks. */
     rootSessionId?: string;
-    /** design/151 S3b — revival lookup keys (CC meta-sidecar shape): the model RECORD KEY and the team
-     *  name, persisted on the durable row so a tier-3 revival rebuilds the spec the way a fresh
-     *  named-teammate spawn would. Lookup keys only, never a serialized spec. `model` is NOT the
+    /** design/151 S3b — the revival lookup key (CC meta-sidecar shape): the model RECORD KEY,
+     *  persisted on the durable row so a tier-3 revival rebuilds the spec the way a fresh
+     *  named-teammate spawn would. A lookup key only, never a serialized spec. `model` is NOT the
      *  resolved model id: a spawn that named a model in WORDS records the caller's spelling verbatim
      *  (catalog key / tier word / CC alias) so the revival can re-resolve it against the catalog in
      *  force at WAKE time; only a spawn that carried a Model OBJECT records that object's id. Same
      *  value and same rule as the roster row's `model` column. */
     model?: string;
-    teamName?: string;
     toolUseId?: string;
     abort: AbortController;
     now?: number;

package/dist/core/task-registry-shared.js

@@ -101,14 +101,25 @@ export function spoolDropNote(acct) {
         return "[!] an unknown amount of earlier output was permanently dropped before this window (buffer evicted)\n";
     return "";
 }
+export const TASK_OUTPUT_REPLAY_KINDS = ["full", "cursor"];
+export const REPLAY_FACE = {
+    full: { stdout: "stdout (full, re-readable)", stdoutWhenGapped: "stdout (re-readable spool — INCOMPLETE, see note above)", stderr: "stderr" },
+    cursor: { stdout: "new stdout", stdoutWhenGapped: undefined, stderr: "new stderr" },
+};
+export const SPOOL_REPLAY = "full";
+export const INCREMENT_REPLAY = "cursor";
+export function stdoutHeadingOf(replay, gapDisclosed) {
+    const face = REPLAY_FACE[replay];
+    return gapDisclosed ? (face.stdoutWhenGapped ?? face.stdout) : face.stdout;
+}
 export function renderSpoolBody(spool, opts) {
     const timedOutClause = spool.timedOut === true ? ` (timed out after ${spool.timeoutSec !== undefined ? `${spool.timeoutSec}s` : "its background time budget"})` : "";
     const displayStatus = (spool.exitCode !== undefined ? `exited(code ${spool.exitCode})` : opts.running ? "running" : opts.handleStatus) + timedOutClause;
     const rolledNote = spool.rolledChars > 0 ? `[!] ${spool.rolledChars} earlier char(s) dropped from the spool (memory bound)${opts.rolledExtraClause}\n` : "";
     const droppedNote = spoolDropNote(spool);
-    const stdoutHeading = droppedNote !== "" || opts.drainNote !== "" ? "stdout (re-readable spool — INCOMPLETE, see note above)" : "stdout (full, re-readable)";
+    const stdoutHeading = stdoutHeadingOf(SPOOL_REPLAY, droppedNote !== "" || opts.drainNote !== "");
     return (`status: ${displayStatus}\n${rolledNote}${droppedNote}${opts.drainNote}--- ${stdoutHeading} ---\n${opts.shape(spool.stdout) || "(none)"}\n` +
-        `--- stderr ---\n${opts.shape(spool.stderr) || "(none)"}`);
+        `--- ${REPLAY_FACE[SPOOL_REPLAY].stderr} ---\n${opts.shape(spool.stderr) || "(none)"}`);
 }
 export function droppedGapNote(spool) {
     if ((spool.droppedBytes ?? 0) > 0)

package/dist/core/task-registry.js

@@ -8,7 +8,7 @@ import { createSafeNotifier } from "./safe-notify.js";
 import { stripCwdSentinel } from "../tools/fs/fs-shared.js";
 import { registerMonitorLane, pollMonitorLane, stopMonitorLane } from "./task-registry-monitor.js";
 import { registerWorkflowLane, pollWorkflowLane, stopWorkflowLane } from "./task-registry-workflow.js";
-import { mintCompletionId, canAccessWorkflowRun, formatWorkflowRun, clipTaskOutput, assertOwnership, sleepPollStep, statusFromBackground, rollSpoolText, accountDroppedBytes, renderSpoolBody, spoolDropNote, droppedGapNote, alreadyTerminalStopNote, terminalTaskSummary, TASK_OUTPUT_MAX_CHARS, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccess, DURABLE_AGENT_HANDLE_RE, } from "./task-registry-shared.js";
+import { mintCompletionId, canAccessWorkflowRun, formatWorkflowRun, clipTaskOutput, assertOwnership, sleepPollStep, statusFromBackground, rollSpoolText, accountDroppedBytes, renderSpoolBody, stdoutHeadingOf, REPLAY_FACE, SPOOL_REPLAY, INCREMENT_REPLAY, spoolDropNote, droppedGapNote, alreadyTerminalStopNote, terminalTaskSummary, TASK_OUTPUT_MAX_CHARS, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccess, DURABLE_AGENT_HANDLE_RE, } from "./task-registry-shared.js";
 export { normalizeAgentName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR } from "./task-registry-shared.js";
 import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_MISSING_ID_MESSAGE, TASK_STOP_MISSING_ID_MESSAGE, TASK_STOP_PARAMS, resolveTaskIdArg, REGISTRY_TASK_TOOL_CAPS, composeTaskOutputDescription, composeTaskOutputParams, composeTaskStopDescription, } from "./task-tool-shape.js";
 import { durableAgentArmedLane, durableAgentRowProbeLane, beginDurableClaimLane, endDurableClaimLane, reapDurableAgentsLane, noteBackgroundAgentActivityLane, reapStaleSessionBackgroundAgentsLane, releaseDurableTranscriptAnchorLane, bindBackgroundAgentSessionLane, registerBackgroundAgentLane, recordBackgroundAgentOrgAdmissionLane, parkBackgroundAgentLane, reconcileParkedAgentsLane, claimParkedAgentLane, rollbackParkedClaimLane, consumeParkedFlipLane, finalizeParkedResumeLane, settleBackgroundAgentLane, abortBackgroundAgentsForOwnerLane, serveDurableAgentRowLane, resolveBackgroundAgentByNameLane, backgroundAgentCycleSeqLane, activeDelegationHandlesLane, markRetainedContinuationLane, reviveBackgroundAgentLane, settleRevivedAgentLane, unmarkRetainedContinuationLane, attachAgentNotifyLane, deliverToRunningAgentLane, runningBackgroundAgentLabelsLane, runningAgentFooterLane, notFoundRunningAgentsTail, pollBackgroundAgentLane, stopBackgroundAgentLane, } from "./task-registry-agent.js";
@@ -1075,6 +1075,7 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
                     details: {
                         status: running ? "running" : handle.status,
                         exitCode: spool.exitCode,
+                        replay: SPOOL_REPLAY,
                         ...(spool.droppedBytes !== undefined ? { bytesDroppedBeforeCursor: spool.droppedBytes } : {}),
                         ...(spool.timedOut === true ? { timedOut: true, ...(spool.timeoutSec !== undefined ? { timeoutSec: spool.timeoutSec } : {}) } : {}),
                     },
@@ -1099,12 +1100,13 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
                 if (r.error.code === "not_found")
                     return noTask(requestedId, runningAgentFooterLane(this.core, access));
                 const retrieval_status = r.error.code === "timeout" ? "timeout" : "not_ready";
-                const salvaged = stdout.length > 0 || stderr.length > 0
+                const carriedOutput = stdout.length > 0 || stderr.length > 0;
+                const salvaged = carriedOutput
                     ? `\n--- output accumulated before the error ---\n${clipTaskOutput(stdout, handle.outputFile)}${stderr ? `\n--- stderr ---\n${clipTaskOutput(stderr, handle.outputFile)}` : ""}`
                     : "";
                 return {
                     content: `Error (TaskOutput): ${r.error.message}${salvaged}`,
-                    details: { task_id: handle.id, type: "background_bash", status: handle.status, retrieval_status, error: r.error.code },
+                    details: { task_id: handle.id, type: "background_bash", status: handle.status, retrieval_status, ...(carriedOutput ? { details: { replay: INCREMENT_REPLAY } } : {}), error: r.error.code },
                     isError: true,
                 };
             }
@@ -1125,8 +1127,8 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
                 const displayStatus = (r.value.status === "exited" ? `exited(code ${r.value.exitCode})` : r.value.status) + timedOutClause;
                 const droppedNote = spoolDropNote(dropAcct) +
                     (rolledChars > 0 ? `[!] ${rolledChars} accumulated char(s) dropped from the middle during the blocked wait (memory bound)\n` : "");
-                const body = `status: ${displayStatus}\n${droppedNote}--- new stdout ---\n${shape(stdout) || "(none)"}\n` +
-                    `--- new stderr ---\n${shape(stderr) || "(none)"}`;
+                const body = `status: ${displayStatus}\n${droppedNote}--- ${stdoutHeadingOf(INCREMENT_REPLAY, droppedNote !== "")} ---\n${shape(stdout) || "(none)"}\n` +
+                    `--- ${REPLAY_FACE[INCREMENT_REPLAY].stderr} ---\n${shape(stderr) || "(none)"}`;
                 return {
                     content: delimitUntrusted(`TaskOutput ${handle.id}`, body),
                     details: {
@@ -1139,6 +1141,7 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
                         details: {
                             status: r.value.status,
                             exitCode: r.value.exitCode,
+                            replay: INCREMENT_REPLAY,
                             bytesDroppedBeforeCursor: dropAcct.droppedBytes ?? 0,
                             ...(r.value.timedOut === true ? { timedOut: true, ...(r.value.timeoutSec !== undefined ? { timeoutSec: r.value.timeoutSec } : {}) } : {}),
                         },

package/dist/core/task-spec.d.ts

@@ -783,9 +783,12 @@ export interface TaskSpec {
     /**
      * design/199 件B — TASK-layer ADDITIONS to the built-in sensitive-path READ deny set
      * ({@link import("../tools/fs/read-deny.js").READ_FACE_DEFAULT_DENY_ENTRIES}). Judged by the
-     * structured read faces (Read/Grep/Glob/RepoMap, their traversals, the classify shell gate's
-     * auto-allow probe, the compaction attachment reader and the `bash_readonly` shell mounted by
-     * {@link handsReadOnly} — one deny judge for every read face) in BOTH containment modes. Add-only at
+     * structured read faces (Read/Grep/Glob/RepoMap, their traversals, the compaction attachment reader) and
+     * by the shell READ STATION under every doctrine — the full shell (`Bash`, `Monitor`, whatever
+     * {@link shellGate} says) and the `bash_readonly` shell mounted by {@link handsReadOnly} alike: a
+     * deny-listed shell read is REFUSED at the gate (`deniedBy: "read_boundary"`), never asked, with the same
+     * sentence the structured faces refuse with — one deny judge for every read face — in BOTH containment
+     * modes. Add-only at
      * the task layer: entries here UNION with the active built-ins and the deployment's
      * {@link RunnerDeps.readDenyPatterns}; `[]` ≡ absent (union identity); NOTHING at the task layer
      * can remove a built-in — the one removal channel is the DEPLOYMENT's built-in configuration
@@ -873,8 +876,12 @@ export interface TaskSpec {
      *  - `"always"`: every `bash` command tightens to an `irreversible_ask` durable suspend (fail-closed; the
      *    correct default for an unattended/supervisor deployment with no classifier).
      *  - `"classify"`: mark `bash` `irreversibility:"maybe"` with {@link import("../tools/fs/index.js").bashReversibilityProbe}
-     *    — a provably-benign single allowlisted read-only command (no operators) auto-allows; everything else
-     *    (writes, egress, pipes, unknown commands) tightens to ask. An egress command (e.g. `curl`) suspends under
+     *    — the SHAPE classifier alone: a provably-benign single allowlisted read-only command (no operators)
+     *    auto-allows; everything else (writes, egress, pipes, unknown commands) tightens to ask. WHERE a command
+     *    reads is not this doctrine's question under any value: the gate's shell read station judges every
+     *    shell call's read candidates against the deny set and the containment roots (a deny-listed read is
+     *    refused, an out-of-root read is a mandated ask) whether `shellGate` is `"off"`, `"classify"` or
+     *    `"always"`. An egress command (e.g. `curl`) suspends under
      *    the IRREVERSIBLE axis (the shell mark is irreversibility, not egress) — the kind is non-budgetable either
      *    way, so the budget resolver still never auto-approves it; the axis label is informational.
      *    NOT unconditional: a POSITIVE per-tool mark on the shell tool keeps its seat — an explicit

package/dist/core/tool-catalog-entries.js

@@ -154,6 +154,7 @@ export const ENGINE_CARDS = Object.freeze({
     a2a: "src/core/a2a.ts",
     path_not_in_root: "src/tools/fs/safety.ts",
     read_path_denied: "src/tools/fs/safety.ts",
+    readonly_out_of_root: "src/tools/fs/shell-read-check.ts",
 });
 const byId = new Map();
 for (const e of TOOL_CATALOG_ENTRIES) {

package/dist/core/tool-policy.js

@@ -13,6 +13,7 @@ import { thrownText } from "./thrown-value.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
 import { protocolOf } from "./protocol-table.js";
 import { isAbsoluteForFamily, isAbsolutePathForm, joinForFamily, normalizeAbsPathLexically, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
+import { ASSIGNMENT_PREFIX, writtenAssignmentPrefix } from "../tools/fs/bash-program-position.js";
 export function advertisedWritableRootsSeat(seat) {
     return seat === undefined ? {} : { advertisedWritableRoots: Object.freeze([...seat.roots]) };
 }
@@ -618,22 +619,28 @@ export function findUnverifiableRecursiveDelete(command, safeVars = new Set(UNVE
         }
         return false;
     };
+    const applyAssignmentWord = (words, at) => {
+        const written = writtenAssignmentPrefix(words[at]);
+        if (written === undefined) {
+            assigned.delete(words[at].replace(/\[.*$/, ""));
+            return;
+        }
+        const value = restOfAssignment(words, at, written.prefix.length - 1);
+        if ((!written.settlesWholeName && !assigned.has(written.name)) || valueIsOpaque(value, assigned, safeVars))
+            assigned.delete(written.name);
+        else
+            assigned.add(written.name);
+        if (valueEscapesRoot(value, safeVars))
+            assignedEscapesRoot.add(written.name);
+        else if (written.settlesWholeName)
+            assignedEscapesRoot.delete(written.name);
+    };
     const statements = command.replace(/\\\r?\n/g, " ").split(STATEMENT_SPLIT);
     for (const stmt of statements) {
         const tokens = stmt.trim().split(/\s+/).filter(Boolean);
         let i = 0;
-        while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) {
-            const eq = tokens[i].indexOf("=");
-            const name = tokens[i].slice(0, eq);
-            const value = restOfAssignment(tokens, i, eq);
-            if (valueIsOpaque(value, assigned, safeVars))
-                assigned.delete(name);
-            else
-                assigned.add(name);
-            if (valueEscapesRoot(value, safeVars))
-                assignedEscapesRoot.add(name);
-            else
-                assignedEscapesRoot.delete(name);
+        while (i < tokens.length && ASSIGNMENT_PREFIX.test(tokens[i])) {
+            applyAssignmentWord(tokens, i);
             i += assignmentTokenSpan(tokens, i);
         }
         let sawWrapper = false;
@@ -646,7 +653,7 @@ export function findUnverifiableRecursiveDelete(command, safeVars = new Set(UNVE
             if (DELETE_WRAPPERS.has(t)) {
                 sawWrapper = true;
                 i++;
-                while (i < tokens.length && (/^-/.test(tokens[i]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])))
+                while (i < tokens.length && (/^-/.test(tokens[i]) || ASSIGNMENT_PREFIX.test(tokens[i])))
                     i++;
                 continue;
             }
@@ -672,16 +679,16 @@ export function findUnverifiableRecursiveDelete(command, safeVars = new Set(UNVE
         i = headIdx;
         const head = stripTokenEdges(tokens[i]).replace(/^\\/, "");
         const headName = head.split("/").pop() ?? head;
-        let m;
-        if ((m = stmt.trim().match(/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/))) {
-            if (valueIsOpaque(m[2], assigned, safeVars))
-                assigned.delete(m[1]);
-            else
-                assigned.add(m[1]);
-            if (valueEscapesRoot(m[2], safeVars))
-                assignedEscapesRoot.add(m[1]);
-            else
-                assignedEscapesRoot.delete(m[1]);
+        const declStmt = stmt.trim();
+        const declaredWords = /^(?:export|declare|typeset|local|readonly)\b/.test(declStmt) ? declStmt.split(/\s+/).filter(Boolean).slice(1) : ASSIGNMENT_PREFIX.test(declStmt) ? [declStmt] : [];
+        for (let d = 0; d < declaredWords.length;) {
+            if (/^[-+]/.test(declaredWords[d])) {
+                d += 1;
+                continue;
+            }
+            declaredWords[d] = stripTokenEdges(declaredWords[d]);
+            applyAssignmentWord(declaredWords, d);
+            d += assignmentTokenSpan(declaredWords, d);
         }
         if (headName === "read") {
             void 0;

package/dist/core/tool-spec.d.ts

@@ -1180,7 +1180,7 @@ export interface ToolExecuteContext {
      */
     onTaskNotification?: (n: import("./task-notification.js").TaskNotificationPayload, opts?: {
         priority?: import("./task-notification.js").SystemInjectionPriority;
-    }) => void;
+    }) => unknown;
     /**
      * design/99 (nested-subagent live observability): the host run's OPT-IN display sink — a deployment sets it (via
      * `RunInternals.onForwardEvent`) to receive a SUBAGENT's live `task_progress` ticks that otherwise stay in the

package/dist/core/wiring-manifest.d.ts

@@ -432,8 +432,8 @@ export interface WiringFacts {
     parkDurableApprovalOptIn: boolean;
     /** `undefined` = unresolved at this half (per-principal runtime caps are a prepare-time fact). */
     parkForceDurableGate?: boolean;
-    /** `undefined` = unresolved at this half (the irreversible/egress tool vocabulary is assembled in
-     *  prepare). */
+    /** `undefined` = unresolved at this half (the irreversible/egress tool vocabulary and the shell read station —
+     *  the three sources of a mandated ask — are assembled in prepare). */
     parkSafetyVocabularyArmed?: boolean;
     /** Present iff `parkCapable` (the resolved checkpoint store's declaration). */
     checkpointDurability?: StoreDurability;

package/dist/engine/loop/agent-loop.js

@@ -1325,7 +1325,7 @@ async function prepareToolCall(currentContext, assistantMessage, toolCall, confi
                 };
             }
             if (beforeResult?.block) {
-                const blocked = createErrorToolResult(beforeResult.reason || "Tool execution was blocked");
+                const blocked = createErrorToolResult(beforeResult.reason || "Tool execution was blocked", beforeResult.details !== undefined ? { details: beforeResult.details } : undefined);
                 if (beforeResult.haltRemaining !== undefined) {
                     return { kind: "immediate", result: blocked, isError: true, halt: beforeResult.haltRemaining };
                 }

package/dist/engine/loop/types.d.ts

@@ -83,6 +83,10 @@ export type AgentToolCall = Extract<AssistantMessage["content"][number], {
 export interface BeforeToolCallResult {
     block?: boolean;
     reason?: string;
+    /** With `block`: the structured details the refusing layer minted, attached to the error result the loop
+     *  builds from `reason` (a `{ type, code, … }` card reaches `tool_end.structured` / `errorCode` exactly as a
+     *  tool's own refusal would). Ignored without `block`. */
+    details?: unknown;
     updatedInput?: unknown;
     haltRemaining?: HaltRemainingDirective;
 }

package/dist/index.d.ts

@@ -100,7 +100,7 @@ export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted } from "./core
 export { mintReminderMark, isValidReminderMark, openSystemReminder, mintSystemReminder, reminderMarkDeclaration } from "./core/reminder-mint.js";
 export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export type { InvariantKind, FunctionContract, Invariant, InvariantViolation, CheckResult, } from "./core/property-harness.js";
-export { bashReversibilityProbe, bashReadBoundaryProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
+export { bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, type ReadDenyEntry, type ReadDenyMatcher, type NormalizedReadDenyEntry, type ReadDenyBuiltinTier, type ReadDenyBuiltinRow, type ReadDenyBuiltinConfig, } from "./tools/fs/index.js";
@@ -132,7 +132,9 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE, type FsWriteGatePolicyOptions } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, type NotificationInjectionOutcome, // the injector's outcome words (`parked_durably` = the session's durable box took the frame)
+NOTIFICATION_INJECTION_OUTCOMES, // …and their value half + guard, so a host wiring its own uplink validates a reported outcome without duplicating the vocabulary
+isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, type RosterBoundMembers, type RosterBoundCode, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
@@ -201,7 +203,7 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * allowed and widening is not.
  */
 export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReachOutcome, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBase, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
+export { removePersistedRule, addPersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type AddResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleTightenAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, type PermissionRuleStore, type PermissionRuleStoreProvider, type PermissionRuleStoreConfig, type EffectivePermissionRules, type EffectivePermissionRule, type RemovedPermissionRule, type RuleSource, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, type SessionRulePartition, type SessionRuleAdd, type SessionRuleApplyResult, } from "./core/permission-rule-session.js";
@@ -277,6 +279,7 @@ export { workflowJournalStoreContract } from "./core/store-contracts/workflow-jo
 export { permissionRuleSyncContract, type PermissionRuleSyncContractHooks } from "./core/store-contracts/permission-rule-sync-contract.js";
 export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, type MailboxTombstonedRecipientContractHooks, mailboxCrossProcessContract, type MailboxCrossProcessContractHooks, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
+export { PEER_DIRECTORY_CONTRACT_SCOPE, peerDirectoryContract, type PeerDirectoryContractHooks } from "./core/store-contracts/peer-directory-contract.js";
 export { type BackgroundAgentStore, type BackgroundAgentRecord, type BackgroundAgentRowSummary, type BackgroundAgentUsage, canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, type BackgroundAgentQuery, } from "./core/background-agent-store.js";
 export { serveDurableAgentRowLane, buildAgentPollDetails, type AgentPollDetailsInput, } from "./core/task-registry-agent.js";
 export type { UnifiedTaskResult } from "./core/task-registry-shared.js";

package/dist/index.js

@@ -78,7 +78,7 @@ export { runExecGate } from "./core/exec-gate.js";
 export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted } from "./core/untrusted-text.js";
 export { mintReminderMark, isValidReminderMark, openSystemReminder, mintSystemReminder, reminderMarkDeclaration } from "./core/reminder-mint.js";
 export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
-export { bashReversibilityProbe, bashReadBoundaryProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
+export { bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, } from "./tools/fs/index.js";
@@ -107,7 +107,7 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
 export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
@@ -159,7 +159,7 @@ export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoMo
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
 export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
+export { removePersistedRule, addPersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, } from "./core/permission-rule-session.js";
@@ -233,6 +233,7 @@ export { workflowJournalStoreContract } from "./core/store-contracts/workflow-jo
 export { permissionRuleSyncContract } from "./core/store-contracts/permission-rule-sync-contract.js";
 export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, mailboxCrossProcessContract, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
+export { PEER_DIRECTORY_CONTRACT_SCOPE, peerDirectoryContract } from "./core/store-contracts/peer-directory-contract.js";
 export { canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, } from "./core/background-agent-store.js";
 export { serveDurableAgentRowLane, buildAgentPollDetails, } from "./core/task-registry-agent.js";
 export { FileBackgroundAgentStore } from "./stores/file/background-agent-store.js";

package/dist/prompts/coordinator.d.ts

@@ -2,7 +2,8 @@
  * design/147 S3b — the teammate communication addendum (CC 2.1.212
  * `TEAMMATE_SYSTEM_PROMPT_ADDENDUM`, pretty.js:322948, sema-ized): composed for a NAMED delegated
  * child (`core/mode.teammate` section, admit = facts.teammateEnabled — the CC injection condition
- * `agentId && agentName && teamName` maps to sema's named-spawn internals chain). Divergences:
+ * `agentId && agentName && teamName` maps to sema's named-spawn internals chain; sema keeps no team
+ * name — one implicit team per session, keyed by the root session). Divergences:
  * CC's "task system"/"team lead" wording maps to sema's `"main"` reserved lane (the spawning
  * conversation); and the capability sentences track the shipped contract (S2a
  * delivered mid-run delivery): a message to a RUNNING teammate is queued and reaches it at its next