@sema-agent/core 7.54.1 → 7.56.0

package/dist/agents/send-message-tool.js

@@ -6,7 +6,7 @@ import { announceTranscriptIntegrityGapOnce, canAccessAgentRecord, clearRevivedR
 import { uuidv7 } from "../internal/harness.js";
 import { MAILBOX_TOMBSTONED_RECIPIENT_CODE, mailboxCrossProcessMountVerdict } from "../core/mailbox-store.js";
 import { peerSendVerdictSeverity } from "./cross-session-judge.js";
-import { parsePeerSessionAddress, peerSessionBoxHandle, resolvePeerSessions } from "./peer-directory.js";
+import { listPeerDirectory, parsePeerSessionAddress, peerSessionBoxHandle, peerSessionLane, resolvePeerSessions } from "./peer-directory.js";
 import { peerIdleMachineFor } from "./peer-idle.js";
 import { PEER_IDLE_OUTSTANDING_CAP, PEER_IDLE_SUBSCRIPTION_TTL_MS, peerIdleNoticeLabel } from "./peer-notices.js";
 import { escapeAttributeValue, escapeEnvelopeTag, isObserverTaskId, OBSERVER_SENDMESSAGE_SENDER_REFUSAL, OBSERVER_SENDMESSAGE_TARGET_REFUSAL, } from "./observer.js";
@@ -15,7 +15,7 @@ import { neutralizePeerBody } from "./cross-session-envelope.js";
 import { SUBAGENT_RESUME_CAP, SubagentRetainLedger, getSessionRetainLedger } from "./retain-ledger.js";
 import { createSubagentResume } from "./subagent.js";
 import { appendHopToken, judgePeerAdmission, peerAxisToken, resolvePeerLaneConfig, PEER_MESSAGE_NOTICE, } from "./peer-admission.js";
-import { toolFace } from "../core/tool-catalog-entries.js";
+import { mountRuleFace, toolFace } from "../core/tool-catalog-entries.js";
 import { thrownText } from "../core/thrown-value.js";
 import { assertNoRetiredKeys } from "../core/retired-keys.js";
 import { sliceHeadSafe } from "../core/surrogate-safe-slice.js";
@@ -163,6 +163,7 @@ export function createSendMessageTool(opts) {
     return defineTool({
         name: SEND_MESSAGE_TOOL_NAME,
         ...toolFace("send-message"),
+        ruleFace: mountRuleFace("send-message"),
         executionMode: "parallel",
         description: `Send a follow-up message to a previously spawned background agent. ` +
             `Your plain text output is NOT visible to other agents — to communicate, you MUST call this tool. Messages addressed to you are delivered automatically; you don't check an inbox. ` +
@@ -187,7 +188,7 @@ export function createSendMessageTool(opts) {
                     : `Continuing a finished agent requires the run to retain sub-agent sessions; when the session was not ` +
                         `retained (or is no longer held) you get an honest error and should launch a new agent with the needed context instead.`) +
             (peerLane.active
-                ? ` Peer SESSIONS — other sessions of this engine for the same user${opts.peerListingMounted === false ? "" : opts.peerListingMounted === true ? " (list them with ListAgents)" : " (list them with ListAgents where that tool is mounted)"} — are addressed by name, by \`name [ref]\` when a name is ambiguous, or by their \`session.<id>\` address. A message to a peer is parked durably in its session box and read at its next turn boundary (an offline peer reads it when it next runs); the receipt confirms the box accepted it, not that the peer acted on it.`
+                ? ` Peer SESSIONS — other sessions of this engine for the same user${opts.peerListingMounted === false ? "" : opts.peerListingMounted === true ? " (list them with ListAgents)" : " (list them with ListAgents where that tool is mounted)"} — are addressed by name, by \`name [ref]\` when a name is ambiguous, or by their \`session.<id>\` address. A message to a peer is parked durably in its session box and read at its next turn boundary (an offline peer reads it when it next runs); the receipt confirms the box accepted it, not that the peer acted on it.${opts.peerChannel !== undefined ? " A peer whose box is not in this host's mailbox store — a Claude Code session, or a session of this engine on another store — is reached over its socket instead: nothing is parked for it, the message is sent once and only while it runs, and its receipt says so." : ""}`
                 : ""),
         parameters: sendMessageParameters,
         execute: async (args, ctx) => {
@@ -262,7 +263,7 @@ export function createSendMessageTool(opts) {
             let ownRowName;
             const resolvePeerTarget = async () => {
                 try {
-                    const rows = await opts.peerDirectory.listPeerSessions({ scope: peerScope ?? "" });
+                    const rows = await listPeerDirectory(opts.peerDirectory, { scope: peerScope ?? "" });
                     if (peerSelfSessionId !== undefined)
                         ownRowName = rows.find((r) => r.sessionId.toLowerCase() === peerSelfSessionId.toLowerCase())?.name;
                     return resolvePeerSessions(rows, to, peerSelfSessionId !== undefined ? { sessionId: peerSelfSessionId } : undefined);
@@ -282,6 +283,8 @@ export function createSendMessageTool(opts) {
                 }
                 const modeClass = opts.peerSelfSession?.modeClass?.();
                 const now = Date.now();
+                if (peerSessionLane(record, opts.mailbox) === "uds")
+                    return deliverOverSocket(record, peerLabel, modeClass);
                 let boxFull = false;
                 try {
                     boxFull = (await opts.mailbox.peekCount(peerScope, handle)) >= admissionConfig.maxQueuedPeerMessages;
@@ -343,9 +346,10 @@ export function createSendMessageTool(opts) {
                         }
                     }
                 }
+                const doorbell = opts.peerChannel !== undefined && record.sockPath !== undefined && record.liveness === "live" && (seq !== undefined || subscriptionSeq !== undefined) ? await opts.peerChannel.nudge(record.sockPath).catch(() => false) : undefined;
                 let rowRestored = "present";
                 try {
-                    const rowsNow = await opts.peerDirectory.listPeerSessions({ scope: peerScope });
+                    const rowsNow = await listPeerDirectory(opts.peerDirectory, { scope: peerScope });
                     const nowRow = rowsNow.find((r) => r.sessionId.toLowerCase() === record.sessionId.toLowerCase());
                     if (nowRow?.liveness === "deleted")
                         rowRestored = "deleted_meanwhile";
@@ -372,7 +376,7 @@ export function createSendMessageTool(opts) {
                     }
                     return {
                         content: `Idle subscription recorded for ${peerLabel} (record seq ${subscriptionSeq}): you will get ONE automated notice when that session next goes idle or exits (one-shot; it expires unheard after ${PEER_IDLE_SUBSCRIPTION_TTL_MS / 3_600_000} h). No message was sent. Do not poll for it; continue with your task.${rowNote}`,
-                        details: { type: "send-message", status: "peer_idle_subscribed", to, address: handle, subscription, ...(subscriptionSeq !== undefined ? { subscriptionSeq } : {}), ...(rowRestored !== "present" ? { directoryRow: rowRestored } : {}) },
+                        details: { type: "send-message", status: "peer_idle_subscribed", to, address: handle, subscription, ...(subscriptionSeq !== undefined ? { subscriptionSeq } : {}), ...(rowRestored !== "present" ? { directoryRow: rowRestored } : {}), ...(doorbell !== undefined ? { doorbell } : {}) },
                     };
                 }
                 const verdict = { ok: true, disposition: offline ? "parked_offline" : "queued", via: "store" };
@@ -380,7 +384,32 @@ export function createSendMessageTool(opts) {
                     content: offline
                         ? `Message parked for ${peerLabel}: that session is offline, so the message was parked durably in its session box (seq ${seq}) and will be delivered when it next runs — subject to the deployment's mailbox retirement policy, which does not notify you. Continue with your task; do not resend the same content.${subscriptionNote}${rowNote}`
                         : `Message queued for ${peerLabel} (seq ${seq}): it is parked durably in that session's box and will be read at its next turn boundary. This receipt confirms acceptance into the box, not the peer's judgment of the message. Continue with your task; do not resend the same content.${subscriptionNote}${rowNote}`,
-                    details: { type: "send-message", status: offline ? "peer_parked_offline" : "peer_queued", to, address: handle, seq, verdict, ...(subscription !== undefined ? { subscription } : {}), ...(subscriptionSeq !== undefined ? { subscriptionSeq } : {}), ...(rowRestored !== "present" ? { directoryRow: rowRestored } : {}) },
+                    details: { type: "send-message", status: offline ? "peer_parked_offline" : "peer_queued", to, address: handle, seq, verdict, ...(subscription !== undefined ? { subscription } : {}), ...(subscriptionSeq !== undefined ? { subscriptionSeq } : {}), ...(rowRestored !== "present" ? { directoryRow: rowRestored } : {}), ...(doorbell !== undefined ? { doorbell } : {}) },
+                };
+            };
+            const deliverOverSocket = async (record, peerLabel, modeClass) => {
+                if (notifyWhenIdle)
+                    return peerRefusal("peer_send.invalid_target", `notify_when_idle is only supported for peer sessions that drain this host's mailbox store, and ${peerLabel} is reached over its socket. Nothing was sent.`);
+                if (opts.peerChannel === undefined)
+                    return peerRefusal("peer_send.not_reachable", `${peerLabel} does not drain this host's mailbox store (a Claude Code session, or a session of this engine on another store), so a message parked here would never be read, and no socket channel is wired here to reach it (RunnerDeps.peerChannel). Nothing was sent.`);
+                if (record.liveness !== "live")
+                    return peerRefusal("peer_send.not_reachable", `${peerLabel} is reached only over its socket and is not running; nothing holds a message for it while it is down. Nothing was sent.`);
+                const recipientKey = peerAxisToken(peerScope, "s", record.sessionId);
+                const sendVerdict = judgePeerAdmission(peerScope, recipientKey, { senderKey, body: message, prospectiveChain, ownTokens: [recipientKey] }, admissionConfig, undefined, "send");
+                if (!sendVerdict.ok)
+                    return admissionRefusal(sendVerdict.reason, peerLabel);
+                const verdict = await opts.peerChannel.dial(record.sockPath, {
+                    body: message,
+                    ...(peerSelfSessionId !== undefined ? { fromSession: peerSelfSessionId } : {}),
+                    fromName: ownRowName ?? opts.peerSelfSession?.name ?? senderLabel,
+                    ...(modeClass === "bypass" || modeClass === "prompting" ? { fromMode: modeClass } : {}),
+                    hopChain: prospectiveChain,
+                });
+                if (!verdict.ok)
+                    return peerRefusal(verdict.code, `${peerLabel} could not be reached over its socket — ${verdict.message}.${verdict.code === "peer_send.send_uncertain" ? " It may have arrived: do not resend the same content blindly." : " Nothing was delivered."}`);
+                return {
+                    content: `Message sent to ${peerLabel} over its socket: it does not drain this host's mailbox store, so nothing is parked here, and the socket answers no acknowledgement — the message was written to its socket once and the connection closed cleanly, which is all this receipt confirms (not that its session took it in, nor that its model read it). Continue with your task; do not resend the same content.`,
+                    details: { type: "send-message", status: "peer_delivered", to, address: peerSessionBoxHandle(record.sessionId), verdict },
                 };
             };
             const settlePeerResolution = async (r) => {
@@ -877,7 +906,7 @@ export function createSendMessageTool(opts) {
                             (suggestion !== undefined ? ` Did you mean: ${suggestion}?` : "") +
                             (labels.length > 0 ? ` Running background agents: ${labels.join(", ")}.` : "") +
                             ` Reachable from here: ${reachable.join("; ").slice(0, 300)}.` +
-                            ` Note: a completed foreground agent is not resumable (its transcript is not retained) — spawn with run_in_background to keep an agent addressable, or launch a new agent.`,
+                            ` Note: a completed foreground agent is not addressable (nothing retains its transcript) — name an agent or run it in the background to keep it addressable (a named agent always runs in the background), or launch a new agent.`,
                         details: { error: "not_found", to, ...(suggestion !== undefined ? { suggestion } : {}) },
                         isError: true,
                     };

package/dist/agents/subagent.d.ts

@@ -65,7 +65,7 @@ interface ReviewSample {
 /** Layered head/middle/tail sample of `text` under `budget`, with each skipped span marked in band so the
  *  reader can see that the material is discontinuous. Exported for tests (window determinism). */
 export declare function layeredReviewSample(text: string, budget?: number, windows?: number): ReviewSample;
-/** Default model-facing name of the delegation tool (CC 2.1.187 `Agent`; legacy alias `Task`). */
+/** Default model-facing name of the delegation tool (`Agent`; legacy alias `Task`). */
 export declare const DEFAULT_SUBAGENT_TOOL_NAME = "Agent";
 /**
  * extraTools 快审 S4 — per-root-spawn-tree cap on `extraTools` factory evaluations. The factory runs
@@ -77,8 +77,8 @@ export declare const DEFAULT_SUBAGENT_TOOL_NAME = "Agent";
  * runs) with the same generic-note + host-sink disclosure as a factory failure (S3 posture).
  */
 export declare const EXTRA_TOOLS_MAX_FACTORY_CALLS_PER_TREE = 64;
-/** RB-292 — default delegation nesting depth. CC 2.1.220 `bee()` @272064 falls back to `aHu = 3`
- *  @272076 (cli250.js:37597); the previous value 5 was CC 2.1.201's `Y4t` and is a stale anchor. Semantics (off-by-one)
+/** RB-292 — default delegation nesting depth: 3, the reference's own default (`CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH`, cli296.js:245773).
+ *  Semantics (off-by-one)
  *  are pinned on {@link SubagentToolOptions.maxDepth}. */
 export declare const DEFAULT_SUBAGENT_MAX_DEPTH = 3;
 /**
@@ -91,31 +91,17 @@ export declare const EXTRA_TOOLS_FAILED_NOTE = "note: extraTools evaluation fail
 /** extraTools 快审 S4 — the fixed model-facing disclosure for a budget-exhausted (skipped) evaluation. */
 export declare const EXTRA_TOOLS_BUDGET_NOTE = "note: extraTools evaluation was skipped \u2014 this spawn tree exhausted its factory-call budget (64); no dynamic tools were injected for this spawn.";
 /**
- * CC206-B 欠账 — the Agent completed card's structured `toolStats` (CC 206:541193-541201 `sfd` schema:
- * seven counters, `.optional()`; counting logic 206:540431-540491 `_my`). CC derives the counts from the
- * child's transcript (assistant `tool_use` blocks) and FOLDS nested delegations' toolStats in via each
- * user message's `toolUseResult.toolStats`; sema counts on the shared forward-event sink instead — the
- * sink re-threads DESCENDANT events too (grandchildren bubble through, see subagent-steps.ts header), so
- * the cumulative semantics match without a fold step. Delegation calls themselves are excluded from every
- * bucket (CC excludes `gi`=Agent and `yU`=Task, 206:540453-540455). `linesAdded`/`linesRemoved` mirror CC
- * `i3r` (206:399357-399375): LINE COUNTS OF THE EDIT ARGUMENTS (new/old_string, Write content, NotebookEdit
- * new_source) — not a real diff; honest to CC's own approximation.
+ * The Agent completed card's structured `toolStats`: seven counters, each `.optional()`. sema counts them on the
+ * shared forward-event sink — the sink re-threads DESCENDANT events too (grandchildren bubble through, see
+ * subagent-steps.ts header), so nested delegations are counted without a separate fold step. Delegation calls
+ * themselves are excluded from every bucket. `linesAdded`/`linesRemoved` are LINE COUNTS OF THE EDIT ARGUMENTS
+ * (new/old_string, Write content, NotebookEdit new_source) — not a real diff.
  *
- * RB-303 — ANCHOR REFRESHED to CC 2.1.220 (schema @409081-409090, counting `U2_` @408252-408312).
- * The seven counters below are byte-for-byte the same seven, and the counting rules are unchanged
- * (Agent/Task excluded; nested folds via each user message's `toolUseResult.toolStats`). Two 220
- * facts the 206 anchor predates:
- *  • 220 declares an EIGHTH, optional field: `frameCount`. It counts calls to CC's Artifact tool
- *    (`F2_ = ARTIFACT_TOOL_NAME` @409045) with `input.action !== "list"`, and it is the one counter
- *    that also joins the "did this child do anything at all" sum (@408306-408312). sema has no
- *    Artifact tool, so there is no call to count: the field is deliberately NOT added (an
- *    always-absent counter is noise on every consumer). Registered as a divergence candidate — if a
- *    deployment ever mounts an artifact-shaped tool, this is where it lands.
- *  • 220's Agent result carries `modelsUsed` (ordered distinct models, emitted only when length > 1
- *    @408398) and `resolvedModel` (@466120-466127) beside toolStats. sema reports the resolved model
- *    through `TaskResult.model` and has no mid-run swap history on the delegation card. Also
- *    registered rather than added: the swap list needs a per-turn model ledger sema does not keep,
- *    and inventing a one-element array would be a face without a mechanism.
+ * Two fields of the reference's card are deliberately NOT carried, each registered as a divergence candidate:
+ *  • `frameCount` (cli296.js:34029), a count of artifact-tool calls.
+ *  • `modelsUsed` (cli296.js:54014), the ordered distinct models: sema reports the resolved model through
+ *    `TaskResult.model` and has no mid-run swap history on the delegation card; the swap list needs a per-turn
+ *    model ledger sema does not keep, and inventing a one-element array would be a face without a mechanism.
  */
 export interface SubagentToolStats {
     readCount: number;
@@ -134,9 +120,9 @@ export interface SubagentToolStats {
  */
 export declare const FORK_SUBAGENT_TYPE = "fork";
 /**
- * The BUILT-IN "general-purpose" `subagent_type` alias (CC 2.1.207 parity — 锚 pretty.js:459482 `oje`:
+ * The BUILT-IN "general-purpose" `subagent_type` alias (the reference ships the same built-in definition:
  * CC's agent registry always contains a built-in `general-purpose` definition with `tools: ["*"]`, and an
- * OMITTED `subagent_type` defaults to it, :492377 `t ?? oje.agentType`). CC-ecosystem prompts/skills
+ * OMITTED `subagent_type` defaults to it). CC-ecosystem prompts/skills
  * therefore hardcode `subagent_type: "general-purpose"` freely. sema's equivalent of that built-in is the
  * plain clean-context delegation (full tool pool, SUBAGENT_PROMPT persona) — so the literal FOLDS to the
  * omitted-type path instead of bouncing as an unknown type. A deployment (or builtin) agent definition of
@@ -182,9 +168,6 @@ export interface SubagentWorktreeIsolation {
     /** CC "auto-cleaned if unchanged": remove the worktree when clean, keep it when the child made changes. */
     finish(worktreeDir: string): Promise<"pruned" | "kept">;
 }
-/** Is `result` one of the delegation tool's refusals before any child ran ({@link notStartedResult})? The brand only: the identity
- *  of its `details` object, never what the result says. */
-export declare function isNotStartedDelegationResult(result: unknown): boolean;
 /**
  * Build the {@link SubagentWorktreeIsolation} helper over a base env + repo root. Called by `prepare-task`
  * (closure over the run's ExecutionEnv/taskRootPath — trusted, mirrors the scheduler/fork mounts). The
@@ -568,10 +551,7 @@ export interface SubagentToolOptions {
      * `WiringManifest.fleet.subagentTranscripts` is the ADDRESSABILITY tier and folds to `"none"` on
      * the absent-row-store arm before it looks at a session store, so it cannot separate the first
      * shape above from the third. What DOES answer it is this runner's store's own pair of
-     * declarations — `sessions.durability` and its release/evict policy — read together. Upstream
-     * (CC 2.1.250) writes a sub-agent transcript unconditionally to its own file beside the parent
-     * session, so "the child conversation is readable afterwards" is never conditional on a store
-     * tier there.
+     * declarations — `sessions.durability` and its release/evict policy — read together.
      */
     runner: RunnerSelfSeat;
     /**
@@ -644,8 +624,7 @@ export interface SubagentToolOptions {
      */
     agents?: AgentDefinition[];
     /**
-     * F1 (CC 2.1.198 parity): offer the BUILT-IN read-only `Explore`/`Plan` agent types (CC `HCe`
-     * registry, GA default-on — pretty.js:487221-487240 + iAt :487127). Default `true` (CC posture);
+     * F1: offer the BUILT-IN read-only `Explore`/`Plan` agent types, on by default. Default `true`;
      * `false` removes them (the config-driven analog of CC's `CLAUDE_AGENT_SDK_DISABLE_BUILTIN_AGENTS`).
      * A deployment definition named "Explore"/"Plan" SHADOWS the built-in of the same name (definition
      * wins — fork-shadowing precedent).
@@ -690,10 +669,15 @@ export interface SubagentToolOptions {
     allowTools?: string[];
     /** Tool-level denylist (design/38 1A), used when no `agent` is selected: the denied half of the child's own selector layer (a deny wins). */
     denyTools?: string[];
-    /** System prompt / persona for the child. Default (1.259.0, CC 198 parity): the LEAN
+    /** System prompt / persona for the child, by TEXT — the child's own role-base statement, written on its task seat (an
+     *  agent definition's `systemPrompt` wins over it). Default (since 1.259.0): the LEAN
      *  {@link SUBAGENT_PROMPT} (agent persona + return contract), NOT the full default constitution role
      *  base — pass `DEFAULT_SYSTEM_PROMPT` here explicitly to restore the pre-1.259 behavior. */
     systemPrompt?: string;
+    /** The child's role base by WORD (`TaskSpec.promptRole`'s closed set: `"code"` gives the children the catalog's coding
+     *  base): the same seat as {@link systemPrompt} (text beside it replaces the base this word selects) — so a role
+     *  preset never overtakes it. Outside the closed set ⇒ refused when the tool is built (`config.prompt_selector_invalid`). */
+    promptRole?: import("../prompt-assembly/catalog/schema.js").HostRole;
     /** Tool name exposed to the parent. Default "Agent". */
     name?: string;
     /** What the child is for (shown to the parent in the tool description). */
@@ -704,11 +688,9 @@ export interface SubagentToolOptions {
      * Max nesting depth of delegation. A child at depth `d` only receives a delegation tool when
      * `d + 1 < maxDepth`, so it cannot recurse past the limit.
      *
-     * Default 3 (RB-292) — CC 2.1.220 parity: `bee()` @272064 returns `CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH`
-     * when set, else a remote-config value, else the constant `aHu = 3` @272076 (cli250.js:37597). The old default of 5 was
-     * anchored on CC 2.1.201's `Y4t` and upstream has since moved; 5 is a stale anchor, not a sema choice.
+     * Default 3 (RB-292): the same default as the reference (`CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH`, cli296.js:245773).
      * sema exposes the override as THIS option rather than an env var (deployments configure the tool, not
-     * the process), so the env/remote-config half of `bee()` has no sema counterpart to keep in sync.
+     * the process), so the env/remote-config half of that lookup has no sema counterpart to keep in sync.
      *
      * Semantics pin (off-by-one checked): with the default, the main agent + children at depths 1-2 all
      * carry a delegation tool, the depth-3 child is the STRUCTURAL leaf (no delegation tool mounted —
@@ -814,56 +796,32 @@ export interface SubagentSpawnContext {
     /** Delegation depth of the SPAWNING tool (0 = the main agent's Agent tool; a grandchild spawn sees 1, …). */
     depth: number;
 }
-/**
- * "general-purpose" alias fold (CC 2.1.207 parity — see {@link GENERAL_PURPOSE_SUBAGENT_TYPE}): rewrite
- * `subagent_type: "general-purpose"` to the OMITTED form so it takes the plain clean-context delegation
- * path (sema's built-in general-purpose equivalent: full tool pool + SUBAGENT_PROMPT persona). Wired both
- * as the tool's `prepareArguments` pre-validation shim (the declared `subagent_type` enum lists only
- * DEFINED agent names, so the literal must rewrite BEFORE the schema check) AND inside execute (direct
- * ToolSpec.execute callers). Idempotent; identity when `shadowed` (a deployment/builtin definition of the
- * same name wins — the literal then resolves as a normal agent lookup, never this fold). This is a LIVE
- * cross-vocabulary mapping, not a compatibility arm (RB-479-A③ retired the Fork `{directive}` adapter
- * that used to share this wiring).
- */
-/**
- * RB-293 — subagent_type fold, CC 2.1.220 `ulr` @317317 verbatim:
- * `e.normalize("NFKC").toLowerCase().replace(/[\p{White_Space}\p{Pd}_]+/gu, "")`.
- *
- * Deliberately lossy and deliberately NOT a resolver: it exists only to decide whether two spellings
- * denote the same roster entry AFTER an exact match has already failed. `\p{Pd}` is the dash punctuation
- * class (so an en-dash paste folds like a hyphen), `\p{White_Space}` covers NBSP and friends, and NFKC
- * folds fullwidth/compatibility forms — the three ways a name gets mangled between a listing line and a
- * tool call. Note it can map DISTINCT roster names onto one key ("code-review" / "code_review"), which
- * is exactly why the caller must treat a multi-hit as ambiguous rather than picking a winner.
- */
-export declare function normalizeSubagentType(value: string): string;
+export { normalizeSubagentType } from "../core/permission-rule-model.js";
 /**
  * A system-prompt note you can append to the PARENT task so the model knows delegation exists.
  * (The tool description below is the primary "explicit instruction"; this is an optional reinforcement.)
  */
 export declare const SUBAGENT_SYSTEM_NOTE: string;
 /**
- * G4 (CC 2.1.198 parity — 锚 pretty.js:225024 `Z4t` fork-boilerplate): the MESSAGE-LAYER instruction
- * frame prepended to a fork child's directive. 198 keeps the fork's SYSTEM prompt byte-identical to the
+ * G4: the MESSAGE-LAYER instruction
+ * frame prepended to a fork child's directive. The fork's SYSTEM prompt stays byte-identical to the
  * parent (prompt-cache) and carries the fork behavior contract in the messages instead — same posture
  * here: this frame wraps the `prompt` (the child's objective/user turn) and never touches systemPrompt.
- * 198-faithful verbatim (2026-07-10 realignment): the no-spawn line is now the full 198 text — the tool
- * name matches (198 `is`="Agent" = our DEFAULT_SUBAGENT_TOOL_NAME) and our tool card carries its own
- * fork guidance (:939) for the referent. An earlier adaptation dropped the "default to forking" clause
+ * The no-spawn line is the full text — the tool
+ * name matches our DEFAULT_SUBAGENT_TOOL_NAME and our tool card carries its own
+ * fork guidance for the referent. An earlier adaptation dropped the "default to forking" clause
  * as CC-specific; a live identity-confusion incident (a fork reading the parent's delegation record as
  * "someone else is on it" and stopping) showed the parent/fork disambiguation clause is load-bearing —
- * keep the anchor whole. (NOT the 88-era frame — 88's "STOP. READ THIS
- * FIRST… Scope:/Result/Key files" format was rewritten shorter and softer in 198; parity follows 198.)
- * Frame TAIL = the literal directive prefix `Your directive: ` (198 `ZDt`, pretty.js:35621; the Z4t
- * assembly is `…</fork-boilerplate>\n\n${ZDt}${directive}`, :225038, and 198 strips the SAME prefix on
- * read-back, :415673). 1.259.0 合车复审修①: an earlier transcription invented a `<directive-prefix>`
- * tag here — that tag does not exist in 198; the anchor is the plain-text prefix.
+ * keep the frame whole.
+ * Frame TAIL = the literal plain-text directive prefix `Your directive: ` (no `<directive-prefix>` tag exists;
+ * the assembly is `…</fork-boilerplate>\n\n${prefix}${directive}`, and the SAME prefix is stripped on
+ * read-back).
  */
 export declare const FORK_DIRECTIVE_FRAME = "<fork-boilerplate>\nYou are a worker fork. The transcript above is the parent's history \u2014 inherited reference, not your situation. You are NOT a continuation of that agent. Execute ONE directive, then stop.\n\nHard rules:\n- Do NOT spawn subagents with the Agent tool. The \"default to forking\" guidance is for the parent; you ARE the fork, execute directly.\n- One shot: report once and stop. No follow-up questions, no proposed next steps, no waiting for the user.\n\nGuidelines (your directive may override any of these):\n- Stay in scope. Other forks may be handling adjacent work; if you spot something outside your directive, note it in a sentence and move on.\n- Open with one line restating your task, so the parent can spot scope drift at a glance.\n- Be concise \u2014 as short as the answer allows, no shorter. Plain text, no preamble, no meta-commentary.\n- If you committed changes, list the paths and commit hashes in your report.\n</fork-boilerplate>\n\nYour directive: ";
 /**
- * RB-295 (CC 2.1.220 `Kus` @273133 — verbatim modulo the two interpolations): the path-translation note
+ * RB-295: the path-translation note
  * a FORK gets when it also runs under `isolation: "worktree"`. Upstream pushes it as its own message
- * appended AFTER the fork's directive messages (@466667: `if (L && Le) de.push(zr({content: Kus(…)}))`)
+ * appended AFTER the fork's directive messages
  * — it exists precisely because a fork INHERITS the parent's transcript, and every absolute path in that
  * transcript points at the parent's working copy while the fork's tools now resolve inside the worktree.
  * A non-fork worktree child has no inherited paths and gets no note, exactly as upstream.
@@ -874,7 +832,7 @@ export declare const FORK_DIRECTIVE_FRAME = "<fork-boilerplate>\nYou are a worke
  */
 export declare function forkWorktreeTranslationNote(parentCwd: string | undefined, worktreeDir: string): string;
 /**
- * RB-291 — the `async_launched` tool-result card, rebuilt from the CC 2.1.220 anchor (@467305-467320)
+ * RB-291 — the `async_launched` tool-result card, rebuilt from the reference's card
  * and shared by both background lanes (Agent bg + fork bg) so the two copies cannot drift apart again.
  * Three drifts were repaired against the anchor:
  *  ① the closing instruction had inverted the anchor's meaning — sema said "end your response. Do not
@@ -936,8 +894,7 @@ export declare function agentToolsNote(def: {
     denyTools?: string[];
 }): string;
 /**
- * F4 (CC 2.1.198 `tIl` selection half — 锚 pretty.js:453029 `(t && e.whenToUseLean) || e.whenToUse`,
- * `t = yg(mainLoopModel)` :479504): pick the roster guidance text for one agent definition. CC keys
+ * F4: pick the roster guidance text for one agent definition. CC keys
  * `lean` on its simple-system-prompt model predicate; sema runs the CC lean-prompt arm wholesale
  * (provider-neutral engine, web.ts lean-card precedent), so every call site passes the default
  * `lean = true` — a definition WITH `whenToUseLean` shows the lean text (exactly what modern CC main