@wrongstack/core 0.313.1 → 0.316.1

package/dist/{chunk-QVOVMXJR.js → chunk-GJJGJB2R.js}

@@ -1,15 +1,15 @@
 import {
   atomicWrite,
   withFileLock
-} from "./chunk-7ZHZE5EO.js";
+} from "./chunk-OSGLYW5J.js";
+import {
+  expectDefined
+} from "./chunk-PFZO3C6H.js";
 import {
   ERROR_CODES,
   FsError,
   WrongStackError
-} from "./chunk-WOEZV3Q4.js";
-import {
-  expectDefined
-} from "./chunk-PFZO3C6H.js";
+} from "./chunk-25LSLC3G.js";
 
 // src/storage/cloud-config-sync/sanitize.ts
 var SAGE_TREE = {
@@ -59,6 +59,7 @@ var CORE_RUNTIME_TREE = {
     restrictToProjectRoot: true,
     descriptionMode: true,
     disabledTools: true,
+    disabledToolMeta: true,
     maxToolTimeoutMs: true,
     loopDetection: {
       mode: true,
@@ -66,6 +67,13 @@ var CORE_RUNTIME_TREE = {
       cutThreshold: true,
       windowSize: true,
       callRepeatThreshold: true
+    },
+    autoThin: {
+      enabled: true,
+      idleDays: true,
+      minInvocations: true,
+      neverAutoThin: true,
+      applyOnBoot: true
     }
   },
   log: { level: true, format: true },
@@ -276,6 +284,16 @@ var INBOUND_DENIED_PATHS = [
     path: "tools.disabledTools",
     reason: "Could re-enable a tool the operator deliberately switched off."
   },
+  {
+    namespace: "core.runtime",
+    path: "tools.disabledToolMeta",
+    reason: "Could rewrite the disabled-tool audit trail to hide operator intent."
+  },
+  {
+    namespace: "core.runtime",
+    path: "tools.autoThin",
+    reason: "Could switch on or tune the auto-thinning pipeline without operator consent, silently disabling tools on remote pulls."
+  },
   {
     namespace: "ui.preferences",
     path: "autonomy.defaultMode",
@@ -423,7 +441,7 @@ function reinjectLocalSecrets(local, incoming) {
   const out = { ...incoming };
   for (const [key, value] of Object.entries(local)) {
     const secretish = SECRET_KEY.test(key) || typeof value === "string" && ENCRYPTED_VALUE.test(value);
-    if (secretish && !(key in incoming)) {
+    if (secretish && (!(key in incoming) || incoming[key] === void 0 || incoming[key] === null)) {
       out[key] = value;
       continue;
     }
@@ -812,14 +830,14 @@ var PromptUsageStore = class {
   async recent(limit = 15) {
     const usage = await this.load();
     return Object.entries(usage).map(([slug, u]) => ({ slug, usage: u })).sort(
-      (a, b) => new Date(b.usage.lastUsedAt).getTime() - new Date(a.usage.lastUsedAt).getTime() || b.usage.count - a.usage.count
+      (a, b) => toTimestamp(b.usage.lastUsedAt) - toTimestamp(a.usage.lastUsedAt) || b.usage.count - a.usage.count
     ).slice(0, limit);
   }
   /** Slugs ordered by usage count (then recency), capped at `limit`. */
   async top(limit = 15) {
     const usage = await this.load();
     return Object.entries(usage).map(([slug, u]) => ({ slug, usage: u })).sort(
-      (a, b) => b.usage.count - a.usage.count || new Date(b.usage.lastUsedAt).getTime() - new Date(a.usage.lastUsedAt).getTime()
+      (a, b) => b.usage.count - a.usage.count || toTimestamp(b.usage.lastUsedAt) - toTimestamp(a.usage.lastUsedAt)
     ).slice(0, limit);
   }
   scheduleDrain() {
@@ -881,6 +899,11 @@ function sameSignature(a, b) {
 function cloneUsage(usage) {
   return Object.fromEntries(Object.entries(usage).map(([slug, value]) => [slug, { ...value }]));
 }
+function toTimestamp(iso) {
+  if (!iso) return 0;
+  const t = new Date(iso).getTime();
+  return Number.isNaN(t) ? 0 : t;
+}
 
 // src/storage/cloud-sync.ts
 import * as fs3 from "node:fs/promises";
@@ -1348,4 +1371,4 @@ export {
   ALL_SYNC_CATEGORIES,
   CloudSync
 };
-//# sourceMappingURL=chunk-QVOVMXJR.js.map
+//# sourceMappingURL=chunk-GJJGJB2R.js.map

package/dist/{chunk-4XV6IR37.js → chunk-HI3JGZR2.js}

@@ -1,6 +1,6 @@
 import {
   atomicWrite
-} from "./chunk-7ZHZE5EO.js";
+} from "./chunk-OSGLYW5J.js";
 
 // src/utils/ulid.ts
 import { randomBytes } from "node:crypto";
@@ -27,10 +27,11 @@ function encodeRandom(len) {
   return str;
 }
 function ulid(seedTime = Date.now()) {
-  return encodeTime(seedTime, TIME_LEN) + encodeRandom(RANDOM_LEN);
+  const safeTime = typeof seedTime === "number" && Number.isFinite(seedTime) && seedTime > 0 ? seedTime : Date.now();
+  return encodeTime(safeTime, TIME_LEN) + encodeRandom(RANDOM_LEN);
 }
 function isUlid(value) {
-  if (value.length !== TIME_LEN + RANDOM_LEN) return false;
+  if (typeof value !== "string" || value.length !== TIME_LEN + RANDOM_LEN) return false;
   for (const ch of value) {
     if (!ENCODING.includes(ch)) return false;
   }
@@ -130,8 +131,8 @@ async function ensureProjectGitignore(projectRoot) {
     }
   }
   if (!changed) return;
-  await fsPromises.writeFile(filePath, `${lines.join("\n")}
-`, "utf8");
+  const eol = content.includes("\r\n") ? "\r\n" : "\n";
+  await atomicWrite(filePath, `${lines.join(eol)}${eol}`);
 }
 function makeIdentity(projectId) {
   if (!isProjectId(projectId)) {
@@ -184,4 +185,4 @@ export {
   rekeyProjectIdentity,
   ensureProjectGitignore
 };
-//# sourceMappingURL=chunk-4XV6IR37.js.map
+//# sourceMappingURL=chunk-HI3JGZR2.js.map

package/dist/{chunk-FSWCWSTS.js → chunk-HMLIGAU7.js}

@@ -133,29 +133,18 @@ var MODEL_FAMILY_RATIO = {
   // DeepSeek: ~3.5 chars/token
   deepseek: 3.5
 };
-var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
-var _estimateCacheOrder = [];
-var ESTIMATE_CACHE_MAX_SIZE = 5e4;
-function estimateCacheKey(source) {
-  let h = 5381;
-  for (let i = 0; i < source.length; i++) {
-    h = (h << 5) + h + source.charCodeAt(i) | 0;
+var PAYLOAD_TOKEN_MEMO = /* @__PURE__ */ new WeakMap();
+function memoizedPayloadTokens(payload) {
+  const cached = PAYLOAD_TOKEN_MEMO.get(payload);
+  if (cached !== void 0) return cached;
+  let str;
+  try {
+    str = JSON.stringify(payload) ?? "";
+  } catch {
+    str = String(payload);
   }
-  return `${source.length}:${h >>> 0}`;
-}
-function getCachedEstimate(source, compute) {
-  const key = estimateCacheKey(source);
-  const existing = ESTIMATE_CACHE.get(key);
-  if (existing !== void 0) return existing;
-  if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
-    while (ESTIMATE_CACHE.size > Math.floor(ESTIMATE_CACHE_MAX_SIZE / 2)) {
-      const oldest = _estimateCacheOrder.shift();
-      if (oldest !== void 0) ESTIMATE_CACHE.delete(oldest);
-    }
-  }
-  const estimate = compute(source);
-  ESTIMATE_CACHE.set(key, estimate);
-  _estimateCacheOrder.push(key);
+  const estimate = RoughTokenEstimate(str);
+  PAYLOAD_TOKEN_MEMO.set(payload, estimate);
   return estimate;
 }
 function estimateToolInputTokens(input) {
@@ -163,11 +152,14 @@ function estimateToolInputTokens(input) {
   if (input === null || typeof input !== "object") {
     return RoughTokenEstimate(String(input));
   }
-  return getCachedEstimate(JSON.stringify(input), (key) => RoughTokenEstimate(key));
+  return memoizedPayloadTokens(input);
 }
 function estimateToolResultTokens(content) {
   if (typeof content === "string") return RoughTokenEstimate(content);
-  return getCachedEstimate(JSON.stringify(content), (key) => RoughTokenEstimate(key));
+  if (content === null || typeof content !== "object") {
+    return RoughTokenEstimate(String(content));
+  }
+  return memoizedPayloadTokens(content);
 }
 function estimateTextTokens(text) {
   return RoughTokenEstimate(text);
@@ -179,7 +171,15 @@ function computeMessageTokens(msg) {
     if (b.type === "text") total += estimateTextTokens(b.text);
     else if (b.type === "tool_use") total += estimateToolInputTokens(b.input);
     else if (b.type === "tool_result") total += estimateToolResultTokens(b.content);
-    else total += RoughTokenEstimate(JSON.stringify(b));
+    else {
+      let str;
+      try {
+        str = JSON.stringify(b) ?? "";
+      } catch {
+        str = String(b);
+      }
+      total += RoughTokenEstimate(str);
+    }
   }
   return total;
 }
@@ -392,4 +392,4 @@ export {
   estimateRequestTokensUpperBound,
   resetCalibration
 };
-//# sourceMappingURL=chunk-FSWCWSTS.js.map
+//# sourceMappingURL=chunk-HMLIGAU7.js.map

package/dist/{chunk-PFXFQQRT.js → chunk-HXKZ7OBQ.js}

@@ -1,55 +1,19 @@
+import {
+  reportEventTypeFor,
+  validateReportTransition
+} from "./chunk-WP7BVANJ.js";
 import {
   SECRET_FILE_MODE
-} from "./chunk-H5E77KUJ.js";
+} from "./chunk-6FHWXLPT.js";
 import {
   atomicWrite,
   withFileLock
-} from "./chunk-7ZHZE5EO.js";
+} from "./chunk-OSGLYW5J.js";
 
 // src/plugins/review-report-store.ts
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path from "node:path";
-
-// src/plugins/review-report-types.ts
-var InvalidReportTransitionError = class extends Error {
-  from;
-  to;
-  constructor(from, to, reason) {
-    const msg = reason ?? `Invalid report transition from "${from}" to "${to}"`;
-    super(msg);
-    this.name = "InvalidReportTransitionError";
-    this.from = from;
-    this.to = to;
-  }
-};
-var REPORT_TRANSITION_MATRIX = {
-  open: /* @__PURE__ */ new Set(["actioned", "completed", "skipped"]),
-  actioned: /* @__PURE__ */ new Set(["completed", "skipped"]),
-  completed: /* @__PURE__ */ new Set(["open"]),
-  skipped: /* @__PURE__ */ new Set(["open"])
-};
-function validateReportTransition(from, to) {
-  if (from === to) return;
-  const allowed = REPORT_TRANSITION_MATRIX[from];
-  if (!allowed?.has(to)) {
-    throw new InvalidReportTransitionError(from, to);
-  }
-}
-function reportEventTypeFor(to) {
-  switch (to) {
-    case "actioned":
-      return "actioned";
-    case "completed":
-      return "completed";
-    case "skipped":
-      return "skipped";
-    default:
-      return "reopened";
-  }
-}
-
-// src/plugins/review-report-store.ts
 var REPORT_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 var REPORT_DEFAULT_PAGE_SIZE = 25;
 var NL = "\n";
@@ -336,4 +300,4 @@ export {
   resolveReportStorePath,
   JsonlReportStore
 };
-//# sourceMappingURL=chunk-PFXFQQRT.js.map
+//# sourceMappingURL=chunk-HXKZ7OBQ.js.map

package/dist/{chunk-2FQL4PDC.js → chunk-I7DALG7J.js}

@@ -7,13 +7,13 @@ import {
 import {
   estimateMessageTokens,
   estimateTextTokens
-} from "./chunk-FSWCWSTS.js";
-import {
-  isTextBlock
-} from "./chunk-O37BQ65S.js";
+} from "./chunk-HMLIGAU7.js";
 import {
   expectDefined
 } from "./chunk-PFZO3C6H.js";
+import {
+  isTextBlock
+} from "./chunk-O37BQ65S.js";
 
 // src/utils/compaction-preview.ts
 var PATH_HINT_PATTERN = /(?:(?:[A-Za-z]:)?[./\\]?[\w@.-]+(?:[\\/][\w@(). -]+)+\.[A-Za-z0-9]{1,12})/g;
@@ -289,4 +289,4 @@ export {
   buildCompactionPreview,
   LLMSelector
 };
-//# sourceMappingURL=chunk-2FQL4PDC.js.map
+//# sourceMappingURL=chunk-I7DALG7J.js.map

package/dist/{chunk-GM54GJBU.js → chunk-IRUTEHCE.js}

@@ -2,13 +2,13 @@ import {
   isMailboxReceiptRecordV2,
   normalizeRecipient,
   validateSendType
-} from "./chunk-W4A6QA3D.js";
+} from "./chunk-FWNLEZYG.js";
 import {
   withSqliteExperimentalWarningSuppressed
 } from "./chunk-LX5QWLBL.js";
 import {
   projectSlug
-} from "./chunk-YNCVSFGF.js";
+} from "./chunk-SAFHACFA.js";
 
 // src/coordination/mailbox-constants.ts
 var AGENT_STALE_MS = 6e4;
@@ -957,4 +957,4 @@ export {
   initializeSchema,
   migrateLegacyFiles
 };
-//# sourceMappingURL=chunk-GM54GJBU.js.map
+//# sourceMappingURL=chunk-IRUTEHCE.js.map

package/dist/{chunk-TYW2GI5I.js → chunk-J2WRWR37.js}

@@ -1,20 +1,20 @@
 import {
   SYSTEM_BLOCK_SOURCE,
   buildLiveNextStepsGateBlock
-} from "./chunk-WZO23AWO.js";
+} from "./chunk-M27LIEKV.js";
 import {
   color,
   writeErr
 } from "./chunk-4VWO3ZXL.js";
 import {
   buildCompletedWorkLedgerBlock
-} from "./chunk-EFEHDQGY.js";
+} from "./chunk-ZHZ2Y2DH.js";
 import {
   estimateTextTokens,
   estimateToolDefTokens,
   estimateToolInputTokens,
   estimateToolResultTokens
-} from "./chunk-FSWCWSTS.js";
+} from "./chunk-HMLIGAU7.js";
 import {
   expectDefined
 } from "./chunk-PFZO3C6H.js";
@@ -46,6 +46,7 @@ async function checkConnectivity(opts) {
 async function probe(url, timeoutMs) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
+  if (typeof timer.unref === "function") timer.unref();
   try {
     await fetch(url, { method: "HEAD", signal: controller.signal });
     return true;
@@ -143,11 +144,25 @@ function getContextBreakdown(ctx) {
         case "tool_result":
           histToolResults += estimateToolResultTokens(b.content);
           break;
-        case "thinking":
-          histThinking += estimateTextTokens(JSON.stringify(b));
+        case "thinking": {
+          let str;
+          try {
+            str = JSON.stringify(b) ?? "";
+          } catch {
+            str = String(b);
+          }
+          histThinking += estimateTextTokens(str);
           break;
-        default:
-          histOther += estimateTextTokens(JSON.stringify(b));
+        }
+        default: {
+          let str;
+          try {
+            str = JSON.stringify(b) ?? "";
+          } catch {
+            str = String(b);
+          }
+          histOther += estimateTextTokens(str);
+        }
       }
     }
   }
@@ -335,8 +350,8 @@ function backtrack(trace, a, b, N, M, finalD) {
 }
 function unifiedDiff(oldText, newText, opts = {}) {
   const context = opts.context ?? 3;
-  const a = oldText.split("\n");
-  const b = newText.split("\n");
+  const a = oldText.replace(/\r\n/g, "\n").split("\n");
+  const b = newText.replace(/\r\n/g, "\n").split("\n");
   if (a[a.length - 1] === "") a.pop();
   if (b[b.length - 1] === "") b.pop();
   const edits = myersDiff(a, b);
@@ -482,6 +497,12 @@ function globToRegex(pat) {
       re += "[^/\\\\]";
       i++;
     } else if (c === "[") {
+      const closeIndex = pat.indexOf("]", i + 1);
+      if (closeIndex === -1) {
+        re += "\\[";
+        i++;
+        continue;
+      }
       let cls = "[";
       i++;
       if (pat[i] === "!" || pat[i] === "^") {
@@ -521,10 +542,12 @@ function baseDir(pat) {
 }
 async function expandGlob(pattern) {
   if (!isGlob(pattern)) return [pattern];
+  const normalized = pattern.replace(/\\/g, "/");
   const results = /* @__PURE__ */ new Set();
   const abs = isAbsolute(pattern);
-  const base = abs ? baseDir(pattern) : baseDir(pattern);
-  const relPat = base === "." ? pattern : pattern.slice(base.length + 1);
+  const base = baseDir(pattern);
+  const baseNorm = base.replace(/\\/g, "/");
+  const relPat = base === "." ? normalized : normalized.slice(baseNorm.length + 1);
   async function walk(dir, pat) {
     let entries;
     try {
@@ -680,6 +703,7 @@ function mergeCustomModelDefs(providerCustomModels, configModels) {
 
 // src/utils/newline-normalize.ts
 function detectNewlineStyle(text) {
+  if (typeof text !== "string") return "lf";
   let lf = 0;
   let crlf = 0;
   let cr = 0;
@@ -701,12 +725,14 @@ function detectNewlineStyle(text) {
   return "lf";
 }
 function toStyle(text, style) {
+  if (typeof text !== "string") return "";
   const normalized = text.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
   if (style === "lf") return normalized;
   if (style === "crlf") return normalized.replace(/\n/g, "\r\n");
   return normalized.replace(/\n/g, "\r");
 }
 function normalizeToLf(text) {
+  if (typeof text !== "string") return "";
   return text.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
 }
 
@@ -714,7 +740,7 @@ function normalizeToLf(text) {
 import * as path from "node:path";
 var MAX_PATH_SEGMENT_LENGTH = 256;
 function isSafePathSegment(value) {
-  if (value.length === 0 || value.length > MAX_PATH_SEGMENT_LENGTH) return false;
+  if (typeof value !== "string" || value.length === 0 || value.length > MAX_PATH_SEGMENT_LENGTH) return false;
   if (value === "." || value === "..") return false;
   if (value.includes("/") || value.includes("\\")) return false;
   if (value.includes("\0")) return false;
@@ -814,6 +840,7 @@ function sleep(ms) {
 
 // src/utils/slug.ts
 function slugify(name, fallback = "prompt", maxLen = 64) {
+  if (typeof name !== "string") return fallback;
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, maxLen).replace(/-+$/g, "") || fallback;
 }
 
@@ -1074,4 +1101,4 @@ export {
   getToolResultRenderMode,
   applyToolResultRenderModes
 };
-//# sourceMappingURL=chunk-TYW2GI5I.js.map
+//# sourceMappingURL=chunk-J2WRWR37.js.map

package/dist/{chunk-ZEHUCJHY.js → chunk-JFPJ6LLQ.js}

@@ -1,6 +1,6 @@
 import {
   ToolCapabilities
-} from "./chunk-A455ATZB.js";
+} from "./chunk-UBGDX6FI.js";
 
 // src/security/readonly-permission-policy.ts
 import * as path from "node:path";
@@ -126,4 +126,4 @@ export {
   toolMutates,
   ReadOnlyPermissionPolicy
 };
-//# sourceMappingURL=chunk-ZEHUCJHY.js.map
+//# sourceMappingURL=chunk-JFPJ6LLQ.js.map

package/dist/chunk-JMULFFLN.js

@@ -0,0 +1,9 @@
+// src/storage/session-store/directory-scan.ts
+function shouldSkipSessionDirectoryEntry(name) {
+  return name.startsWith(".") && name !== ".wrongstack" || name === "shared" || name === "subagents" || name === "attachments";
+}
+
+export {
+  shouldSkipSessionDirectoryEntry
+};
+//# sourceMappingURL=chunk-JMULFFLN.js.map

package/dist/{chunk-RD6DEE36.js → chunk-JO4MGB6Z.js}

@@ -6,23 +6,24 @@ import {
   isMailboxProjectServerMessage,
   mailboxProjectServerEndpoint,
   mailboxProjectServerMetadataPath
-} from "./chunk-5RP3QTRL.js";
+} from "./chunk-PQNS3U7Z.js";
 import {
   HQ_MAILBOX_SNAPSHOT_MIN_INTERVAL_MS,
   resolveProjectDir,
   resolveSendTypeSafe
-} from "./chunk-GM54GJBU.js";
+} from "./chunk-IRUTEHCE.js";
 import {
   acceptMailboxMessageForSession,
   isMailboxMessageVisibleTo,
+  mailboxIdentityBase,
   normalizeRecipient
-} from "./chunk-W4A6QA3D.js";
+} from "./chunk-FWNLEZYG.js";
 import {
   ToolCapabilities
-} from "./chunk-A455ATZB.js";
+} from "./chunk-UBGDX6FI.js";
 import {
   wstackGlobalRoot
-} from "./chunk-YNCVSFGF.js";
+} from "./chunk-SAFHACFA.js";
 import {
   toErrorMessage
 } from "./chunk-TBRL2RCC.js";
@@ -1027,7 +1028,12 @@ async function executeSend(mb, identity, sessionId, i, ctx) {
     audience: delivery.audience,
     priority: i.priority ?? "normal",
     replyTo: i.replyTo,
-    senderSessionId: sessionId
+    senderSessionId: sessionId,
+    // Same scoping rule as `mail_send`: with four tabs live, every one of them
+    // has a leader on this mailbox and an unscoped "to: leader" is accepted by
+    // all four. Only the ambiguous alias, and only from a sender that carries
+    // an explicit owning stamp — see `scopeAgentMailToOwningSession`.
+    ...typeof ctx.meta["sessionId"] === "string" && ctx.meta["sessionId"].length > 0 && delivery.to.trim().toLowerCase() === "leader" ? { sessionAffinity: { sessionId } } : {}
   });
   return {
     ok: true,
@@ -1163,6 +1169,83 @@ function formatMessage(m, readerId) {
   };
 }
 
+// src/coordination/session-note-hub.ts
+function resolveInboxSessionId(inbox) {
+  return typeof inbox.sessionId === "function" ? inbox.sessionId() : inbox.sessionId;
+}
+function identityKeys(inbox) {
+  const keys = /* @__PURE__ */ new Set();
+  const add = (raw) => {
+    if (typeof raw !== "string") return;
+    const value = raw.trim().toLowerCase();
+    if (!value) return;
+    keys.add(value);
+    keys.add(mailboxIdentityBase(value).toLowerCase());
+  };
+  add(inbox.agentId);
+  for (const alias of inbox.aliases ?? []) add(alias);
+  return keys;
+}
+var SessionNoteHub = class {
+  inboxes = /* @__PURE__ */ new Set();
+  buses = /* @__PURE__ */ new Map();
+  register(inbox) {
+    this.inboxes.add(inbox);
+    const rawSid = resolveInboxSessionId(inbox);
+    const sid = rawSid ? rawSid.trim().replace(/\\/g, "/") : void 0;
+    if (sid && inbox.events && !this.buses.has(sid)) this.buses.set(sid, inbox.events);
+    return () => {
+      this.inboxes.delete(inbox);
+    };
+  }
+  post(input) {
+    const sessionId = input.sessionId.trim().replace(/\\/g, "/");
+    const body = input.body.trim();
+    if (!sessionId || !body) return { delivered: 0 };
+    const to = input.to.trim().toLowerCase();
+    const from = input.from.trim() || "unknown";
+    const broadcast = to === "@session" || to === "*" || to === "all";
+    const note = {
+      from,
+      kind: input.kind,
+      body,
+      ...input.subject?.trim() ? { subject: input.subject.trim() } : {}
+    };
+    let delivered = 0;
+    const fromKey = from.toLowerCase();
+    for (const inbox of this.inboxes) {
+      const inboxSid = resolveInboxSessionId(inbox)?.trim().replace(/\\/g, "/");
+      if (inboxSid !== sessionId) continue;
+      const keys = identityKeys(inbox);
+      if (keys.has(fromKey)) continue;
+      if (!broadcast && !keys.has(to)) continue;
+      try {
+        inbox.deliver(note);
+        delivered += 1;
+      } catch {
+      }
+    }
+    try {
+      const bus = input.events ?? this.buses.get(sessionId);
+      bus?.emit("session.note", {
+        sessionId,
+        from,
+        to: input.to.trim(),
+        kind: input.kind,
+        body: note.body,
+        subject: note.subject,
+        ts: Date.now()
+      });
+    } catch {
+    }
+    return { delivered };
+  }
+};
+var sessionNoteHub = new SessionNoteHub();
+function postSessionNote(input) {
+  return sessionNoteHub.post(input);
+}
+
 export {
   isMailboxProjectServerAvailable,
   MailboxProjectServerConnection,
@@ -1173,6 +1256,9 @@ export {
   mailboxSessionTag,
   resolveMailboxIdentity,
   applyMailboxSendPolicy,
-  makeMailboxTool
+  makeMailboxTool,
+  SessionNoteHub,
+  sessionNoteHub,
+  postSessionNote
 };
-//# sourceMappingURL=chunk-RD6DEE36.js.map
+//# sourceMappingURL=chunk-JO4MGB6Z.js.map

package/dist/{chunk-5DSMEVA4.js → chunk-K6BXGITA.js}

@@ -1,13 +1,13 @@
-import {
-  DESIGN_STACKS,
-  isDesignStack
-} from "./chunk-G5S3S5ZN.js";
 import {
   stripFrontmatter
-} from "./chunk-WEBMSQP2.js";
+} from "./chunk-FC2ZGRF3.js";
 import {
   resolveWstackPaths
-} from "./chunk-YNCVSFGF.js";
+} from "./chunk-SAFHACFA.js";
+import {
+  DESIGN_STACKS,
+  isDesignStack
+} from "./chunk-G5S3S5ZN.js";
 
 // src/execution/design-kit-loader.ts
 import { existsSync } from "node:fs";
@@ -928,4 +928,4 @@ export {
   makeDesignStudioRequestMiddleware,
   installDesignStudioMiddleware
 };
-//# sourceMappingURL=chunk-5DSMEVA4.js.map
+//# sourceMappingURL=chunk-K6BXGITA.js.map

package/dist/{chunk-O74MJHXU.js → chunk-KZMSZV32.js}

@@ -1,7 +1,7 @@
 import {
   ERROR_CODES,
   WrongStackError
-} from "./chunk-WOEZV3Q4.js";
+} from "./chunk-25LSLC3G.js";
 
 // src/kernel/container.ts
 var Container = class {
@@ -184,4 +184,4 @@ var Container = class {
 export {
   Container
 };
-//# sourceMappingURL=chunk-O74MJHXU.js.map
+//# sourceMappingURL=chunk-KZMSZV32.js.map