@wrongstack/core 0.313.1 → 0.316.2

package/dist/security/index.js

@@ -10,11 +10,11 @@ import {
   noOpVault,
   rewriteConfigEncrypted,
   rotateConfigKeys
-} from "../chunk-6AKOTGLM.js";
+} from "../chunk-CU546ESW.js";
 import {
   ReadOnlyPermissionPolicy,
   toolMutates
-} from "../chunk-ZEHUCJHY.js";
+} from "../chunk-JFPJ6LLQ.js";
 import {
   decryptConfigSecrets,
   encryptConfigSecrets,
@@ -25,13 +25,32 @@ import {
   evaluateToolKanbanBoundary,
   kanbanGovernance,
   setKanbanGovernance
-} from "../chunk-EPC3GZD4.js";
+} from "../chunk-OOYZPOXM.js";
+import {
+  matchAny,
+  matchAnyCommand,
+  matchGlob,
+  subjectForToolInput
+} from "../chunk-WAHQVNWT.js";
+import {
+  safeParse
+} from "../chunk-W5VITDM2.js";
+import "../chunk-B7F4WVP4.js";
 import {
   ERROR_DETAIL_MAX,
   sanitizeApiError,
   scrubErrorDetail,
   scrubErrorText
-} from "../chunk-PAAWLLZX.js";
+} from "../chunk-Y5YXDM7D.js";
+import {
+  DefaultSecretScrubber
+} from "../chunk-QSTSJOCK.js";
+import {
+  SECRET_DIR_MODE,
+  SECRET_FILE_MODE,
+  restrictDirPermissions,
+  restrictFilePermissions
+} from "../chunk-6FHWXLPT.js";
 import {
   DANGEROUS_FOR_SUBAGENTS,
   ToolCapabilities,
@@ -40,35 +59,16 @@ import {
   getDangerousCapabilities,
   hasCapability,
   hasDangerousCapabilityForSubagents
-} from "../chunk-A455ATZB.js";
-import {
-  SECRET_DIR_MODE,
-  SECRET_FILE_MODE,
-  restrictDirPermissions,
-  restrictFilePermissions
-} from "../chunk-H5E77KUJ.js";
-import {
-  DefaultSecretScrubber
-} from "../chunk-3E244UDA.js";
-import {
-  matchAny,
-  matchAnyCommand,
-  matchGlob,
-  subjectForToolInput
-} from "../chunk-QRTG4XTI.js";
-import {
-  safeParse
-} from "../chunk-RPOA7IAE.js";
-import "../chunk-DEIQMBD2.js";
+} from "../chunk-UBGDX6FI.js";
 import {
   atomicWrite
-} from "../chunk-7ZHZE5EO.js";
+} from "../chunk-OSGLYW5J.js";
 import {
   wstackGlobalRoot
-} from "../chunk-YNCVSFGF.js";
-import "../chunk-WOEZV3Q4.js";
-import "../chunk-TBRL2RCC.js";
+} from "../chunk-SAFHACFA.js";
 import "../chunk-PFZO3C6H.js";
+import "../chunk-25LSLC3G.js";
+import "../chunk-TBRL2RCC.js";
 
 // src/security/directory-permission-policy.ts
 import * as path from "node:path";
@@ -1646,7 +1646,7 @@ var DefaultPermissionPolicy = class {
     return false;
   }
   yoloBlockedAsDestructive(tool, input, ctx) {
-    if (!this.yolo || this.yoloDestructive) return false;
+    if (!this.effectiveYolo(ctx) || this.yoloDestructive) return false;
     if (this.hasAgentStateWriteTarget(tool, input, ctx)) return true;
     if (attachesWellKnownCredential(input)) return true;
     const isShellSurface = tool.name === "bash" || tool.name === "exec" || (tool.capabilities ?? []).includes("shell.arbitrary");
@@ -1658,6 +1658,20 @@ var DefaultPermissionPolicy = class {
   setPromptDelegate(delegate) {
     this.promptDelegate = delegate;
   }
+  /**
+   * YOLO as it applies to ONE conversation.
+   *
+   * `this.yolo` is a process-wide switch, which is right for a CLI or a TUI —
+   * one process, one conversation. A WebUI holds four at once, and YOLO is a
+   * per-tab preference stored on each session's own context meta, so reading
+   * the process switch meant turning YOLO on in one tab auto-approved the
+   * tools of the other three. The instance flag stays as the fallback for
+   * hosts (and tests) that never write the meta key.
+   */
+  effectiveYolo(ctx) {
+    const scoped = ctx?.meta?.["yolo"];
+    return typeof scoped === "boolean" ? scoped : this.yolo;
+  }
   setYolo(enabled) {
     if (this.yolo !== enabled) this._evalCache.clear();
     this.yolo = enabled;
@@ -1745,7 +1759,7 @@ var DefaultPermissionPolicy = class {
     const entry = mergeTrustEntries(this.policy[tool.name], namespaceEntry);
     const subject = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
     const cacheKey = `${tool.name}::${subject ?? tool.name}`;
-    const evalKey = `${cacheKey}::${permissionFingerprint(tool)}`;
+    const evalKey = `${ctx.session?.id ?? "__default__"}::${cacheKey}::${permissionFingerprint(tool)}::y${this.effectiveYolo(ctx) ? 1 : 0}`;
     if (tool.name !== "write" && !this.hasAgentStateWriteTarget(tool, input, ctx)) {
       const cached = this._evalCache.get(evalKey);
       if (cached !== void 0) return cached;
@@ -1805,7 +1819,7 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
-    if (!this.yolo && this.isSensitiveReadCall(tool, input)) {
+    if (!this.effectiveYolo(ctx) && this.isSensitiveReadCall(tool, input)) {
       if (this.promptDelegate) {
         const userDecision = await this.promptDelegate(tool, input, subject ?? tool.name);
         if (userDecision === "always") {
@@ -1841,7 +1855,7 @@ var DefaultPermissionPolicy = class {
         reason: "sensitive file read needs explicit approval"
       };
     }
-    if (this.yolo) {
+    if (this.effectiveYolo(ctx)) {
       if (this.yoloBlockedAsDestructive(tool, input, ctx)) {
         return {
           permission: "confirm",
@@ -1962,7 +1976,7 @@ var DefaultPermissionPolicy = class {
         wildcardEntries: this.wildcardEntries,
         sessionDenied: this.sessionDenied,
         sessionAllowed: this.sessionAllowed,
-        yolo: this.yolo,
+        yolo: this.effectiveYolo(ctx),
         promptDelegatePresent: this.promptDelegate !== void 0,
         isSensitiveReadCall: (t, inp) => this.isSensitiveReadCall(t, inp),
         yoloBlockedAsDestructive: (t, inp, c) => this.yoloBlockedAsDestructive(t, inp, c)

package/dist/security/permission-policy.d.ts

@@ -4,7 +4,7 @@ import type { PermissionDecision, PermissionPolicy, PermissionTrace, TrustPolicy
 import type { Tool } from '../types/tool.js';
 import { type TrustPolicyDiagnostic } from './permission-policy-schema.js';
 export { AutoApprovePermissionPolicy } from './auto-approve-policy.js';
-export { alwaysAllowUnavailableReason, matchesTrust, matchesCommandTrust, hasShellSubject, permissionFingerprint, shellCommandLineFromInput, inputPathLooksSensitive, shellCommandReadsSensitivePath, } from './permission-helpers.js';
+export { alwaysAllowUnavailableReason, inputPathLooksSensitive, matchesTrust, shellCommandLineFromInput, shellCommandReadsSensitivePath } from './permission-helpers.js';
 /**
  * Combine an exact-name trust entry with the wildcard entry that also matched.
  *
@@ -40,6 +40,17 @@ export declare class DefaultPermissionPolicy implements PermissionPolicy {
     private hasAgentStateWriteTarget;
     private yoloBlockedAsDestructive;
     setPromptDelegate(delegate: PermissionPolicyOptions['promptDelegate']): void;
+    /**
+     * YOLO as it applies to ONE conversation.
+     *
+     * `this.yolo` is a process-wide switch, which is right for a CLI or a TUI —
+     * one process, one conversation. A WebUI holds four at once, and YOLO is a
+     * per-tab preference stored on each session's own context meta, so reading
+     * the process switch meant turning YOLO on in one tab auto-approved the
+     * tools of the other three. The instance flag stays as the fallback for
+     * hosts (and tests) that never write the meta key.
+     */
+    private effectiveYolo;
     setYolo(enabled: boolean): void;
     getYolo(): boolean;
     getPolicyDiagnostics(): readonly TrustPolicyDiagnostic[];

package/dist/security/secret-scrubber.d.ts

@@ -10,5 +10,20 @@ export declare class DefaultSecretScrubber implements SecretScrubber {
      * value without a credential anchor returns immediately without regex work.
      */
     scrubObject<T>(obj: T): T;
+    /**
+     * Copy-on-write {@link scrubObject}: clean subtrees come back by reference.
+     *
+     * `scrubObject` rebuilds the entire graph unconditionally — a new object for
+     * every node, a new array for every array — whether or not anything was
+     * redacted. On the read path that is almost all waste: measured over a real
+     * 133 MB journal, 488k nodes and 309k strings were rebuilt so that FOUR
+     * strings could be redacted, costing ~480 ms of allocation and the GC
+     * pressure that comes with it. Rebuilding only the spine above an actual
+     * redaction gives the same output for a fraction of the garbage.
+     *
+     * The sharing is why this is a separate method rather than a change to
+     * `scrubObject`: see the contract note on `SecretScrubber.scrubObjectShared`.
+     */
+    scrubObjectShared<T>(obj: T): T;
 }
 //# sourceMappingURL=secret-scrubber.d.ts.map

package/dist/session-catalog/index.d.ts

@@ -2,5 +2,6 @@ export * from './client.js';
 export * from './endpoint.js';
 export * from './protocol.js';
 export * from './registry.js';
+export * from './session-agents.js';
 export * from './store.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/session-catalog/index.js

@@ -1,17 +1,19 @@
-import "../chunk-M7BS2K6U.js";
+import "../chunk-NHJ75HXY.js";
 import {
   ProjectSessionRegistry,
   getProjectSessionRegistry,
   hasProjectSessionRegistry
-} from "../chunk-YBUJCZ57.js";
+} from "../chunk-4I7HGVVA.js";
 import {
-  SessionCatalogStore
-} from "../chunk-AI4LLQ2U.js";
+  SessionCatalogStore,
+  deriveSessionAgents
+} from "../chunk-27QIURLN.js";
 import {
   SessionCatalogProjectClient,
   resolveSessionCatalogDaemonAvailability,
   resolveSessionCatalogProjectServerUrl
-} from "../chunk-52RTVH4M.js";
+} from "../chunk-F3JWNST7.js";
+import "../chunk-JMULFFLN.js";
 import {
   SESSION_CATALOG_DEFAULT_LEASE_MS,
   SESSION_CATALOG_DEFAULT_RESERVATION_MS,
@@ -24,17 +26,19 @@ import {
   sessionCatalogProjectServerEndpoint,
   sessionCatalogProjectServerKey,
   sessionCatalogProjectServerMetadataPath
-} from "../chunk-E6I5RXVK.js";
-import "../chunk-GM54GJBU.js";
-import "../chunk-W4A6QA3D.js";
-import "../chunk-3E244UDA.js";
-import "../chunk-AD7ZFZCS.js";
+} from "../chunk-AYW5YINX.js";
+import "../chunk-5BMIE7QG.js";
+import "../chunk-IRUTEHCE.js";
+import "../chunk-FWNLEZYG.js";
+import "../chunk-QSTSJOCK.js";
 import "../chunk-TRT2HRWZ.js";
 import "../chunk-LX5QWLBL.js";
-import "../chunk-FAYRX2AD.js";
-import "../chunk-7ZHZE5EO.js";
-import "../chunk-YNCVSFGF.js";
-import "../chunk-WOEZV3Q4.js";
+import "../chunk-POOOIWE5.js";
+import "../chunk-OSGLYW5J.js";
+import "../chunk-SAFHACFA.js";
+import "../chunk-3ECENVHL.js";
+import "../chunk-B4AMLZPB.js";
+import "../chunk-25LSLC3G.js";
 import "../chunk-TBRL2RCC.js";
 export {
   ProjectSessionRegistry,
@@ -46,6 +50,7 @@ export {
   SESSION_CATALOG_PROTOCOL_VERSION,
   SessionCatalogProjectClient,
   SessionCatalogStore,
+  deriveSessionAgents,
   encodeSessionCatalogMessage,
   ensureSessionCatalogSocketDirectory,
   getProjectSessionRegistry,

package/dist/session-catalog/project-server.js

@@ -1,32 +1,35 @@
 #!/usr/bin/env node
 import {
   SessionCatalogStore
-} from "../chunk-AI4LLQ2U.js";
+} from "../chunk-27QIURLN.js";
+import "../chunk-JMULFFLN.js";
 import {
   SESSION_CATALOG_MAX_FRAME_CHARS,
   SESSION_CATALOG_PROTOCOL_VERSION,
   encodeSessionCatalogMessage,
   sessionCatalogProjectServerEndpoint,
   sessionCatalogProjectServerMetadataPath
-} from "../chunk-E6I5RXVK.js";
-import "../chunk-GM54GJBU.js";
-import "../chunk-W4A6QA3D.js";
-import {
-  restrictFilePermissions
-} from "../chunk-H5E77KUJ.js";
-import "../chunk-3E244UDA.js";
+} from "../chunk-AYW5YINX.js";
 import {
   useDaemonPerfDefaults
 } from "../chunk-FNXVT7HF.js";
-import "../chunk-AD7ZFZCS.js";
+import "../chunk-5BMIE7QG.js";
+import "../chunk-IRUTEHCE.js";
+import "../chunk-FWNLEZYG.js";
+import "../chunk-QSTSJOCK.js";
+import {
+  restrictFilePermissions
+} from "../chunk-6FHWXLPT.js";
 import "../chunk-TRT2HRWZ.js";
 import "../chunk-LX5QWLBL.js";
-import "../chunk-FAYRX2AD.js";
+import "../chunk-POOOIWE5.js";
 import {
   atomicWrite
-} from "../chunk-7ZHZE5EO.js";
-import "../chunk-YNCVSFGF.js";
-import "../chunk-WOEZV3Q4.js";
+} from "../chunk-OSGLYW5J.js";
+import "../chunk-SAFHACFA.js";
+import "../chunk-3ECENVHL.js";
+import "../chunk-B4AMLZPB.js";
+import "../chunk-25LSLC3G.js";
 import "../chunk-TBRL2RCC.js";
 
 // src/session-catalog/project-server.ts
@@ -99,6 +102,7 @@ var OPERATION_KEYS = {
   reconnect_lease: ["sessionId", "leaseId", "leaseSecret", "ownerInstanceId", "expiresAt"],
   reserve_resume: ["targetSessionId", "requesterInstanceId", "currentSessionId", "reservationMs"],
   activate_reservation: ["reservation", "entry", "leaseMs"],
+  renew_reservation: ["reservationId", "requesterInstanceId", "reservationMs"],
   cancel_reservation: ["reservationId", "requesterInstanceId"],
   heartbeat: ["credential", "status"],
   publish_agents: ["credential", "revision", "agents"],
@@ -121,6 +125,7 @@ var OPERATION_KEYS = {
   ],
   resolve_id: ["query"],
   get_summary: ["sessionId"],
+  list_session_agents: ["sessionId"],
   rename: ["sessionId", "name"],
   acquire_maintenance: ["sessionId", "operation", "holderId", "leaseMs", "holderPid"],
   release_maintenance: ["lease"],
@@ -228,6 +233,14 @@ async function dispatch(op, args) {
         value.leaseMs
       );
     }
+    case "renew_reservation": {
+      const value = args;
+      return catalog.renewReservation(
+        value.reservationId,
+        value.requesterInstanceId,
+        value.reservationMs
+      );
+    }
     case "cancel_reservation": {
       const value = args;
       catalog.cancelReservation(value.reservationId, value.requesterInstanceId);
@@ -321,6 +334,10 @@ async function dispatch(op, args) {
         value.holderId
       );
     }
+    case "list_session_agents": {
+      const value = args;
+      return catalog.listSessionAgents(value.sessionId);
+    }
     case "rebuild_catalog":
       return catalog.rebuildCatalog();
     default:

package/dist/session-catalog/protocol.d.ts

@@ -1,5 +1,6 @@
-import type { SessionRegistryEntry } from './session-registry-types.js';
 import type { SessionSummary } from '../types/session.js';
+import type { SessionAgentRecord } from './session-agents.js';
+import type { SessionRegistryEntry } from './session-registry-types.js';
 export declare const SESSION_CATALOG_PROTOCOL_VERSION = 1;
 export declare const SESSION_CATALOG_MAX_FRAME_CHARS: number;
 export declare const SESSION_CATALOG_DEFAULT_LEASE_MS = 30000;
@@ -126,6 +127,25 @@ export interface SessionCatalogOperations {
         };
         result: SessionLeaseCredential;
     };
+    /**
+     * Extend a reservation that is still being worked on.
+     *
+     * A resume reserves ownership BEFORE it can know how long the transcript
+     * takes to open, and the default window is 15s. Hydrating a large journal
+     * (load + summary + file-observation validation + opening the append
+     * handle, all of which can also wait on this daemon) routinely outruns it,
+     * and `activate_reservation` then fails with "reservation expired" after
+     * the expensive work is already done. Renewal keeps the reservation alive
+     * for exactly as long as the caller is demonstrably still hydrating.
+     */
+    renew_reservation: {
+        args: {
+            reservationId: string;
+            requesterInstanceId: string;
+            reservationMs?: number;
+        };
+        result: ResumeReservation;
+    };
     cancel_reservation: {
         args: {
             reservationId: string;
@@ -210,6 +230,17 @@ export interface SessionCatalogOperations {
         };
         result: CatalogSessionRecord | null;
     };
+    /**
+     * Agent roster of one session, derived from its journal. Read-only: there
+     * is no write op, because the rows are a projection of the transcript and
+     * a writer would create a second authority that can disagree with it.
+     */
+    list_session_agents: {
+        args: {
+            sessionId: string;
+        };
+        result: SessionAgentRecord[];
+    };
     rename: {
         args: {
             sessionId: string;

package/dist/session-catalog/registry.d.ts

@@ -1,8 +1,22 @@
-import type { AgentEntry, SessionRegistryEntry } from './session-registry-types.js';
 import type { ResumeReservation, SessionCatalogEvent } from './protocol.js';
+import type { AgentEntry, SessionRegistryEntry } from './session-registry-types.js';
 export interface SessionResumeClaim {
     reservation: ResumeReservation;
     activate(entry: SessionRegistryRegistration): Promise<void>;
+    /**
+     * Push the reservation deadline out while the caller is still hydrating.
+     *
+     * The reservation is taken before the transcript is opened, so its window
+     * has to cover work whose duration nobody knows yet. Callers that do slow
+     * work between reserve and activate must call this periodically; without it
+     * a large journal simply outlives its own reservation and `activate` fails
+     * after the expensive part already succeeded.
+     *
+     * Resolves to `false` when the reservation is already settled (activated or
+     * cancelled) — renewal is then a no-op, not an error. Rejects when the
+     * daemon refuses (expired, or owned by someone else).
+     */
+    renew(reservationMs?: number): Promise<boolean>;
     cancel(): Promise<void>;
 }
 export type SessionRegistryRegistration = Omit<SessionRegistryEntry, 'status' | 'lastHeartbeatAt' | 'agentCount' | 'agents'> & {
@@ -36,6 +50,8 @@ export declare class ProjectSessionRegistry {
         sessionId: string;
         projectSlug: string;
         projectRoot: string;
+        /** Initial reservation window. Callers doing slow hydration should also `renew()`. */
+        reservationMs?: number | undefined;
     }): Promise<SessionResumeClaim>;
     updateAgents(agents: AgentEntry[]): Promise<void>;
     private flushAgents;

package/dist/session-catalog/session-agents.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Derive the agent roster of one session from its journal.
+ *
+ * The journal is the source of truth and this is a pure projection over it —
+ * deliberately, because the alternative (agents writing their own rows as they
+ * spawn) creates a second authority that drifts the first time a process dies
+ * between the append and the row. A projection cannot drift: re-run it and it
+ * agrees with the file by construction.
+ *
+ * Three records feed a row, and they do NOT arrive in a fixed order.
+ * `agent_session_linked` is appended by the subagent factory, which runs
+ * INSIDE `coordinator.spawn()`, while `agent_spawned` is appended by the fleet
+ * layer only after that call returns — so the link normally lands first. Every
+ * merge here is therefore an upsert keyed on `agentId`, never a lookup that
+ * assumes the row already exists.
+ */
+import type { Usage } from '../types/provider.js';
+import type { SessionEvent } from '../types/session.js';
+export type SessionAgentStatus = 'running' | 'completed' | 'failed';
+export interface SessionAgentRecord {
+    agentId: string;
+    /** Role the agent was spawned as, from `agent_spawned`. */
+    role?: string | undefined;
+    provider?: string | undefined;
+    model?: string | undefined;
+    /** The agent's own journal id, when it has one of its own. */
+    agentSessionId?: string | undefined;
+    /** Absolute path of the agent's own JSONL, when it has one. */
+    transcriptPath?: string | undefined;
+    /** Set when another agent — not the leader — spawned this one. */
+    parentAgentId?: string | undefined;
+    spawnedAt?: string | undefined;
+    endedAt?: string | undefined;
+    status: SessionAgentStatus;
+    error?: string | undefined;
+    /**
+     * Events in THIS journal stamped with this agent's id.
+     *
+     * Non-zero only for agents running on the parent-interleaved writer, whose
+     * events land in the leader's file. An agent with its own transcript writes
+     * nothing here, so a `0` means "look in `transcriptPath`", not "did nothing".
+     */
+    interleavedEventCount: number;
+    usage?: Usage | undefined;
+}
+/**
+ * Project a session's events into one record per agent, ordered by first
+ * appearance so the roster reads in spawn order.
+ *
+ * Tolerates truncated journals: an agent that never got a terminal record
+ * stays `running`, which is exactly what a crashed-mid-fleet session should
+ * report. Callers that need "running or just never finished" must compare
+ * against the session's own liveness, which this function has no view of.
+ */
+export declare function deriveSessionAgents(events: Iterable<SessionEvent>): SessionAgentRecord[];
+//# sourceMappingURL=session-agents.d.ts.map

package/dist/session-catalog/store-rebuild.d.ts

@@ -1,5 +1,19 @@
 import type { DatabaseSync } from 'node:sqlite';
 import type { SessionSummary } from '../types/session.js';
+/**
+ * Collect the transcript/summary files this catalog indexes.
+ *
+ * Skips exactly what `DefaultSessionStore`'s own directory scan skips — see
+ * `shouldSkipSessionDirectoryEntry`. The two disagreed: the store excluded
+ * `subagents/` (and `shared/`, `attachments/`) from what counts as a session,
+ * while this walk descended into them, so a full rebuild pushed subagent
+ * transcripts into the table backing the user's session list. On a real project
+ * that is 3,156 worker transcripts against 170 actual sessions; the five
+ * subagent rows found in a live catalog were this leak already in progress.
+ *
+ * Subagent transcripts are not unindexed — each director run maintains its own
+ * `_index.jsonl` beside them. They just are not user-resumable sessions.
+ */
 export declare function walkSessionFiles(root: string, suffix: string): string[];
 export declare function summarizeTranscriptFile(transcriptFilePath: string, id: string): SessionSummary;
 export declare function rebuildCatalogIndex(db: DatabaseSync, sessionsDir: string, containedPathFn: (relative: string) => string, transactionFn: <T>(run: () => T) => T, bumpGenerationFn: () => number): {

package/dist/session-catalog/store-schema.d.ts

@@ -1,5 +1,14 @@
 import type { DatabaseSync } from 'node:sqlite';
 import type { SessionRegistryEntry } from './session-registry-types.js';
+/**
+ * Bumped ONLY for breaking changes — a mismatch throws and takes the catalog
+ * with it (`initializeCatalogSchema`), and there is no downgrade path.
+ *
+ * Purely additive tables do not qualify and must not bump it: every statement
+ * below is `IF NOT EXISTS`, so a new binary adds what it needs on open and an
+ * older binary reading the same file simply never queries the extra tables.
+ * `session_agents` / `session_agent_index` were added this way.
+ */
 export declare const SCHEMA_VERSION = 1;
 export declare const MAX_LEASE_MS = 120000;
 export declare const MAX_RESERVATION_MS = 60000;
@@ -25,6 +34,23 @@ export interface ReservationRow {
     current_session_id: string | null;
     expires_at: number;
 }
+export interface SessionAgentRow {
+    session_id: string;
+    agent_id: string;
+    role: string | null;
+    provider: string | null;
+    model: string | null;
+    agent_session_id: string | null;
+    transcript_path: string | null;
+    parent_agent_id: string | null;
+    spawned_at: string | null;
+    ended_at: string | null;
+    status: string;
+    error: string | null;
+    interleaved_event_count: number;
+    usage_json: string | null;
+    ordinal: number;
+}
 export interface CatalogRow {
     session_id: string;
     transcript_relative_path: string;

package/dist/session-catalog/store.d.ts

@@ -1,6 +1,7 @@
-import type { SessionRegistryEntry } from './session-registry-types.js';
 import type { SessionSummary } from '../types/session.js';
 import type { CatalogSessionRecord, MaintenanceLease, ResumeReservation, SessionCatalogHealth, SessionCatalogListArgs, SessionLeaseCredential } from './protocol.js';
+import { type SessionAgentRecord } from './session-agents.js';
+import type { SessionRegistryEntry } from './session-registry-types.js';
 export declare class SessionCatalogStore {
     readonly projectDir: string;
     readonly databasePath: string;
@@ -24,6 +25,15 @@ export declare class SessionCatalogStore {
     reconnectLease(credential: SessionLeaseCredential): SessionLeaseCredential;
     reserveResume(targetSessionId: string, requesterInstanceId: string, currentSessionId?: string, reservationMs?: number): ResumeReservation;
     activateReservation(reservation: ResumeReservation, entry: SessionRegistryEntry, leaseMs?: number): SessionLeaseCredential;
+    /**
+     * Extend a live reservation the requester still owns.
+     *
+     * Deliberately does NOT call `reapExpired()` first: reaping would delete an
+     * already-expired row and turn the accurate "expired" answer into the
+     * indistinguishable "not owned by this requester". The caller needs to know
+     * which of the two happened.
+     */
+    renewReservation(reservationId: string, requesterInstanceId: string, reservationMs?: number): ResumeReservation;
     cancelReservation(reservationId: string, requesterInstanceId: string): void;
     heartbeat(credential: SessionLeaseCredential, status?: SessionRegistryEntry['status']): SessionLeaseCredential;
     publishAgents(credential: SessionLeaseCredential, revision: number, agents: SessionRegistryEntry['agents']): {
@@ -39,6 +49,22 @@ export declare class SessionCatalogStore {
     private catalogRecord;
     listCatalog(criteria?: SessionCatalogListArgs): CatalogSessionRecord[];
     getSummary(sessionId: string): CatalogSessionRecord | null;
+    /**
+     * The agent roster of one session, derived from its journal.
+     *
+     * Cached in `session_agents`, keyed to the transcript's size and mtime: the
+     * journal is the authority, so the cache is a memo of a pure function over
+     * it rather than a second place agents get recorded. When the file has grown
+     * (the usual case — a live session) the rows are re-derived from scratch, so
+     * a partial read can never leave a half-updated roster behind.
+     *
+     * Returns `[]` for a session with no transcript on disk. A caller cannot
+     * distinguish that from "a real session that spawned nothing", and should
+     * not need to: both mean there is no agent to show.
+     */
+    listSessionAgents(sessionId: string): SessionAgentRecord[];
+    private readSessionAgentRows;
+    private writeSessionAgentRows;
     resolveId(query: string): string;
     rename(sessionId: string, name: string): Promise<CatalogSessionRecord>;
     acquireMaintenance(sessionId: string, operation: MaintenanceLease['operation'], holderId: string, leaseMs?: number, holderPid?: number): MaintenanceLease;

package/dist/session-note-attach.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Bind a running agent to the same-session note hub so peers can reach it
+ * without mailbox. Unregisters via the agent hook on teardown.
+ *
+ * @module session-note-attach
+ */
+import type { AgentInternals } from './core/agent-internals.js';
+export declare function attachSessionNotes(a: AgentInternals): void;
+//# sourceMappingURL=session-note-attach.d.ts.map

package/dist/skills/index.js

@@ -13,7 +13,7 @@ import {
   parseSkillRef,
   validateSkillNameAvailable,
   writeSkeletonSkill
-} from "../chunk-SN2DQRL6.js";
+} from "../chunk-RXKSDUAU.js";
 import {
   FOREIGN_SKILL_TOOLS,
   resolveForeignToolIds,
@@ -24,16 +24,16 @@ import "../chunk-LHOA5DWA.js";
 import {
   SKILL_LIMITS
 } from "../chunk-XEBHSJLT.js";
-import "../chunk-7ZHZE5EO.js";
+import "../chunk-OSGLYW5J.js";
 import {
   isValidSkillNameFormat,
   parseSkillFrontmatter,
   stripFrontmatter,
   validateSkillName
-} from "../chunk-WEBMSQP2.js";
-import "../chunk-WOEZV3Q4.js";
-import "../chunk-TBRL2RCC.js";
+} from "../chunk-FC2ZGRF3.js";
 import "../chunk-PFZO3C6H.js";
+import "../chunk-25LSLC3G.js";
+import "../chunk-TBRL2RCC.js";
 export {
   DEFAULT_SKILLS_SH_URL,
   FOREIGN_SKILL_TOOLS,