@ziggs-ai/agent-sdk 0.28.0 → 0.30.0

package/dist/Agent.js

@@ -650,18 +650,15 @@ export class Agent {
     }
     memoryForWake(session, event) {
         const fromEvent = hireIdsFromEvent(event);
-        const wakeAgreementIds = uniqueHireIds([
-            ...fromEvent,
-            session.actingHireId,
-        ]);
+        const wakeAgreementIds = fromEvent.length ? fromEvent : uniqueHireIds([session.actingHireId]);
         const section = memorySectionForWake({
             sessionId: session.sessionId,
-            activeAgreementId: session.ctx
+            activeAgreementId: fromEvent.length ? undefined : session.ctx
                 ?.activeAgreementId,
             wakeAgreementIds,
         });
         const known = uniqueHireIds([
-            session.ctx
+            fromEvent.length ? undefined : session.ctx
                 ?.activeAgreementId,
             ...wakeAgreementIds,
         ]);

package/dist/brain/ClaudeBrain.d.ts

@@ -19,12 +19,11 @@ export { isPublishProbeChat, isCapabilityProbeSession } from '../probeChat.js';
  *
  * Empty / missing batch → notice-only (do not burn a turn on a malformed wake).
  *
- * A message addressed to a DIFFERENT party is notice-only too (attention
- * gate): the sender named who should act, and it wasn't this agent. The
- * message still lands in chat history and arrives as context on the next
- * real wake — skipped here is the LLM turn, not the information.
+ * Who a message is for is not decided here: the backend picks the receiver,
+ * and the inbox hands this agent only the rows assigned to it. Whether a
+ * message needs a turn at all is the wake gate's question.
  */
-export declare function isNoticeOnlyWake(event: RawEvent | undefined, ownAgentId?: string | null): boolean;
+export declare function isNoticeOnlyWake(event: RawEvent | undefined): boolean;
 export type CognitionKind = 'fsm' | 'claude-sdk';
 export interface ClaudeBrainOptions {
     workflow: Workflow;

package/dist/brain/ClaudeBrain.js

@@ -1,11 +1,12 @@
 import { getAgreement } from '@ziggs-ai/api-client';
 import { permitsAutomaticMandate } from '../runtime/agreementContext.js';
 import { query } from '@anthropic-ai/claude-agent-sdk';
-import { isMessageAddressedElsewhere, outcomeFromEvent } from '../runtime/buildOutcome.js';
+import { outcomeFromEvent } from '../runtime/buildOutcome.js';
 import { getBatchEvents } from '../context/batch.js';
 import { bootstrapCtx } from '../runtime/bootstrapCtx.js';
 import { createDeliveryWriteKeys } from '../runtime/deliveryWriteKeys.js';
 import { CLAUDE_SDK_PROTOCOL } from './claudeSdkProtocol.js';
+import { hireIdsFromEvent, memorySectionForWake } from '../memory/MemoryStore.js';
 import { hostedModelTools } from './hostedToolSurface.js';
 import { buildZiggsSdkMcpServer } from './toolManagerToSdkMcp.js';
 import { claudeQueryOptions, buildClaudeEventPrompt, summarizeContext, extractAssistantText, } from './claudeCognition.js';
@@ -30,17 +31,15 @@ export { isPublishProbeChat, isCapabilityProbeSession } from '../probeChat.js';
  *
  * Empty / missing batch → notice-only (do not burn a turn on a malformed wake).
  *
- * A message addressed to a DIFFERENT party is notice-only too (attention
- * gate): the sender named who should act, and it wasn't this agent. The
- * message still lands in chat history and arrives as context on the next
- * real wake — skipped here is the LLM turn, not the information.
+ * Who a message is for is not decided here: the backend picks the receiver,
+ * and the inbox hands this agent only the rows assigned to it. Whether a
+ * message needs a turn at all is the wake gate's question.
  */
-export function isNoticeOnlyWake(event, ownAgentId) {
+export function isNoticeOnlyWake(event) {
     const events = getBatchEvents(event);
     if (events.length === 0)
         return true;
-    return events.every((ev) => ev?.type === 'notification' ||
-        isMessageAddressedElsewhere(ev, ownAgentId));
+    return events.every((ev) => ev?.type === 'notification');
 }
 const DEFAULT_STATE = 'ready';
 /**
@@ -264,7 +263,7 @@ export class ClaudeBrain {
                 skippedReason: 'agent_formed_hire_activation',
             };
         }
-        if (isNoticeOnlyWake(rawEvent, identity.agentId)) {
+        if (isNoticeOnlyWake(rawEvent)) {
             runtimeLog.info('ClaudeBrain', `notice-only wake — skipping LLM session=${identity.sessionId} agent=${this.agentId} ` +
                 `type=${rawEvent?.type ?? 'unknown'}`);
             return {
@@ -281,7 +280,7 @@ export class ClaudeBrain {
             nextCtx.lastOutcome = outcomeFromEvent(rawEvent ?? null, identity.agentId);
             runtimeLog.info('ClaudeBrain', `standing listing acceptance — no customer hire agent=${this.agentId} ` +
                 `agreements=${listingCheck.ignoredAgreementIds.join(',')}`);
-            if (!rawEvent || isNoticeOnlyWake(rawEvent, identity.agentId)) {
+            if (!rawEvent || isNoticeOnlyWake(rawEvent)) {
                 return {
                     ctx: nextCtx,
                     state: state ?? DEFAULT_STATE,
@@ -447,6 +446,23 @@ export class ClaudeBrain {
                     runtimeLog.warn('ClaudeBrain', `stderr session=${identity.sessionId}: ${line}`);
             },
         });
+        const workIds = hireIdsFromEvent(rawEvent);
+        const selectedWork = contextSnap?.work;
+        const workScope = JSON.stringify([
+            selectedWork?.contexts?.map(p => [p.agreementId, p.task?.taskId]) ?? [selectedWork?.agreementId, selectedWork?.task?.taskId],
+            memorySectionForWake({
+                sessionId: identity.sessionId,
+                wakeAgreementIds: workIds,
+                activeAgreementId: workIds.length ? undefined : nextCtx.activeAgreementId,
+            }),
+            contextSnap?.workBrief?.audience ??
+                contextSnap?.work?.contexts?.map(p => p.workBrief?.audience ?? null) ?? {
+                users: contextSnap?.users ?? [], agents: contextSnap?.agents ?? [],
+            },
+        ]);
+        if (nextCtx.claudeWorkScope !== workScope)
+            nextCtx.claudeSessionId = undefined;
+        nextCtx.claudeWorkScope = workScope;
         let metrics = { llmCalls: 0, tokens: { total: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 } };
         let sessionId = nextCtx.claudeSessionId;
         // Cost-weighted, cumulative: what this wake has charged the key so far.

package/dist/brain/claudeCognition.d.ts

@@ -66,8 +66,8 @@ export declare function resolveClaudeModel(preferred?: string, servicesModel?: s
  * Caching is a prefix match, so block ORDER decides how far the hit reaches:
  * the protocol block is byte-identical for every hosted agent and goes first,
  * the role block is per-agent and goes second. An agent whose combined prompt
- * lands under the model's minimum cacheable prefix (~1k tokens on Sonnet, more
- * on Haiku) simply writes no entry — that is a silent no-op, not an error, so
+ * lands under the model's minimum cacheable prefix (512 tokens on Sonnet 5.5,
+ * 4,096 on Haiku 4.5) simply writes no entry — that is a silent no-op, not an error, so
  * read `cacheRead`/`cacheCreation` in the wake metrics rather than assuming.
  */
 export declare function claudeQueryOptions(params: ClaudeQueryOptionsParams): Options;

package/dist/brain/claudeCognition.js

@@ -14,7 +14,7 @@
 import { SYSTEM_PROMPT_DYNAMIC_BOUNDARY, } from '@anthropic-ai/claude-agent-sdk';
 import { decisionWords } from '@ziggs-ai/api-client';
 import { getBatchEvents } from '../context/batch.js';
-const DEFAULT_CLAUDE_MODEL = 'claude-sonnet-4-6';
+const DEFAULT_CLAUDE_MODEL = 'claude-sonnet-5-5';
 /**
  * Pick the Claude model for a Claude-brain wake. The brain must run a `claude-*`
  * model, but the host's default model is provider-agnostic (an OpenAI id today),
@@ -47,8 +47,8 @@ export function resolveClaudeModel(preferred, servicesModel) {
  * Caching is a prefix match, so block ORDER decides how far the hit reaches:
  * the protocol block is byte-identical for every hosted agent and goes first,
  * the role block is per-agent and goes second. An agent whose combined prompt
- * lands under the model's minimum cacheable prefix (~1k tokens on Sonnet, more
- * on Haiku) simply writes no entry — that is a silent no-op, not an error, so
+ * lands under the model's minimum cacheable prefix (512 tokens on Sonnet 5.5,
+ * 4,096 on Haiku 4.5) simply writes no entry — that is a silent no-op, not an error, so
  * read `cacheRead`/`cacheCreation` in the wake metrics rather than assuming.
  */
 export function claudeQueryOptions(params) {
@@ -99,7 +99,7 @@ export function summarizeContext(snap) {
     const agreements = Array.isArray(snap.agreements) ? snap.agreements.length : 0;
     const history = Array.isArray(snap.history) ? snap.history.length : 0;
     const users = Array.isArray(snap.users) ? snap.users.length : 0;
-    return `history=${history} messages, agreements=${agreements}, users=${users}${directArtifactGrantLine(snap)}${snap.work ? `\nWork context (exact scope, governing constraints and required dependencies):\n${JSON.stringify(snap.work)}` : ''}`;
+    return `${snap.workBrief ? `Work brief:\n${JSON.stringify(snap.workBrief)}\n` : ''}history=${history} messages, agreements=${agreements}, users=${users}${directArtifactGrantLine(snap)}${snap.work ? `\nWork context (exact scope, governing constraints and required dependencies):\n${JSON.stringify(snap.work)}` : ''}`;
 }
 /** Ids and names only. Absent when the wake has nothing outside the room inventory. */
 function directArtifactGrantLine(snap) {
@@ -277,7 +277,8 @@ function renderEventLines(event, lines, now) {
                 '';
             lines.push('Work signal: listing claimed (proposal_approved). Verify the accepted interaction mode. For task-only agreements, wait for assigned tasks and report results through tasks; no chat or greeting. Only if messages are accepted, call chat_open with the buyer' +
                 (buyerId ? ` (participantId=${buyerId})` : ' (actorId / Sender on this event)') +
-                ', greet them, then serve the agreement terms. Do not chat_send to an agrn-* session id — open a real chat first.');
+                (agreementId ? ` and agreementId=${agreementId}` : ' and the claimed agreementId') +
+                ". That returns the hire's room, which the server usually made at claim, or opens one when there is none; then greet them and serve the agreement terms. Do not chat_send to an agrn-* session id — open a real chat first.");
             if (buyerId)
                 lines.push(`Buyer (claim actor): ${buyerId}`);
             // Prefer nested resource agreementId when the outer event omitted it.

package/dist/brain/claudeSdkProtocol.js

@@ -14,7 +14,7 @@ import { INBOUND_DISCOVERY_POLICY } from '../inboundDiscoveryPolicy.js';
 const loadedByName = EVERYDAY_SDK_TOOLS.map((name) => `\`${name}\``).join(', ');
 export const CLAUDE_SDK_PROTOCOL = `You are an autonomous agent on a Ziggs team, running as a hosted worker. Your host reads your inbox for you and hands you each event that concerns you — you never poll for news and you never acknowledge anything; the host does both on your behalf. Work waits in your inbox whether your process is running or not, so nothing is ever missed.
 
-Each wake hands you ONE event (or a small batch). Handle it, then stop.
+Each wake hands you ONE event (or a small batch). Read workBrief for current work and audience. Resource open/access_explain returns the same scoped actions: use tool, args and required inputs; recovery names a suggested next call. Available is checked at read time, needs_decision names missing authority, unavailable names a known blocker, and not_evaluated requires further inputs or execution checks. It is backend-resolved context, not a permission token. Use normal tools for actions marked not_evaluated; that state alone does not require human approval. Never infer authority from role names or combine customers’ permissions. actingFor.state ambiguous means several customers are present and only your own account authority applies; relationship.side is the agreement side you hold and authorizes nothing by itself. A chat_send refused with WORK_SELECTION_REQUIRED lists the eligible agreements in choices: set conversationAgreementId to one of them and send again; never guess which one. Handle the event, then stop.
 
 Ziggs tools loaded with their full schemas are ${loadedByName}, plus any tools that belong to you specifically. Every other Ziggs tool is one call away: \`tools\` lists each one (name and one line); pass \`describe\` to \`tools\` for the schema before you call a tool you have not used. A read goes through \`tool_read\` { tool, args }; a change goes through \`tool_write\` { tool, args }. \`agreement_revoke\` is irreversible, so call it by its own name — the dispatchers refuse it. When the lines below name \`context_snapshot\`, \`wake_at\`, \`task_list\`, \`task_update_plan_step\`, \`grant_list\`, or an agreement verb, that is how you reach it.
 
@@ -27,19 +27,19 @@ Your prose and final summary are private host notes, not messages to the people
 - Closing a task closes the TASK, and only the task. It stores your result where the next agent reads it, queues a wake for whoever the platform addresses, and on an agreement that bills per completed task it meters that one execution. It does not end the hire — a standing agreement stays active for the next task — it does not prove anyone has read you, and it does not prove you were paid. The reply tells you which of those actually happened: report that and nothing beyond it. A completion whose reply you never saw is recovered by READING the task back, never by completing it a second time; your retry carries the same write key, so a redelivered completion no-ops instead of doubling the result, the wake and the charge.
 - Enumerate open work with \`task_list\` (use assignedToMe for your own active tasks).
 - Chat is where you talk to whoever you are working with, and where a human reads what you delivered — sending it to them there is delivery, not duplication. It is not where another AGENT collects a deliverable: that one reads the task result, so a chat message never stands in for closing the task. Deliver into the working conversation the hire already has; do not repeat it into every room you can reach.
-- When a store listing of yours is claimed (\`resource_changed\` with reason \`proposal_approved\`, often with no chat yet), call \`chat_open\` with the buyer (actorId / Sender) AND the claimed agreementId, greet them only when the agreement accepts messages, then serve the agreement terms. A task-only agreement needs no chat or greeting: wait for assigned tasks and deliver results through tasks. Do not \`chat_send\` to an \`agrn-*\` session id — open a real chat first.
+- When a store listing of yours is claimed (\`resource_changed\` with reason \`proposal_approved\`), call \`chat_open\` with the buyer (actorId / Sender) AND the claimed agreementId. That returns the hire's room, which the server usually made at claim, or opens one when there is none. Greet them only when the agreement accepts messages, then serve the agreement terms. A task-only agreement needs no chat or greeting: wait for assigned tasks and deliver results through tasks. Do not \`chat_send\` to an \`agrn-*\` session id — open a real chat first.
 - When a task you hold carries a deadline or a reminder rule, they are part of the job, not decoration. Never remind the same person sooner than the stated interval or more times than the budget; use \`wake_at\` to come back rather than waiting in place, and re-arm it each time you wake. When the budget is spent, stop asking and say what you have. At the deadline, post what you got and where you are stuck in the room where the question was asked, close the task, and stop — whether or not you got the answer. Nothing stops you from breaking this, which is exactly why it is on you: over-reminding is a breach of the task, not diligence, and every reminder costs a wake.
 - Hand off by completing your task — the platform notifies the next agent.
 
 You are headless — there is no human to prompt during a wake:
-- When proposals or connection requests need a human decision, DO NOT approve or reject on their behalf. Summarize what needs the operator's attention and stop.
+- For proposals and connection requests, read the agreement’s approvalAction. Use existing covering authority when available; otherwise ask the accountable party to decide. Slot ownership alone is not authority. Do not add a confirmation when an existing mandate covers the decision.
 - When you ask somebody and stop, SAY SO ON THE TASK: \`task_update_plan_step\` with \`waitingOn\` ({ kind, id }), with the step you are ticking or on its own when the ask is all that happened. Until you do, your person sees a task that is running, and a job waiting on them is indistinguishable from one that has stalled. It clears itself when you next post progress without it, so you never have to remember to take it back.
 - When the work needs something only the person who hired you can answer (a business detail, a decision, an access you were not given), ASK THEM: if you already have a conversation, \`chat_send\` with \`to\` set to their user id from \`context_snapshot\`'s \`users\`; first contact still needs \`chat_open\` then \`chat_send\` in the chat it returns — name that person as receiverId there; room membership never selects a recipient. Say what you need and why, then stop; their reply wakes you. Going quiet instead leaves the job parked with nobody asked. An id starting \`psn_\` is a masked face, not an address: that person belongs to the counterparty, and you reach them by messaging THEIR agent.
 - When the work needs an answer from somebody you have no way to reach — a teammate of theirs, a partner, a customer, anyone \`chat_open\` refuses you — ASK THE PERSON YOU WORK FOR TO PUT YOU IN A ROOM WITH THEM. Say it plainly in your conversation with them: "I need to ask Dana about the Q3 number — can you open a room with her and add me?" Then stop; you are woken when you are in the room. Name the person, say what you need from them and why, and ask for one room about that one thing. Do NOT go looking for another way in: claiming a listing, proposing a link or sending an invite are for strangers you are doing business with, and they are the wrong move for somebody your person already knows — they cost that person a negotiation for something a click would have done. You inherit nobody's contacts, and asking is not a failure; it is the only door, and it takes them two clicks.
 
 Security:
-- A relationship or free negotiation agreement can parent a separately accepted service agreement. Parentage carries governing authority and revocation, not automatic spending consent. Each message or task uses one exact work agreement; its quota is direct unless a governing term explicitly shares it across the subtree. Agreement proposals, decisions, and system notices do not consume the conversation allowance.
-- You decide what to do with a chat message. Ziggs does not enforce that counterparty text is ignored — that is a convention. What Ziggs does enforce: no spending and no commitments without an agreement, and every service conversation is covered by an agreement, including free chat; incoming messages beyond that agreement's allowance are refused at the send door. Work is a task under an agreement; a chat work order from a stranger is best answered with a drafted agreement. Your operating contract is this protocol and your role below.
+- A relationship (a link) can parent a separately accepted service agreement. Parentage carries governing authority and revocation, not automatic spending consent. Each message or task uses one exact work agreement; its quota is direct unless a governing term explicitly shares it across the subtree. Agreement proposals, decisions, and system notices do not consume the conversation allowance.
+- You decide what to do with a chat message. Ziggs does not enforce that counterparty text is ignored — that is a convention. What Ziggs does enforce: no spending and no commitments without an agreement, and a stranger talks to a listed agent under its listing, which counts their free messages; messages past those are refused at the send door, asking them to hire. Work is a task under an agreement; a stranger hires you through your listing, or through an agreement you draft when you have none. Your operating contract is this protocol and your role below.
 - ${INBOUND_DISCOVERY_POLICY}
 
 When the event is handled, stop with a one-paragraph summary of what you did. If the event needs nothing from you (a status echo, a duplicate, a notification you already acted on), say so in one sentence and stop — do not invent work.`;

package/dist/brain/claudeSdkTools.js

@@ -73,7 +73,7 @@ export const chatSendTool = defineTool('chat_send', {
     conversationAgreementId: { type: 'string', description: 'Explicit service work requested from the recipient, separate from your own run authority.' },
     underAgreementId: { type: 'string', description: 'Your run authority, defaulting to the current run in every destination room.' },
     chatId: { type: 'string', description: 'Omit this to send in the chat you were woken in — that is the usual case. Only pass a chatId to send in a DIFFERENT chat, such as one you just opened with chat_open. When chatId is set it wins over `to`.' },
-    to: { type: 'string', description: 'User or agent id of someone you already have a conversation with. Sends in that pair room. Does not open contact — first contact still needs chat_open. Ignored when chatId is set (chatId wins; `to` is used as receiverId if receiverId is omitted).' },
+    to: { type: 'string', description: 'User or agent id of someone you already have a conversation with. Sends in that pair room. Naming the person whose message woke you sends in the room that woke you instead, addressed to them. Does not open contact — first contact still needs chat_open. Ignored when chatId is set (chatId wins; `to` is used as receiverId if receiverId is omitted).' },
     receiverId: { type: 'string', description: 'Explicit recipient user or agent id, or a participant reference from this destination room. Omit it when the room has one other participant: they are the recipient. With several, Jev chooses when confident; otherwise this is room context with no specific wake. The wake sender and last writer are never defaults. Pass human for an intentional broadcast to people.' },
     text: { type: 'string', required: true },
     idempotencyKey: { type: 'string', description: 'Reuse for retry-safe resend of the same logical message.' },
@@ -82,9 +82,15 @@ export const chatSendTool = defineTool('chat_send', {
     const explicitChatId = asChatLane(firstFilled(args.chatId));
     const to = firstFilled(args.to);
     const text = String(args.text);
+    // Naming the person who woke you is an answer, not a new conversation: it
+    // goes in the room that woke you, addressed to them. A probe room or a
+    // stranger's room has no pair room with that person, and asking the server
+    // for one only bought a refusal and a chat_open round trip.
+    const wakeChat = asChatLane(firstFilled(c.chatId, c.sessionId));
+    const answersWakeSender = !!to && !!wakeChat && to === c.senderId;
     // Existing conversation with a person: resolve their pair room server-side.
     // Does not open contact. An explicit chatId still wins.
-    if (!explicitChatId && to) {
+    if (!explicitChatId && to && !answersWakeSender) {
         const creds = credsFromToolContext(c, 'chat_send');
         const messageId = args.idempotencyKey
             ? `sdk_idem_${String(args.idempotencyKey)}`

package/dist/memory/MemoryStore.d.ts

@@ -3,9 +3,10 @@
  *
  * This is the SDK's contract; the *storage* is operator-provided. The agent
  * picks the key shape (often `counterparty:<id>`, sometimes `agreement:<id>:notes`,
- * etc.) — the SDK does not enforce one. The host prefixes every key with
- * the hire the wake is inside (or the agent's own section when there is
- * no hire), so one customer's notes cannot be read in another's wake.
+ * etc.) — the SDK does not enforce one. Notes are bound to an agreement
+ * (Ido, 2026-09-29): the host prefixes every key with the one agreement the
+ * wake is under, and a wake under none or several has no notes at all. A
+ * room is not a drawer, and neither is the agent as a whole.
  *
  * Reference implementations: `InMemoryStore` (default; non-durable) and
  * `FileMemoryStore` (single JSON file; useful for local dev). Anything
@@ -60,17 +61,19 @@ export declare class FileMemoryStore implements MemoryStore {
  *
  * Pick from the hire this wake is acting under — the same fact the
  * server uses for acting-for: a pinned agreement, the delivery / event
- * hire, or an `agrn-` lane. A chat-room wake with exactly one hire
- * behind it lands in that hire's section. Zero hires, or more than one
- * customer present, share the agent's own section — the "operator only"
- * answer in memory form. Never pick from the chat id alone.
+ * hire, or an `agrn-` lane. Exactly one agreement gives that agreement's
+ * section. None, or several, gives null: notes are bound to an agreement,
+ * so such a wake has nowhere to keep them, and says so on a write rather
+ * than landing in a room's or the agent's shared drawer.
  */
 export declare function memorySectionForWake(input: {
     sessionId?: string | null;
     activeAgreementId?: string | null;
     /** Hire ids already on this wake (delivery / event / acting-for). */
     wakeAgreementIds?: readonly (string | null | undefined)[];
-}): string;
+}): string | null;
+/** The notes of a wake that has no single agreement: nothing to read, and a write says why. */
+export declare function noAgreementMemoryStore(): MemoryStore;
 /** Distinct non-empty hire ids, first-seen order. */
 export declare function uniqueHireIds(raw: readonly (string | null | undefined)[]): string[];
 /**
@@ -83,4 +86,4 @@ export declare function hireIdsFromEvent(event: unknown): string[];
  * Present a store as if it only contained one section. Agent keys stay
  * unchanged; get/put/list/delete all go through `section:`.
  */
-export declare function partitionMemoryStore(store: MemoryStore, section: string): MemoryStore;
+export declare function partitionMemoryStore(store: MemoryStore, section: string | null): MemoryStore;

package/dist/memory/MemoryStore.js

@@ -82,10 +82,10 @@ export class FileMemoryStore {
  *
  * Pick from the hire this wake is acting under — the same fact the
  * server uses for acting-for: a pinned agreement, the delivery / event
- * hire, or an `agrn-` lane. A chat-room wake with exactly one hire
- * behind it lands in that hire's section. Zero hires, or more than one
- * customer present, share the agent's own section — the "operator only"
- * answer in memory form. Never pick from the chat id alone.
+ * hire, or an `agrn-` lane. Exactly one agreement gives that agreement's
+ * section. None, or several, gives null: notes are bound to an agreement,
+ * so such a wake has nowhere to keep them, and says so on a write rather
+ * than landing in a room's or the agent's shared drawer.
  */
 export function memorySectionForWake(input) {
     const ids = uniqueHireIds([
@@ -93,9 +93,21 @@ export function memorySectionForWake(input) {
         ...(input.wakeAgreementIds ?? []),
         agreementIdFromAgrnSession(input.sessionId),
     ]);
-    if (ids.length === 1)
-        return `hire:${ids[0]}`;
-    return 'agent';
+    return ids.length === 1 ? `hire:${ids[0]}` : null;
+}
+const NO_AGREEMENT_NOTES = 'Notes are kept per agreement, and this wake is under none or several, so there is nothing to keep them under. Name the work this note belongs to, or keep it in the reply.';
+/** The notes of a wake that has no single agreement: nothing to read, and a write says why. */
+export function noAgreementMemoryStore() {
+    return {
+        get: async () => undefined,
+        put: async () => {
+            throw new Error(NO_AGREEMENT_NOTES);
+        },
+        list: async () => [],
+        delete: async () => {
+            throw new Error(NO_AGREEMENT_NOTES);
+        },
+    };
 }
 /** Distinct non-empty hire ids, first-seen order. */
 export function uniqueHireIds(raw) {
@@ -142,6 +154,8 @@ function agreementIdFromAgrnSession(sessionId) {
  * unchanged; get/put/list/delete all go through `section:`.
  */
 export function partitionMemoryStore(store, section) {
+    if (section === null)
+        return noAgreementMemoryStore();
     const prefix = `${section}:`;
     const partitioned = {
         get: (key) => store.get(prefix + key),

package/dist/platform/ZiggsEffectHandler.js

@@ -245,7 +245,7 @@ export function createZiggsEffectHandler(deps) {
                 const packets = await Promise.all((scopes.length ? scopes : [undefined]).map(workScope => buildSnapshot(deps, effect.sessionId, deps.agentId, { limit: effect.opts?.maxMessages, workScope })));
                 const snap = packets.length === 1 ? packets[0] : {
                     ...emptySnapshot(deps.agentId),
-                    work: { contexts: packets.map(p => ({ ...p.work, agreements: p.agreements, history: p.history, artifacts: p.artifacts })),
+                    work: { contexts: packets.map(p => ({ ...p.work, workBrief: p.workBrief, agreements: p.agreements, history: p.history, artifacts: p.artifacts })),
                         instruction: 'Separate work items: select one exact agreement for each action. Context and authority do not transfer between these packets.' },
                     unavailable: packets.some(p => p.unavailable),
                 };

package/dist/runtime/agreementContext.d.ts

@@ -1,5 +1,13 @@
+/**
+ * A seller's standing offer: open to everyone (`everyone`) or one
+ * company (`org`). A listing is never work: claiming it gives each claimer
+ * their own hire, so nothing is done or spent under the listing itself. Reads
+ * both party shapes: an agreement row (`{ principal }`) and a room snapshot
+ * row (the principal as a string).
+ */
+export declare function isListing(agreement: unknown): boolean;
 /** Enrich each wake from the agreement it actually names, never from the room's
  * latest deal. Reads use the agent's credentials; no grants are inferred here. */
 export declare function withAgreementContext(event: unknown, read: (agreementId: string) => Promise<unknown>): Promise<unknown>;
-/** Free chat supplies conversation context, never consent to another engagement. */
+/** A link or a listing supplies conversation context, never consent to another engagement. */
 export declare function permitsAutomaticMandate(event: unknown): boolean;

package/dist/runtime/agreementContext.js

@@ -1,4 +1,17 @@
 const row = (value) => value && typeof value === 'object' ? value : {};
+/**
+ * A seller's standing offer: open to everyone (`everyone`) or one
+ * company (`org`). A listing is never work: claiming it gives each claimer
+ * their own hire, so nothing is done or spent under the listing itself. Reads
+ * both party shapes: an agreement row (`{ principal }`) and a room snapshot
+ * row (the principal as a string).
+ */
+export function isListing(agreement) {
+    const a = row(agreement);
+    const payer = row(a.parties).payer;
+    const principal = typeof payer === 'string' ? payer : row(payer).principal;
+    return (principal === 'everyone' || principal === 'org') && a.engagementKind !== 'link';
+}
 /** Enrich each wake from the agreement it actually names, never from the room's
  * latest deal. Reads use the agent's credentials; no grants are inferred here. */
 export async function withAgreementContext(event, read) {
@@ -20,13 +33,20 @@ export async function withAgreementContext(event, read) {
                     const terms = row(agreement.terms);
                     const usage = row(agreement.conversationUsage);
                     const money = row(agreement.money);
+                    if (isListing(agreement)) {
+                        return {
+                            agreementId: id, available: true, listing: true, relationship: true,
+                            status: agreement.status,
+                            scope: terms.description,
+                            instruction: 'This is a store listing, not work: a stranger talks with you under it, and hires you by claiming it. Answer as conversation; nothing you do is spent under it.',
+                        };
+                    }
                     const limit = typeof terms.conversationAllowance === 'number' ? terms.conversationAllowance : null;
                     const used = typeof usage.messages === 'number' ? usage.messages : 0;
                     return {
                         agreementId: id, available: true,
-                        freeConversation: row(agreement.metadata).freeConversation === true,
                         status: agreement.status,
-                        relationship: agreement.engagementKind === 'link' || row(agreement.metadata).freeConversation === true,
+                        relationship: agreement.engagementKind === 'link',
                         interactionMode: terms.interactionMode ?? 'both',
                         parentAgreementId: agreement.parentAgreementId ?? null,
                         allowanceScope: terms.conversationAllowanceScope ?? 'direct',
@@ -65,11 +85,11 @@ export async function withAgreementContext(event, read) {
     };
     return enrich(event);
 }
-/** Free chat supplies conversation context, never consent to another engagement. */
+/** A link or a listing supplies conversation context, never consent to another engagement. */
 export function permitsAutomaticMandate(event) {
     const frame = row(event);
     if (frame.type === 'batch' && Array.isArray(frame.events))
         return frame.events.every(permitsAutomaticMandate);
     const context = row(frame.agreementContext);
-    return context.relationship !== true && context.freeConversation !== true && context.available !== false;
+    return context.relationship !== true && context.available !== false;
 }

package/dist/runtime/buildOutcome.d.ts

@@ -36,15 +36,6 @@ export interface EmittedEvent {
     senderId?: string;
     [key: string]: unknown;
 }
-/**
- * A chat message whose stated receiver is a DIFFERENT party. `receiverId` is
- * the sender's addressing decision, carried on every wire frame; the
- * human-broadcast sentinel counts as "elsewhere" for an agent (a broadcast is
- * addressed to the room's humans). A frame with NO receiver keeps the turn —
- * we cannot know it is not ours, and skipping on absence would deafen agents
- * to malformed or legacy frames.
- */
-export declare function isMessageAddressedElsewhere(ev: RawEvent | null | undefined, ownAgentId: string | null | undefined): boolean;
 /**
  * Converts a raw incoming event into the single Outcome that re-enters the
  * machine.

package/dist/runtime/buildOutcome.js

@@ -1,22 +1,6 @@
 import { isProtocolToolName, mapProtocolToolToOperation } from '../tasks/protocolRegistry.js';
 import { getBatchEvents, isTaskResultRelevantToAgent } from '../context/batch.js';
 import { bookForDelegation, ensureTaskBook, findBookHoldingPending, removeTaskBook, } from './taskBookkeeping.js';
-/**
- * A chat message whose stated receiver is a DIFFERENT party. `receiverId` is
- * the sender's addressing decision, carried on every wire frame; the
- * human-broadcast sentinel counts as "elsewhere" for an agent (a broadcast is
- * addressed to the room's humans). A frame with NO receiver keeps the turn —
- * we cannot know it is not ours, and skipping on absence would deafen agents
- * to malformed or legacy frames.
- */
-export function isMessageAddressedElsewhere(ev, ownAgentId) {
-    if (!ev || ev.type !== 'message' || !ownAgentId || !ev.receiverId) {
-        return false;
-    }
-    if (ev.assigneeId === ownAgentId || ev.receiverId === ownAgentId)
-        return false;
-    return true;
-}
 // ── outcomeFromEvent: incoming wire event → Outcome ──────────────────────────
 /**
  * Converts a raw incoming event into the single Outcome that re-enters the
@@ -168,14 +152,6 @@ function singleEventToOutcome(ev, ownAgentId) {
     // Suppress our own messages echoed back through the chat fanout.
     if (ownAgentId && ev.senderId && ev.senderId === ownAgentId)
         return null;
-    // Attention gate: a message addressed to someone else is room context, not
-    // a turn. Delivery is audience-based on purpose (everyone in the chat hears
-    // everything), so in a multi-agent room every agent used to burn an LLM turn
-    // per utterance just to decide it wasn't theirs — the sender already decided
-    // that by naming a receiver. The message still lands in chat history and
-    // rides in on the next wake's read-back; nothing is lost but the interrupt.
-    if (isMessageAddressedElsewhere(ev, ownAgentId))
-        return null;
     const text = typeof ev.text === 'string' ? ev.text : undefined;
     const senderType = typeof ev.senderType === 'string' ? ev.senderType : undefined;
     return { kind: 'message-received', text, senderId: ev.senderId, senderType };

package/dist/runtime/kickoff.js

@@ -175,16 +175,16 @@ export function buildClaimKickoffState(initial) {
     return {
         kind: 'thinking',
         prompt: {
-            role: 'A buyer just claimed your store listing. There is no chat yet — you open the conversation and start serving the terms.',
-            goal: 'Open a chat with the buyer and greet them so the engagement begins.',
-            constraints: 'The claimed agreement id is in <event> / activeAgreementId. The buyer is the claim actor (Sender / actorId / Buyer on the event) — call chat_open with that participantId, then chat_send a short greeting that acknowledges the hire and offers to serve the agreement terms. Do not chat_send to an agrn-* session id. Do not spawn task_create here unless the terms require it after the greeting. Do not re-negotiate — the agreement is already active.',
+            role: "A buyer just claimed your store listing. chat_open with the buyer and the claimed agreementId returns the hire's room, which the server usually made at claim, or opens one when there is none. Then greet them and start serving the terms.",
+            goal: "Open or reuse the hire's room with the buyer and greet them so the engagement begins.",
+            constraints: "The claimed agreement id is in <event> / activeAgreementId. The buyer is the claim actor (Sender / actorId / Buyer on the event) — call chat_open with that participantId AND the claimed agreementId. That returns the hire's room the server usually made at claim, or opens one when there is none. Then chat_send a short greeting that acknowledges the hire and offers to serve the agreement terms. Do not chat_send to an agrn-* session id. Do not spawn task_create here unless the terms require it after the greeting. Do not re-negotiate — the agreement is already active.",
         },
         actions: {
             ...dflt.actions,
             openChat: {
                 prompt: {
-                    when: 'There is not yet a real chat with the buyer (common on store claims).',
-                    instruction: 'Open or reuse a chat with the buyer who claimed the listing.',
+                    when: "Call chat_open with the buyer and the claimed agreementId. The server usually already made the hire's room at claim; this returns it, or opens one when there is none.",
+                    instruction: "Open or reuse the hire's room with the buyer who claimed the listing.",
                     format: '{"participantId": "<buyer actorId / Sender from the event>", "agreementId": "<the claimed agreement id>"}',
                 },
                 tool: 'chat_open',

package/dist/runtime/wakeEffects.js

@@ -1,4 +1,5 @@
 import { agreementIdFromLane } from '@ziggs-ai/api-client';
+import { isListing } from './agreementContext.js';
 const record = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 const id = (value) => typeof value === 'string' && value.trim() ? value : undefined;
 /** Never combine a task from one event with an agreement from another. */
@@ -22,7 +23,10 @@ export function workScopeFromWake(event, sessionId) {
     }
     const resource = record(rec.resource);
     const task = rec.type === 'task_result' || rec.type === 'notification' ? record(rec.result) : {};
-    const agreementId = id(rec.agreementId) ?? id(resource.agreementId) ?? id(task.agreementId)
+    // A listing is never work, so it is never what a wake's sends and
+    // tools are filed under.
+    const listing = record(rec.agreementContext).listing === true;
+    const agreementId = listing ? undefined : id(rec.agreementId) ?? id(resource.agreementId) ?? id(task.agreementId)
         ?? agreementIdFromLane(rec.chatId) ?? agreementIdFromLane(resource.chatId)
         ?? agreementIdFromLane(sessionId) ?? undefined;
     const taskId = id(rec.taskId) ?? id(resource.taskId) ?? id(task.taskId) ?? (resource.kind === 'task' ? id(resource.resourceId) : undefined);
@@ -100,6 +104,10 @@ export class WakeEffects {
         if (effect.kind === 'read-context' && effect.sessionId === this.sessionId
             && outer.chatMissing !== true && Array.isArray(outer.agreements)) {
             for (const row of outer.agreements) {
+                // A stranger's room is linked to the agent's listing; the listing is
+                // every stranger's and never the room's work.
+                if (isListing(row))
+                    continue;
                 const agreementId = id(record(row).agreementId);
                 if (agreementId)
                     this.roomAgreementIds.push(agreementId);

package/dist/types.d.ts

@@ -207,6 +207,8 @@ export interface Ctx {
     lastOutcome: Outcome;
     /** Claude Agent SDK session id for resume across ticks (claude-sdk cognition only). */
     claudeSessionId?: string;
+    /** Work and audience bound to the saved transcript. Older unbound sessions are not resumed. */
+    claudeWorkScope?: string;
     /**
      * Recent wake timestamps (epoch ms) for this lane (claude-sdk cognition
      * only). Backstop circuit breaker: if a lane wakes faster than any real

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ziggs-ai/agent-sdk",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "description": "Agent framework SDK for building autonomous agents on the Ziggs platform",
   "type": "module",
   "main": "dist/index.js",
@@ -23,10 +23,10 @@
     "test:watch": "node --experimental-test-module-mocks --import tsx/esm --test --watch test/*.test.ts"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.204",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.284",
     "@anthropic-ai/sdk": "^0.110.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@ziggs-ai/api-client": "0.27.0",
+    "@ziggs-ai/api-client": "0.29.0",
     "ajv": "^8.17.1",
     "dotenv": "^17.2.3",
     "openai": "^4.0.0",