dsh-interconnect 0.11.8 → 0.11.10

package/lib/tool-interconnect/index.js

@@ -1,5 +1,1741 @@
 // src/tool-interconnect/index.ts
 import { defineTool } from "@deepseek-ai/dsh-tools";
+
+// src/interconnect/index.ts
+import { Service } from "@deepseek-ai/cordis";
+import { createHash, randomUUID, timingSafeEqual as constantTimeEqual } from "node:crypto";
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm";
+
+// ../.dsh/source/staging-20260807T143236Z/vendor/cosmokit/src/misc.ts
+function isNullable(value) {
+  return value === null || value === void 0;
+}
+function isPlainObject(data) {
+  return data && typeof data === "object" && !Array.isArray(data);
+}
+function filterKeys(object, filter) {
+  return Object.fromEntries(Object.entries(object).filter(([key, value]) => filter(key, value)));
+}
+function mapValues(object, transform) {
+  return Object.fromEntries(Object.entries(object).map(([key, value]) => [key, transform(value, key)]));
+}
+function pick(source, keys, forced) {
+  if (!keys) return { ...source };
+  const result = {};
+  for (const key of keys) {
+    if (forced || source[key] !== void 0) result[key] = source[key];
+  }
+  return result;
+}
+
+// ../.dsh/source/staging-20260807T143236Z/vendor/cosmokit/src/types.ts
+function is(type, value) {
+  if (arguments.length === 1) return (value2) => is(type, value2);
+  return type in globalThis && value instanceof globalThis[type] || Object.prototype.toString.call(value).slice(8, -1) === type;
+}
+function isArrayBufferLike(value) {
+  return is("ArrayBuffer", value) || is("SharedArrayBuffer", value);
+}
+function isArrayBufferSource(value) {
+  return isArrayBufferLike(value) || ArrayBuffer.isView(value);
+}
+var Binary;
+((Binary2) => {
+  Binary2.is = isArrayBufferLike;
+  Binary2.isSource = isArrayBufferSource;
+  function fromSource(source) {
+    if (ArrayBuffer.isView(source)) {
+      return source.buffer.slice(source.byteOffset, source.byteOffset + source.byteLength);
+    } else {
+      return source;
+    }
+  }
+  Binary2.fromSource = fromSource;
+  function toBase64(source) {
+    source = fromSource(source);
+    if (typeof Buffer !== "undefined") {
+      return Buffer.from(source).toString("base64");
+    }
+    let binary = "";
+    const bytes = new Uint8Array(source);
+    for (let i = 0; i < bytes.byteLength; i++) {
+      binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+  }
+  Binary2.toBase64 = toBase64;
+  function fromBase64(source) {
+    if (typeof Buffer !== "undefined") return fromSource(Buffer.from(source, "base64"));
+    return Uint8Array.from(atob(source), (c) => c.charCodeAt(0));
+  }
+  Binary2.fromBase64 = fromBase64;
+  function toHex(source) {
+    source = fromSource(source);
+    if (typeof Buffer !== "undefined") return Buffer.from(source).toString("hex");
+    return Array.from(new Uint8Array(source), (byte) => byte.toString(16).padStart(2, "0")).join("");
+  }
+  Binary2.toHex = toHex;
+  function fromHex(source) {
+    if (typeof Buffer !== "undefined") return fromSource(Buffer.from(source, "hex"));
+    const hex = source.length % 2 === 0 ? source : source.slice(0, source.length - 1);
+    const buffer = [];
+    for (let i = 0; i < hex.length; i += 2) {
+      buffer.push(parseInt(`${hex[i]}${hex[i + 1]}`, 16));
+    }
+    return Uint8Array.from(buffer).buffer;
+  }
+  Binary2.fromHex = fromHex;
+})(Binary || (Binary = {}));
+var base64ToArrayBuffer = Binary.fromBase64;
+var arrayBufferToBase64 = Binary.toBase64;
+var hexToArrayBuffer = Binary.fromHex;
+var arrayBufferToHex = Binary.toHex;
+function clone(source, refs = /* @__PURE__ */ new Map()) {
+  if (!source || typeof source !== "object") return source;
+  if (is("Date", source)) return new Date(source.valueOf());
+  if (is("RegExp", source)) return new RegExp(source.source, source.flags);
+  if (isArrayBufferLike(source)) return source.slice(0);
+  if (ArrayBuffer.isView(source)) return source.buffer.slice(source.byteOffset, source.byteOffset + source.byteLength);
+  const cached = refs.get(source);
+  if (cached) return cached;
+  if (Array.isArray(source)) {
+    const result2 = [];
+    refs.set(source, result2);
+    source.forEach((value, index) => {
+      result2[index] = Reflect.apply(clone, null, [value, refs]);
+    });
+    return result2;
+  }
+  const result = Object.create(Object.getPrototypeOf(source));
+  refs.set(source, result);
+  for (const key of Reflect.ownKeys(source)) {
+    const descriptor = { ...Reflect.getOwnPropertyDescriptor(source, key) };
+    if ("value" in descriptor) {
+      descriptor.value = Reflect.apply(clone, null, [descriptor.value, refs]);
+    }
+    Reflect.defineProperty(result, key, descriptor);
+  }
+  return result;
+}
+function deepEqual(a, b, strict) {
+  if (a === b) return true;
+  if (!strict && isNullable(a) && isNullable(b)) return true;
+  if (typeof a !== typeof b) return false;
+  if (typeof a !== "object") return false;
+  if (!a || !b) return false;
+  function check(test, then) {
+    return test(a) ? test(b) ? then(a, b) : false : test(b) ? false : void 0;
+  }
+  return check(Array.isArray, (a2, b2) => a2.length === b2.length && a2.every((item, index) => deepEqual(item, b2[index]))) ?? check(is("Date"), (a2, b2) => a2.valueOf() === b2.valueOf()) ?? check(is("RegExp"), (a2, b2) => a2.source === b2.source && a2.flags === b2.flags) ?? check(isArrayBufferLike, (a2, b2) => {
+    if (a2.byteLength !== b2.byteLength) return false;
+    const viewA = new Uint8Array(a2);
+    const viewB = new Uint8Array(b2);
+    for (let i = 0; i < viewA.length; i++) {
+      if (viewA[i] !== viewB[i]) return false;
+    }
+    return true;
+  }) ?? Object.keys({ ...a, ...b }).every((key) => deepEqual(a[key], b[key], strict));
+}
+
+// ../.dsh/source/staging-20260807T143236Z/vendor/cosmokit/src/time.ts
+var Time;
+((Time2) => {
+  Time2.millisecond = 1;
+  Time2.second = 1e3;
+  Time2.minute = Time2.second * 60;
+  Time2.hour = Time2.minute * 60;
+  Time2.day = Time2.hour * 24;
+  Time2.week = Time2.day * 7;
+  let timezoneOffset = (/* @__PURE__ */ new Date()).getTimezoneOffset();
+  function setTimezoneOffset(offset) {
+    timezoneOffset = offset;
+  }
+  Time2.setTimezoneOffset = setTimezoneOffset;
+  function getTimezoneOffset() {
+    return timezoneOffset;
+  }
+  Time2.getTimezoneOffset = getTimezoneOffset;
+  function getDateNumber(date2 = /* @__PURE__ */ new Date(), offset) {
+    if (typeof date2 === "number") date2 = new Date(date2);
+    if (offset === void 0) offset = timezoneOffset;
+    return Math.floor((date2.valueOf() / Time2.minute - offset) / 1440);
+  }
+  Time2.getDateNumber = getDateNumber;
+  function fromDateNumber(value, offset) {
+    const date2 = new Date(value * Time2.day);
+    if (offset === void 0) offset = timezoneOffset;
+    return new Date(+date2 + offset * Time2.minute);
+  }
+  Time2.fromDateNumber = fromDateNumber;
+  const numeric = /\d+(?:\.\d+)?/.source;
+  const timeRegExp = new RegExp(`^${[
+    "w(?:eek(?:s)?)?",
+    "d(?:ay(?:s)?)?",
+    "h(?:our(?:s)?)?",
+    "m(?:in(?:ute)?(?:s)?)?",
+    "s(?:ec(?:ond)?(?:s)?)?"
+  ].map((unit) => `(${numeric}${unit})?`).join("")}$`);
+  function parseTime(source) {
+    const capture = timeRegExp.exec(source);
+    if (!capture) return 0;
+    return (parseFloat(capture[1]) * Time2.week || 0) + (parseFloat(capture[2]) * Time2.day || 0) + (parseFloat(capture[3]) * Time2.hour || 0) + (parseFloat(capture[4]) * Time2.minute || 0) + (parseFloat(capture[5]) * Time2.second || 0);
+  }
+  Time2.parseTime = parseTime;
+  function parseDate(date2) {
+    const parsed = parseTime(date2);
+    if (parsed) {
+      date2 = Date.now() + parsed;
+    } else if (/^\d{1,2}(:\d{1,2}){1,2}$/.test(date2)) {
+      date2 = `${(/* @__PURE__ */ new Date()).toLocaleDateString()}-${date2}`;
+    } else if (/^\d{1,2}-\d{1,2}-\d{1,2}(:\d{1,2}){1,2}$/.test(date2)) {
+      date2 = `${(/* @__PURE__ */ new Date()).getFullYear()}-${date2}`;
+    }
+    return date2 ? new Date(date2) : /* @__PURE__ */ new Date();
+  }
+  Time2.parseDate = parseDate;
+  function format(ms) {
+    const abs = Math.abs(ms);
+    if (abs >= Time2.day - Time2.hour / 2) {
+      return Math.round(ms / Time2.day) + "d";
+    } else if (abs >= Time2.hour - Time2.minute / 2) {
+      return Math.round(ms / Time2.hour) + "h";
+    } else if (abs >= Time2.minute - Time2.second / 2) {
+      return Math.round(ms / Time2.minute) + "m";
+    } else if (abs >= Time2.second) {
+      return Math.round(ms / Time2.second) + "s";
+    }
+    return ms + "ms";
+  }
+  Time2.format = format;
+  function toDigits(source, length = 2) {
+    return source.toString().padStart(length, "0");
+  }
+  Time2.toDigits = toDigits;
+  function template(template2, time = /* @__PURE__ */ new Date()) {
+    return template2.replace("yyyy", time.getFullYear().toString()).replace("yy", time.getFullYear().toString().slice(2)).replace("MM", toDigits(time.getMonth() + 1)).replace("dd", toDigits(time.getDate())).replace("hh", toDigits(time.getHours())).replace("mm", toDigits(time.getMinutes())).replace("ss", toDigits(time.getSeconds())).replace("SSS", toDigits(time.getMilliseconds(), 3));
+  }
+  Time2.template = template;
+})(Time || (Time = {}));
+
+// ../.dsh/source/staging-20260807T143236Z/vendor/schemastery/lib/index.mjs
+var kSchema = Symbol.for("schemastery");
+var kValidationError = Symbol.for("ValidationError");
+globalThis.__schemastery_index__ ??= 0;
+globalThis.__schemastery_refs__ = void 0;
+var ValidationError = class extends TypeError {
+  options;
+  name = "ValidationError";
+  constructor(message, options) {
+    let prefix = "$";
+    for (const segment of options.path || []) if (typeof segment === "string") prefix += "." + segment;
+    else if (typeof segment === "number") prefix += "[" + segment + "]";
+    else if (typeof segment === "symbol") prefix += `[Symbol(${segment.toString()})]`;
+    if (prefix.startsWith(".")) prefix = prefix.slice(1);
+    super((prefix === "$" ? "" : `${prefix} `) + message);
+    this.options = options;
+  }
+  static is(error) {
+    return !!error?.[kValidationError];
+  }
+};
+Object.defineProperty(ValidationError.prototype, kValidationError, { value: true });
+var Schema = function(options) {
+  const schema = function(data, options2 = {}) {
+    return Schema.resolve(data, schema, options2)[0];
+  };
+  if (options.refs) {
+    const refs = mapValues(options.refs, (options2) => new Schema(options2));
+    const getRef = (uid) => refs[uid];
+    for (const key in refs) {
+      const options2 = refs[key];
+      options2.sKey = getRef(options2.sKey);
+      options2.inner = getRef(options2.inner);
+      options2.list = options2.list && options2.list.map(getRef);
+      options2.dict = options2.dict && mapValues(options2.dict, getRef);
+    }
+    return refs[options.uid];
+  }
+  Object.assign(schema, options);
+  if (typeof schema.callback === "string") try {
+    schema.callback = new Function("return " + schema.callback)();
+  } catch {
+  }
+  Object.defineProperty(schema, "uid", { value: globalThis.__schemastery_index__++ });
+  Object.setPrototypeOf(schema, Schema.prototype);
+  schema.meta ||= {};
+  schema.toString = schema.toString.bind(schema);
+  return schema;
+};
+Schema.prototype = Object.create(Function.prototype);
+Schema.prototype[kSchema] = true;
+Object.defineProperty(Schema.prototype, "~standard", { get() {
+  return {
+    version: 1,
+    vendor: "schemastery",
+    validate: (value) => {
+      try {
+        return { value: Schema.resolve(value, this, {})[0] };
+      } catch (error) {
+        if (ValidationError.is(error)) return { issues: [{
+          message: error.message,
+          path: error.options.path
+        }] };
+        throw error;
+      }
+    }
+  };
+} });
+Schema.ValidationError = ValidationError;
+Schema.prototype.toJSON = function toJSON() {
+  if (globalThis.__schemastery_refs__) {
+    globalThis.__schemastery_refs__[this.uid] ??= JSON.parse(JSON.stringify({ ...this }));
+    return this.uid;
+  }
+  globalThis.__schemastery_refs__ = { [this.uid]: { ...this } };
+  globalThis.__schemastery_refs__[this.uid] = JSON.parse(JSON.stringify({ ...this }));
+  const result = {
+    uid: this.uid,
+    refs: globalThis.__schemastery_refs__
+  };
+  globalThis.__schemastery_refs__ = void 0;
+  return result;
+};
+Schema.prototype.set = function set(key, value) {
+  this.dict[key] = value;
+  return this;
+};
+Schema.prototype.push = function push(value) {
+  this.list.push(value);
+  return this;
+};
+function mergeDesc(original, messages) {
+  const result = typeof original === "string" ? { "": original } : { ...original };
+  for (const locale in messages) {
+    const value = messages[locale];
+    if (value?.$description || value?.$desc) result[locale] = value.$description || value.$desc;
+    else if (typeof value === "string") result[locale] = value;
+  }
+  return result;
+}
+function getInner(value) {
+  return value?.$value ?? value?.$inner;
+}
+function extractKeys(data) {
+  return filterKeys(data ?? {}, (key) => !key.startsWith("$"));
+}
+Schema.prototype.i18n = function i18n(messages) {
+  const schema = Schema(this);
+  const desc = mergeDesc(schema.meta.description, messages);
+  if (Object.keys(desc).length) schema.meta.description = desc;
+  if (schema.dict) schema.dict = mapValues(schema.dict, (inner, key) => {
+    return inner.i18n(mapValues(messages, (data) => getInner(data)?.[key] ?? data?.[key]));
+  });
+  if (schema.list) schema.list = schema.list.map((inner, index) => {
+    return inner.i18n(mapValues(messages, (data = {}) => {
+      if (Array.isArray(getInner(data))) return getInner(data)[index];
+      if (Array.isArray(data)) return data[index];
+      return extractKeys(data);
+    }));
+  });
+  if (schema.inner) schema.inner = schema.inner.i18n(mapValues(messages, (data) => {
+    if (getInner(data)) return getInner(data);
+    return extractKeys(data);
+  }));
+  if (schema.sKey) schema.sKey = schema.sKey.i18n(mapValues(messages, (data) => data?.$key));
+  return schema;
+};
+Schema.prototype.extra = function extra(key, value) {
+  const schema = Schema(this);
+  schema.meta = {
+    ...schema.meta,
+    [key]: value
+  };
+  return schema;
+};
+for (const key of [
+  "required",
+  "disabled",
+  "collapse",
+  "hidden",
+  "loose"
+]) Object.assign(Schema.prototype, { [key](value = true) {
+  const schema = Schema(this);
+  schema.meta = {
+    ...schema.meta,
+    [key]: value
+  };
+  return schema;
+} });
+Schema.prototype.deprecated = function deprecated() {
+  const schema = Schema(this);
+  schema.meta.badges ||= [];
+  schema.meta.badges.push({
+    text: "deprecated",
+    type: "danger"
+  });
+  return schema;
+};
+Schema.prototype.experimental = function experimental() {
+  const schema = Schema(this);
+  schema.meta.badges ||= [];
+  schema.meta.badges.push({
+    text: "experimental",
+    type: "warning"
+  });
+  return schema;
+};
+Schema.prototype.pattern = function pattern(regexp) {
+  const schema = Schema(this);
+  const pattern2 = pick(regexp, ["source", "flags"]);
+  schema.meta = {
+    ...schema.meta,
+    pattern: pattern2
+  };
+  return schema;
+};
+Schema.prototype.simplify = function simplify(value) {
+  if (deepEqual(value, this.meta.default, this.type === "dict")) return null;
+  if (isNullable(value)) return value;
+  if (this.type === "object" || this.type === "dict") {
+    const result = {};
+    for (const key in value) {
+      const item = (this.type === "object" ? this.dict[key] : this.inner)?.simplify(value[key]);
+      if (this.type === "dict" || !isNullable(item)) result[key] = item;
+    }
+    if (deepEqual(result, this.meta.default, this.type === "dict")) return null;
+    return result;
+  } else if (this.type === "array" || this.type === "tuple") {
+    const result = [];
+    value.forEach((value2, index) => {
+      const schema = this.type === "array" ? this.inner : this.list[index];
+      const item = schema ? schema.simplify(value2) : value2;
+      result.push(item);
+    });
+    return result;
+  } else if (this.type === "intersect") {
+    const result = {};
+    for (const item of this.list) Object.assign(result, item.simplify(value));
+    return result;
+  } else if (this.type === "union") for (const schema of this.list) try {
+    Schema.resolve(value, schema, {});
+    return schema.simplify(value);
+  } catch {
+  }
+  return value;
+};
+Schema.prototype.toString = function toString(inline) {
+  return formatters[this.type]?.(this, inline) ?? `Schema<${this.type}>`;
+};
+Schema.prototype.role = function role(role, extra2) {
+  const schema = Schema(this);
+  schema.meta = {
+    ...schema.meta,
+    role,
+    extra: extra2
+  };
+  return schema;
+};
+for (const key of [
+  "default",
+  "link",
+  "comment",
+  "description",
+  "max",
+  "min",
+  "step"
+]) Object.assign(Schema.prototype, { [key](value) {
+  const schema = Schema(this);
+  schema.meta = {
+    ...schema.meta,
+    [key]: value
+  };
+  return schema;
+} });
+var resolvers = {};
+Schema.extend = function extend(type, resolve2) {
+  resolvers[type] = resolve2;
+};
+Schema.resolve = function resolve(data, schema, options = {}, strict = false) {
+  if (!schema) return [data];
+  if (options.ignore?.(data, schema)) return [data];
+  if (isNullable(data) && schema.type !== "lazy") {
+    if (schema.meta.required) throw new ValidationError(`missing required value`, options);
+    let current = schema;
+    let fallback = schema.meta.default;
+    while (current?.type === "intersect" && isNullable(fallback)) {
+      current = current.list[0];
+      fallback = current?.meta.default;
+    }
+    if (isNullable(fallback)) return [data];
+    data = clone(fallback);
+  }
+  const callback = resolvers[schema.type];
+  if (!callback) throw new ValidationError(`unsupported type "${schema.type}"`, options);
+  try {
+    return callback(data, schema, options, strict);
+  } catch (error) {
+    if (!schema.meta.loose) throw error;
+    return [schema.meta.default];
+  }
+};
+Schema.from = function from(source) {
+  if (isNullable(source)) return Schema.any();
+  else if ([
+    "string",
+    "number",
+    "boolean"
+  ].includes(typeof source)) return Schema.const(source).required();
+  else if (source[kSchema]) return source;
+  else if (typeof source === "function") switch (source) {
+    case String:
+      return Schema.string().required();
+    case Number:
+      return Schema.number().required();
+    case Boolean:
+      return Schema.boolean().required();
+    case Function:
+      return Schema.function().required();
+    default:
+      return Schema.is(source).required();
+  }
+  else throw new TypeError(`cannot infer schema from ${source}`);
+};
+Schema.lazy = function lazy(builder) {
+  const toJSON2 = () => {
+    if (!schema.inner[kSchema]) {
+      schema.inner = schema.builder();
+      schema.inner.meta = {
+        ...schema.meta,
+        ...schema.inner.meta
+      };
+    }
+    return schema.inner.toJSON();
+  };
+  const schema = new Schema({
+    type: "lazy",
+    builder,
+    inner: { toJSON: toJSON2 }
+  });
+  return schema;
+};
+Schema.natural = function natural() {
+  return Schema.number().step(1).min(0);
+};
+Schema.percent = function percent() {
+  return Schema.number().step(0.01).min(0).max(1).role("slider");
+};
+Schema.date = function date() {
+  return Schema.union([Schema.is(Date), Schema.transform(Schema.string().role("datetime"), (value, options) => {
+    const date2 = new Date(value);
+    if (isNaN(+date2)) throw new ValidationError(`invalid date "${value}"`, options);
+    return date2;
+  }, true)]);
+};
+Schema.regExp = function regExp(flag = "") {
+  return Schema.union([Schema.is(RegExp), Schema.transform(Schema.string().role("regexp", { flag }), (value, options) => {
+    try {
+      return new RegExp(value, flag);
+    } catch (e) {
+      throw new ValidationError(e.message, options);
+    }
+  }, true)]);
+};
+Schema.arrayBuffer = function arrayBuffer(encoding) {
+  return Schema.union([
+    Schema.is(ArrayBuffer),
+    Schema.is(SharedArrayBuffer),
+    Schema.transform(Schema.any(), (value, options) => {
+      if (Binary.isSource(value)) return Binary.fromSource(value);
+      throw new ValidationError(`expected ArrayBufferSource but got ${value}`, options);
+    }, true),
+    ...encoding ? [Schema.transform(Schema.string(), (value, options) => {
+      try {
+        return encoding === "base64" ? Binary.fromBase64(value) : Binary.fromHex(value);
+      } catch (e) {
+        throw new ValidationError(e.message, options);
+      }
+    }, true)] : []
+  ]);
+};
+Schema.extend("lazy", (data, schema, options, strict) => {
+  if (!schema.inner[kSchema]) {
+    schema.inner = schema.builder();
+    schema.inner.meta = {
+      ...schema.meta,
+      ...schema.inner.meta
+    };
+  }
+  return Schema.resolve(data, schema.inner, options, strict);
+});
+Schema.extend("any", (data) => {
+  return [data];
+});
+Schema.extend("never", (data, _, options) => {
+  throw new ValidationError(`expected nullable but got ${data}`, options);
+});
+Schema.extend("const", (data, { value }, options) => {
+  if (deepEqual(data, value)) return [value];
+  throw new ValidationError(`expected ${value} but got ${data}`, options);
+});
+function checkWithinRange(data, meta, description, options, skipMin = false) {
+  const { max = Infinity, min = -Infinity } = meta;
+  if (data > max) throw new ValidationError(`expected ${description} <= ${max} but got ${data}`, options);
+  if (data < min && !skipMin) throw new ValidationError(`expected ${description} >= ${min} but got ${data}`, options);
+}
+Schema.extend("string", (data, { meta }, options) => {
+  if (typeof data !== "string") throw new ValidationError(`expected string but got ${data}`, options);
+  if (meta.pattern) {
+    const regexp = new RegExp(meta.pattern.source, meta.pattern.flags);
+    if (!regexp.test(data)) throw new ValidationError(`expect string to match regexp ${regexp}`, options);
+  }
+  checkWithinRange(data.length, meta, "string length", options);
+  return [data];
+});
+function decimalShift(data, digits) {
+  const str = data.toString();
+  if (str.includes("e")) return data * Math.pow(10, digits);
+  const index = str.indexOf(".");
+  if (index === -1) return data * Math.pow(10, digits);
+  const frac = str.slice(index + 1);
+  const integer = str.slice(0, index);
+  if (frac.length <= digits) return +(integer + frac.padEnd(digits, "0"));
+  return +(integer + frac.slice(0, digits) + "." + frac.slice(digits));
+}
+function isMultipleOf(data, min, step) {
+  step = Math.abs(step);
+  if (!/^\d+\.\d+$/.test(step.toString())) return (data - min) % step === 0;
+  const index = step.toString().indexOf(".");
+  const digits = step.toString().slice(index + 1).length;
+  return Math.abs(decimalShift(data, digits) - decimalShift(min, digits)) % decimalShift(step, digits) === 0;
+}
+Schema.extend("number", (data, { meta }, options) => {
+  if (typeof data !== "number") throw new ValidationError(`expected number but got ${data}`, options);
+  checkWithinRange(data, meta, "number", options);
+  const { step } = meta;
+  if (step && !isMultipleOf(data, meta.min ?? 0, step)) throw new ValidationError(`expected number multiple of ${step} but got ${data}`, options);
+  return [data];
+});
+Schema.extend("boolean", (data, _, options) => {
+  if (typeof data === "boolean") return [data];
+  throw new ValidationError(`expected boolean but got ${data}`, options);
+});
+Schema.extend("bitset", (data, { bits, meta }, options) => {
+  let value = 0, keys = [];
+  if (typeof data === "number") {
+    value = data;
+    for (const key in bits) if (data & bits[key]) keys.push(key);
+  } else if (Array.isArray(data)) {
+    keys = data;
+    for (const key of keys) {
+      if (typeof key !== "string") throw new ValidationError(`expected string but got ${key}`, options);
+      if (key in bits) value |= bits[key];
+    }
+  } else throw new ValidationError(`expected number or array but got ${data}`, options);
+  if (value === meta.default) return [value];
+  return [value, keys];
+});
+Schema.extend("function", (data, _, options) => {
+  if (typeof data === "function") return [data];
+  throw new ValidationError(`expected function but got ${data}`, options);
+});
+Schema.extend("is", (data, { constructor }, options) => {
+  if (typeof constructor === "function") {
+    if (data instanceof constructor) return [data];
+    throw new ValidationError(`expected ${constructor.name} but got ${data}`, options);
+  } else {
+    if (isNullable(data)) throw new ValidationError(`expected ${constructor} but got ${data}`, options);
+    let prototype = Object.getPrototypeOf(data);
+    while (prototype) {
+      if (prototype.constructor?.name === constructor) return [data];
+      prototype = Object.getPrototypeOf(prototype);
+    }
+    throw new ValidationError(`expected ${constructor} but got ${data}`, options);
+  }
+});
+function property(data, key, schema, options) {
+  try {
+    const [value, adapted] = Schema.resolve(data[key], schema, {
+      ...options,
+      path: [...options.path || [], key]
+    });
+    if (adapted !== void 0) data[key] = adapted;
+    return value;
+  } catch (e) {
+    if (!options?.autofix) throw e;
+    delete data[key];
+    return schema.meta.default;
+  }
+}
+Schema.extend("array", (data, { inner, meta }, options) => {
+  if (!Array.isArray(data)) throw new ValidationError(`expected array but got ${data}`, options);
+  checkWithinRange(data.length, meta, "array length", options, !isNullable(inner.meta.default));
+  return [data.map((_, index) => property(data, index, inner, options))];
+});
+Schema.extend("dict", (data, { inner, sKey }, options, strict) => {
+  if (!isPlainObject(data)) throw new ValidationError(`expected object but got ${data}`, options);
+  const result = {};
+  for (const key in data) {
+    let rKey;
+    try {
+      rKey = Schema.resolve(key, sKey, options)[0];
+    } catch (error) {
+      if (strict) continue;
+      throw error;
+    }
+    result[rKey] = property(data, key, inner, options);
+    data[rKey] = data[key];
+    if (key !== rKey) delete data[key];
+  }
+  return [result];
+});
+Schema.extend("tuple", (data, { list }, options, strict) => {
+  if (!Array.isArray(data)) throw new ValidationError(`expected array but got ${data}`, options);
+  const result = list.map((inner, index) => property(data, index, inner, options));
+  if (strict) return [result];
+  result.push(...data.slice(list.length));
+  return [result];
+});
+function merge(result, data) {
+  for (const key in data) {
+    if (key in result) continue;
+    result[key] = data[key];
+  }
+}
+Schema.extend("object", (data, { dict }, options, strict) => {
+  if (!isPlainObject(data)) throw new ValidationError(`expected object but got ${data}`, options);
+  const result = {};
+  for (const key in dict) {
+    const value = property(data, key, dict[key], options);
+    if (!isNullable(value) || key in data) result[key] = value;
+  }
+  if (!strict) merge(result, data);
+  return [result];
+});
+Schema.extend("union", (data, { list, toString: toString2 }, options, strict) => {
+  const messages = [];
+  for (const inner of list) try {
+    return Schema.resolve(data, inner, options, strict);
+  } catch (error) {
+    messages.push(error);
+  }
+  throw new ValidationError(`expected ${toString2()} but got ${JSON.stringify(data)}`, options);
+});
+Schema.extend("intersect", (data, { list, toString: toString2 }, options, strict) => {
+  if (!list.length) return [data];
+  let result;
+  for (const inner of list) {
+    const value = Schema.resolve(data, inner, options, true)[0];
+    if (isNullable(value)) continue;
+    if (isNullable(result)) result = value;
+    else if (typeof result !== typeof value) throw new ValidationError(`expected ${toString2()} but got ${JSON.stringify(data)}`, options);
+    else if (typeof value === "object") merge(result ??= {}, value);
+    else if (result !== value) throw new ValidationError(`expected ${toString2()} but got ${JSON.stringify(data)}`, options);
+  }
+  if (!strict && isPlainObject(data)) merge(result, data);
+  return [result];
+});
+Schema.extend("transform", (data, { inner, callback, preserve }, options) => {
+  const [result, adapted = data] = Schema.resolve(data, inner, options, true);
+  if (preserve) return [callback(result)];
+  else return [callback(result), callback(adapted)];
+});
+var formatters = {};
+function defineMethod(name2, keys, format) {
+  formatters[name2] = format;
+  Object.assign(Schema, { [name2](...args) {
+    const schema = new Schema({ type: name2 });
+    keys.forEach((key, index) => {
+      switch (key) {
+        case "sKey":
+          schema.sKey = args[index] ?? Schema.string();
+          break;
+        case "inner":
+          schema.inner = Schema.from(args[index]);
+          break;
+        case "list":
+          schema.list = args[index].map(Schema.from);
+          break;
+        case "dict":
+          schema.dict = mapValues(args[index], Schema.from);
+          break;
+        case "bits":
+          schema.bits = {};
+          for (const key2 in args[index]) {
+            if (typeof args[index][key2] !== "number") continue;
+            schema.bits[key2] = args[index][key2];
+          }
+          break;
+        case "callback": {
+          const callback = schema.callback = args[index];
+          callback["toJSON"] ||= () => callback.toString();
+          break;
+        }
+        case "constructor": {
+          const constructor = schema.constructor = args[index];
+          if (typeof constructor === "function") constructor["toJSON"] ||= () => constructor["name"];
+          break;
+        }
+        default:
+          schema[key] = args[index];
+      }
+    });
+    if (name2 === "object" || name2 === "dict") schema.meta.default = {};
+    else if (name2 === "array" || name2 === "tuple") schema.meta.default = [];
+    else if (name2 === "bitset") schema.meta.default = 0;
+    return schema;
+  } });
+}
+defineMethod("is", ["constructor"], ({ constructor }) => {
+  if (typeof constructor === "function") return constructor.name;
+  else return constructor;
+});
+defineMethod("any", [], () => "any");
+defineMethod("never", [], () => "never");
+defineMethod("const", ["value"], ({ value }) => typeof value === "string" ? JSON.stringify(value) : value);
+defineMethod("string", [], () => "string");
+defineMethod("number", [], () => "number");
+defineMethod("boolean", [], () => "boolean");
+defineMethod("bitset", ["bits"], () => "bitset");
+defineMethod("function", [], () => "function");
+defineMethod("array", ["inner"], ({ inner }) => `${inner.toString(true)}[]`);
+defineMethod("dict", ["inner", "sKey"], ({ inner, sKey }) => `{ [key: ${sKey.toString()}]: ${inner.toString()} }`);
+defineMethod("tuple", ["list"], ({ list }) => `[${list.map((inner) => inner.toString()).join(", ")}]`);
+defineMethod("object", ["dict"], ({ dict }) => {
+  if (Object.keys(dict).length === 0) return "{}";
+  return `{ ${Object.entries(dict).map(([key, inner]) => {
+    return `${key}${inner.meta.required ? "" : "?"}: ${inner.toString()}`;
+  }).join(", ")} }`;
+});
+defineMethod("union", ["list"], ({ list }, inline) => {
+  const result = list.map(({ toString: format }) => format()).join(" | ");
+  return inline ? `(${result})` : result;
+});
+defineMethod("intersect", ["list"], ({ list }) => {
+  return `${list.map((inner) => inner.toString(true)).join(" & ")}`;
+});
+defineMethod("transform", [
+  "inner",
+  "callback",
+  "preserve"
+], ({ inner }, isInner) => inner.toString(isInner));
+
+// src/interconnect/index.ts
+import WebSocket, { WebSocketServer } from "ws";
+function isSessionOwnedBySubagent(ctx, session, agent) {
+  if (session.header.origin === "subagent") return true;
+  const parentId = session.header.parentSession;
+  if (parentId === void 0 || agent === void 0) return false;
+  const parent = ctx.agents.get(parentId);
+  return parent !== void 0 && ctx.agents.isOwnedBy(agent.id, parent);
+}
+function assertNever(value) {
+  throw new Error(`interconnect: unhandled variant ${JSON.stringify(value)}`);
+}
+var INTERCONNECT_TOKEN_REF = "DSH_INTERCONNECT_TOKEN";
+var PLUGIN_SOURCE = "dsh-interconnect";
+var MAX_LINK_FRAME_BYTES = 1024 * 1024;
+var LINK_HANDSHAKE_TIMEOUT_MS = 1e4;
+var LINK_CHANNEL = "/interconnect/link";
+var LIST_FRAME_ENVELOPE_BYTES = 4096;
+var MAX_LIST_ROWS_BYTES = MAX_LINK_FRAME_BYTES - LIST_FRAME_ENVELOPE_BYTES;
+var MAX_LISTED_SESSIONS = 100;
+var rowBytes = (row) => Buffer.byteLength(JSON.stringify(row), "utf8") + 1;
+var notificationSchema = Schema.union([
+  Schema.object({ kind: Schema.const("agent/created").required(), sessionId: Schema.string().required() }),
+  Schema.object({ kind: Schema.const("agent/disposed").required(), sessionId: Schema.string().required() }),
+  Schema.object({ kind: Schema.const("agent/status").required(), sessionId: Schema.string().required(), status: Schema.union([Schema.const("idle"), Schema.const("running")]).required() }),
+  Schema.object({ kind: Schema.const("session/created").required(), sessionId: Schema.string().required(), parentSessionId: Schema.string() }),
+  Schema.object({ kind: Schema.const("session/disposed").required(), sessionId: Schema.string().required() }),
+  Schema.object({ kind: Schema.const("subagent/end").required(), provider: Schema.string().required(), childSessionId: Schema.string().required(), stopReason: Schema.string().required() })
+]);
+var senderSchema = Schema.object({ instanceId: Schema.string(), sessionId: Schema.string() });
+var pingResultSchema = Schema.object({ pong: Schema.const(true).required(), instance: Schema.string().required() });
+var listResultSchema = Schema.object({
+  instance: Schema.string().required(),
+  sessions: Schema.array(Schema.object({
+    sessionId: Schema.string().required(),
+    title: Schema.string().required(false),
+    status: Schema.string().required(false)
+  })).required()
+});
+var withoutNullFields = (value) => {
+  if (Array.isArray(value)) return value.map((item) => withoutNullFields(item));
+  if (value === null || typeof value !== "object") return value;
+  return Object.fromEntries(Object.entries(value).filter(([, field]) => field !== null).map(([key, field]) => [key, withoutNullFields(field)]));
+};
+var projectMsgResult = (result) => result.delivered ? { delivered: true, instance: result.instance, ...result.delivery === void 0 ? {} : { delivery: result.delivery } } : { delivered: false, instance: result.instance, reason: result.reason };
+var parseQueryResult = (schema, result) => {
+  try {
+    const [parsed] = Schema.resolve(result, schema, {});
+    return parsed;
+  } catch {
+    return void 0;
+  }
+};
+var projectPingResult = (result) => {
+  const parsed = parseQueryResult(pingResultSchema, result);
+  return parsed === void 0 ? void 0 : { pong: true, instance: parsed.instance };
+};
+var projectListResult = (result) => {
+  const parsed = parseQueryResult(listResultSchema, result);
+  if (parsed === void 0) return void 0;
+  const rows = parsed.sessions;
+  return {
+    instance: parsed.instance,
+    sessions: rows.map((row) => ({
+      sessionId: row.sessionId,
+      ...row.title === void 0 || row.title === null ? {} : { title: row.title },
+      ...row.status === void 0 || row.status === null ? {} : { status: row.status }
+    }))
+  };
+};
+var queryResultSchema = Schema.union([
+  pingResultSchema,
+  listResultSchema,
+  Schema.object({ accepted: Schema.const(true).required() })
+]);
+var messageSchema = Schema.object({
+  kind: Schema.const("send").required(),
+  sessionId: Schema.string().required(),
+  text: Schema.string().required(),
+  sender: senderSchema,
+  delivery: Schema.union([Schema.const("followup"), Schema.const("steer"), Schema.const("inject")]),
+  resume: Schema.boolean()
+});
+var querySchema = Schema.union([
+  Schema.object({ kind: Schema.const("ping").required() }),
+  Schema.object({ kind: Schema.const("list").required() }),
+  Schema.object({ kind: Schema.const("event").required(), notification: notificationSchema.required() })
+]);
+var msgResultSchema = Schema.union([
+  Schema.object({ delivered: Schema.const(true).required(), instance: Schema.string().required(), delivery: Schema.union([Schema.const("followup"), Schema.const("steer"), Schema.const("inject")]) }),
+  Schema.object({ delivered: Schema.const(false).required(), instance: Schema.string().required(), reason: Schema.union([
+    Schema.const("session-not-live"),
+    Schema.const("unreachable"),
+    Schema.const("resume-refused"),
+    Schema.const("resume-failed"),
+    Schema.const("session-owned-by-subagent"),
+    Schema.const("no-sender-known")
+  ]).required() })
+]);
+var linkFrameSchema = Schema.union([
+  Schema.object({ type: Schema.const("hello").required(), sender: Schema.string().required() }),
+  Schema.object({ type: Schema.const("event").required(), notification: notificationSchema.required() }),
+  Schema.object({ type: Schema.const("msg").required(), reqId: Schema.string().required(), message: messageSchema.required() }),
+  Schema.object({ type: Schema.const("msg-result").required(), reqId: Schema.string().required(), result: msgResultSchema.required() }),
+  Schema.object({ type: Schema.const("query").required(), reqId: Schema.string().required(), query: querySchema.required() }),
+  Schema.object({ type: Schema.const("query-result").required(), reqId: Schema.string().required(), result: queryResultSchema.required() })
+]);
+var InterconnectService = class extends Service {
+  static inject = ["agents", "credentials"];
+  static Config = Schema.object({
+    instanceId: Schema.string().default("dsh"),
+    requestTimeoutMs: Schema.natural().max(6e4).default(1e4),
+    peers: Schema.dict(Schema.string()).default({}),
+    delivery: Schema.union([Schema.const("followup"), Schema.const("steer"), Schema.const("inject")]).default("followup"),
+    allowResume: Schema.boolean().default(true)
+  });
+  instanceId;
+  requestTimeoutMs;
+  delivery;
+  allowResume;
+  subscriptions = [];
+  server = new WebSocketServer({ noServer: true, maxPayload: MAX_LINK_FRAME_BYTES });
+  sockets = /* @__PURE__ */ new Set();
+  /** Outbound peer links keyed by the peer's `instanceId`. */
+  linkStates = /* @__PURE__ */ new Map();
+  heartbeatTimer;
+  /** Peer identity each live socket announced via its `hello` frame, if any. */
+  peerOf = /* @__PURE__ */ new WeakMap();
+  /** Sender each local session last received a send from, keyed by local session id. */
+  senders = /* @__PURE__ */ new Map();
+  /** In-flight frames sent over a peer link, keyed by `reqId`, awaiting a correlated result. */
+  pendingMessages = /* @__PURE__ */ new Map();
+  reqIdCounter = 0;
+  /** Set when the service fiber unwinds; guards late inbound deliveries against driving disposed agents. */
+  disposed = false;
+  constructor(ctx, config) {
+    super(ctx, "interconnect");
+    this.instanceId = config.instanceId;
+    this.requestTimeoutMs = config.requestTimeoutMs;
+    this.delivery = config.delivery ?? "followup";
+    this.allowResume = config.allowResume ?? true;
+    for (const origin of Object.values(config.peers ?? {})) {
+      linkUrl(trimBase(origin));
+    }
+    for (const [peerInstanceId, origin] of Object.entries(config.peers ?? {})) {
+      this.link(peerInstanceId, origin);
+    }
+    const upgrade = {
+      path: LINK_CHANNEL,
+      handler: (req, socket, head) => {
+        void this.handleUpgrade(req, socket, head).catch((error) => {
+          this.ctx.logger.warn(`interconnect: upgrade failed: ${error instanceof Error ? error.message : String(error)}`);
+          socket.destroy();
+        });
+      }
+    };
+    ctx.inject(["webServer"], (webCtx) => {
+      webCtx.effect(() => webCtx.webServer.registerUpgrade(upgrade), "interconnect: /interconnect/link websocket");
+    });
+    this.heartbeatTimer = setInterval(() => {
+      for (const socket of this.sockets) {
+        if (socket.readyState !== WebSocket.OPEN) {
+          this.sockets.delete(socket);
+          continue;
+        }
+        if (socket.isAlive === false) {
+          socket.terminate();
+          this.sockets.delete(socket);
+          continue;
+        }
+        ;
+        socket.isAlive = false;
+        socket.ping();
+      }
+    }, 3e4);
+    this.subscriptions.push(ctx.on("agent/status", ({ agent, status }) => {
+      this.fanout({ kind: "agent/status", sessionId: String(agent.session.id), status });
+    }));
+    this.subscriptions.push(ctx.on("agent/created", ({ agent }) => {
+      this.fanout({ kind: "agent/created", sessionId: String(agent.session.id) });
+    }));
+    this.subscriptions.push(ctx.on("agent/disposed", ({ agent }) => {
+      this.fanout({ kind: "agent/disposed", sessionId: String(agent.session.id) });
+    }));
+    this.subscriptions.push(ctx.on("session/created", (session) => {
+      const parentSessionId = session.header.parentSession === void 0 ? void 0 : String(session.header.parentSession);
+      this.fanout({
+        kind: "session/created",
+        sessionId: String(session.id),
+        ...parentSessionId === void 0 ? {} : { parentSessionId }
+      });
+    }));
+    this.subscriptions.push(ctx.on("session/disposed", (session) => {
+      this.senders.delete(String(session.id));
+      this.fanout({ kind: "session/disposed", sessionId: String(session.id) });
+    }));
+    this.subscriptions.push(ctx.on("subagent/end", (info) => {
+      if (!info.local) return;
+      this.fanout({
+        kind: "subagent/end",
+        provider: info.provider,
+        childSessionId: String(info.id),
+        stopReason: info.stopReason
+      });
+    }));
+    ctx.effect(() => () => {
+      for (const dispose of this.subscriptions.splice(0)) dispose();
+    }, "interconnect: event subscriptions");
+    ctx.effect(() => () => {
+      if (this.heartbeatTimer !== void 0) clearInterval(this.heartbeatTimer);
+      for (const state of this.linkStates.values()) state.close();
+      this.linkStates.clear();
+      for (const socket of this.sockets) socket.terminate();
+      this.sockets.clear();
+      this.server.close();
+      for (const pending of this.pendingMessages.values()) {
+        clearTimeout(pending.timer);
+        pending.resolve?.(void 0);
+      }
+      this.pendingMessages.clear();
+      this.disposed = true;
+    }, "interconnect: websocket teardown");
+  }
+  /**
+   * This instance's identity to attach to outbound messages. Always present:
+   * it needs no address, only this instance's id and the calling session.
+   * @param sessionId - the local session that is sending, used as the reply target.
+   * @returns this instance's address-free identity for the calling session.
+   */
+  selfSender(sessionId) {
+    return { instanceId: this.instanceId, sessionId };
+  }
+  /**
+   * Deliver one text message to a live session on a peer instance.
+   * @param request - the peer instance id, target session, text, and optional delivery/resume overrides.
+   * @returns the peer's answer, or an unreachable result when no link answers.
+   */
+  async send(request) {
+    const payload = {
+      sessionId: request.sessionId,
+      text: request.text,
+      ...request.sender === void 0 ? {} : { sender: request.sender },
+      ...request.delivery === void 0 ? {} : { delivery: request.delivery },
+      ...request.resume === void 0 ? {} : { resume: request.resume }
+    };
+    try {
+      const result = await this.msgRequest(request.instanceId, "send", payload);
+      return result ?? { delivered: false, instance: request.instanceId, reason: "unreachable" };
+    } catch {
+      return { delivered: false, instance: request.instanceId, reason: "unreachable" };
+    }
+  }
+  /**
+   * Deliver one text message back to the peer that a local session last
+   * received a send from. `sessionId` names the LOCAL replying session; the
+   * outbound target is the `sender` that session recorded, addressed through
+   * this instance's own link to the sender's instance.
+   * @param request - the LOCAL replying session id, the reply text, and optional delivery/resume overrides.
+   * @returns the recalled sender's answer, or an unreachable result when no link answers.
+   */
+  async reply(request) {
+    const sender = this.senders.get(request.sessionId);
+    if (sender === void 0) {
+      return { delivered: false, instance: this.instanceId, reason: "no-sender-known" };
+    }
+    const payload = {
+      sessionId: sender.sessionId,
+      text: request.text,
+      ...request.delivery === void 0 ? {} : { delivery: request.delivery },
+      ...request.resume === void 0 ? {} : { resume: request.resume },
+      // Attribute the reply to this instance so the peer, in turn, can reply
+      // back — chaining the conversation.
+      sender: this.selfSender(request.sessionId)
+    };
+    try {
+      const result = await this.msgRequest(sender.instanceId, "send", payload);
+      return result ?? { delivered: false, instance: sender.instanceId, reason: "unreachable" };
+    } catch {
+      return { delivered: false, instance: sender.instanceId, reason: "unreachable" };
+    }
+  }
+  /**
+   * Probe a peer instance for liveness and identity over its persistent link.
+   * Returns the peer identity when reachable, or undefined when the link is
+   * not up or no answer arrives.
+   * @param instanceId - the peer's `instanceId` as configured under {@link Config.peers}.
+   * @returns the peer's identity, or undefined when the link is not up or no answer arrives.
+   */
+  async ping(instanceId) {
+    return this.queryRequest(instanceId, { kind: "ping" });
+  }
+  /**
+   * List a peer instance's live sessions over its persistent link. Undefined on
+   * transport failure, matching `ping`.
+   * @param instanceId - the peer's `instanceId` as configured under {@link Config.peers}.
+   * @returns the peer's live session rows, or undefined on transport failure.
+   */
+  async list(instanceId) {
+    return this.queryRequest(instanceId, { kind: "list" });
+  }
+  /**
+   * Send a `msg` frame over the live link to a peer and resolve with its
+   * correlated `msg-result`. Undefined when the peer has no live link here
+   * (not configured, or the link is down) — sends can only address configured+
+   * connected peers by design.
+   */
+  async msgRequest(instanceId, kind, payload) {
+    const state = this.linkStates.get(instanceId);
+    if (state === void 0 || !state.writable()) return void 0;
+    const reqId = `m${++this.reqIdCounter}-${randomUUID()}`;
+    const message = {
+      kind,
+      sessionId: payload.sessionId,
+      text: payload.text,
+      ...payload.sender === void 0 ? {} : { sender: payload.sender },
+      ...payload.delivery === void 0 ? {} : { delivery: payload.delivery },
+      ...payload.resume === void 0 ? {} : { resume: payload.resume }
+    };
+    return this.waitForResult(reqId, "msg", (failure) => {
+      const wrote = state.sendFrame({ type: "msg", reqId, message });
+      if (!wrote) failure(new Error(`interconnect: peer link to ${instanceId} closed while sending`));
+    });
+  }
+  /** Send a `query` frame over the live link to a peer and resolve its result. */
+  async queryRequest(instanceId, query) {
+    const state = this.linkStates.get(instanceId);
+    if (state === void 0 || !state.writable()) return void 0;
+    const reqId = `q${++this.reqIdCounter}-${randomUUID()}`;
+    const accept = query.kind === "ping" ? projectPingResult : projectListResult;
+    try {
+      return await this.waitForResult(reqId, "query", (failure) => {
+        const wrote = state.sendFrame({ type: "query", reqId, query });
+        if (!wrote) failure(new Error(`interconnect: peer link to ${instanceId} closed while querying`));
+      }, accept);
+    } catch {
+      return void 0;
+    }
+  }
+  /** Settle a `reqId` frame against its `*-result`, timing out at `requestTimeoutMs`. */
+  waitForResult(reqId, kind, send, accept) {
+    return new Promise((resolve2, reject) => {
+      const timer = setTimeout(() => {
+        this.pendingMessages.delete(reqId);
+        reject(new Error(`interconnect: no result for ${reqId} within ${this.requestTimeoutMs}ms`));
+      }, this.requestTimeoutMs);
+      const settle = (result) => {
+        clearTimeout(timer);
+        this.pendingMessages.delete(reqId);
+        resolve2(result);
+      };
+      this.pendingMessages.set(reqId, kind === "query" ? { timer, kind, accept, resolve: settle } : { timer, kind, resolve: settle });
+      send((error) => {
+        clearTimeout(timer);
+        this.pendingMessages.delete(reqId);
+        reject(error instanceof Error ? error : new Error(String(error)));
+      });
+    });
+  }
+  /**
+   * Add a peer route at runtime. Returns a disposer that removes it. Re-adding
+   * an existing instanceId re-routes it to the new origin.
+   * @param instanceId - the peer's `instanceId`.
+   * @param origin - origin this instance dials to reach that peer.
+   * @returns disposer removing the peer route.
+   */
+  subscribe(instanceId, origin) {
+    const linked = this.link(instanceId, origin);
+    const dialedOrigin = trimBase(origin);
+    return () => {
+      const state = this.linkStates.get(instanceId);
+      if (state === linked && state.peer === dialedOrigin) {
+        state.close();
+        this.linkStates.delete(instanceId);
+      }
+    };
+  }
+  /**
+   * Remove a peer route, closing its outbound link.
+   * @param instanceId - the peer route to remove.
+   */
+  unsubscribe(instanceId) {
+    const state = this.linkStates.get(instanceId);
+    if (state !== void 0) state.close();
+    this.linkStates.delete(instanceId);
+  }
+  /**
+   * Open (and, on drop, re-open) a persistent WebSocket link to a peer. Local
+   * events stream over the link in real time, and events the peer pushes are
+   * surfaced as `interconnect/event`. Repeating for the same instanceId
+   * re-routes the link to the new origin.
+   * @param instanceId - the peer's `instanceId`.
+   * @param origin - receiver origin this instance dials, e.g. `http://127.0.0.1:13080`.
+   * @returns a handle closing the link and cancelling reconnection.
+   */
+  link(instanceId, origin) {
+    const existing = this.linkStates.get(instanceId);
+    if (existing !== void 0 && !existing.isClosed()) {
+      existing.reroute(trimBase(origin));
+      return existing;
+    }
+    const state = new LinkState(
+      (socket) => {
+        this.attachSocket(socket);
+      },
+      this.ctx.logger,
+      () => this.resolveToken(),
+      instanceId,
+      trimBase(origin)
+    );
+    this.linkStates.set(instanceId, state);
+    state.dial();
+    return state;
+  }
+  /** Push one serialized lifecycle fact out to every linked peer over WS. */
+  fanout(notification) {
+    this.broadcast(notification);
+  }
+  /** Push one fact over every live WebSocket link, dropping closed sockets. */
+  broadcast(notification) {
+    if (this.sockets.size === 0) return;
+    const frame = { type: "event", notification };
+    const encoded = JSON.stringify(frame);
+    const sent = /* @__PURE__ */ new Set();
+    for (const socket of this.sockets) {
+      if (socket.readyState !== WebSocket.OPEN) {
+        this.sockets.delete(socket);
+        continue;
+      }
+      const peer = this.peerOf.get(socket);
+      if (peer !== void 0 && sent.has(peer)) continue;
+      if (peer !== void 0) sent.add(peer);
+      socket.send(encoded);
+    }
+  }
+  /**
+   * Dispatch one inbound `msg` frame: deliver a `send`/`reply` and answer the
+   * correlated `msg-result` on the same socket. Errors are surfaced as the
+   * result so a throwing handler cannot escape the socket's message callback.
+   */
+  async handleMsgFrame(socket, reqId, message) {
+    const result = await this.deliver({
+      sessionId: message.sessionId,
+      text: message.text,
+      /* v8 ignore next 1 -- schemastery resolves an absent optional `sender` to an empty object, never undefined. */
+      ...message.sender === void 0 ? {} : { sender: message.sender },
+      ...message.delivery === void 0 ? {} : { delivery: message.delivery },
+      ...message.resume === void 0 ? {} : { resume: message.resume }
+    });
+    this.sendFrame(socket, { type: "msg-result", reqId, result });
+  }
+  /** Dispatch one inbound `query` frame (ping/list/event) and answer on the socket. */
+  handleQueryFrame(socket, reqId, query) {
+    let result;
+    if (query.kind === "ping") {
+      result = { pong: true, instance: this.instanceId };
+    } else if (query.kind === "list") {
+      result = this.listSessions();
+    } else {
+      const payload = {
+        sender: this.peerOf.get(socket) ?? "unknown-peer",
+        notification: query.notification
+      };
+      this.receiveEvent(payload);
+      result = { accepted: true };
+    }
+    this.sendFrame(socket, { type: "query-result", reqId, result });
+  }
+  /**
+   * Surface one remote notification to local listeners and the log.
+   *
+   * `ctx.parallel` is used instead of `ctx.emit`: `emit` maps listeners without
+   * awaiting them, so a listener that returns a rejected promise would surface
+   * as an unhandled rejection, while `parallel` settles every listener and
+   * aggregates their failures.
+   */
+  receiveEvent(eventPayload) {
+    const { notification, sender } = eventPayload;
+    this.ctx.logger.info(`interconnect: remote event ${notification.kind} from ${sender}`);
+    void this.ctx.parallel("interconnect/event", notification, sender).catch((error) => {
+      const reasons = error instanceof AggregateError ? error.errors : [error];
+      const detail = reasons.map((reason) => reason instanceof Error ? reason.message : String(reason)).join("; ");
+      this.ctx.logger.warn(`interconnect: listener for a ${notification.kind} event from ${sender} threw: ${detail}`);
+    });
+  }
+  /**
+   * Summarize the live local sessions so a sender can discover valid targets
+   * instead of having to know a session id already. Only live agents are listed
+   * because `send` can reach exactly those, and the answer carries at most
+   * {@link MAX_LISTED_SESSIONS} rows so a large live set cannot push the
+   * `query-result` frame past the link's frame cap.
+   *
+   * Title and status are best-effort: the title projection is an optional
+   * service, and a receiver without it still returns the ids. A projection that
+   * throws degrades that one row rather than failing the whole listing, which
+   * matches how the Host's own session listing treats its projection column.
+   */
+  listSessions() {
+    const reachable = this.ctx.agents.list().filter((agent) => !isSessionOwnedBySubagent(this.ctx, agent.session, agent));
+    const sessions = [];
+    let used = 0;
+    for (const agent of reachable.slice(0, MAX_LISTED_SESSIONS)) {
+      const row = this.sessionRow(agent);
+      const sized = used + rowBytes(row);
+      if (sized > MAX_LIST_ROWS_BYTES) {
+        const untitled = {
+          sessionId: row.sessionId,
+          ...row.status === void 0 ? {} : { status: row.status }
+        };
+        const untitledSized = used + rowBytes(untitled);
+        if (untitledSized > MAX_LIST_ROWS_BYTES) break;
+        sessions.push(untitled);
+        used = untitledSized;
+        continue;
+      }
+      sessions.push(row);
+      used = sized;
+    }
+    return { sessions, instance: this.instanceId };
+  }
+  /** One listing row for a live agent; the title projection is best-effort. */
+  sessionRow(agent) {
+    let title;
+    try {
+      const snapshot = this.ctx.get("sessionProjections")?.snapshot(agent.session);
+      const value = snapshot?.values.title;
+      if (typeof value === "string" && value !== "") title = value;
+    } catch {
+      title = void 0;
+    }
+    return {
+      sessionId: agent.id,
+      ...title === void 0 ? {} : { title },
+      ...typeof agent.status === "string" ? { status: agent.status } : {}
+    };
+  }
+  /**
+   * Resolve a session that is not currently live, when the sender asked to wake
+   * it. Returns the agent, or the reason it stays undelivered.
+   *
+   * The resume is delegated to the Host's configured `agent` lookup rather than
+   * calling `ctx.agents.resume()` here, and that is the whole point: a handle
+   * from `resume()` is owned by the CALLING context, so resuming on this
+   * plugin's fiber would tear the session down again the moment the plugin
+   * unloads (measured: the same call through the root context leaves it alive).
+   * The Host's resolver owns it instead, and it also composes the preset the
+   * session recorded — so a woken agent comes back with the toolset its history
+   * was produced under, not an empty one.
+   */
+  async wake(payload) {
+    if (payload.resume !== true) return { reason: "session-not-live" };
+    if (!this.allowResume) return { reason: "resume-refused" };
+    const lookup = this.ctx.get("typert")?.lookups.get("agent");
+    if (lookup === void 0) return { reason: "session-not-live" };
+    try {
+      const resolved = await lookup.resolve(payload.sessionId);
+      if (resolved === void 0 || resolved === null) return { reason: "session-not-live" };
+      return { agent: resolved };
+    } catch (error) {
+      this.ctx.logger.info(
+        `interconnect: resume refused for ${payload.sessionId}: ${error instanceof Error ? error.message : String(error)}`
+      );
+      return { reason: "resume-failed" };
+    }
+  }
+  /**
+   * Deliver one message to a live local session, waking a persisted one only
+   * when the sender asked and this receiver allows it.
+   */
+  async deliver(payload) {
+    if (this.disposed) return { delivered: false, instance: this.instanceId, reason: "unreachable" };
+    let agent = this.ctx.agents.get(payload.sessionId);
+    if (agent === void 0) {
+      const woken = await this.wake(payload);
+      if (this.disposed) return { delivered: false, instance: this.instanceId, reason: "unreachable" };
+      if ("reason" in woken) {
+        return { delivered: false, instance: this.instanceId, reason: woken.reason };
+      }
+      agent = woken.agent;
+    }
+    if (isSessionOwnedBySubagent(this.ctx, agent.session, agent)) {
+      return { delivered: false, instance: this.instanceId, reason: "session-owned-by-subagent" };
+    }
+    const sender = (() => {
+      const candidate = payload.sender;
+      if (typeof candidate !== "object" || candidate === null) return void 0;
+      const record = candidate;
+      if (typeof record.instanceId !== "string" || typeof record.sessionId !== "string") return void 0;
+      return { instanceId: record.instanceId, sessionId: record.sessionId };
+    })();
+    const message = createUserMessage({
+      source: {
+        kind: "plugin",
+        plugin: PLUGIN_SOURCE,
+        form: "notice",
+        summary: boundContextSummary(
+          sender === void 0 ? `interconnect handoff delivered on instance ${this.instanceId}` : `interconnect handoff from ${sender.instanceId} (session ${sender.sessionId}) delivered on instance ${this.instanceId}`
+        )
+      },
+      content: [{ type: "text", text: payload.text }]
+    });
+    const mode = payload.delivery ?? this.delivery;
+    switch (mode) {
+      case "steer":
+        agent.steer(message);
+        break;
+      case "inject":
+        agent.inject(message);
+        break;
+      case "followup":
+        agent.followup(message);
+        break;
+      /* v8 ignore next -- closed-union exhaustiveness guard */
+      default:
+        assertNever(mode);
+    }
+    if (sender !== void 0) {
+      this.senders.set(payload.sessionId, sender);
+    } else {
+      this.senders.delete(payload.sessionId);
+    }
+    return { delivered: true, instance: this.instanceId, delivery: mode };
+  }
+  async resolveToken() {
+    const credential = await this.ctx.credentials.resolve(credentialRef(INTERCONNECT_TOKEN_REF));
+    return credential === void 0 || credential.value.length === 0 ? void 0 : credential.value;
+  }
+  /**
+   * Answer one refused upgrade and close its socket. `socket.end()` alone only
+   * half-closes the connection: a client that keeps its own writing side open
+   * (a socket created with `allowHalfOpen`) leaves the connection live, and a
+   * refused socket never enters the link pool, so nothing else would reap it.
+   * @param socket - the refused upgrade socket.
+   * @param response - the complete HTTP response sent to the client.
+   */
+  refuseUpgrade(socket, response) {
+    socket.end(response, () => {
+      socket.destroy();
+    });
+  }
+  /** Inbound WebSocket upgrade: authenticate the bearer header, then accept. */
+  async handleUpgrade(req, socket, head) {
+    let token;
+    try {
+      token = await this.resolveToken();
+    } catch (error) {
+      this.ctx.logger.warn(`interconnect: upgrade token read failed: ${error instanceof Error ? error.message : String(error)}`);
+      this.refuseUpgrade(socket, "HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 9\r\n\r\nforbidden");
+      return;
+    }
+    if (token === void 0) {
+      this.refuseUpgrade(socket, "HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 9\r\n\r\nforbidden");
+      return;
+    }
+    if (this.disposed) {
+      this.refuseUpgrade(socket, "HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\nContent-Length: 11\r\n\r\nunavailable");
+      return;
+    }
+    const expected = `Bearer ${token}`;
+    const header = req.headers.authorization;
+    if (header === void 0 || !timingSafeEqual(header, expected)) {
+      this.refuseUpgrade(socket, "HTTP/1.1 401 Unauthorized\r\nConnection: close\r\nContent-Length: 12\r\n\r\nunauthorized");
+      return;
+    }
+    this.server.handleUpgrade(req, socket, head, (websocket) => {
+      this.attachSocket(websocket);
+    });
+  }
+  /**
+   * Install frame + liveness handling on one socket and add it to the live
+   * pool. Used by both the server half (accepted upgrade) and the client half
+   * (outbound dial), so a single socket carries events both directions. Not a
+   * model-facing entry point; the outbound dial reaches it through a private
+   * closure.
+   * @param websocket - the accepted or dialed socket to install handlers on.
+   */
+  attachSocket(websocket) {
+    this.sockets.add(websocket);
+    websocket.isAlive = true;
+    websocket.on("pong", () => {
+      ;
+      websocket.isAlive = true;
+    });
+    websocket.on("message", (data, isBinary) => {
+      if (isBinary) return;
+      this.handleFrame(websocket, data);
+    });
+    websocket.on("close", () => {
+      this.sockets.delete(websocket);
+      this.peerOf.delete(websocket);
+    });
+    websocket.on("error", () => {
+      this.sockets.delete(websocket);
+    });
+    websocket.send(JSON.stringify({ type: "hello", sender: this.instanceId }));
+  }
+  /** Parse and route one inbound link frame, attributing events to the socket's announced peer. */
+  handleFrame(socket, data) {
+    const byteLength = typeof data === "string" ? Buffer.byteLength(data) : Array.isArray(data) ? data.reduce((total, part) => total + part.byteLength, 0) : data.byteLength;
+    if (byteLength > MAX_LINK_FRAME_BYTES) {
+      this.ctx.logger.warn("interconnect: dropping oversized link frame");
+      return;
+    }
+    const text = typeof data === "string" ? data : Array.isArray(data) ? Buffer.concat(data).toString("utf8") : Buffer.isBuffer(data) ? data.toString("utf8") : Buffer.from(data).toString("utf8");
+    let parsed;
+    try {
+      parsed = withoutNullFields(Schema.resolve(JSON.parse(text), linkFrameSchema, {})[0]);
+    } catch {
+      this.ctx.logger.warn("interconnect: dropping malformed link frame");
+      return;
+    }
+    if (parsed === null || typeof parsed !== "object") {
+      this.ctx.logger.warn("interconnect: dropping malformed link frame");
+      return;
+    }
+    const frame = parsed;
+    if (frame.type === "hello") {
+      this.peerOf.set(socket, frame.sender);
+      return;
+    }
+    if (frame.type === "event") {
+      this.receiveEvent({ sender: this.peerOf.get(socket) ?? "unknown-peer", notification: frame.notification });
+      return;
+    }
+    if (frame.type === "msg-result") {
+      const pending = this.pendingMessages.get(frame.reqId);
+      if (pending !== void 0 && pending.kind === "msg") {
+        ;
+        pending.resolve?.(projectMsgResult(frame.result));
+      }
+      return;
+    }
+    if (frame.type === "query-result") {
+      const pending = this.pendingMessages.get(frame.reqId);
+      if (pending !== void 0 && pending.kind === "query") {
+        const answer = pending.accept(frame.result);
+        if (answer !== void 0) pending.resolve?.(answer);
+      }
+      return;
+    }
+    if (frame.type === "msg") {
+      void Promise.resolve().then(async () => {
+        await this.handleMsgFrame(socket, frame.reqId, frame.message);
+      }).catch((error) => {
+        this.ctx.logger.warn(`interconnect: msg ${frame.reqId} handler threw: ${error instanceof Error ? error.message : String(error)}`);
+        void this.sendFrame(socket, {
+          type: "msg-result",
+          reqId: frame.reqId,
+          result: { delivered: false, instance: this.instanceId, reason: "unreachable" }
+        });
+      });
+      return;
+    }
+    void Promise.resolve().then(() => {
+      this.handleQueryFrame(socket, frame.reqId, frame.query);
+    }).catch((error) => {
+      this.ctx.logger.warn(`interconnect: query ${frame.reqId} handler threw: ${error instanceof Error ? error.message : String(error)}`);
+    });
+  }
+  /** Write one frame to a socket, returning false when the socket cannot take it. */
+  sendFrame(socket, frame) {
+    if (socket.readyState !== WebSocket.OPEN) return false;
+    socket.send(JSON.stringify(frame));
+    return true;
+  }
+};
+var LinkState = class {
+  constructor(attachSocket, logger, resolveToken, instanceId, origin) {
+    this.attachSocket = attachSocket;
+    this.logger = logger;
+    this.resolveToken = resolveToken;
+    this.instanceId = instanceId;
+    this.peer = origin;
+  }
+  socket;
+  dialEpoch = 0;
+  closed = false;
+  retry = 0;
+  reconnectTimer;
+  warnedNoToken = false;
+  /** Dial-registered handlers, removed by reference on close/reroute so the pool-cleanup handlers attachSocket added stay alive. */
+  dialListeners;
+  // `peer` is mutable so `reroute` can point the link at a new origin.
+  peer;
+  instanceId;
+  /** Point this link at a different origin; re-dials immediately. */
+  reroute(origin) {
+    if (origin === this.peer) return;
+    this.peer = origin;
+    this.dialEpoch += 1;
+    if (this.reconnectTimer !== void 0) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = void 0;
+    }
+    const socket = this.socket;
+    if (socket !== void 0) {
+      this.removeDialListeners(socket);
+      socket.on("error", () => {
+      });
+      socket.terminate();
+      this.socket = void 0;
+    }
+    this.dial();
+  }
+  /** Open the socket; reconnect is scheduled by the close handler. */
+  dial() {
+    if (this.closed) return;
+    const epoch = this.dialEpoch;
+    let url;
+    try {
+      url = linkUrl(this.peer);
+    } catch {
+      this.logger.warn(`interconnect: invalid peer origin ${this.peer}; link to ${this.instanceId} stays down`);
+      return;
+    }
+    void this.resolveToken().then((token) => {
+      if (token === void 0) {
+        if (!this.warnedNoToken) {
+          this.warnedNoToken = true;
+          this.logger.warn(`interconnect: no shared token configured; peer ${this.instanceId} link stays down, retrying until one is set`);
+        }
+        if (this.closed || epoch !== this.dialEpoch) return;
+        this.scheduleReconnect();
+        return;
+      }
+      if (this.closed || epoch !== this.dialEpoch) return;
+      const socket = new WebSocket(url, {
+        headers: { authorization: `Bearer ${token}` },
+        maxPayload: MAX_LINK_FRAME_BYTES,
+        // A peer that accepts TCP but never completes the upgrade would leave
+        // the socket in CONNECTING forever: no open (so no heartbeat) and no
+        // close (so no reconnect). ws aborts the connection past the handshake
+        // window, so its own error+close fire and the close handler schedules
+        // a reconnect — and ws owns the timer, so nothing leaks on teardown.
+        handshakeTimeout: LINK_HANDSHAKE_TIMEOUT_MS
+      });
+      this.socket = socket;
+      const onOpen = () => {
+        this.retry = 0;
+        this.attachSocket(socket);
+      };
+      const onClose = () => {
+        if (this.closed) return;
+        this.scheduleReconnect();
+      };
+      const onError = () => {
+      };
+      this.dialListeners = { open: onOpen, close: onClose, error: onError };
+      socket.once("open", onOpen);
+      socket.once("close", onClose);
+      socket.on("error", onError);
+    }).catch(() => {
+      if (this.closed || epoch !== this.dialEpoch) return;
+      this.scheduleReconnect();
+    });
+  }
+  /** Whether this link has been closed; a closed state is never reused by `link()`. */
+  isClosed() {
+    return this.closed;
+  }
+  /** Whether this link currently holds an open socket that can carry frames. */
+  writable() {
+    return this.socket !== void 0 && this.socket.readyState === WebSocket.OPEN;
+  }
+  /** Write one frame over this link's outbound socket; false when not open. */
+  sendFrame(frame) {
+    const socket = this.socket;
+    if (socket === void 0 || socket.readyState !== WebSocket.OPEN) return false;
+    socket.send(JSON.stringify(frame));
+    return true;
+  }
+  close() {
+    this.closed = true;
+    if (this.reconnectTimer !== void 0) clearTimeout(this.reconnectTimer);
+    const socket = this.socket;
+    if (socket !== void 0) {
+      this.removeDialListeners(socket);
+      socket.on("error", () => {
+      });
+      socket.terminate();
+    }
+  }
+  /** Detach the dial-registered handlers from a socket before terminating it. */
+  removeDialListeners(socket) {
+    const listeners = this.dialListeners;
+    if (listeners === void 0) return;
+    socket.removeListener("open", listeners.open);
+    socket.removeListener("close", listeners.close);
+    socket.removeListener("error", listeners.error);
+    this.dialListeners = void 0;
+  }
+  scheduleReconnect() {
+    const delay = Math.min(3e4, 1e3 * 2 ** this.retry);
+    this.retry += 1;
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = void 0;
+      this.dial();
+    }, delay);
+  }
+};
+function timingSafeEqual(a, b) {
+  return constantTimeEqual(createHash("sha256").update(a, "utf8").digest(), createHash("sha256").update(b, "utf8").digest());
+}
+function linkUrl(origin) {
+  const url = new URL("/interconnect/link", origin);
+  if (url.protocol === "http:") url.protocol = "ws:";
+  else if (url.protocol === "https:") url.protocol = "wss:";
+  if (url.protocol !== "ws:" && url.protocol !== "wss:") {
+    throw new TypeError(`interconnect: unsupported peer origin protocol ${url.protocol}`);
+  }
+  return url;
+}
+function trimBase(baseUrl) {
+  return baseUrl.replace(/\/+$/, "");
+}
+
+// src/tool-interconnect/index.ts
 var name = "tool-interconnect";
 var inject = ["interconnect", "tools"];
 var deliveryOutcomeSchema = {
@@ -12,7 +1748,7 @@ var deliveryOutcomeSchema = {
     reason: { type: "string" }
   }
 };
-var raceSignal = (signal, promise) => new Promise((resolve, reject) => {
+var raceSignal = (signal, promise) => new Promise((resolve2, reject) => {
   const abort = () => {
     const reason = signal.reason;
     reject(reason instanceof Error ? reason : new Error(typeof reason === "string" ? reason : "aborted"));
@@ -25,7 +1761,7 @@ var raceSignal = (signal, promise) => new Promise((resolve, reject) => {
   promise.then(
     (value) => {
       signal.removeEventListener("abort", abort);
-      resolve(value);
+      resolve2(value);
     },
     (error) => {
       signal.removeEventListener("abort", abort);
@@ -82,7 +1818,7 @@ function apply(ctx) {
         const text = (() => {
           switch (value.reason) {
             case "unreachable":
-              return `not delivered: ${value.instance} did not answer (unreachable or unauthorized)`;
+              return `not delivered: ${value.instance} did not answer (unreachable)`;
             case "resume-refused":
               return `not delivered: ${value.instance} does not allow waking persisted sessions`;
             case "resume-failed":
@@ -115,12 +1851,12 @@ function apply(ctx) {
   }));
   ctx.tools.register(defineTool({
     name: "interconnect_ping",
-    description: "Probe a peer DSH instance for liveness and identity over the shared-secret channel. Reports reachable with the peer instance id, or unreachable when the link is down or unauthorized.",
+    description: "Probe a peer DSH instance for liveness and identity. Reports reachable with the peer instance id, or unreachable when the peer does not answer.",
     parameters: {
       instanceId: {
         type: "string",
         required: true,
-        description: "The peer instance id to probe, as configured under this instance's interconnect peers map."
+        description: "The peer instance id to probe, as configured for this instance's interconnect peers."
       }
     },
     output: {
@@ -134,7 +1870,7 @@ function apply(ctx) {
       },
       render: (_args, value) => [{
         type: "text",
-        text: value.reachable ? `reachable: ${value.instance ?? "(unknown instance)"}` : "unreachable or unauthorized"
+        text: value.reachable ? `reachable: ${value.instance ?? "(unknown instance)"}` : "unreachable"
       }]
     },
     async execute(args, exec) {
@@ -145,12 +1881,12 @@ function apply(ctx) {
   }));
   ctx.tools.register(defineTool({
     name: "interconnect_list",
-    description: "List the live sessions on a peer DSH instance, so a message can be addressed without knowing a session id in advance. Every returned sessionId is a valid interconnect_send target at the time of the call. Only sessions with a running agent appear, and a long listing stops at a size bound, so a live session missing from it may simply not fit; reaching a persisted session requires interconnect_send with resume set.",
+    description: "List the live sessions on a peer DSH instance, so a message can be addressed without knowing a session id in advance. Every returned sessionId is a valid interconnect_send target at the time of the call. Only live sessions appear, and a long listing stops at a size bound, so a live session missing from it may simply not fit; reaching a persisted session requires interconnect_send with resume set.",
     parameters: {
       instanceId: {
         type: "string",
         required: true,
-        description: "The peer instance id to list, as configured under this instance's interconnect peers map."
+        description: "The peer instance id to list, as configured for this instance's interconnect peers."
       }
     },
     output: {
@@ -175,7 +1911,7 @@ function apply(ctx) {
         }
       },
       render: (_args, value) => {
-        if (!value.reachable) return [{ type: "text", text: "unreachable or unauthorized" }];
+        if (!value.reachable) return [{ type: "text", text: "unreachable" }];
         const sessions = value.sessions ?? [];
         if (sessions.length === 0) {
           return [{ type: "text", text: `no live sessions on ${value.instance ?? "(unknown instance)"}` }];
@@ -185,6 +1921,9 @@ function apply(ctx) {
           const status = session.status === void 0 ? "" : ` [${session.status}]`;
           return `${session.sessionId}${title}${status}`;
         });
+        if (sessions.length === MAX_LISTED_SESSIONS) {
+          lines.push(`(${String(MAX_LISTED_SESSIONS)} of possibly more live sessions; a missing target may still be live)`);
+        }
         return [{ type: "text", text: lines.join("\n") }];
       }
     },
@@ -240,7 +1979,7 @@ function apply(ctx) {
             return "not delivered: the recorded sender's session belongs to a subagent and its parent agent owns delivery";
           }
           if (value.reason === "unreachable") {
-            return "not delivered: the recorded sender did not answer (unreachable or unauthorized)";
+            return "not delivered: the recorded sender did not answer (unreachable)";
           }
           if (value.reason === "resume-refused") {
             return "not delivered: the recorded sender does not allow waking persisted sessions";