negotium 0.19.2 → 0.20.0

package/dist/runtime/src/mcp/runtime-spec.ts

@@ -9,8 +9,18 @@
  */
 
 import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { isExplicitAgentSwitchTargets } from "#agents/explicit-agent-switch";
 import { NEGOTIUM_PORT, RUNTIME_MCP_SECRET } from "#platform/config";
-import { type AgentKind, isAgentKind, type PeerRuntimeBridgeContext } from "#types";
+import { logger } from "#platform/logger";
+import { isActorTopicScope } from "#runtime/actor-topic-scope";
+import { isRemoteSessionGrant } from "#runtime/remote-session-grant";
+import {
+  type ActorTopicScope,
+  type AgentKind,
+  isAgentKind,
+  type PeerRuntimeBridgeContext,
+  type RemoteSessionGrant,
+} from "#types";
 
 export const RUNTIME_MCP_KEY = "runtime";
 
@@ -30,18 +40,80 @@ export type HostedMcpSurface = (typeof HOSTED_MCP_SURFACES)[number];
 const TOKEN_TTL_MS = 4 * 60 * 60 * 1000;
 const CLAUDE_MCP_TOOL_TIMEOUT_MS = 600_000;
 
+/**
+ * Hard ceiling on the length of a built-in MCP URL (path plus `?token=...`).
+ *
+ * The signed per-turn token rides the URL query of an `http://127.0.0.1`
+ * request, and `Bun.serve` answers 431 once the request line is too long:
+ * measured on Bun 1.3.14 with a plain `fetch`, a 16,205-character URL is
+ * served (200) and a 16,305-character one is refused (431). The budget stays
+ * 1,869 characters under the last known-good length so the server, the
+ * agent's own client and a slightly different Bun release all have room.
+ *
+ * Real sizes (UUID ids, base64url growth of 4/3 on the JSON payload):
+ * - runtime token, no assertion, every optional field set (peer bridge,
+ *   thread, 64-char title, workspace cwd, all three explicit-switch
+ *   targets): ~1,150-character URL;
+ * - the same with the largest assertion `validateActorTopicScope` admits
+ *   (8,159 bytes of JSON = 208 UUIDs): 12,052–12,055 characters, under this
+ *   budget with ~2,280 characters to spare for an unusually long cwd or title;
+ *   the hosted tokens (`buildHostedMcpSpec`) with the same assertion measure
+ *   12,100–12,118, so neither variant is the "small" one.
+ * The token has no free-text field: the user's prompt never rides it. It used
+ * to, and an uncapped prompt made the assertion cap meaningless (3,000 Korean
+ * characters on top of the maximal assertion gave a 24,009-character URL and
+ * 10,000 gave 52,009 — every built-in MCP unreachable for that turn), while a
+ * capped one broke `set_agent` for any request phrased after the cap. The
+ * prompt's only consumer was that gate, so the node now derives the gate's
+ * answer from the full prompt when it mints the token
+ * (`explicitAgentSwitchTargets`, at most three agent names) and signs that.
+ *
+ * Over budget, {@link buildRuntimeMcpSpec} throws
+ * {@link McpUrlBudgetExceededError} rather than minting a URL that will 431.
+ * Nothing is dropped or trimmed to fit: every remaining field either
+ * authorizes (ids, assertion, switch targets) or changes behaviour (thread,
+ * capabilities, bridge), and a token missing one would widen or alter the
+ * turn, not narrow it.
+ */
+export const MCP_URL_BUDGET_CHARS = 14 * 1024;
+
+export class McpUrlBudgetExceededError extends Error {
+  constructor(
+    readonly surface: string,
+    readonly urlLength: number,
+  ) {
+    super(
+      `built-in MCP URL for "${surface}" is ${urlLength} characters; the transport allows at most ${MCP_URL_BUDGET_CHARS}`,
+    );
+    this.name = "McpUrlBudgetExceededError";
+  }
+}
+
 export interface RuntimeMcpContext {
   /** Canonical principal authorized against this node's topic roster. */
   userId: string;
   /** Product-side human actor when it differs from the execution principal. */
   actorUserId?: string;
+  /**
+   * Hub-asserted rooms `actorUserId` may reach on this node. Signed with the
+   * rest of the context and authoritative when present (no lineage is added);
+   * absent means the tools reach only the current room plus its own subagent
+   * lineage.
+   */
+  actorTopicScope?: ActorTopicScope;
   topicId: string;
   topicTitle: string;
   queryId?: string;
   cwd: string;
   agent: AgentKind;
   model?: string;
-  currentUserPrompt?: string;
+  /**
+   * Agents the current user message explicitly asked to switch to, derived
+   * from the full prompt at mint time (`explicitAgentSwitchTargets`). Signed
+   * with the rest of the context, so the agent cannot grant itself a switch;
+   * absent or empty means `set_agent` is refused this turn.
+   */
+  explicitAgentSwitchTargets?: AgentKind[];
   autoContinue?: boolean;
   /** Capability minted by the adapter. Visual tools are absent unless true. */
   visualTools?: boolean;
@@ -62,6 +134,19 @@ export interface RuntimeMcpContext {
 /** Signed identity/capability context shared by hosted built-in MCP surfaces. */
 export interface HostedMcpContext {
   userId: string;
+  /** Product-side human actor when it differs from the execution principal. */
+  actorUserId?: string;
+  /** Hub-asserted rooms `actorUserId` may reach; see {@link RuntimeMcpContext}. */
+  actorTopicScope?: ActorTopicScope;
+  /**
+   * Hub-issued per-turn authority for remote (`node/topic`) session-comm.
+   * Carried by the `session-comm` audience only. Signed with the rest of the
+   * context so the agent cannot mint or swap one; the capability inside is a
+   * bearer for the hub, which the node cannot verify (it holds no key) and
+   * only ever decodes for the untrusted `e` expiry it uses to order grants
+   * when several requests fold into one turn.
+   */
+  remoteSession?: RemoteSessionGrant;
   topicTitle: string;
   topicId?: string;
   queryId?: string;
@@ -136,9 +221,11 @@ function isRuntimeMcpContext(value: unknown): value is RuntimeMcpContext {
     typeof ctx.agent === "string" &&
     isAgentKind(ctx.agent) &&
     (ctx.actorUserId === undefined || typeof ctx.actorUserId === "string") &&
+    (ctx.actorTopicScope === undefined || isActorTopicScope(ctx.actorTopicScope)) &&
     (ctx.queryId === undefined || typeof ctx.queryId === "string") &&
     (ctx.model === undefined || typeof ctx.model === "string") &&
-    (ctx.currentUserPrompt === undefined || typeof ctx.currentUserPrompt === "string") &&
+    (ctx.explicitAgentSwitchTargets === undefined ||
+      isExplicitAgentSwitchTargets(ctx.explicitAgentSwitchTargets)) &&
     (ctx.autoContinue === undefined || typeof ctx.autoContinue === "boolean") &&
     (ctx.visualTools === undefined || typeof ctx.visualTools === "boolean") &&
     (ctx.fileDeliveryTools === undefined || typeof ctx.fileDeliveryTools === "boolean") &&
@@ -163,6 +250,9 @@ function isHostedMcpContext(value: unknown): value is HostedMcpContext {
     typeof ctx.cwd === "string" &&
     typeof ctx.agent === "string" &&
     isAgentKind(ctx.agent) &&
+    (ctx.actorUserId === undefined || typeof ctx.actorUserId === "string") &&
+    (ctx.actorTopicScope === undefined || isActorTopicScope(ctx.actorTopicScope)) &&
+    (ctx.remoteSession === undefined || isRemoteSessionGrant(ctx.remoteSession)) &&
     (ctx.topicId === undefined || typeof ctx.topicId === "string") &&
     (ctx.queryId === undefined || typeof ctx.queryId === "string") &&
     (ctx.wikiTopicId === undefined || typeof ctx.wikiTopicId === "string") &&
@@ -247,18 +337,35 @@ export function buildRuntimeMcpSpec(
   agent: AgentKind,
   ctx: RuntimeMcpContext,
 ): Record<string, unknown> {
-  const token = issueRuntimeMcpToken(ctx);
   const base = `http://127.0.0.1:${runtimePort}${RUNTIME_MCP_BASE_PATH}`;
-  const query = `token=${encodeURIComponent(token)}`;
-  if (agent === "codex") return { url: `${base}/mcp?${query}` };
+  const query = `token=${encodeURIComponent(issueRuntimeMcpToken(ctx))}`;
+  const url = agent === "codex" ? `${base}/mcp?${query}` : `${base}/sse?${query}`;
+  assertMcpUrlWithinBudget(RUNTIME_MCP_KEY, url, ctx.topicId);
+  if (agent === "codex") return { url };
   return {
     type: "sse" as const,
-    url: `${base}/sse?${query}`,
+    url,
     timeout: CLAUDE_MCP_TOOL_TIMEOUT_MS,
     ...(agent === "maestro" ? { lifecycle: "turn" as const } : {}),
   };
 }
 
+/**
+ * Refuse loudly rather than hand the agent a URL the server will 431. This
+ * fails the turn's MCP setup, which is the safe outcome: the alternative —
+ * minting the token without the fields that do not fit — would silently
+ * widen the turn whenever the field that did not fit was the assertion.
+ */
+function assertMcpUrlWithinBudget(surface: string, url: string, topicId: string | undefined) {
+  if (url.length <= MCP_URL_BUDGET_CHARS) return;
+  const error = new McpUrlBudgetExceededError(surface, url.length);
+  logger.error(
+    { topicId, surface, urlLength: url.length, budget: MCP_URL_BUDGET_CHARS },
+    "built-in MCP URL exceeds the transport budget; refusing to mint the token",
+  );
+  throw error;
+}
+
 function hostedMcpCacheIdentity(surface: HostedMcpSurface, ctx: HostedMcpContext): string {
   let semanticContext: unknown;
   switch (surface) {
@@ -289,6 +396,14 @@ function hostedMcpCacheIdentity(surface: HostedMcpSurface, ctx: HostedMcpContext
     case "session-comm":
       semanticContext = {
         userId: ctx.userId,
+        // Who may reach what changes per turn (a different person, or a hub
+        // that has since changed a roster), so a cached server must not carry
+        // an earlier turn's reach into this one.
+        actorUserId: ctx.actorUserId ?? null,
+        actorTopicScope: ctx.actorTopicScope ?? null,
+        // The grant is per turn (bound to this turn's request id), so a
+        // server cached with one must not answer a later turn with it.
+        remoteSession: ctx.remoteSession ?? null,
         topicTitle: ctx.topicTitle,
         topicId: ctx.topicId ?? null,
         subagentParentTopicId: ctx.subagentParentTopicId ?? null,
@@ -319,13 +434,33 @@ export function buildHostedMcpSpec(
   const token = issueHostedMcpToken(surface, ctx);
   const base = `http://127.0.0.1:${runtimePort}${RUNTIME_MCP_BASE_PATH}/${surface}`;
   const query = `token=${encodeURIComponent(token)}`;
-  if (agent === "codex") return { url: `${base}/mcp?${query}` };
+  const url = agent === "codex" ? `${base}/mcp?${query}` : `${base}/sse?${query}`;
+  // A hosted context has no free-text field either. Measured with the
+  // maximal assertion (208 UUIDs, 8,159 bytes) and every optional field set,
+  // the hosted URL is marginally *longer* than the runtime one — ~12,118
+  // characters for `session-comm`, 12,100–12,109 for the other surfaces,
+  // against 12,052–12,055 for the runtime token — because the surface name
+  // and lifecycle fields outweigh the runtime token's switch-target list.
+  // All stay ≥ 2,200 characters under budget. The session-comm token may
+  // additionally carry a remote-session grant. Measured in
+  // `hosted-runtime-spec.test.ts`: the hub's real grant (≈440-character
+  // capability, short hub URL) adds 682 characters — 12,800 beside the
+  // maximal assertion, ~1,500 to spare. A grant at both caps (512-char URL,
+  // 2 KiB capability) adds ≈3,475 and fits alone (4,689) but not beside the
+  // maximal assertion (15,593); the hard check below refuses that mint, so
+  // the caps bound the grant while the budget bounds the token — the largest
+  // capability that fits beside a maximal assertion is ≈1,590 characters.
+  // The check is the same on purpose, so a field added later cannot quietly
+  // push it past the transport.
+  assertMcpUrlWithinBudget(surface, url, ctx.topicId);
+  if (agent === "codex") return { url };
   const queryBound =
-    surface === "session-comm" && (ctx.silent === true || ctx.peerBridge !== undefined);
+    surface === "session-comm" &&
+    (ctx.silent === true || ctx.peerBridge !== undefined || ctx.remoteSession !== undefined);
   const lifecycle = queryBound ? "turn" : surface === "session-comm" ? "session" : "process";
   return {
     type: "sse" as const,
-    url: `${base}/sse?${query}`,
+    url,
     timeout: CLAUDE_MCP_TOOL_TIMEOUT_MS,
     ...(agent === "maestro"
       ? {

package/dist/runtime/src/mcp/session-comm/actor-policy.ts

@@ -0,0 +1,87 @@
+/**
+ * Actor-facing rules shared by the two session-comm implementations — the
+ * hosted `default-host.ts` and the stdio `server.ts`. They used to apply the
+ * owner check and the peer rules independently and drifted (the stdio server
+ * lost the owner check on `abort_session`); one module keeps them identical.
+ */
+import { actorOwnedTopicIds } from "#runtime/actor-topic-reach";
+import type { ActorTopicScope, RemoteSessionGrant } from "#types";
+
+export interface ActorTopicPolicyInput {
+  surface: string | undefined;
+  currentTopicId: string | undefined;
+  actorTopicScope: ActorTopicScope | undefined;
+}
+
+/**
+ * Whether the calling turn may stop work in `targetTopicId`, and the refusal
+ * to return when it may not. Stopping someone else's work is an owner's call:
+ * on `otium` that is the hub's owner assertion when the turn carries one, and
+ * only the current room's own subagent workers when it does not (a turn no
+ * person started). A room the actor can see but does not own answers as if
+ * it were not there, so the refusal reveals nothing the listing did not.
+ * Off `otium` the node's membership already decided; returns `null`.
+ */
+export function abortTargetRefusal(
+  input: ActorTopicPolicyInput & { targetTopicId: string; to: string },
+): string | null {
+  const owned = actorOwnedTopicIds(input);
+  if (owned && !owned.has(input.targetTopicId)) return `Error: Session "${input.to}" not found.`;
+  return null;
+}
+
+/**
+ * Whether remote (`node/topic`) session-comm is available to this turn, and
+ * the refusal to return when it is not.
+ *
+ * A peer call carries the node's execution principal and, at most, the hub
+ * query id of a worker turn — never who spoke or which rooms they may reach.
+ * Off `otium` that is fine: the principal *is* the person. On `otium` the
+ * principal is the hub itself and sits in every room, so a peer call would be
+ * authorized as the hub, for anyone. There the only remote path is the hub
+ * itself: a turn the hub started for a person carries a per-turn
+ * {@link RemoteSessionGrant} and the remote branches go to the hub, which
+ * re-checks that person's membership on every call. Without a grant — an
+ * older hub, the feature off, or a turn no person started — the remote
+ * branches stay fail-closed: remote listings contribute nothing and remote
+ * tell/ask/abort refuse.
+ */
+export function remotePeerRefusal(
+  surface: string | undefined,
+  remoteSession?: RemoteSessionGrant,
+): string | null {
+  if (surface !== "otium") return null;
+  if (remoteSession) return null;
+  return "Error: remote sessions (node/topic) cannot be reached from an Otium room: this turn carries no hub remote-session grant, so the call cannot be authorized for the person who spoke.";
+}
+
+/**
+ * Which transport the remote (`node/topic`) branch of a session-comm tool
+ * uses for this turn — the hub with the turn's grant, the legacy peer bridge
+ * off `otium`, or nothing (with the refusal to return).
+ */
+export type RemoteSessionRoute =
+  | { kind: "hub"; grant: RemoteSessionGrant }
+  | { kind: "peer" }
+  | { kind: "refused"; error: string };
+
+export function remoteSessionRoute(
+  surface: string | undefined,
+  remoteSession: RemoteSessionGrant | undefined,
+): RemoteSessionRoute {
+  if (surface === "otium" && remoteSession) return { kind: "hub", grant: remoteSession };
+  const refused = remotePeerRefusal(surface, remoteSession);
+  if (refused) return { kind: "refused", error: refused };
+  return { kind: "peer" };
+}
+
+/**
+ * Whether the session-comm catalog on this surface drops rooms that have no
+ * AI. On `otium` a human-only channel is never a target — it cannot be told,
+ * asked or aborted — so it is excluded at the catalog level rather than
+ * listed idle and refused later. Other surfaces keep listing them so the
+ * "has no AI agent" explanation stays reachable.
+ */
+export function excludesAgentlessTargets(surface: string | undefined): boolean {
+  return surface === "otium";
+}

package/dist/runtime/src/mcp/session-comm/context.ts

@@ -1,8 +1,26 @@
-import type { AgentKind } from "#types";
+import { parseActorTopicScope } from "#runtime/actor-topic-scope";
+import { decodeRemoteSessionGrantArg } from "#runtime/remote-session-grant";
+import type { ActorTopicScope, AgentKind, RemoteSessionGrant } from "#types";
 import { isAgentKind } from "#types";
 
 export interface SessionCommContext {
   userId: string;
+  /** Product-side human actor when it differs from the execution principal. */
+  actorUserId?: string;
+  /**
+   * Hub-asserted rooms the actor may reach. Only consulted on the `otium`
+   * surface, where this node holds no per-person membership. Authoritative
+   * when present (exactly the current room plus the asserted rooms, no
+   * lineage); absent there (a turn no person started) means the tools reach
+   * only the current room plus its own subagent lineage.
+   */
+  actorTopicScope?: ActorTopicScope;
+  /**
+   * Hub-issued per-turn authority for the remote (`node/topic`) branches on
+   * the `otium` surface. Opaque to the node; presented to the hub as a bearer.
+   * Absent means those branches are fail-closed there.
+   */
+  remoteSession?: RemoteSessionGrant;
   currentTopic: string;
   currentTopicId?: string;
   /** Thread the calling turn is answering inside, when it is answering in one. */
@@ -41,8 +59,31 @@ export function parseSessionCommContext(
   if (!Number.isInteger(depth) || depth < 0) {
     throw new Error(`Invalid --depth arg: ${depthValue}`);
   }
+  const scopeValue = value(args, "actor-topic-scope");
+  let actorTopicScope: ActorTopicScope | undefined;
+  if (scopeValue) {
+    let decoded: unknown;
+    try {
+      decoded = JSON.parse(Buffer.from(scopeValue, "base64url").toString("utf-8"));
+    } catch {
+      throw new Error("Invalid --actor-topic-scope arg");
+    }
+    const parsed = parseActorTopicScope(decoded);
+    if (!parsed) throw new Error("Invalid --actor-topic-scope arg");
+    actorTopicScope = parsed;
+  }
+  const grantValue = value(args, "remote-session-grant");
+  let remoteSession: RemoteSessionGrant | undefined;
+  if (grantValue) {
+    const decoded = decodeRemoteSessionGrantArg(grantValue);
+    if (!decoded) throw new Error("Invalid --remote-session-grant arg");
+    remoteSession = decoded;
+  }
   return {
     userId: value(args, "user-id") ?? defaults.userId,
+    actorUserId: value(args, "actor-user-id") || undefined,
+    ...(actorTopicScope ? { actorTopicScope } : {}),
+    ...(remoteSession ? { remoteSession } : {}),
     currentTopic: value(args, "topic") ?? "",
     currentTopicId: value(args, "topic-id") || undefined,
     currentThreadRootId: value(args, "thread-root-id") || undefined,

package/dist/runtime/src/mcp/session-comm/default-host.ts

@@ -1,6 +1,18 @@
 import { basename, join } from "node:path";
 import type { SessionCommMcpHost, SessionCommMcpResult } from "#mcp/factories/session-comm";
+import {
+  abortTargetRefusal,
+  excludesAgentlessTargets,
+  remoteSessionRoute,
+} from "#mcp/session-comm/actor-policy";
 import type { SessionCommContext } from "#mcp/session-comm/context";
+import {
+  hubRemoteAbort,
+  hubRemoteAsk,
+  hubRemotePeek,
+  hubRemoteSessions,
+  hubRemoteTell,
+} from "#mcp/session-comm/hub-remote-session";
 import { forwardToPeer, peerSessionsForUser } from "#mcp/session-comm/peer-forward";
 import {
   canSubagentTellTarget,
@@ -13,6 +25,7 @@ import { logger } from "#platform/logger";
 import { OPTIONAL_FORUM_MCP_SERVERS, REQUIRED_FORUM_MCP_SERVERS } from "#platform/mcp-config";
 import { closeBrowserOwnerTabs } from "#platform/playwright/manager";
 import { deleteManagedBrowserProfile } from "#platform/playwright/profile-management";
+import { actorReachableTopicIds } from "#runtime/actor-topic-reach";
 import { getRegisteredCronSession } from "#runtime/cron-sessions";
 import { sanitizeId } from "#security/sanitize";
 import { getApiTopicConfig, setApiTopicConfig } from "#storage/api-topic-config";
@@ -30,6 +43,7 @@ import {
   isTopicBrowserProfileOwner,
   listBrowserProfiles,
 } from "#storage/browser-profiles";
+import { deleteRemoteSessionAsk, recordRemoteSessionAsk } from "#storage/remote-session";
 import {
   clearPendingAsk,
   createPendingAsk,
@@ -57,6 +71,14 @@ function currentTopic(context: SessionCommContext) {
   return topic;
 }
 
+/** Surface of the room this turn runs in; the host default when unknown. */
+function currentSurface(context: SessionCommContext) {
+  return (
+    (context.currentTopicId ? getTopic(context.currentTopicId) : null)?.surface ??
+    defaultTopicSurface()
+  );
+}
+
 function targetCatalog(context: SessionCommContext) {
   const current = context.currentTopicId ? getTopic(context.currentTopicId) : null;
   const surface = current?.surface ?? defaultTopicSurface();
@@ -69,15 +91,28 @@ function targetCatalog(context: SessionCommContext) {
     : surface === "otium"
       ? defaultSurfaceScope()
       : null;
+  // On `otium` the roster check below matches the hub's execution principal
+  // (`local`), which sits in every hub-backed room, not the person who spoke.
+  // The hub's signed per-turn assertion is what says which of those rooms this
+  // actor is actually in, and it is the whole answer when present. Without one
+  // (a turn no person started) only the current room plus its own subagent
+  // lineage — direct parent, granted targets, own workers — is reachable.
+  const reachable = actorReachableTopicIds({
+    surface,
+    currentTopicId: context.currentTopicId,
+    actorTopicScope: context.actorTopicScope,
+  });
   return createSessionTargetCatalog({
     currentTopicId: context.currentTopicId,
     currentTopicName: context.currentTopic,
     currentSurface: surface,
+    excludeAgentless: excludesAgentlessTargets(surface),
     isAgent: isAgentKind,
     // Scoped in the store query, not after the fact.
     listRows: () =>
       listTopics({ surface, surfaceScope })
         .filter((topic) => topic.participants.some((p) => p.userId === context.userId))
+        .filter((topic) => !reachable || reachable.has(topic.id))
         .map((topic) => ({
           id: topic.id,
           title: topic.title,
@@ -104,6 +139,15 @@ function remoteTarget(context: SessionCommContext, to: string) {
   return { node: to.slice(0, slash), topic: to.slice(slash + 1) };
 }
 
+/** Which transport serves `node/topic` targets for this turn (see `remoteSessionRoute`). */
+function remoteRoute(context: SessionCommContext) {
+  return remoteSessionRoute(currentSurface(context), context.remoteSession);
+}
+
+function newRequestId(): string {
+  return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+
 function activeQuery(context: SessionCommContext, topicId: string, title: string) {
   const dir = join(USERS_LOG_DIR, context.userId, "active-queries");
   const candidates = [join(dir, `${sanitizeId(topicId)}.json`)];
@@ -148,7 +192,29 @@ export function createDefaultSessionCommMcpHost(): SessionCommMcpHost {
           ({ key, topic }) =>
             `- ${key}: ${topic.sessionId ? "active" : "fresh-start ready"}${topic.description ? `\n    description: ${topic.description.slice(0, 80)}` : ""}`,
         );
-      if (!identity.restricted) {
+      // Remote rooms are listed only where a remote call could be authorized
+      // for this turn (see `remoteSessionRoute`): through the hub with the
+      // turn's grant on Otium, through the peer bridge elsewhere, else not.
+      const route = identity.restricted ? null : remoteRoute(context);
+      if (route?.kind === "hub") {
+        const remote = await hubRemoteSessions(route.grant);
+        if (!remote.ok) {
+          entries.push(`- remote nodes: (${remote.error})`);
+        } else {
+          for (const node of remote.nodes) {
+            if (node.error) {
+              entries.push(`- ${node.node}/: (unreachable: ${node.error})`);
+              continue;
+            }
+            for (const session of node.sessions ?? []) {
+              if (!session.agent) continue;
+              entries.push(
+                `- ${node.node}/${session.name}: ${session.status === "active" ? "active" : "fresh-start ready"}${session.description ? `\n    description: ${session.description.slice(0, 80)}` : ""}`,
+              );
+            }
+          }
+        }
+      } else if (route?.kind === "peer") {
         const peers = await peerSessionsForUser(
           context.userId,
           context.peerHostQueryId,
@@ -241,7 +307,7 @@ export function createDefaultSessionCommMcpHost(): SessionCommMcpHost {
       }
     },
 
-    peekSession(context) {
+    async peekSession(context) {
       const targets = targetCatalog(context).listTargets();
       const running: string[] = [];
       const idle: string[] = [];
@@ -258,6 +324,39 @@ export function createDefaultSessionCommMcpHost(): SessionCommMcpHost {
         userId: context.userId,
         from: currentRef(context).key,
       });
+      // Remote rooms (v1): the hub's own active/ready view, no elapsed time
+      // or task text — the hub does not fan out to every node for a peek.
+      const remoteLines: string[] = [];
+      const route = remoteRoute(context);
+      if (route.kind === "hub") {
+        const remote = await hubRemotePeek(route.grant);
+        if (!remote.ok) {
+          remoteLines.push(`Remote: (${remote.error})`);
+        } else {
+          const remoteRunning: string[] = [];
+          const remoteIdle: string[] = [];
+          for (const node of remote.nodes) {
+            if (node.error) {
+              remoteLines.push(`Remote ${node.node}: (unreachable: ${node.error})`);
+              continue;
+            }
+            for (const session of node.sessions ?? []) {
+              // Same policy as the listing: a room with no AI is not a session.
+              if (session.agent === null) continue;
+              (session.status === "active" ? remoteRunning : remoteIdle).push(
+                `${node.node}/${session.name}`,
+              );
+            }
+          }
+          remoteLines.push(
+            `Remote running: ${remoteRunning.join(", ") || "none"}`,
+            `Remote idle: ${remoteIdle.join(", ") || "none"}`,
+            ...remote.pendingAsks.map(
+              (ask) => `Pending ${ask.to}: ${ask.status} (${ask.requestId})`,
+            ),
+          );
+        }
+      }
       return ok(
         [
           `Running: ${running.join(", ") || "none"}`,
@@ -265,6 +364,7 @@ export function createDefaultSessionCommMcpHost(): SessionCommMcpHost {
           ...pending.map(
             (ask) => `Pending ${ask.to}: ${describePendingAskState(ask.state)} (${ask.requestId})`,
           ),
+          ...remoteLines,
         ].join("\n"),
       );
     },
@@ -286,10 +386,49 @@ export function createDefaultSessionCommMcpHost(): SessionCommMcpHost {
       const clearAsk = () =>
         clearPendingAsk({ userId: context.userId, from: from.key, to, requestId });
       if (remote) {
+        const route = remoteRoute(context);
+        if (route.kind === "refused") {
+          clearAsk();
+          return error(route.error);
+        }
         if (!from.topicId) {
           clearAsk();
           return error("Error: current topic id is unavailable.");
         }
+        if (route.kind === "hub") {
+          // Durable caller record first: the hub's `ask-reply` delivery is
+          // routed back through it, possibly after this process restarted.
+          recordRemoteSessionAsk({
+            requestId,
+            callerTopicId: from.topicId,
+            userId: context.userId,
+            fromKey: from.key,
+            toKey: to,
+            ...(context.currentThreadRootId
+              ? { callerThreadRootId: context.currentThreadRootId }
+              : {}),
+          });
+          const sent = await hubRemoteAsk(route.grant, {
+            requestId,
+            to: remote,
+            message,
+            fromDepth: context.depth,
+            fromLabel: { key: from.key, title: from.title },
+          });
+          if (!sent.ok) {
+            if (sent.uncertain) {
+              // The hub may have forwarded it. Keep the pending marker so a
+              // late answer still lands; the ask TTL cleans up otherwise.
+              return ok(
+                `Ask sent to "${to}" (delivery unconfirmed: ${sent.error}). request_id: ${requestId}`,
+              );
+            }
+            clearAsk();
+            deleteRemoteSessionAsk(requestId);
+            return error(`Error: ${sent.error}`);
+          }
+          return ok(`Ask sent to "${to}". request_id: ${requestId}`);
+        }
         const result = await forwardToPeer({
           action: "ask",
           toNode: remote.node,
@@ -395,6 +534,12 @@ export function createDefaultSessionCommMcpHost(): SessionCommMcpHost {
     async abortSession(context, to) {
       const remote = remoteTarget(context, to);
       if (remote) {
+        const route = remoteRoute(context);
+        if (route.kind === "refused") return error(route.error);
+        if (route.kind === "hub") {
+          const sent = await hubRemoteAbort(route.grant, { requestId: newRequestId(), to: remote });
+          return sent.ok ? ok(`Abort sent to "${to}".`) : error(`Error: ${sent.error}`);
+        }
         const result = await forwardToPeer({
           action: "abort",
           toNode: remote.node,
@@ -409,6 +554,14 @@ export function createDefaultSessionCommMcpHost(): SessionCommMcpHost {
       const targetTopicId = validation.target.topicId;
       if (!targetTopicId) return error(`Error: "${to}" has no topic id.`);
       if (targetTopicId === context.currentTopicId) return error("Error: cannot abort self.");
+      const refused = abortTargetRefusal({
+        surface: currentSurface(context),
+        currentTopicId: context.currentTopicId,
+        actorTopicScope: context.actorTopicScope,
+        targetTopicId,
+        to,
+      });
+      if (refused) return error(refused);
       enqueueSessionInbox({
         userId: context.userId,
         topicId: targetTopicId,
@@ -426,6 +579,29 @@ export function createDefaultSessionCommMcpHost(): SessionCommMcpHost {
       const from = currentRef(context);
       const remote = remoteTarget(context, to);
       if (remote) {
+        const route = remoteRoute(context);
+        if (route.kind === "refused") return error(route.error);
+        if (route.kind === "hub") {
+          const requestId = newRequestId();
+          const sent = await hubRemoteTell(route.grant, {
+            requestId,
+            to: remote,
+            message,
+            depth: context.depth + 1,
+            fromLabel: { key: from.key, title: from.title },
+          });
+          if (!sent.ok) {
+            // A timed-out response may still have been delivered; report it
+            // as sent-but-unconfirmed rather than invite a duplicate.
+            if (sent.uncertain) {
+              return ok(
+                `Message sent to "${to}" (delivery unconfirmed: ${sent.error}). request_id: ${requestId}`,
+              );
+            }
+            return error(`Error: ${sent.error}`);
+          }
+          return ok(`Message sent to "${to}". request_id: ${requestId}`);
+        }
         const result = await forwardToPeer({
           action: "tell",
           toNode: remote.node,