negotium 0.19.2 → 0.20.1

package/dist/agent-helpers.js

@@ -480,7 +480,7 @@ function resolveWhisperBackend() {
 function codexAuthFilePath() {
   return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(process.env.CODEX_HOME || join(homedir(), ".codex"), "auth.json");
 }
-var HOME, PROJECT_ROOT, STATE_DIR, WORKSPACE_DIR, TOPIC_WORKSPACE_DIR, SHARED_WIKI_DIR, CRON_WORKSPACE_DIR, BROWSER_DIR, BROWSER_PROFILES_DIR, BINARIES_DIR, SECRETS_DIR, DM_WORKSPACE_DIR, SESSION_WORKSPACE_DIR, CLAUDE_EXECUTABLE_ENV, CLAUDE_EXECUTABLE, DEFAULT_OUTPUT_LANGUAGE = "English", BINARY_EXTENSION, BROWSER_RS_VERSION = "v0.6.0", BROWSER_RS_MIN_SECURE_VERSION = "0.2.1", BROWSER_RS_VERSION_PROBE_TIMEOUT_MS = 15000, SNIPPETS_API_URL, BROWSER_RS_BIN, BASH_RS_VERSION = "v0.1.10", BASH_RS_BIN, PLAYWRIGHT_MCP_BIN, TSX_BIN, TSX_LOADER_PATH, TSX_LOADER, TSCONFIG_PATH, SESSION_COMM_SERVER, TASK_SERVER, DECISION_SERVER, CANONICAL_MCP_PROXY_SERVER, WIKI_SERVER, TOKEN_STATS_SERVER, COMPACTION_LOG_SERVER, SYSTEM_HEALTH_SERVER, AGENT_HEALTH_SERVER, VAULT_SERVER, BG_BASH_BASE_PORT, BG_BASH_MAX_PORT, RUNTIME_MCP_SECRET, NODE_CONTROL_TOKEN, NODE_ID, VAULT_MASTER_KEY, NEGOTIUM_PORT, hostname, DATA_DIR, LOG_DIR, UPLOADS_DIR, VAULT_DIR, SESSIONS_DB, DEBUG_FILE, USERS_LOG_DIR, RUN_DIR, RUNTIME_DIR, PROGRESS_DIR, DM_CMD_DIR, DM_RESP_DIR, SESSION_INBOX_DIR, SESSION_ASKS_DIR, BASHRS_SPILL_ROOT, PLAYWRIGHT_BASE_PORT, PLAYWRIGHT_MAX_PORT, PLAYWRIGHT_PORTS_DIR, ACTIVE_QUERY_STALE_MS, AGENTS_PROMPTS_DIR, RESOURCES_DIR, ABSOLUTE_PATH_PREFIX, FILE_EXTENSIONS_REGEX, FILE_TAG_REGEX, MODEL_SONNET = "claude-sonnet-5", MODEL_OPUS = "claude-opus-5-5", MODEL_HAIKU = "claude-haiku-4-5-20251001", MODEL_FABLE = "claude-fable-5-1", MODEL_DEEPSEEK_V4_PRO = "deepseek-v4-pro", MODEL_DEEPSEEK_V4_FLASH = "deepseek-v4-flash", FALLBACK_AGENT, FALLBACK_MODEL, DEFAULT_TOPIC_EFFORT, FFMPEG_BIN, FFPROBE_BIN, PYTHON_BIN, FASTER_WHISPER_WRAPPER, WHISPER_MODEL, TESSERACT_BIN, PDFTOTEXT_BIN, WHISPER_BACKEND, MLX_WHISPER_BIN, WHISPER_MODEL_MLX, _envMaxTellDepth, MAX_TELL_DEPTH;
+var HOME, PROJECT_ROOT, STATE_DIR, WORKSPACE_DIR, TOPIC_WORKSPACE_DIR, SHARED_WIKI_DIR, CRON_WORKSPACE_DIR, BROWSER_DIR, BROWSER_PROFILES_DIR, BINARIES_DIR, SECRETS_DIR, DM_WORKSPACE_DIR, SESSION_WORKSPACE_DIR, CLAUDE_EXECUTABLE_ENV, CLAUDE_EXECUTABLE, DEFAULT_OUTPUT_LANGUAGE = "English", BINARY_EXTENSION, BROWSER_RS_VERSION = "v0.7.0", BROWSER_RS_MIN_SECURE_VERSION = "0.2.1", BROWSER_RS_VERSION_PROBE_TIMEOUT_MS = 15000, SNIPPETS_API_URL, BROWSER_RS_BIN, BASH_RS_VERSION = "v0.1.10", BASH_RS_BIN, PLAYWRIGHT_MCP_BIN, TSX_BIN, TSX_LOADER_PATH, TSX_LOADER, TSCONFIG_PATH, SESSION_COMM_SERVER, TASK_SERVER, DECISION_SERVER, CANONICAL_MCP_PROXY_SERVER, WIKI_SERVER, TOKEN_STATS_SERVER, COMPACTION_LOG_SERVER, SYSTEM_HEALTH_SERVER, AGENT_HEALTH_SERVER, VAULT_SERVER, BG_BASH_BASE_PORT, BG_BASH_MAX_PORT, RUNTIME_MCP_SECRET, NODE_CONTROL_TOKEN, NODE_ID, VAULT_MASTER_KEY, NEGOTIUM_PORT, hostname, DATA_DIR, LOG_DIR, UPLOADS_DIR, VAULT_DIR, SESSIONS_DB, DEBUG_FILE, USERS_LOG_DIR, RUN_DIR, RUNTIME_DIR, PROGRESS_DIR, DM_CMD_DIR, DM_RESP_DIR, SESSION_INBOX_DIR, SESSION_ASKS_DIR, BASHRS_SPILL_ROOT, PLAYWRIGHT_BASE_PORT, PLAYWRIGHT_MAX_PORT, PLAYWRIGHT_PORTS_DIR, ACTIVE_QUERY_STALE_MS, AGENTS_PROMPTS_DIR, RESOURCES_DIR, ABSOLUTE_PATH_PREFIX, FILE_EXTENSIONS_REGEX, FILE_TAG_REGEX, MODEL_SONNET = "claude-sonnet-5", MODEL_OPUS = "claude-opus-5-5", MODEL_HAIKU = "claude-haiku-4-5-20251001", MODEL_FABLE = "claude-fable-5-1", MODEL_DEEPSEEK_V4_PRO = "deepseek-v4-pro", MODEL_DEEPSEEK_V4_FLASH = "deepseek-v4-flash", FALLBACK_AGENT, FALLBACK_MODEL, DEFAULT_TOPIC_EFFORT, FFMPEG_BIN, FFPROBE_BIN, PYTHON_BIN, FASTER_WHISPER_WRAPPER, WHISPER_MODEL, TESSERACT_BIN, PDFTOTEXT_BIN, WHISPER_BACKEND, MLX_WHISPER_BIN, WHISPER_MODEL_MLX, _envMaxTellDepth, MAX_TELL_DEPTH;
 var init_config = __esm(() => {
   init_config_helpers();
   init_logger();
@@ -593,6 +593,72 @@ var init_config = __esm(() => {
   MAX_TELL_DEPTH = Number.isInteger(_envMaxTellDepth) && _envMaxTellDepth > 0 ? _envMaxTellDepth : 20;
 });
 
+// ../../packages/core/src/agents/explicit-agent-switch.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function agentAliases(agent) {
+  switch (agent) {
+    case "codex":
+      return [
+        "codex",
+        "\uCF54\uB371\uC2A4",
+        "gpt-6-luna",
+        "gpt-6-sol",
+        "gpt-5.6-luna",
+        "gpt-5.6-terra",
+        "gpt-5.6-sol",
+        "gpt-6-astra"
+      ];
+    case "claude":
+      return ["claude", "\uD074\uB85C\uB4DC", "sonnet", "opus", "fable"];
+    case "maestro":
+      return [
+        "maestro",
+        "\uB9C8\uC5D0\uC2A4\uD2B8\uB85C",
+        "\uBA54\uC2A4\uD2B8\uB85C",
+        "deepseek",
+        "deepseek-pro",
+        "kimi",
+        "kimi-pro",
+        "kimi-k3",
+        "kimi-code",
+        "kimi-k2.7-code",
+        "\uB525\uC2DC\uD06C",
+        "\uD0A4\uBBF8"
+      ];
+  }
+}
+function hasExplicitAgentSwitchRequest(prompt, agent) {
+  if (!prompt?.trim())
+    return false;
+  const text = prompt.toLowerCase().replace(/\s+/g, " ").trim();
+  const target = `(?:${agentAliases(agent).map(escapeRegExp).join("|")})`;
+  const switchVerb = "(?:\uBC14\uAFD4|\uBC14\uAFD4\uC918|\uBCC0\uACBD|\uBCC0\uACBD\uD574|\uC804\uD658|\uC804\uD658\uD574|\uC124\uC815|\uC124\uC815\uD574|\uC368\uC918|\uC0AC\uC6A9|\uAC00|switch|change|set|use)";
+  const switchSubject = "(?:agent|runtime|model|\uC5D0\uC774\uC804\uD2B8|\uB7F0\uD0C0\uC784|\uBAA8\uB378)";
+  return [
+    new RegExp(`^/(?:agent|runtime)\\s+${target}(?:\\s|$)`, "iu"),
+    new RegExp(`${target}\\s*(?:\uB85C|\uC73C\uB85C)\\s*.{0,16}${switchVerb}`, "iu"),
+    new RegExp(`${switchSubject}.{0,24}${target}.{0,24}${switchVerb}`, "iu"),
+    new RegExp(`${switchVerb}.{0,24}${switchSubject}.{0,24}${target}`, "iu"),
+    new RegExp(`(?:switch|change|set|use).{0,24}${target}`, "iu")
+  ].some((pattern) => pattern.test(text));
+}
+function explicitAgentSwitchTargets(prompt) {
+  if (!prompt?.trim())
+    return [];
+  return SUPPORTED_AGENTS.filter((agent) => hasExplicitAgentSwitchRequest(prompt, agent));
+}
+function isExplicitAgentSwitchTargets(value) {
+  return Array.isArray(value) && value.length <= SUPPORTED_AGENTS.length && value.every((item, index) => isAgentKindUnique(value, item, index));
+}
+function isAgentKindUnique(list, item, index) {
+  return typeof item === "string" && SUPPORTED_AGENTS.includes(item) && list.indexOf(item) === index;
+}
+var init_explicit_agent_switch = __esm(() => {
+  init_types();
+});
+
 // ../../packages/core/src/mcp/canonical-bridge-config.ts
 function turnKey(scope) {
   return JSON.stringify([
@@ -620,6 +686,232 @@ var init_canonical_bridge_config = __esm(() => {
   turnLeases = new Map;
 });
 
+// ../../packages/core/src/runtime/actor-topic-scope.ts
+function idList(value, name) {
+  if (!Array.isArray(value))
+    return `${name} must be an array of topic ids`;
+  if (value.length > ACTOR_TOPIC_SCOPE_LIMITS.maxIdsPerList) {
+    return `${name} has ${value.length} ids; at most ${ACTOR_TOPIC_SCOPE_LIMITS.maxIdsPerList} are allowed`;
+  }
+  const ids = new Set;
+  for (const item of value) {
+    if (typeof item !== "string")
+      return `${name} must contain only strings`;
+    const id = item.trim();
+    if (!id)
+      return `${name} must not contain empty ids`;
+    if (id.length > ACTOR_TOPIC_SCOPE_LIMITS.maxIdLength) {
+      return `${name} contains an id longer than ${ACTOR_TOPIC_SCOPE_LIMITS.maxIdLength} characters`;
+    }
+    ids.add(id);
+  }
+  return [...ids];
+}
+function validateActorTopicScope(value) {
+  if (value === undefined)
+    return { ok: true, scope: undefined };
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {
+      ok: false,
+      error: "actorTopicScope must be { visibleNodeTopicIds: string[], ownedNodeTopicIds: string[] }"
+    };
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    return { ok: false, error: "actorTopicScope must be a plain object" };
+  }
+  const keys = Object.keys(value);
+  const unknown = keys.filter((key) => !SCOPE_KEYS.includes(key));
+  if (unknown.length || keys.length !== SCOPE_KEYS.length) {
+    return {
+      ok: false,
+      error: unknown.length ? `actorTopicScope has unexpected key(s): ${unknown.join(", ")}` : "actorTopicScope must have both visibleNodeTopicIds and ownedNodeTopicIds"
+    };
+  }
+  const record = value;
+  const visible = idList(record.visibleNodeTopicIds, "actorTopicScope.visibleNodeTopicIds");
+  if (typeof visible === "string")
+    return { ok: false, error: visible };
+  const owned = idList(record.ownedNodeTopicIds, "actorTopicScope.ownedNodeTopicIds");
+  if (typeof owned === "string")
+    return { ok: false, error: owned };
+  const scope = { visibleNodeTopicIds: visible, ownedNodeTopicIds: owned };
+  const bytes = Buffer.byteLength(JSON.stringify(scope), "utf-8");
+  if (bytes > ACTOR_TOPIC_SCOPE_LIMITS.maxSerializedBytes) {
+    return {
+      ok: false,
+      error: `actorTopicScope is ${bytes} bytes serialized; at most ${ACTOR_TOPIC_SCOPE_LIMITS.maxSerializedBytes} are allowed`
+    };
+  }
+  return { ok: true, scope };
+}
+function parseActorTopicScope(value) {
+  const validated = validateActorTopicScope(value);
+  return validated.ok ? validated.scope : null;
+}
+function actorTopicScopeFrom(value) {
+  return parseActorTopicScope(value) ?? undefined;
+}
+function intersectActorTopicScopes(scopes) {
+  if (scopes.length === 0 || scopes.some((scope) => scope === undefined))
+    return;
+  const [first, ...rest] = scopes;
+  const keep = (key) => first[key].filter((id) => rest.every((scope) => scope[key].includes(id)));
+  return {
+    visibleNodeTopicIds: keep("visibleNodeTopicIds"),
+    ownedNodeTopicIds: keep("ownedNodeTopicIds")
+  };
+}
+function encodeActorTopicScopeArg(scope) {
+  const validated = validateActorTopicScope(scope);
+  if (!validated.ok)
+    throw new Error(validated.error);
+  if (!validated.scope)
+    throw new Error("actorTopicScope is required");
+  return Buffer.from(JSON.stringify(validated.scope), "utf-8").toString("base64url");
+}
+var ACTOR_TOPIC_SCOPE_LIMITS, SCOPE_KEYS;
+var init_actor_topic_scope = __esm(() => {
+  ACTOR_TOPIC_SCOPE_LIMITS = Object.freeze({
+    maxIdsPerList: 200,
+    maxIdLength: 128,
+    maxSerializedBytes: 8 * 1024
+  });
+  SCOPE_KEYS = ["visibleNodeTopicIds", "ownedNodeTopicIds"];
+});
+
+// ../../packages/core/src/runtime/remote-session-grant.ts
+function normalizeHubUrl(raw, name = "remoteSession.hubUrl") {
+  if (raw.length > REMOTE_SESSION_GRANT_LIMITS.maxHubUrlLength) {
+    return {
+      error: `${name} is longer than ${REMOTE_SESSION_GRANT_LIMITS.maxHubUrlLength} characters`
+    };
+  }
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return { error: `${name} must be an absolute URL` };
+  }
+  if (url.username || url.password) {
+    return { error: `${name} must not carry credentials` };
+  }
+  if (url.search || url.hash || raw.includes("?") || raw.includes("#")) {
+    return { error: `${name} must not carry a query or fragment` };
+  }
+  if (url.protocol === "http:") {
+    if (!LOOPBACK_HOSTS.has(url.hostname)) {
+      return { error: `${name} must be https:// or a loopback http:// origin` };
+    }
+  } else if (url.protocol !== "https:") {
+    return { error: `${name} must be https:// or a loopback http:// origin` };
+  }
+  return { url: url.toString().replace(/\/+$/, "") };
+}
+function validateRemoteSessionGrant(value) {
+  if (value === undefined)
+    return { ok: true, grant: undefined };
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { ok: false, error: "remoteSession must be { hubUrl: string, capability: string }" };
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    return { ok: false, error: "remoteSession must be a plain object" };
+  }
+  const keys = Object.keys(value);
+  const unknown = keys.filter((key) => !GRANT_KEYS.includes(key));
+  if (unknown.length || keys.length !== GRANT_KEYS.length) {
+    return {
+      ok: false,
+      error: unknown.length ? `remoteSession has unexpected key(s): ${unknown.join(", ")}` : "remoteSession must have both hubUrl and capability"
+    };
+  }
+  const record = value;
+  if (typeof record.hubUrl !== "string" || !record.hubUrl.trim()) {
+    return { ok: false, error: "remoteSession.hubUrl must be a non-empty string" };
+  }
+  const hubUrl = normalizeHubUrl(record.hubUrl.trim());
+  if ("error" in hubUrl)
+    return { ok: false, error: hubUrl.error };
+  if (typeof record.capability !== "string" || !record.capability.trim()) {
+    return { ok: false, error: "remoteSession.capability must be a non-empty string" };
+  }
+  const capability = record.capability.trim();
+  if (capability.length > REMOTE_SESSION_GRANT_LIMITS.maxCapabilityLength) {
+    return {
+      ok: false,
+      error: `remoteSession.capability is ${capability.length} characters; at most ${REMOTE_SESSION_GRANT_LIMITS.maxCapabilityLength} are allowed`
+    };
+  }
+  if (!capability.startsWith(REMOTE_SESSION_GRANT_LIMITS.capabilityPrefix)) {
+    return {
+      ok: false,
+      error: `remoteSession.capability must start with "${REMOTE_SESSION_GRANT_LIMITS.capabilityPrefix}"`
+    };
+  }
+  if (!/^rsc1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(capability)) {
+    return { ok: false, error: "remoteSession.capability is malformed" };
+  }
+  return { ok: true, grant: { hubUrl: hubUrl.url, capability } };
+}
+function parseRemoteSessionGrant(value) {
+  const validated = validateRemoteSessionGrant(value);
+  return validated.ok ? validated.grant : null;
+}
+function remoteSessionGrantFrom(value) {
+  return parseRemoteSessionGrant(value) ?? undefined;
+}
+function remoteSessionGrantExpiry(grant) {
+  const payload = grant.capability.split(".")[1];
+  if (!payload)
+    return null;
+  try {
+    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
+    const exp = decoded?.e;
+    return typeof exp === "number" && Number.isFinite(exp) ? exp : null;
+  } catch {
+    return null;
+  }
+}
+function mergeRemoteSessionGrants(grants) {
+  if (grants.length === 0 || grants.some((grant) => grant === undefined))
+    return;
+  const present = grants;
+  const hubUrl = present[0].hubUrl;
+  if (present.some((grant) => grant.hubUrl !== hubUrl))
+    return;
+  let chosen = present[present.length - 1];
+  let chosenExpiry = remoteSessionGrantExpiry(chosen);
+  for (const grant of present) {
+    const expiry = remoteSessionGrantExpiry(grant);
+    if (expiry !== null && (chosenExpiry === null || expiry > chosenExpiry)) {
+      chosen = grant;
+      chosenExpiry = expiry;
+    }
+  }
+  return chosen;
+}
+function encodeRemoteSessionGrantArg(grant) {
+  const validated = validateRemoteSessionGrant(grant);
+  if (!validated.ok)
+    throw new Error(validated.error);
+  if (!validated.grant)
+    throw new Error("remoteSession is required");
+  return Buffer.from(JSON.stringify(validated.grant), "utf-8").toString("base64url");
+}
+var REMOTE_SESSION_GRANT_LIMITS, GRANT_KEYS, LOOPBACK_HOSTS, REMOTE_SESSION_REPLY_TOKEN_PATTERN, MAX_REMOTE_SESSION_REPLY_TOKEN_LENGTH;
+var init_remote_session_grant = __esm(() => {
+  REMOTE_SESSION_GRANT_LIMITS = Object.freeze({
+    maxHubUrlLength: 512,
+    maxCapabilityLength: 2 * 1024,
+    capabilityPrefix: "rsc1."
+  });
+  GRANT_KEYS = ["hubUrl", "capability"];
+  LOOPBACK_HOSTS = new Set(["127.0.0.1", "::1", "[::1]", "localhost"]);
+  REMOTE_SESSION_REPLY_TOKEN_PATTERN = /^rsr1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+  MAX_REMOTE_SESSION_REPLY_TOKEN_LENGTH = REMOTE_SESSION_GRANT_LIMITS.maxCapabilityLength;
+});
+
 // ../../packages/core/src/mcp/runtime-spec.ts
 import { createHash, createHmac, timingSafeEqual } from "crypto";
 function encodeTokenPart(value) {
@@ -646,18 +938,26 @@ function issueHostedMcpToken(surface, ctx) {
   return `${payloadPart}.${signTokenPayload(payloadPart)}`;
 }
 function buildRuntimeMcpSpec(agent, ctx) {
-  const token = issueRuntimeMcpToken(ctx);
   const base = `http://127.0.0.1:${runtimePort}${RUNTIME_MCP_BASE_PATH}`;
-  const query = `token=${encodeURIComponent(token)}`;
+  const query = `token=${encodeURIComponent(issueRuntimeMcpToken(ctx))}`;
+  const url = agent === "codex" ? `${base}/mcp?${query}` : `${base}/sse?${query}`;
+  assertMcpUrlWithinBudget(RUNTIME_MCP_KEY, url, ctx.topicId);
   if (agent === "codex")
-    return { url: `${base}/mcp?${query}` };
+    return { url };
   return {
     type: "sse",
-    url: `${base}/sse?${query}`,
+    url,
     timeout: CLAUDE_MCP_TOOL_TIMEOUT_MS,
     ...agent === "maestro" ? { lifecycle: "turn" } : {}
   };
 }
+function assertMcpUrlWithinBudget(surface, url, topicId) {
+  if (url.length <= MCP_URL_BUDGET_CHARS)
+    return;
+  const error = new McpUrlBudgetExceededError(surface, url.length);
+  logger.error({ topicId, surface, urlLength: url.length, budget: MCP_URL_BUDGET_CHARS }, "built-in MCP URL exceeds the transport budget; refusing to mint the token");
+  throw error;
+}
 function hostedMcpCacheIdentity(surface, ctx) {
   let semanticContext;
   switch (surface) {
@@ -688,6 +988,9 @@ function hostedMcpCacheIdentity(surface, ctx) {
     case "session-comm":
       semanticContext = {
         userId: ctx.userId,
+        actorUserId: ctx.actorUserId ?? null,
+        actorTopicScope: ctx.actorTopicScope ?? null,
+        remoteSession: ctx.remoteSession ?? null,
         topicTitle: ctx.topicTitle,
         topicId: ctx.topicId ?? null,
         subagentParentTopicId: ctx.subagentParentTopicId ?? null,
@@ -706,13 +1009,15 @@ function buildHostedMcpSpec(agent, surface, ctx) {
   const token = issueHostedMcpToken(surface, ctx);
   const base = `http://127.0.0.1:${runtimePort}${RUNTIME_MCP_BASE_PATH}/${surface}`;
   const query = `token=${encodeURIComponent(token)}`;
+  const url = agent === "codex" ? `${base}/mcp?${query}` : `${base}/sse?${query}`;
+  assertMcpUrlWithinBudget(surface, url, ctx.topicId);
   if (agent === "codex")
-    return { url: `${base}/mcp?${query}` };
-  const queryBound = surface === "session-comm" && (ctx.silent === true || ctx.peerBridge !== undefined);
+    return { url };
+  const queryBound = surface === "session-comm" && (ctx.silent === true || ctx.peerBridge !== undefined || ctx.remoteSession !== undefined);
   const lifecycle = queryBound ? "turn" : surface === "session-comm" ? "session" : "process";
   return {
     type: "sse",
-    url: `${base}/sse?${query}`,
+    url,
     timeout: CLAUDE_MCP_TOOL_TIMEOUT_MS,
     ...agent === "maestro" ? {
       lifecycle,
@@ -720,11 +1025,26 @@ function buildHostedMcpSpec(agent, surface, ctx) {
     } : {}
   };
 }
-var RUNTIME_MCP_KEY = "runtime", RUNTIME_MCP_BASE_PATH = "/mcp/runtime", TOKEN_TTL_MS, CLAUDE_MCP_TOOL_TIMEOUT_MS = 600000, runtimePort;
+var RUNTIME_MCP_KEY = "runtime", RUNTIME_MCP_BASE_PATH = "/mcp/runtime", TOKEN_TTL_MS, CLAUDE_MCP_TOOL_TIMEOUT_MS = 600000, MCP_URL_BUDGET_CHARS, McpUrlBudgetExceededError, runtimePort;
 var init_runtime_spec = __esm(() => {
+  init_explicit_agent_switch();
   init_config();
+  init_logger();
+  init_actor_topic_scope();
+  init_remote_session_grant();
   init_types();
   TOKEN_TTL_MS = 4 * 60 * 60 * 1000;
+  MCP_URL_BUDGET_CHARS = 14 * 1024;
+  McpUrlBudgetExceededError = class McpUrlBudgetExceededError extends Error {
+    surface;
+    urlLength;
+    constructor(surface, urlLength) {
+      super(`built-in MCP URL for "${surface}" is ${urlLength} characters; the transport allows at most ${MCP_URL_BUDGET_CHARS}`);
+      this.surface = surface;
+      this.urlLength = urlLength;
+      this.name = "McpUrlBudgetExceededError";
+    }
+  };
   runtimePort = NEGOTIUM_PORT;
 });
 
@@ -1545,6 +1865,9 @@ function initializeApiTopicsSchema() {
   if (!tableColumns("api_topics").has("subagent_report_mode")) {
     db.exec("ALTER TABLE api_topics ADD COLUMN subagent_report_mode TEXT NOT NULL DEFAULT 'auto'");
   }
+  if (!tableColumns("api_topics").has("derived_by_user_id")) {
+    db.exec("ALTER TABLE api_topics ADD COLUMN derived_by_user_id TEXT");
+  }
   if (!tableColumns("api_topics").has("memory_topic_id")) {
     db.exec("ALTER TABLE api_topics ADD COLUMN memory_topic_id TEXT");
   }
@@ -1657,6 +1980,7 @@ function rowToDto(r, participants = getTopicParticipants(r.id), tellTargets) {
     memoryTopicId: r.memory_topic_id ?? undefined,
     memoryKey: r.memory_key ?? undefined,
     isFork: r.is_fork !== 0,
+    ...r.derived_by_user_id ? { derivedByUserId: r.derived_by_user_id } : {},
     ...r.is_subagent !== 0 ? { isSubagent: true } : {},
     ...r.is_subagent !== 0 ? {
       subagentTellTargetIds: tellTargets ? tellTargets.get(r.id) ?? [] : listSubagentTellTargetIds(r.id)
@@ -1731,8 +2055,8 @@ function upsertTopic(t) {
     db.query(`INSERT INTO api_topics
        (id,title,kind,description,agent,base_model,base_effort,response_policy,
         created_at,last_message_at,parent_topic_id,memory_topic_id,memory_key,is_fork,is_subagent,visibility,surface,
-        surface_scope,subagent_report_mode)
-     VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+        surface_scope,subagent_report_mode,derived_by_user_id)
+     VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
      ON CONFLICT(id) DO UPDATE SET
        title = excluded.title,
        kind = excluded.kind,
@@ -1754,7 +2078,10 @@ function upsertTopic(t) {
        -- assignment: an update may fill in a scope that was unknown when the
        -- room was created, but may never move a room to another workspace.
        surface_scope = COALESCE(api_topics.surface_scope, excluded.surface_scope),
-       subagent_report_mode = excluded.subagent_report_mode`).run(t.id, t.title, normalized.kind, t.description ?? null, normalized.agent ?? null, t.defaultModel ?? null, t.defaultEffort ?? null, normalized.aiMode, t.createdAt, t.lastMessageAt ?? null, t.parentTopicId ?? null, t.memoryTopicId ?? null, t.memoryKey ?? null, t.isFork ? 1 : 0, t.isSubagent ? 1 : 0, normalizeTopicVisibility(t.visibility), normalizeTopicSurface(t.surface ?? defaultTopicSurface()), surfaceScopeForWrite(t), t.subagentReportMode ?? "auto");
+       subagent_report_mode = excluded.subagent_report_mode,
+       -- Who asked for the derive is a fact about creation; a later update
+       -- that omits it must not erase it.
+       derived_by_user_id = COALESCE(excluded.derived_by_user_id, api_topics.derived_by_user_id)`).run(t.id, t.title, normalized.kind, t.description ?? null, normalized.agent ?? null, t.defaultModel ?? null, t.defaultEffort ?? null, normalized.aiMode, t.createdAt, t.lastMessageAt ?? null, t.parentTopicId ?? null, t.memoryTopicId ?? null, t.memoryKey ?? null, t.isFork ? 1 : 0, t.isSubagent ? 1 : 0, normalizeTopicVisibility(t.visibility), normalizeTopicSurface(t.surface ?? defaultTopicSurface()), surfaceScopeForWrite(t), t.subagentReportMode ?? "auto", t.derivedByUserId ?? null);
     db.query("DELETE FROM topic_members WHERE topic_id = ?").run(t.id);
     for (const participant of t.participants) {
       db.query("INSERT INTO topic_members (topic_id,user_id,role) VALUES (?,?,?)").run(t.id, participant.userId, participant.role);
@@ -1903,6 +2230,9 @@ function grantSubagentTellTarget(subagentTopicId, targetTopicId, grantedByTopicI
 function revokeSubagentTellTarget(subagentTopicId, targetTopicId) {
   return db.query("DELETE FROM subagent_tell_grants WHERE subagent_topic_id = ? AND target_topic_id = ?").run(subagentTopicId, targetTopicId).changes > 0;
 }
+function listSubagentChildTopicIds(parentTopicId) {
+  return db.query("SELECT id FROM api_topics WHERE parent_topic_id = ? AND is_subagent = 1 ORDER BY created_at").all(parentTopicId).map((row) => row.id);
+}
 function reparentTopicChildren(deletedTopicId, replacementParentTopicId) {
   const rows = db.query("SELECT id FROM api_topics WHERE parent_topic_id = ?").all(deletedTopicId);
   if (rows.length === 0)
@@ -1949,6 +2279,9 @@ function buildBuiltinMcpServer(surface, ctx, stdio) {
   const agent = ctx.agent ?? FALLBACK_AGENT;
   return buildHostedMcpSpec(agent, surface, {
     userId: ctx.userId,
+    ...ctx.actorUserId ? { actorUserId: ctx.actorUserId } : {},
+    ...ctx.actorTopicScope ? { actorTopicScope: ctx.actorTopicScope } : {},
+    ...surface === "session-comm" && ctx.remoteSession ? { remoteSession: ctx.remoteSession } : {},
     topicTitle: ctx.session,
     ...ctx.topicId ? { topicId: ctx.topicId } : {},
     ...ctx.queryId ? { queryId: ctx.queryId } : {},
@@ -2140,6 +2473,9 @@ function getManagerMcpServers(opts) {
   const topicId = opts.topicId;
   return buildScope("manager", {
     userId: opts.userId,
+    actorUserId: opts.actorUserId,
+    actorTopicScope: opts.actorTopicScope,
+    remoteSession: opts.remoteSession,
     session: opts.session ?? "General",
     topicId,
     queryId: opts.queryId,
@@ -2159,6 +2495,8 @@ function getForumMcpServers(opts) {
   const {
     userId,
     actorUserId,
+    actorTopicScope,
+    remoteSession,
     vaultUserId,
     session,
     topicId,
@@ -2192,6 +2530,8 @@ function getForumMcpServers(opts) {
   const base = buildScope("forum", {
     userId,
     actorUserId,
+    actorTopicScope,
+    remoteSession,
     vaultUserId,
     session,
     topicId,
@@ -2272,6 +2612,9 @@ function getMcpServersForQuery(opts) {
   if (opts.sessionType === "manager") {
     return hideProviderIntrospectionForOtium(mergeHostMcpServers(getManagerMcpServers({
       userId: opts.userId || "local",
+      actorUserId: opts.actorUserId,
+      actorTopicScope: opts.actorTopicScope,
+      remoteSession: opts.remoteSession,
       session: opts.session,
       topicId: opts.topicId,
       queryId: opts.queryId,
@@ -2290,6 +2633,8 @@ function getMcpServersForQuery(opts) {
   return hideProviderIntrospectionForOtium(getForumMcpServers({
     userId: opts.userId || "local",
     actorUserId: opts.actorUserId,
+    actorTopicScope: opts.actorTopicScope,
+    remoteSession: opts.remoteSession,
     vaultUserId: opts.vaultUserId,
     session: opts.session || "default",
     topicId: opts.topicId,
@@ -2324,6 +2669,7 @@ function hideProviderIntrospectionForOtium(servers, topicId) {
 }
 var _playwrightUnavailableNotifier, _playwrightUnavailableLastNotifiedAt, _PLAYWRIGHT_UNAVAILABLE_COOLDOWN_MS, _playwrightUnavailableThisTurn, cuaRsMcpPort, cuaRsMcpToken, MCP_CATALOG, nodeMcpEntries, resolvedNodeMcpPorts, allForumMcpServerNames, requiredForumMcpServers, REQUIRED_FORUM_MCP_SERVERS, optionalForumMcpServers;
 var init_mcp_config = __esm(async () => {
+  init_explicit_agent_switch();
   init_canonical_bridge_config();
   init_runtime_spec();
   init_bridge_ipc_config();
@@ -2333,7 +2679,9 @@ var init_mcp_config = __esm(async () => {
   init_mcp_catalog_policy();
   init_capability();
   init_mcp_transport();
+  init_actor_topic_scope();
   init_cron_sessions();
+  init_remote_session_grant();
   await init_api_topics();
   _playwrightUnavailableLastNotifiedAt = new Map;
   _PLAYWRIGHT_UNAVAILABLE_COOLDOWN_MS = 5 * 60000;
@@ -2361,6 +2709,7 @@ var init_mcp_config = __esm(async () => {
       build({
         userId,
         actorUserId,
+        actorTopicScope,
         session,
         topicId,
         queryId,
@@ -2376,16 +2725,18 @@ var init_mcp_config = __esm(async () => {
       }) {
         if (!topicId || !agent)
           return null;
+        const switchTargets = explicitAgentSwitchTargets(currentUserPrompt);
         return buildRuntimeMcpSpec(agent, {
           userId,
           ...actorUserId ? { actorUserId } : {},
+          ...actorTopicScope ? { actorTopicScope } : {},
           topicId,
           topicTitle: session,
           queryId,
           cwd: cwd ?? resolveTopicWorkspaceDir(topicId),
           agent,
           model,
-          currentUserPrompt,
+          ...switchTargets.length ? { explicitAgentSwitchTargets: switchTargets } : {},
           autoContinue,
           visualTools,
           fileDeliveryTools,
@@ -2455,6 +2806,9 @@ var init_mcp_config = __esm(async () => {
       build(ctx) {
         const {
           userId,
+          actorUserId,
+          actorTopicScope,
+          remoteSession,
           session,
           topicId,
           subagentParentTopicId,
@@ -2468,6 +2822,9 @@ var init_mcp_config = __esm(async () => {
         const cronSessionId = topicId ? getRegisteredCronSession(topicId, effectiveAgent)?.sessionId : undefined;
         const args = [
           `--user-id=${userId}`,
+          ...actorUserId ? [`--actor-user-id=${actorUserId}`] : [],
+          ...actorTopicScope ? [`--actor-topic-scope=${encodeActorTopicScopeArg(actorTopicScope)}`] : [],
+          ...remoteSession ? [`--remote-session-grant=${encodeRemoteSessionGrantArg(remoteSession)}`] : [],
           `--topic=${session}`,
           ...topicId ? [`--topic-id=${topicId}`] : [],
           ...subagentParentTopicId ? [`--subagent-parent-topic-id=${subagentParentTopicId}`] : [],
@@ -3969,7 +4326,7 @@ var init_codex = __esm(async () => {
 });
 
 // ../../packages/core/src/version.ts
-var NEGOTIUM_VERSION = "0.19.2";
+var NEGOTIUM_VERSION = "0.20.1";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn as spawn2 } from "child_process";
@@ -8797,7 +9154,7 @@ function isTopicSummaryFile(filename, topicId, topicTitle) {
     return false;
   if (topicTitle) {
     const titleSlug = wikiSummarySlug(topicTitle);
-    if (new RegExp(`^\\d{4}-\\d{2}-\\d{2}-${escapeRegExp(titleSlug)}(?:~\\d+)?\\.md$`).test(filename)) {
+    if (new RegExp(`^\\d{4}-\\d{2}-\\d{2}-${escapeRegExp2(titleSlug)}(?:~\\d+)?\\.md$`).test(filename)) {
       return true;
     }
   }
@@ -8810,7 +9167,7 @@ function isTopicBriefFile(filename, topicId, topicTitle) {
   const idSlug = wikiSummarySlug(topicId);
   return filename === `${idSlug}.md` || filename.endsWith(`--${idSlug}.md`);
 }
-function escapeRegExp(value) {
+function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var WIKI_SUMMARY_DATE_PREFIX;
@@ -13656,6 +14013,9 @@ function rowToRequest(row) {
     runningQueryId: row.running_query_id ?? undefined
   };
 }
+function requestActor(actorUserId) {
+  return actorUserId ?? null;
+}
 function loggedMessageCount(request) {
   const explicit = request.execution?.loggedUserMessageCount;
   if (typeof explicit === "number" && Number.isInteger(explicit)) {
@@ -13672,7 +14032,13 @@ function mergeRuntimeUserTurnRequest(input) {
   return db.transaction(() => {
     const rows = db.query("SELECT * FROM runtime_user_turn_requests WHERE topic_id = ? ORDER BY created_at ASC, rowid ASC").all(input.topicId);
     const thread = input.execution.threadRootId;
-    const previous = rows.map(rowToRequest).filter((request) => request.execution?.threadRootId === thread);
+    const sameThread = rows.map(rowToRequest).filter((request) => request.execution?.threadRootId === thread);
+    const actor = requestActor(input.execution.actorUserId);
+    let firstMergeable = sameThread.length;
+    while (firstMergeable > 0 && requestActor(sameThread[firstMergeable - 1].execution?.actorUserId) === actor) {
+      firstMergeable -= 1;
+    }
+    const previous = sameThread.slice(firstMergeable);
     const omittedRequestIds = new Set([
       ...input.omitRequestIds ?? [],
       ...previous.filter((request) => Boolean(request.execution?.providerSessionId)).map((request) => request.requestId)
@@ -13691,8 +14057,18 @@ function mergeRuntimeUserTurnRequest(input) {
     ];
     const incomingLoggedCount = Math.min(Math.max(0, input.execution.loggedUserMessageCount ?? 0), input.userMessages.length);
     const loggedUserMessageCount = carried.reduce((count, request) => count + loggedMessageCount(request), 0) + Math.max(0, incomingLoggedCount - alreadyIncludedMessageCount);
+    const actorTopicScope = intersectActorTopicScopes([
+      ...previous.map((request) => request.execution?.actorTopicScope),
+      input.execution.actorTopicScope
+    ]);
+    const remoteSession = mergeRemoteSessionGrants([
+      ...previous.map((request) => request.execution?.remoteSession),
+      input.execution.remoteSession
+    ]);
     const execution = {
       ...input.execution,
+      actorTopicScope,
+      remoteSession,
       loggedUserMessageCount,
       supersededRequestIds: [
         ...new Set(previous.flatMap((request) => [
@@ -13828,12 +14204,21 @@ function cancelRuntimeUserTurnRequests(topicId) {
   db.query("DELETE FROM runtime_user_turn_requests WHERE topic_id = ?").run(topicId);
   return rows.map((row) => row.request_id);
 }
+function getActiveRuntimeUserTurnRequest(topicId) {
+  const row = db.query(`SELECT * FROM runtime_user_turn_requests
+       WHERE topic_id = ?
+         AND (status = 'running' OR (claimed_by IS NOT NULL AND claimed_at >= ?))
+       ORDER BY created_at ASC, rowid ASC LIMIT 1`).get(topicId, Date.now() - REQUEST_CLAIM_STALE_MS);
+  return row ? rowToRequest(row) : null;
+}
 function getRuntimeUserTurnRequest(topicId) {
   const row = db.query("SELECT * FROM runtime_user_turn_requests WHERE topic_id = ? ORDER BY created_at DESC, rowid DESC LIMIT 1").get(topicId);
   return row ? rowToRequest(row) : null;
 }
 var REQUEST_CLAIM_STALE_MS;
 var init_runtime_turn_requests = __esm(async () => {
+  init_actor_topic_scope();
+  init_remote_session_grant();
   init_user_turn_envelope();
   await __promiseAll([
     init_forum_db(),
@@ -14746,6 +15131,7 @@ async function createDerivedTopicImpl(topic, sourceTopicId, userId, copyHistory,
     parentTopicId: sourceTopicId,
     ...subagent?.memoryTopicId ? { memoryTopicId: subagent.memoryTopicId } : {},
     isFork: copyHistory,
+    ...opts?.derivedByUserId ? { derivedByUserId: opts.derivedByUserId } : {},
     ...subagent ? { isSubagent: true } : {},
     visibility: topic.visibility,
     surface,
@@ -15053,6 +15439,50 @@ var init_state = __esm(() => {
   });
 });
 
+// ../../packages/core/src/runtime/actor-topic-reach.ts
+function subagentLineageTopicIds(currentTopicId) {
+  const reachable = new Set;
+  const children = new Set;
+  if (!currentTopicId)
+    return { reachable, children };
+  const current2 = getTopic(currentTopicId);
+  if (current2?.isSubagent && current2.parentTopicId) {
+    reachable.add(current2.parentTopicId);
+    for (const id of listSubagentTellTargetIds(currentTopicId))
+      reachable.add(id);
+  }
+  for (const id of listSubagentChildTopicIds(currentTopicId)) {
+    reachable.add(id);
+    children.add(id);
+  }
+  return { reachable, children };
+}
+function actorReachableTopicIds(input) {
+  if (input.surface !== "otium")
+    return null;
+  const ids = new Set;
+  if (input.currentTopicId)
+    ids.add(input.currentTopicId);
+  if (input.actorTopicScope) {
+    for (const id of input.actorTopicScope.visibleNodeTopicIds)
+      ids.add(id);
+    return ids;
+  }
+  for (const id of subagentLineageTopicIds(input.currentTopicId).reachable)
+    ids.add(id);
+  return ids;
+}
+function actorOwnedTopicIds(input) {
+  if (input.surface !== "otium")
+    return null;
+  if (input.actorTopicScope)
+    return new Set(input.actorTopicScope.ownedNodeTopicIds);
+  return subagentLineageTopicIds(input.currentTopicId).children;
+}
+var init_actor_topic_reach = __esm(async () => {
+  await init_api_topics();
+});
+
 // ../../packages/core/src/query/session-inbox-path.ts
 import { join as join25 } from "path";
 function sessionInboxPath(userId, topicId) {
@@ -15143,96 +15573,210 @@ var init_session_inbox_cleanup = __esm(async () => {
   await init_session_inbox();
 });
 
-// ../../packages/core/src/mcp/session-comm/peer-forward.ts
-var exports_peer_forward = {};
-__export(exports_peer_forward, {
-  registerPeerSessionBridge: () => registerPeerSessionBridge,
-  peerSessionsForUser: () => peerSessionsForUser,
-  forwardToPeer: () => forwardToPeer,
-  deliverPeerReply: () => deliverPeerReply
-});
-function loopbackBridgeConfig() {
-  const rawUrl = process.env[PEER_BRIDGE_URL_ENV]?.trim();
-  const token = process.env[PEER_BRIDGE_TOKEN_ENV]?.trim();
-  if (!rawUrl || !token)
+// ../../packages/core/src/mcp/session-comm/hub-remote-session.ts
+function isPlainRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function parseListedRoom(value, mode) {
+  if (!isPlainRecord(value))
     return null;
-  try {
-    const url = new URL(rawUrl);
-    if (url.protocol !== "http:" || !["127.0.0.1", "::1", "localhost"].includes(url.hostname)) {
+  const { name, agent, status, description, role } = value;
+  if (typeof name !== "string" || !name.trim())
+    return null;
+  if (agent !== undefined && agent !== null && typeof agent !== "string")
+    return null;
+  if (status === undefined) {
+    if (mode === "peek")
       return null;
-    }
-    return { url: url.toString(), token };
-  } catch {
+  } else if (status !== "active" && status !== "ready") {
     return null;
   }
+  if (description !== undefined && description !== null && typeof description !== "string") {
+    return null;
+  }
+  if (role !== undefined && role !== "owner" && role !== "member")
+    return null;
+  return {
+    name,
+    ...agent !== undefined ? { agent } : {},
+    ...status !== undefined ? { status } : {},
+    ...description !== undefined ? { description } : {},
+    ...role !== undefined ? { role } : {}
+  };
 }
-async function callLoopbackBridge(request) {
-  const config = loopbackBridgeConfig();
-  if (!config)
-    return { configured: false, result: null };
-  try {
-    const response = await fetch(config.url, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${config.token}`,
-        "content-type": "application/json"
-      },
-      body: JSON.stringify(request),
-      signal: AbortSignal.timeout(PEER_BRIDGE_TIMEOUT_MS)
-    });
-    if (!response.ok)
-      return { configured: true, result: null };
-    return { configured: true, result: await response.json() };
-  } catch {
-    return { configured: true, result: null };
+function parseNodeListing(value, mode) {
+  if (!isPlainRecord(value))
+    return null;
+  const { node, sessions, error } = value;
+  if (typeof node !== "string" || !node.trim() || node.includes("/"))
+    return null;
+  if (error !== undefined && (typeof error !== "string" || !error.trim()))
+    return null;
+  if (sessions === undefined === (error === undefined))
+    return null;
+  if (sessions === undefined)
+    return { node, error };
+  if (!Array.isArray(sessions))
+    return null;
+  const parsed = [];
+  for (const entry of sessions) {
+    const room = parseListedRoom(entry, mode);
+    if (!room)
+      return null;
+    parsed.push(room);
   }
+  return { node, sessions: parsed };
 }
-function registerPeerSessionBridge(bridge) {
-  activeBridge = bridge;
-  return () => {
-    if (activeBridge === bridge)
-      activeBridge = null;
-  };
+function parseNodeListings(value, mode) {
+  if (!Array.isArray(value))
+    return null;
+  const listings = [];
+  for (const entry of value) {
+    const listing = parseNodeListing(entry, mode);
+    if (!listing)
+      return null;
+    listings.push(listing);
+  }
+  return listings;
 }
-async function forwardToPeer(args) {
-  if (activeBridge)
-    return activeBridge.forward(args);
-  const forwarded = await callLoopbackBridge({ action: "forward", args });
-  if (forwarded.result)
-    return forwarded.result;
+function parsePendingAsks(value) {
+  if (!Array.isArray(value))
+    return null;
+  const asks = [];
+  for (const entry of value) {
+    if (!isPlainRecord(entry))
+      return null;
+    const { to, requestId, status } = entry;
+    if (typeof to !== "string" || !to.trim())
+      return null;
+    if (typeof requestId !== "string" || !requestId.trim())
+      return null;
+    if (status !== "forwarded" && status !== "reply_pending")
+      return null;
+    asks.push({ to, requestId, status });
+  }
+  return asks;
+}
+function validateHubSuccessEnvelope(body, shape) {
+  if (!isPlainRecord(body))
+    return null;
+  if (body.ok !== true || body.v !== REMOTE_SESSION_PROTOCOL_VERSION)
+    return null;
+  switch (shape) {
+    case "sessions": {
+      const nodes = parseNodeListings(body.nodes, "sessions");
+      return nodes ? { shape, nodes } : null;
+    }
+    case "peek": {
+      const nodes = parseNodeListings(body.nodes, "peek");
+      const pendingAsks = parsePendingAsks(body.pendingAsks);
+      return nodes && pendingAsks ? { shape, nodes, pendingAsks } : null;
+    }
+    case "delivery":
+    case "reply":
+      return typeof body.replayed === "boolean" ? { shape, replayed: body.replayed } : null;
+  }
+}
+function hubHeaders(bearer) {
   return {
-    ok: false,
-    error: forwarded.configured ? "remote session bridge is configured but unavailable" : "remote nodes are not connected on this negotium node (standalone mode)"
+    authorization: `Bearer ${bearer}`,
+    "content-type": "application/json",
+    accept: "application/json"
   };
 }
-async function peerSessionsForUser(userId, sourceQueryId, fromTopicId) {
-  if (activeBridge)
-    return activeBridge.sessions(userId, sourceQueryId, fromTopicId);
-  const sessions = await callLoopbackBridge({
-    action: "sessions",
-    userId,
-    sourceQueryId,
-    fromTopicId
-  });
-  if (sessions.result)
-    return sessions.result;
-  if (sessions.configured)
-    return { ok: false, nodes: [] };
-  return { ok: true, nodes: [] };
-}
-async function deliverPeerReply(route, sourceTitle, replyText, kind) {
-  if (activeBridge)
-    return activeBridge.reply(route, sourceTitle, replyText, kind);
-  return (await callLoopbackBridge({
-    action: "reply",
-    route,
-    sourceTitle,
-    replyText,
-    kind
-  })).result ?? false;
+function errorText(status, body, fallback) {
+  const text2 = body?.error;
+  if (typeof text2 === "string" && text2.trim())
+    return text2.trim();
+  return `${fallback} (hub answered ${status})`;
+}
+function describeFailure(status, body) {
+  switch (status) {
+    case 401:
+      return "remote session authorization for this turn is no longer valid (expired or revoked); send a new message to start a turn with a fresh grant";
+    case 404:
+      return errorText(status, body, "remote session not found");
+    case 409:
+      return errorText(status, body, "remote session refused the request");
+    case 413:
+      return errorText(status, body, "message too long for the hub");
+    case 429:
+      return errorText(status, body, "remote session rate limit reached; try again shortly");
+    case 502:
+      return errorText(status, body, "the target node could not be reached by the hub");
+    case 503:
+      return errorText(status, body, "remote session-comm is disabled on the hub");
+    default:
+      return errorText(status, body, "hub refused the remote session call");
+  }
+}
+async function hubRemoteReply(args) {
+  const url = `${args.hubUrl}${REMOTE_SESSION_HUB_BASE_PATH}/reply`;
+  let response;
+  try {
+    response = await hubFetch(url, {
+      method: "POST",
+      headers: hubHeaders(args.token),
+      body: JSON.stringify({
+        v: REMOTE_SESSION_PROTOCOL_VERSION,
+        requestId: args.requestId,
+        kind: args.kind,
+        replyText: args.replyText,
+        fromLabel: args.fromLabel
+      }),
+      signal: AbortSignal.timeout(HUB_TIMEOUT_MS),
+      redirect: "error"
+    });
+  } catch (error) {
+    return {
+      settled: false,
+      error: `hub unreachable: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  let parsed = null;
+  try {
+    parsed = await response.json();
+  } catch {
+    parsed = null;
+  }
+  if (response.ok) {
+    const envelope = validateHubSuccessEnvelope(parsed, "reply");
+    if (!envelope) {
+      return {
+        settled: false,
+        error: `hub answered ${response.status} with an unexpected body`
+      };
+    }
+    return { settled: true, replayed: envelope.shape === "reply" && envelope.replayed };
+  }
+  const code = parsed?.code;
+  if (response.status >= 500 || response.status === 429 || response.status === 409 && code === HUB_IN_PROGRESS_CODE) {
+    return { settled: false, error: describeFailure(response.status, parsed) };
+  }
+  logger.warn({
+    requestId: args.requestId,
+    status: response.status,
+    error: describeFailure(response.status, parsed)
+  }, "session-comm: hub rejected an ask reply; dropping it");
+  return { settled: true, replayed: false };
 }
-var activeBridge = null, PEER_BRIDGE_URL_ENV = "NEGOTIUM_PEER_SESSION_BRIDGE_URL", PEER_BRIDGE_TOKEN_ENV = "NEGOTIUM_PEER_SESSION_BRIDGE_TOKEN", PEER_BRIDGE_TIMEOUT_MS = 5000;
-
+var REMOTE_SESSION_HUB_BASE_PATH = "/api/v1/session-comm/remote", REMOTE_SESSION_PROTOCOL_VERSION = 1, HUB_TIMEOUT_MS = 15000, HUB_IN_PROGRESS_CODE = "in_progress", hubFetch = (input, init) => fetch(input, init), NEVER_REACHED_HUB_CAUSE_CODES;
+var init_hub_remote_session = __esm(() => {
+  init_logger();
+  NEVER_REACHED_HUB_CAUSE_CODES = new Set([
+    "ECONNREFUSED",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "EHOSTUNREACH",
+    "ENETUNREACH",
+    "ERR_INVALID_URL",
+    "CERT_HAS_EXPIRED",
+    "DEPTH_ZERO_SELF_SIGNED_CERT",
+    "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+    "ERR_TLS_CERT_ALTNAME_INVALID",
+    "SELF_SIGNED_CERT_IN_CHAIN"
+  ]);
+});
 // ../../packages/core/src/storage/session-asks.ts
 var exports_session_asks = {};
 __export(exports_session_asks, {
@@ -15598,6 +16142,326 @@ var init_session_asks = __esm(async () => {
   PENDING_ASK_TTL_MS = 15 * 60 * 1000;
 });
 
+// ../../packages/core/src/storage/remote-session.ts
+function remoteSessionRetryDelayMs(attempts, random = Math.random) {
+  const step = Math.max(0, Math.floor(attempts) - 1);
+  const base = Math.min(REMOTE_SESSION_REPLY_BACKOFF_BASE_MS * 2 ** step, REMOTE_SESSION_REPLY_BACKOFF_MAX_MS);
+  const jitter = 0.8 + 0.4 * Math.min(1, Math.max(0, random()));
+  return Math.round(base * jitter);
+}
+function toOutboxEntry(row) {
+  return {
+    requestId: row.request_id,
+    hubUrl: row.hub_url,
+    token: row.token,
+    kind: row.kind,
+    replyText: row.reply_text,
+    fromLabel: row.from_label,
+    createdAt: Number(row.created_at),
+    attempts: Number(row.attempts),
+    nextAttemptAt: Number(row.next_attempt_at),
+    ...row.last_error ? { lastError: row.last_error } : {}
+  };
+}
+function upsertRemoteSessionReplyOutbox(args) {
+  db.query(`INSERT INTO remote_session_reply_outbox
+       (request_id, hub_url, token, kind, reply_text, from_label, created_at, attempts, next_attempt_at, last_error)
+     VALUES (?, ?, ?, ?, ?, ?, ?, 0, 0, NULL)
+     ON CONFLICT(request_id) DO UPDATE SET
+       hub_url = excluded.hub_url,
+       token = excluded.token,
+       kind = excluded.kind,
+       reply_text = excluded.reply_text,
+       from_label = excluded.from_label,
+       attempts = 0,
+       next_attempt_at = 0,
+       last_error = NULL`).run(args.requestId, args.hubUrl, args.token, args.kind, args.replyText, args.fromLabel, args.createdAt ?? Date.now());
+}
+function listRemoteSessionReplyOutbox(args = {}) {
+  const now = args.now ?? Date.now();
+  const rows = args.due === false ? db.query("SELECT * FROM remote_session_reply_outbox ORDER BY created_at LIMIT ?").all(args.limit ?? 100) : db.query(`SELECT * FROM remote_session_reply_outbox
+           WHERE next_attempt_at <= ?
+           ORDER BY created_at LIMIT ?`).all(now, args.limit ?? 100);
+  return rows.map(toOutboxEntry);
+}
+function deleteRemoteSessionReplyOutbox(requestId) {
+  const result = db.query("DELETE FROM remote_session_reply_outbox WHERE request_id = ?").run(requestId);
+  return Number(result.changes ?? 0) === 1;
+}
+function deferRemoteSessionReplyOutbox(args) {
+  const now = args.now ?? Date.now();
+  db.transaction(() => {
+    const row = db.query("SELECT attempts FROM remote_session_reply_outbox WHERE request_id = ?").get(args.requestId);
+    if (!row)
+      return;
+    const attempts = Number(row.attempts) + 1;
+    const delay2 = args.retryMs ?? remoteSessionRetryDelayMs(attempts, args.random);
+    db.query(`UPDATE remote_session_reply_outbox
+       SET attempts = ?, next_attempt_at = ?, last_error = ?
+       WHERE request_id = ?`).run(attempts, now + delay2, args.error.slice(0, 500), args.requestId);
+  })();
+}
+function purgeExpiredRemoteSessionReplyOutbox(now = Date.now()) {
+  const cutoff = now - REMOTE_SESSION_REPLY_OUTBOX_TTL_MS;
+  const expired = db.query("SELECT * FROM remote_session_reply_outbox WHERE created_at < ?").all(cutoff).map(toOutboxEntry);
+  if (expired.length) {
+    db.query("DELETE FROM remote_session_reply_outbox WHERE created_at < ?").run(cutoff);
+  }
+  return expired;
+}
+var REMOTE_SESSION_INBOX_CLAIM_TTL_MS, REMOTE_SESSION_REPLY_OUTBOX_TTL_MS, REMOTE_SESSION_REPLY_BACKOFF_BASE_MS = 5000, REMOTE_SESSION_REPLY_BACKOFF_MAX_MS = 30000;
+var init_remote_session = __esm(async () => {
+  await __promiseAll([
+    init_forum_db(),
+    init_session_asks(),
+    init_storage_host()
+  ]);
+  registerStorageSchemaInitializer((database) => {
+    database.exec(`
+    CREATE TABLE IF NOT EXISTS remote_session_inbox_claims (
+      request_id   TEXT PRIMARY KEY,
+      kind         TEXT NOT NULL,
+      topic_id     TEXT NOT NULL,
+      payload_hash TEXT NOT NULL,
+      created_at   INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_remote_session_inbox_claims_created
+      ON remote_session_inbox_claims(created_at);
+    CREATE TABLE IF NOT EXISTS remote_session_asks (
+      request_id            TEXT PRIMARY KEY,
+      caller_topic_id       TEXT NOT NULL,
+      user_id               TEXT NOT NULL,
+      from_key              TEXT NOT NULL,
+      to_key                TEXT NOT NULL,
+      caller_thread_root_id TEXT,
+      created_at            INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_remote_session_asks_caller
+      ON remote_session_asks(caller_topic_id);
+    CREATE TABLE IF NOT EXISTS remote_session_reply_outbox (
+      request_id      TEXT PRIMARY KEY,
+      hub_url         TEXT NOT NULL,
+      token           TEXT NOT NULL,
+      kind            TEXT NOT NULL CHECK (kind IN ('reply', 'error')),
+      reply_text      TEXT NOT NULL,
+      from_label      TEXT NOT NULL,
+      created_at      INTEGER NOT NULL,
+      attempts        INTEGER NOT NULL DEFAULT 0,
+      next_attempt_at INTEGER NOT NULL DEFAULT 0,
+      last_error      TEXT
+    );
+  `);
+    for (const ddl of [
+      "ALTER TABLE remote_session_inbox_claims ADD COLUMN state TEXT NOT NULL DEFAULT 'completed'",
+      "ALTER TABLE remote_session_inbox_claims ADD COLUMN lease_until INTEGER NOT NULL DEFAULT 0",
+      "ALTER TABLE remote_session_inbox_claims ADD COLUMN payload_json TEXT"
+    ]) {
+      try {
+        database.exec(ddl);
+      } catch {}
+    }
+  }, 36);
+  REMOTE_SESSION_INBOX_CLAIM_TTL_MS = 24 * 60 * 60 * 1000;
+  REMOTE_SESSION_REPLY_OUTBOX_TTL_MS = PENDING_ASK_TTL_MS;
+});
+
+// ../../packages/core/src/runtime/remote-session-inbox.ts
+var inboxLocks;
+var init_remote_session_inbox = __esm(async () => {
+  init_config();
+  init_logger();
+  await __promiseAll([
+    init_peer_forward(),
+    init_forum_db(),
+    init_remote_session(),
+    init_session_inbox()
+  ]);
+  inboxLocks = new Map;
+});
+
+// ../../packages/core/src/runtime/remote-session-reply-outbox.ts
+async function deliverHubRemoteReply(route, fromLabel, replyText, kind) {
+  db.transaction(() => {
+    upsertRemoteSessionReplyOutbox({
+      requestId: route.requestId,
+      hubUrl: route.hubUrl,
+      token: route.token,
+      kind,
+      replyText,
+      fromLabel
+    });
+    deleteHubRemoteAskCallbackRow(route.requestId);
+  })();
+  await flushRemoteSessionReplyOutbox();
+  return true;
+}
+function flushRemoteSessionReplyOutbox(now = Date.now()) {
+  if (inFlight)
+    return inFlight;
+  inFlight = (async () => {
+    for (const expired of purgeExpiredRemoteSessionReplyOutbox(now)) {
+      logger.warn({ requestId: expired.requestId, attempts: expired.attempts, lastError: expired.lastError }, "session-comm: remote ask reply expired before the hub accepted it");
+    }
+    for (const entry of listRemoteSessionReplyOutbox({ now })) {
+      const result = await hubRemoteReply({
+        hubUrl: entry.hubUrl,
+        token: entry.token,
+        requestId: entry.requestId,
+        kind: entry.kind,
+        replyText: entry.replyText,
+        fromLabel: entry.fromLabel
+      });
+      if (result.settled) {
+        deleteRemoteSessionReplyOutbox(entry.requestId);
+        continue;
+      }
+      deferRemoteSessionReplyOutbox({
+        requestId: entry.requestId,
+        error: result.error,
+        now,
+        random: retryRandom
+      });
+      logger.info({ requestId: entry.requestId, attempts: entry.attempts + 1, error: result.error }, "session-comm: remote ask reply deferred");
+    }
+  })().finally(() => {
+    inFlight = null;
+  });
+  return inFlight;
+}
+var retryRandom, inFlight = null;
+var init_remote_session_reply_outbox = __esm(async () => {
+  init_hub_remote_session();
+  init_logger();
+  await __promiseAll([
+    init_ask_callbacks(),
+    init_remote_session_inbox(),
+    init_forum_db(),
+    init_remote_session()
+  ]);
+  retryRandom = Math.random;
+});
+
+// ../../packages/core/src/mcp/session-comm/peer-forward.ts
+var exports_peer_forward = {};
+__export(exports_peer_forward, {
+  registerPeerSessionBridge: () => registerPeerSessionBridge,
+  peerSessionsForUser: () => peerSessionsForUser,
+  parseHubRemoteReplyRoute: () => parseHubRemoteReplyRoute,
+  isHubRemoteReplyRoute: () => isHubRemoteReplyRoute,
+  forwardToPeer: () => forwardToPeer,
+  deliverPeerReply: () => deliverPeerReply
+});
+function isHubRemoteReplyRoute(route) {
+  return route.via === "hub";
+}
+function parseHubRemoteReplyRoute(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const route = value;
+  if (route.via !== "hub" || typeof route.hubUrl !== "string" || typeof route.token !== "string" || typeof route.nodeName !== "string" || typeof route.topicId !== "string" || typeof route.requestId !== "string") {
+    return null;
+  }
+  const requestId = route.requestId.trim();
+  const nodeName = route.nodeName.trim();
+  const topicId = route.topicId.trim();
+  const token = route.token.trim();
+  if (!requestId || requestId.length > MAX_ROUTE_REQUEST_ID_LENGTH || !nodeName || nodeName.length > MAX_ROUTE_LABEL_LENGTH || !topicId || topicId.length > MAX_ROUTE_LABEL_LENGTH || token.length > MAX_REMOTE_SESSION_REPLY_TOKEN_LENGTH || !REMOTE_SESSION_REPLY_TOKEN_PATTERN.test(token)) {
+    return null;
+  }
+  const hubUrl = normalizeHubUrl(route.hubUrl.trim(), "remoteReply.hubUrl");
+  if ("error" in hubUrl)
+    return null;
+  return { via: "hub", hubUrl: hubUrl.url, token, nodeName, topicId, requestId };
+}
+function loopbackBridgeConfig() {
+  const rawUrl = process.env[PEER_BRIDGE_URL_ENV]?.trim();
+  const token = process.env[PEER_BRIDGE_TOKEN_ENV]?.trim();
+  if (!rawUrl || !token)
+    return null;
+  try {
+    const url = new URL(rawUrl);
+    if (url.protocol !== "http:" || !["127.0.0.1", "::1", "localhost"].includes(url.hostname)) {
+      return null;
+    }
+    return { url: url.toString(), token };
+  } catch {
+    return null;
+  }
+}
+async function callLoopbackBridge(request) {
+  const config = loopbackBridgeConfig();
+  if (!config)
+    return { configured: false, result: null };
+  try {
+    const response = await fetch(config.url, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${config.token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(request),
+      signal: AbortSignal.timeout(PEER_BRIDGE_TIMEOUT_MS)
+    });
+    if (!response.ok)
+      return { configured: true, result: null };
+    return { configured: true, result: await response.json() };
+  } catch {
+    return { configured: true, result: null };
+  }
+}
+function registerPeerSessionBridge(bridge) {
+  activeBridge = bridge;
+  return () => {
+    if (activeBridge === bridge)
+      activeBridge = null;
+  };
+}
+async function forwardToPeer(args) {
+  if (activeBridge)
+    return activeBridge.forward(args);
+  const forwarded = await callLoopbackBridge({ action: "forward", args });
+  if (forwarded.result)
+    return forwarded.result;
+  return {
+    ok: false,
+    error: forwarded.configured ? "remote session bridge is configured but unavailable" : "remote nodes are not connected on this negotium node (standalone mode)"
+  };
+}
+async function peerSessionsForUser(userId, sourceQueryId, fromTopicId) {
+  if (activeBridge)
+    return activeBridge.sessions(userId, sourceQueryId, fromTopicId);
+  const sessions = await callLoopbackBridge({
+    action: "sessions",
+    userId,
+    sourceQueryId,
+    fromTopicId
+  });
+  if (sessions.result)
+    return sessions.result;
+  if (sessions.configured)
+    return { ok: false, nodes: [] };
+  return { ok: true, nodes: [] };
+}
+async function deliverPeerReply(route, sourceTitle, replyText, kind) {
+  if (isHubRemoteReplyRoute(route)) {
+    return deliverHubRemoteReply(route, sourceTitle, replyText, kind);
+  }
+  if (activeBridge)
+    return activeBridge.reply(route, sourceTitle, replyText, kind);
+  return (await callLoopbackBridge({
+    action: "reply",
+    route,
+    sourceTitle,
+    replyText,
+    kind
+  })).result ?? false;
+}
+var MAX_ROUTE_REQUEST_ID_LENGTH = 200, MAX_ROUTE_LABEL_LENGTH = 300, activeBridge = null, PEER_BRIDGE_URL_ENV = "NEGOTIUM_PEER_SESSION_BRIDGE_URL", PEER_BRIDGE_TOKEN_ENV = "NEGOTIUM_PEER_SESSION_BRIDGE_TOKEN", PEER_BRIDGE_TIMEOUT_MS = 5000;
+var init_peer_forward = __esm(async () => {
+  init_remote_session_grant();
+  await init_remote_session_reply_outbox();
+});
+
 // ../../packages/core/src/runtime/ask-callbacks.ts
 var exports_ask_callbacks = {};
 __export(exports_ask_callbacks, {
@@ -15605,21 +16469,25 @@ __export(exports_ask_callbacks, {
   registerAskCallback: () => registerAskCallback,
   purgeStaleAsks: () => purgeStaleAsks,
   failInterruptedRemoteAskCallbacks: () => failInterruptedRemoteAskCallbacks,
+  deleteHubRemoteAskCallbackRow: () => deleteHubRemoteAskCallbackRow,
   cancelAskCallbacksForTopic: () => cancelAskCallbacksForTopic
 });
 function registerAskCallback(entry) {
   pendingAsks.set(entry.targetQueryId, entry);
   if (entry.remoteReply) {
+    const route = entry.remoteReply;
+    const hub = isHubRemoteReplyRoute(route);
     db.query(`INSERT INTO remote_ask_callbacks
-       (target_query_id, request_id, node_name, node_cell_id, topic_id, user_id, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?)
+       (target_query_id, request_id, node_name, node_cell_id, topic_id, user_id, created_at, route_json)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)
        ON CONFLICT(target_query_id) DO UPDATE SET
          request_id = excluded.request_id,
          node_name = excluded.node_name,
          node_cell_id = excluded.node_cell_id,
          topic_id = excluded.topic_id,
          user_id = excluded.user_id,
-         created_at = excluded.created_at`).run(entry.targetQueryId, entry.remoteReply.requestId, entry.remoteReply.nodeName, entry.remoteReply.nodeCellId, entry.remoteReply.topicId, entry.remoteReply.userId, entry.createdAt);
+         created_at = excluded.created_at,
+         route_json = excluded.route_json`).run(entry.targetQueryId, route.requestId, route.nodeName, hub ? "" : route.nodeCellId, route.topicId, hub ? "" : route.userId, entry.createdAt, hub ? JSON.stringify(route) : null);
   }
 }
 function resolveAskCallback(queryId) {
@@ -15630,9 +16498,14 @@ function resolveAskCallback(queryId) {
     entry.timedOut = true;
   }
   pendingAsks.delete(queryId);
-  db.query("DELETE FROM remote_ask_callbacks WHERE target_query_id = ?").run(queryId);
+  if (!entry.remoteReply || !isHubRemoteReplyRoute(entry.remoteReply)) {
+    db.query("DELETE FROM remote_ask_callbacks WHERE target_query_id = ?").run(queryId);
+  }
   return entry;
 }
+function deleteHubRemoteAskCallbackRow(requestId) {
+  db.query("DELETE FROM remote_ask_callbacks WHERE request_id = ? AND route_json IS NOT NULL").run(requestId);
+}
 function purgeStaleAsks(now = Date.now()) {
   for (const [id, entry] of pendingAsks) {
     if (now - entry.createdAt > MAX_ASK_AGE_MS)
@@ -15651,19 +16524,36 @@ function cancelAskCallbacksForTopic(topicId) {
   }
   return cancelled;
 }
-async function failInterruptedRemoteAskCallbacks() {
-  const rows = db.query(`SELECT target_query_id, request_id, node_name, node_cell_id, topic_id, user_id
+function durableRoute(row) {
+  if (row.route_json) {
+    try {
+      return parseHubRemoteReplyRoute(JSON.parse(row.route_json));
+    } catch {
+      return null;
+    }
+  }
+  return {
+    nodeName: row.node_name,
+    nodeCellId: row.node_cell_id,
+    topicId: row.topic_id,
+    userId: row.user_id,
+    requestId: row.request_id
+  };
+}
+async function failInterruptedRemoteAskCallbacks(options = {}) {
+  const rows = db.query(`SELECT target_query_id, request_id, node_name, node_cell_id, topic_id, user_id, route_json
        FROM remote_ask_callbacks
        ORDER BY created_at ASC`).all();
   let failed = 0;
   for (const row of rows) {
-    const delivered = await deliverPeerReply({
-      nodeName: row.node_name,
-      nodeCellId: row.node_cell_id,
-      topicId: row.topic_id,
-      userId: row.user_id,
-      requestId: row.request_id
-    }, "peer", "The remote worker restarted before this ask completed. Please retry the request.", "error");
+    const route = durableRoute(row);
+    if (!route) {
+      db.query("DELETE FROM remote_ask_callbacks WHERE target_query_id = ?").run(row.target_query_id);
+      continue;
+    }
+    if (options.routes === "hub" && !isHubRemoteReplyRoute(route))
+      continue;
+    const delivered = await deliverPeerReply(route, "peer", "The remote worker restarted before this ask completed. Please retry the request.", "error");
     if (!delivered)
       continue;
     db.query("DELETE FROM remote_ask_callbacks WHERE target_query_id = ?").run(row.target_query_id);
@@ -15674,6 +16564,7 @@ async function failInterruptedRemoteAskCallbacks() {
 var pendingAsks, MAX_ASK_AGE_MS;
 var init_ask_callbacks = __esm(async () => {
   await __promiseAll([
+    init_peer_forward(),
     init_forum_db(),
     init_session_asks(),
     init_storage_host()
@@ -15690,6 +16581,9 @@ var init_ask_callbacks = __esm(async () => {
       created_at INTEGER NOT NULL
     )
   `);
+    try {
+      database.exec("ALTER TABLE remote_ask_callbacks ADD COLUMN route_json TEXT");
+    } catch {}
   });
   pendingAsks = new Map;
   MAX_ASK_AGE_MS = PENDING_ASK_TTL_MS;
@@ -17782,6 +18676,7 @@ __export(exports_turn_runner, {
   startDurableTurnRequestWorker: () => startDurableTurnRequestWorker,
   startAiTurn: () => startAiTurn,
   selectableModel: () => selectableModel,
+  sameTurnActor: () => sameTurnActor,
   safeAttachmentFilename: () => safeAttachmentFilename,
   resolveWorkerModel: () => resolveWorkerModel,
   resolveWorkerDefaultModel: () => resolveWorkerDefaultModel,
@@ -18030,20 +18925,27 @@ async function markPendingAskFile(pending, state) {
     logger.warn({ err: err2, pendingAsk: pending.pendingAsk, state }, "sessions: pending ask mark failed");
   }
 }
-async function deliverAskCallbackToCaller(pending, sourceLabel, body, kind) {
+async function deliverAskCallbackToCaller(pending, sourceLabel, body, kind, options = {}) {
   if (pending.remoteReply) {
-    const { deliverPeerReply: deliverPeerReply2 } = await Promise.resolve().then(() => exports_peer_forward);
-    return deliverPeerReply2(pending.remoteReply, sourceLabel, body, kind);
+    const { deliverPeerReply: deliverPeerReply2 } = await init_peer_forward().then(() => exports_peer_forward);
+    const delivered = await deliverPeerReply2(pending.remoteReply, sourceLabel, body, kind);
+    if (delivered)
+      options.onRecorded?.();
+    return delivered;
   }
   const callerTopic = getTopic(pending.callerTopicId);
   const heading = kind === "error" ? `Error from ${sourceLabel}` : `Reply from ${sourceLabel}`;
   const prompt = `[${heading}]
 
 ${body}`;
+  const record = (agentType) => db.transaction(() => {
+    appendAskReplyMessage(pending.callerTopicId, prompt, sourceLabel, body, kind, agentType ?? undefined, pending.callerThreadRootId);
+    options.onRecorded?.();
+  })();
   await markPendingAskFile(pending, "reply_ready");
   if (!callerTopic?.agent) {
     try {
-      appendAskReplyMessage(pending.callerTopicId, prompt, sourceLabel, body, kind, undefined, pending.callerThreadRootId);
+      record(undefined);
       await clearPendingAskFile(pending);
       return true;
     } catch (err2) {
@@ -18074,16 +18976,25 @@ ${body}`;
     }
   });
   if (queued) {
-    appendAskReplyMessage(pending.callerTopicId, prompt, sourceLabel, body, kind, callerTopic.agent, pending.callerThreadRootId);
+    try {
+      record(callerTopic.agent);
+    } catch (err2) {
+      interSessionQueue.remove(pending.callerTopicId, pending.requestId);
+      logger.warn({ err: err2, requestId: pending.requestId, callerTopicId: pending.callerTopicId }, "sessions: ask callback record failed after enqueue; queue entry withdrawn");
+      return false;
+    }
     await markPendingAskFile(pending, "queued_for_caller");
     return true;
   }
   if (interSessionQueue.hasRequest(pending.callerTopicId, pending.requestId)) {
+    db.transaction(() => {
+      options.onRecorded?.();
+    })();
     await markPendingAskFile(pending, "queued_for_caller");
     return true;
   }
   logger.warn({ requestId: pending.requestId, callerTopicId: pending.callerTopicId, source: sourceLabel }, "sessions: ask callback could not enter caller batch; appending direct fallback");
-  appendAskReplyMessage(pending.callerTopicId, prompt, sourceLabel, body, kind, callerTopic.agent, pending.callerThreadRootId);
+  record(callerTopic.agent);
   await clearPendingAskFile(pending);
   return true;
 }
@@ -18153,6 +19064,15 @@ function resolveTurnHostMcpServers(topic, sessionType) {
     return;
   return getTopicHostMcpGrant(topic.id) ?? undefined;
 }
+function sameTurnActor(runningActorUserId, incomingActorUserId) {
+  return (runningActorUserId ?? null) === (incomingActorUserId ?? null);
+}
+function remoteTurnHasSameActor(topicId, incomingActorUserId, ownRequestIds) {
+  const active = getActiveRuntimeUserTurnRequest(topicId);
+  if (!active || ownRequestIds.includes(active.requestId))
+    return false;
+  return sameTurnActor(active.execution?.actorUserId, incomingActorUserId);
+}
 function mergeSupersedingUserTurn(running, incoming) {
   const userMessages = [
     ...running.userMessages ?? [legacyUserTurnEnvelope(running.prompt, running.attachments)],
@@ -18173,6 +19093,8 @@ function serializableUserTurnExecution(params) {
     runtimeEpoch: params._runtimeEpoch ?? getRuntimeTopicEpoch(params.topic.id),
     sourceRequestId: params.requestId,
     actorUserId: params.actorUserId,
+    actorTopicScope: params.actorTopicScope,
+    remoteSession: params.remoteSession,
     agentOverride: params.agentOverride,
     modelOverride: params.modelOverride,
     effortOverride: params.effortOverride,
@@ -18258,6 +19180,8 @@ async function drainOneDurableUserTurn() {
       topic,
       userId: request.userId,
       actorUserId: execution?.actorUserId,
+      actorTopicScope: actorTopicScopeFrom(execution?.actorTopicScope),
+      remoteSession: remoteSessionGrantFrom(execution?.remoteSession),
       vaultUserId: execution?.vaultUserId,
       prompt: request.prompt,
       _userMessages: request.userMessages,
@@ -18471,7 +19395,9 @@ function startAiTurn(params) {
     return null;
   }
   if (decision.action === "remote-abort-wait") {
-    requestRuntimeTurnAbort(topicId, "internal");
+    if (remoteTurnHasSameActor(topicId, params.actorUserId, durableRequestIds)) {
+      requestRuntimeTurnAbort(topicId, "internal");
+    }
     const queuedQueryId = waitToStartRemoteUserTurn({
       ...params,
       topic,
@@ -18489,6 +19415,23 @@ function startAiTurn(params) {
   }
   if (decision.action === "abort-replace") {
     const running = decision.running;
+    if (isUserOrigin(running.origin) && !sameTurnActor(running.actorUserId, params.actorUserId)) {
+      const queuedQueryId2 = waitToStartRemoteUserTurn({
+        ...params,
+        topic,
+        prompt,
+        attachments: attachments2,
+        sessionId,
+        _userMessages: userMessages,
+        _conversationPrompts: conversationPrompts,
+        _loggedUserMessageCount: loggedUserMessageCount,
+        _durableRequestIds: durableRequestIds,
+        _runtimeEpoch: runtimeEpoch
+      }, queryId);
+      announceQueuedUserTurn({ ...params, topic }, queuedQueryId2);
+      logger.info({ topicId, queryId: queuedQueryId2, runningQueryId: running.queryId }, "ai: user turn from another actor queued behind the running turn");
+      return queuedQueryId2;
+    }
     let omitRequestIds;
     if (isUserOrigin(running.origin)) {
       if (running.providerTurnContentObserved && running.sessionId) {
@@ -18548,6 +19491,7 @@ function startAiTurn(params) {
     origin,
     prompt,
     userMessages,
+    ...isUserOrigin(origin) && params.actorUserId !== undefined ? { actorUserId: params.actorUserId } : {},
     durableRequestIds,
     attachments: attachments2,
     sessionId,
@@ -18593,7 +19537,9 @@ function startAiTurn(params) {
       return rejectIsolatedTurnBeforeDispatch("failed to claim isolated turn slot");
     }
     if (isUserOrigin(origin)) {
-      requestRuntimeTurnAbort(topicId, "internal");
+      if (remoteTurnHasSameActor(topicId, params.actorUserId, durableRequestIds)) {
+        requestRuntimeTurnAbort(topicId, "internal");
+      }
       const queuedQueryId = waitToStartRemoteUserTurn({
         ...params,
         topic,
@@ -18853,6 +19799,8 @@ function startAiTurn(params) {
         sessionId,
         userId,
         actorUserId: params.actorUserId,
+        actorTopicScope: params.actorTopicScope,
+        remoteSession: params.remoteSession,
         vaultUserId,
         session: sessionName,
         sessionType: sessionType ?? (isManager ? "manager" : "forum"),
@@ -18917,12 +19865,10 @@ function startAiTurn(params) {
           error: "Provider session expired and conversation history could not be rebuilt; the existing session was preserved for retry."
         };
       } else {
-        if (!silent)
-          WsHub.get().broadcastAborted(topicId, queryId, "stopped");
         const retrySessionId = retry.sessionId;
         logger.info({
           topicId,
-          prevQueryId: queryId,
+          queryId,
           agent: agentKind,
           retrySessionId: retrySessionId ? retrySessionId.slice(0, 8) : null
         }, "ai: retrying query after session expiry");
@@ -18933,6 +19879,9 @@ function startAiTurn(params) {
         startAiTurn({
           topic,
           userId,
+          actorUserId: params.actorUserId,
+          actorTopicScope: params.actorTopicScope,
+          remoteSession: params.remoteSession,
           vaultUserId,
           prompt,
           _userMessages: userMessages,
@@ -18967,7 +19916,8 @@ function startAiTurn(params) {
           peerBridge,
           askReplySources,
           _runtimeEpoch: runtimeEpoch,
-          _sessionRetried: true
+          _sessionRetried: true,
+          _queryId: queryId
         });
         return;
       }
@@ -18976,12 +19926,13 @@ function startAiTurn(params) {
       if (emptyResponseRetried) {
         outcome = { kind: "provider-error", error: outcome.error };
       } else {
-        if (!silent)
-          WsHub.get().broadcastAborted(topicId, queryId, "stopped");
-        logger.info({ topicId, prevQueryId: queryId, agent: agentKind }, "ai: retrying query after empty provider response");
+        logger.info({ topicId, queryId, agent: agentKind }, "ai: retrying query after empty provider response");
         startAiTurn({
           topic,
           userId,
+          actorUserId: params.actorUserId,
+          actorTopicScope: params.actorTopicScope,
+          remoteSession: params.remoteSession,
           vaultUserId,
           prompt,
           _userMessages: userMessages,
@@ -19017,7 +19968,8 @@ function startAiTurn(params) {
           askReplySources,
           _runtimeEpoch: runtimeEpoch,
           _sessionRetried: sessionRetried,
-          _emptyResponseRetried: true
+          _emptyResponseRetried: true,
+          _queryId: queryId
         });
         return;
       }
@@ -19189,8 +20141,10 @@ var init_turn_runner = __esm(async () => {
   init_builders();
   init_state();
   init_types2();
+  init_actor_topic_scope();
   init_attachments();
   init_errors();
+  init_remote_session_grant();
   init_user_turn_envelope();
   init_wiki_summary_names();
   init_user_turn_envelope();
@@ -19216,6 +20170,7 @@ var init_turn_runner = __esm(async () => {
     init_app_settings(),
     init_browser_profiles(),
     init_conversations(),
+    init_forum_db(),
     init_runtime_leases(),
     init_runtime_topic_state(),
     init_runtime_turn_requests(),
@@ -19672,6 +20627,18 @@ ${card.task}${reportInstruction}`;
     ].join(`
 `));
   }
+  function assertedActorScope(ctx) {
+    if (ctx.surface !== "otium" || !ctx.actorTopicScope)
+      return null;
+    const input = {
+      surface: ctx.surface,
+      currentTopicId: ctx.topicId,
+      actorTopicScope: ctx.actorTopicScope
+    };
+    const visible = actorReachableTopicIds(input);
+    const owned = actorOwnedTopicIds(input);
+    return visible && owned ? { visible, owned } : null;
+  }
   function ownedSubagentTree(ctx) {
     const parent = host.storage.getTopic(ctx.topicId);
     if (!parent)
@@ -19685,37 +20652,46 @@ ${card.task}${reportInstruction}`;
         error: "Error: subagent management is only available in agent rooms."
       };
     }
+    const actorScope = assertedActorScope(ctx);
     const rootOwnerId = parent.participants.find((participant) => participant.role === "owner")?.userId;
+    const descendants = rootOwnerId ? (() => {
+      const topics = host.storage.listTopics();
+      const byParent = new Map;
+      for (const topic of topics) {
+        if (!topic.parentTopicId || !topic.isSubagent)
+          continue;
+        const siblings = byParent.get(topic.parentTopicId) ?? [];
+        siblings.push(topic);
+        byParent.set(topic.parentTopicId, siblings);
+      }
+      for (const siblings of byParent.values()) {
+        siblings.sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.id.localeCompare(b.id));
+      }
+      const descendants2 = [];
+      const visited = new Set([ctx.topicId]);
+      const visit = (parentId) => {
+        for (const child of byParent.get(parentId) ?? []) {
+          if (visited.has(child.id))
+            continue;
+          visited.add(child.id);
+          if (!child.participants.some((participant) => participant.userId === rootOwnerId && participant.role === "owner")) {
+            continue;
+          }
+          descendants2.push(child);
+          visit(child.id);
+        }
+      };
+      visit(ctx.topicId);
+      return descendants2;
+    })() : [];
+    const children = actorScope ? descendants.filter((child) => actorScope.visible.has(child.id)) : descendants;
     return {
       ok: true,
       parent,
-      children: rootOwnerId ? (() => {
-        const topics = host.storage.listTopics();
-        const byParent = new Map;
-        for (const topic of topics) {
-          if (!topic.parentTopicId || !topic.isSubagent)
-            continue;
-          const siblings = byParent.get(topic.parentTopicId) ?? [];
-          siblings.push(topic);
-          byParent.set(topic.parentTopicId, siblings);
-        }
-        const descendants = [];
-        const visited = new Set([ctx.topicId]);
-        const visit = (parentId) => {
-          for (const child of byParent.get(parentId) ?? []) {
-            if (visited.has(child.id))
-              continue;
-            visited.add(child.id);
-            if (!child.participants.some((participant) => participant.userId === rootOwnerId && participant.role === "owner")) {
-              continue;
-            }
-            descendants.push(child);
-            visit(child.id);
-          }
-        };
-        visit(ctx.topicId);
-        return descendants;
-      })() : []
+      children,
+      owned: (childId) => children.some((child) => child.id === childId) && (!actorScope || actorScope.owned.has(childId)),
+      visibleTarget: (topicId) => topicId === ctx.topicId || children.some((child) => child.id === topicId),
+      visibleTellTargets: (targetIds) => actorScope ? targetIds.filter((targetId) => targetId === ctx.topicId || actorScope.visible.has(targetId) || children.some((child) => child.id === targetId)) : [...targetIds]
     };
   }
   function subagentStatus(parentTopicId, childTopicId) {
@@ -19779,7 +20755,7 @@ ${card.task}${reportInstruction}`;
             status: subagentStatus(child.parentTopicId ?? ctx.topicId, child.id),
             agent: child.agent ?? null,
             model: child.defaultModel ?? null,
-            tell_target_topic_ids: host.sessionCommunication.listTellTargetIds(child.id),
+            tell_target_topic_ids: result.visibleTellTargets(host.sessionCommunication.listTellTargetIds(child.id)),
             created_at: child.createdAt
           }));
           return textResult(JSON.stringify({ subagents: children }, null, 2));
@@ -19796,7 +20772,7 @@ ${card.task}${reportInstruction}`;
           if (!result.ok)
             return errorResult(result.error);
           const topicId = String(input.topic_id ?? "").trim();
-          if (!result.children.some((child) => child.id === topicId)) {
+          if (!result.owned(topicId)) {
             return errorResult("Error: topic is not a descendant subagent managed by this room.");
           }
           const cardMessage = findSubagentCardMessage(topicId);
@@ -19816,7 +20792,7 @@ ${card.task}${reportInstruction}`;
           if (!result.ok)
             return errorResult(result.error);
           const topicId = typeof input.topic_id === "string" ? input.topic_id.trim() : "";
-          const child = result.children.find((candidate) => candidate.id === topicId);
+          const child = result.owned(topicId) ? result.children.find((candidate) => candidate.id === topicId) : undefined;
           if (!child) {
             return errorResult("Error: no owned descendant subagent with that topic_id exists under this room.");
           }
@@ -19842,11 +20818,10 @@ ${card.task}${reportInstruction}`;
             return errorResult(result.error);
           const sourceId = String(input.subagent_topic_id ?? "").trim();
           const targetId = String(input.target_topic_id ?? "").trim();
-          const descendantIds = new Set(result.children.map((child) => child.id));
-          if (!descendantIds.has(sourceId)) {
+          if (!result.owned(sourceId)) {
             return errorResult("Error: source is not a descendant subagent managed by this room.");
           }
-          if (targetId !== ctx.topicId && !descendantIds.has(targetId)) {
+          if (!result.visibleTarget(targetId)) {
             return errorResult("Error: target is outside this room's managed subagent tree.");
           }
           if (host.storage.getTopic(sourceId)?.parentTopicId === targetId) {
@@ -19869,11 +20844,10 @@ ${card.task}${reportInstruction}`;
             return errorResult(result.error);
           const sourceId = String(input.subagent_topic_id ?? "").trim();
           const targetId = String(input.target_topic_id ?? "").trim();
-          const descendantIds = new Set(result.children.map((child) => child.id));
-          if (!descendantIds.has(sourceId)) {
+          if (!result.owned(sourceId)) {
             return errorResult("Error: source is not a descendant subagent managed by this room.");
           }
-          if (targetId !== ctx.topicId && !descendantIds.has(targetId)) {
+          if (!result.visibleTarget(targetId)) {
             return errorResult("Error: target is outside this room's managed subagent tree.");
           }
           const removed = host.sessionCommunication.revokeTellTarget(sourceId, targetId);
@@ -19955,6 +20929,7 @@ var init_spawn_subagent = __esm(async () => {
   init_types();
   await __promiseAll([
     init_bus(),
+    init_actor_topic_reach(),
     init_api_messages(),
     init_api_topics(),
     init_runtime_leases(),
@@ -20097,6 +21072,7 @@ var init_spawn_subagent = __esm(async () => {
 
 // ../../packages/core/src/agents/public-helpers.ts
 init_codex_tree_kill();
+init_explicit_agent_switch();
 await __promiseAll([
   init_archiver(),
   init_auth_check(),
@@ -20464,6 +21440,7 @@ function switchApiTopicAgent(opts) {
 }
 
 // ../../packages/core/src/agents/self-config-core.ts
+init_explicit_agent_switch();
 init_model_catalog();
 init_config();
 init_config_helpers();
@@ -20505,56 +21482,6 @@ function err(text2) {
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function escapeRegExp2(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function agentAliases(agent) {
-  switch (agent) {
-    case "codex":
-      return [
-        "codex",
-        "\uCF54\uB371\uC2A4",
-        "gpt-6-luna",
-        "gpt-6-sol",
-        "gpt-5.6-luna",
-        "gpt-5.6-terra",
-        "gpt-5.6-sol",
-        "gpt-6-astra"
-      ];
-    case "claude":
-      return ["claude", "\uD074\uB85C\uB4DC", "sonnet", "opus", "fable"];
-    case "maestro":
-      return [
-        "maestro",
-        "\uB9C8\uC5D0\uC2A4\uD2B8\uB85C",
-        "\uBA54\uC2A4\uD2B8\uB85C",
-        "deepseek",
-        "deepseek-pro",
-        "kimi",
-        "kimi-pro",
-        "kimi-k3",
-        "kimi-code",
-        "kimi-k2.7-code",
-        "\uB525\uC2DC\uD06C",
-        "\uD0A4\uBBF8"
-      ];
-  }
-}
-function hasExplicitAgentSwitchRequest(prompt, agent) {
-  if (!prompt?.trim())
-    return false;
-  const text2 = prompt.toLowerCase().replace(/\s+/g, " ").trim();
-  const target = `(?:${agentAliases(agent).map(escapeRegExp2).join("|")})`;
-  const switchVerb = "(?:\uBC14\uAFD4|\uBC14\uAFD4\uC918|\uBCC0\uACBD|\uBCC0\uACBD\uD574|\uC804\uD658|\uC804\uD658\uD574|\uC124\uC815|\uC124\uC815\uD574|\uC368\uC918|\uC0AC\uC6A9|\uAC00|switch|change|set|use)";
-  const switchSubject = "(?:agent|runtime|model|\uC5D0\uC774\uC804\uD2B8|\uB7F0\uD0C0\uC784|\uBAA8\uB378)";
-  return [
-    new RegExp(`^/(?:agent|runtime)\\s+${target}(?:\\s|$)`, "iu"),
-    new RegExp(`${target}\\s*(?:\uB85C|\uC73C\uB85C)\\s*.{0,16}${switchVerb}`, "iu"),
-    new RegExp(`${switchSubject}.{0,24}${target}.{0,24}${switchVerb}`, "iu"),
-    new RegExp(`${switchVerb}.{0,24}${switchSubject}.{0,24}${target}`, "iu"),
-    new RegExp(`(?:switch|change|set|use).{0,24}${target}`, "iu")
-  ].some((pattern) => pattern.test(text2));
-}
 function createSelfConfigCore(host, productOverrides = {}) {
   const product = Object.freeze({
     ...DEFAULT_SELF_CONFIG_PRODUCT,
@@ -20642,7 +21569,8 @@ function createSelfConfigCore(host, productOverrides = {}) {
     if (config.agentLocked) {
       return err("Agent for this topic is locked by the user. Cannot override.");
     }
-    if (!hasExplicitAgentSwitchRequest(ctx.currentUserPrompt, agent)) {
+    const explicitlyRequested = ctx.explicitAgentSwitchTargets ? ctx.explicitAgentSwitchTargets.includes(agent) : hasExplicitAgentSwitchRequest(ctx.currentUserPrompt, agent);
+    if (!explicitlyRequested) {
       return err(`Agent switch to '${agent}' requires an explicit request in the current user message.`);
     }
     const switched = host.runtime.switchAgent({
@@ -20800,7 +21728,10 @@ function createSelfConfigCore(host, productOverrides = {}) {
       return topic;
     let derived;
     try {
-      derived = await host.derivedTopics.create(topic.id, ctx.userId, copyHistory, { name });
+      derived = await host.derivedTopics.create(topic.id, ctx.userId, copyHistory, {
+        name,
+        ...ctx.actorUserId && ctx.actorUserId !== ctx.userId ? { derivedByUserId: ctx.actorUserId } : {}
+      });
     } catch (error) {
       if (host.derivedTopics.isTitleConflict(error)) {
         return err(`${errorMessage(error)} \u2014 pick a different name.`);
@@ -21165,9 +22096,12 @@ export {
   normalizeAskUserChoices,
   killOwnedCodexTreesForShutdown,
   killCodexTrees,
+  isExplicitAgentSwitchTargets,
+  hasExplicitAgentSwitchRequest,
   formatToolUse,
   forkAgentSession,
   findNewCodexChildren,
+  explicitAgentSwitchTargets,
   defaultAskUserDurabilityHost,
   createTopicLogMaintenance,
   createSubagentLifecycle,
@@ -21195,4 +22129,4 @@ export {
   DEFAULT_SELF_CONFIG_PRODUCT
 };
 
-//# debugId=BFEE1EFD11C7696664756E2164756E21
+//# debugId=457F53A21F9DED1164756E2164756E21