feat: add cross-session messaging - #3778

Thanks for the substantial work here. I reviewed the Runtime Host protocol, model tools, Desktop/TUI flows, transcript projection, tests, and the downstream WorkHub integration boundary.

My recommendation is Request changes because of the two upstream P1 correctness issues below. The WorkHub-specific P1 items are integration blockers for us, but are not necessarily blockers for this upstream PR.

P1 — Must fix before merge

[P1] Sender receipts are not actually durable

In packages/runtime-host/src/server/session-mailbox-coordinator.ts:213-230, the target delivery completes before the sender receipt is persisted. Any failure while reading or appending the receipt is silently swallowed.

This leaves a crash/storage-failure window where the target received the message but the sender permanently lacks the promised durable receipt. The Desktop optimistic projection does not repair persisted state after restart.

Please make receipt persistence recoverable and idempotent—for example, persist an outbox/delivery record before submission and reconcile it, or retain sufficient durable state to repair the sender receipt after delivery.

[P1] Mailbox provenance can be forged with ordinary user text

packages/ui/src/materialize.ts:1087 projects any user message matching the XML-like envelope as an incoming mailbox card. It does not require Host-authored origin or typed mailbox metadata.

An ordinary user message can therefore reproduce the envelope and appear to come from another Session. Strict parsing validates syntax, not provenance.

Please persist a trusted mailbox marker/metadata and require it when projecting mailbox UI. The model-facing envelope can remain textual, but the UI should not infer trusted sender identity from text alone.

P1 — WorkHub integration blockers

These items do not necessarily need to expand the scope of this PR, but WorkHub cannot consume the feature unchanged.

[P1][WorkHub] The internal orchestration Session is exposed as a mailbox participant

isMailboxRoot excludes only subagents and side conversations. WorkHub’s internal Unified Discussion Session would remain a valid source/target and receive the mailbox model tools.

That creates a path for the model to communicate directly with Work Sessions instead of going through the Work Orchestrator.

WorkHub must exclude its internal Session as both source and target and suppress mailbox tools in that Session.

[P1][WorkHub] Mailbox reachability is narrower than WorkHub Workspace scope

sharesWorkspace currently means equal projectId, falling back to equal cwd. WorkHub’s Workspace can contain multiple Projects and identifies targets using a composite WorkRef.

Therefore this transport cannot implement WorkHub’s cross-Project routing directly.

If same-Project messaging is the intended contract of this PR, please describe it consistently as such. WorkHub will retain its own Workspace resolution and cross-Project transport.

P2 — Should fix in this PR

[P2] The TUI /send picker is not searchable

The PR describes an “immediately searchable picker,” but /send calls the generic showSelectPicker at packages/cli/src/pi-tui-runner.ts:3309. That helper provides only arrow/Enter/Esc navigation.

Please add query input/filtering and cover it with a TUI interaction test.

[P2] Mailbox behavior should be extracted from AppShell

Mailbox state, effects, target loading, sending, optimistic receipts, notice projection, and overlay rendering are spread across apps/desktop/src/renderer/app-shell.tsx.

This conflicts with the renderer convention that each app-shell-* module owns one narrow concern. Please extract a mailbox action/host module and consolidate the duplicated target-loading flows.

[P2] The new CSS violates the design token contract

• chat-message.css:112-114 combines an invented border, surface fill, and --shadow-low on the same boundary.
• chat-message.css:130 hand-rolls a success wash instead of using --success-wash.
• composer.css:497 describes card geometry but uses the control-radius tier.

Please use the documented semantic surface, border, elevation, status-wash, and radius tiers.

[P2] UI evidence and interaction coverage are missing

CONTRIBUTING.md requires before/after screenshots or a recording for UI changes.

The changed tests cover Core, Runtime Host, Runtime tools, and UI materialization, but not the actual Desktop/TUI workflows. Please add visual evidence and focused tests for picker search, pending composer state, cancellation, delivery failure, and receipt recovery.

[P2][WorkHub] /rename can leave downstream routing metadata stale

WorkHub currently caches candidate metadata using message activity. Renaming a Session does not necessarily advance that activity marker, so routing UI may retain the old name.

WorkHub needs rename-driven cache invalidation or a metadata revision signal.

P3 — Follow-up cleanup

• Import SESSION_MAILBOX_TARGET_MAX_ITEMS instead of repeating literal 64.
• Remove or wire the currently unused delivered and queued composer-notice states.
• Longer term, store typed mailbox metadata beside the model-facing text instead of serializing and reparsing an ad-hoc envelope.

I did not find unrelated scope creep, and the Runtime Host remains the execution authority. After the upstream P1 issues are fixed, the feature should be usable by WorkHub as a lower-level same-Project messaging primitive, with the WorkHub-specific isolation and routing adaptations listed above.

Update on 64c2842123:

[P2] Follow-up batch drops mailbox origin leading to raw protocol render

startFollowupBatch only stores execution.origin when batch.sources.length===1. Multiple queued messages from the same mailbox source are aggregated into one UserMessage; origin is then lost for the aggregate. After restart/UI reconstruction the provenance is missing and the trusted parser falls back to raw <session_message> text instead of a card.

Fix: preserve per-source trusted provenance or define safe multi-envelope UI representation; do not render without origin and bypass authenticity boundary.

I reviewed this head and found blocking issues.

[P2] Mailbox outbox leaves terminal failures permanently pending

session-mailbox-coordinator.ts:201-215 persists outbox before admission; session_busy/host_draining/operation_unavailable return failure but outbox stays pending with only Host-startup recovery — same-Host retry never happens and delayed restart may deliver after user was told failed. Fix: make terminal failures terminal or define retry/wakeup contract.

[P2] SentNoteData missing correlationId in matching

receiptMatchesOutbox does not compare correlation, so reply with same messageId but different in_reply_to returns old success instead of conflict.

No P0/P1.

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.