Add safe daemon-backed agent messaging

[sethkarten]

Summary

• Add daemon-backed direct agent-to-agent messaging for active Prime Agent sessions.
• Preserve the local active-session message bus from the original draft and move shared envelope/safety logic into core.
• Add prime-agent daemon send [--from <session>] [--steer|--follow-up] <target> <message> for user/operator sends.
• Add prime-agent daemon agent-messages status|pause|resume|clear <session> as an explicit safety switch.
• Add the bundled default Python skill agent-message, importable as agent_message, with:
  • await agent_message.list_agents()
  • await agent_message.send(target, message, mode="auto")
• Derive model-originated sender identity from the daemon-scoped current session; the Python skill cannot pass or spoof from.
• Keep v1 local and active-session-only: no broadcast, no offline inbox, no remote/SSH routing.

Safety guardrails

• Broadcast-style targets (*, all, broadcast) are rejected.
• Message payloads are capped at 16,384 characters.
• Target sessions are capped at 20 pending queued messages before accepting agent-message delivery.
• Sender rate limiting uses a daemon-side token bucket: burst 3, refills 1 token per second.
• Agent messages are tagged with source: agent_message in both receipt and delivered prompt text.
• agent-messages pause blocks further sends until resumed.
• agent-messages clear <session> clears one explicitly named session queue and resets that session's rate bucket.

Validation

• Focused messaging suite from packages/coding-agent:
  • npx tsx ../../node_modules/vitest/dist/cli.js --run test/agent-session-bus.test.ts test/kernel-agent-message-skill.test.ts test/builtin-skills.test.ts test/daemon-command.test.ts test/daemon-session-id.test.ts test/agent-connection-daemon.test.ts
  • 6 files passed, 53 tests passed.
• Typecheck from packages/coding-agent:
  • npx tsgo --noEmit --pretty false
• Repo check from root:
  • npm run check
• Full coding-agent Vitest from packages/coding-agent after building workspace dist for extension dynamic imports:
  • npx tsx ../../node_modules/vitest/dist/cli.js --run
  • 165 files passed, 1656 tests passed, 6 files skipped.
• Build needed for full extension tests in this worktree:
  • npm run build
  • Reverted unrelated generated model catalog diff afterward.
• Pre-commit npm run check passed on commit 53d61ed7.

Isolated live smoke

• Used only a temporary daemon socket, temporary PI_CODING_AGENT_DIR, temporary PI_SESSION_DIR, and temporary cwd.
• Created two disposable sessions: alpha and beta.
• Sent exactly one message alpha -> beta through daemon send --from.
• Verified receipt had source: agent_message, from.activeSessionId == alpha, and target.activeSessionId == beta.
• Verified beta transcript contained Agent-to-agent message received. and the message payload.
• Waited 2 seconds and verified beta message count did not grow (1 -> 1), so no loop/storm occurred.
• Killed both disposable sessions, shut down the temp daemon, and removed the temp directory.

Known gaps

• Active sessions only; no offline inbox.
• Text-only payloads.
• No rich TUI slash command yet.
• No remote/SSH gateway protocol yet.

[sethkarten]

Superseded by #207, which combines safe daemon-backed agent messaging with read-only agent observation into one user orchestrator PR.

[sethkarten]

Closing in favor of #207, which combines this daemon-backed agent messaging work with read-only observation and orchestration heartbeat support.