Allow trusted cross-session agent messaging without per-message confirmation (agent-to-agent messages as a distinct, lower-authority channel)

Context

In the desktop app, sessions can message each other via the session-management send_message tool. Every message requires per-message user confirmation, and new sessions can only be created by the user clicking a spawn_task chip. Together these make autonomous multi-session orchestration — an orchestrator thread that spins up worker threads, assigns tasks, requests code reviews, redirects work — effectively impossible.

For comparison, the Codex desktop app lets an agent in one thread independently start any number of new threads with fresh context, and threads can message each other freely. Messages from other threads are wrapped so agents can distinguish agent-mail from the human user. This enables genuinely useful workflows (orchestrator + workers, cross-thread review loops) that Claude Code's within-session subagents don't fully replace, because subagents aren't first-class sidebar threads the user can inspect and steer independently.

The architectural issue

The apparent rationale for the confirmation gate is injection containment: inter-session messages land in the target session as user-shaped turns (labeled "From {session title}"), so unsupervised messaging would let content from one session acquire near-user authority in every other session, and cross-session messaging becomes a lateral-movement channel between sessions with different permission profiles.

But "messages from other agents occupy the user-turn slot" is an architectural choice, not a fact of nature. If inter-session messages were a first-class message channel with explicitly lower authority than user turns — treated as coordination/data rather than instructions, the way tool results are — the injection-escalation argument would largely dissolve, and the per-message confirmation could be safely relaxed.

Requested

1. A distinct message class for agent-to-agent/session-to-session messages, with authority clearly below user turns (not just a "From {session}" label on a user-shaped turn).
2. Standing grants for cross-session messaging: e.g. "these two sessions may talk freely for this task," a per-session toggle, or trusted session groups — instead of per-message confirmation only.
3. (Related) A way for an agent to start new independent sessions without a manual chip click, so orchestrator-style workflows are possible end to end.

Per-message confirmation is a reasonable default; the limitation is that there's no way to relax it, which rules out a class of orchestration workflows that other harnesses support.