@awebai/oats 0.29.2 → 0.29.4

package/docs/release-notes/v0.29.3.md

@@ -0,0 +1,53 @@
+# OATS 0.29.3
+
+## Changed
+
+- **There is no "personal team"; a workspace has its default team.** The
+  vocabulary follows the teams contract's amendment of 2026-09-26: a workspace
+  has its **default team** (the team for the workspace key in its owner's
+  namespace), and agents may join other teams. The model is unchanged:
+  - an instance is in the workspace's default team only, by default;
+  - joining an eligible team is an explicit act;
+  - `OATS_TEAMS` is `[]` for a soul with no label.
+
+  The kernel's docs, comments and the `unmapped-team-label` warning use the
+  new words. The warning now reads "… fall back to the workspace's default team
+  for it". The oats.framework skills (oats.core 2.1.1, oats.setup 2.1.2,
+  oats.framework 1.3.1) teach the same model. The kernel carries no wire name
+  with "personal", and there are no compatibility aliases.
+- **The messaging provider uses the same words** (oats.aweb 1.16.0, below).
+
+## oats.aweb 1.16.0 (catalog pin and bundled mirror)
+
+- **The catalog and this repo's workspace pin `oats.aweb` to `v1.16.0`, and
+  the bundled `capabilities/oats-aweb` is the tag's tree.** It renames the
+  provider's wire names to the default-team vocabulary:
+  - the teams operation's `personal` field becomes `defaultTeam`
+    (`{ team, source }`, where `source` is `setting` or `root`);
+  - `E_TEAM_PERSONAL` becomes `E_TEAM_DEFAULT`;
+  - the broker receive label `personal` becomes `default`;
+  - `settings.oats.aweb.roots.personal` is removed: `roots` keys are team ids
+    only, and the `personal-root-deferred` warning is gone.
+
+  There are no aliases: a reader of the old names must move to the new ones,
+  as the Desktop does in this release. A home spawned under 1.15 still resolves
+  its default team from its recorded team. Per-workspace default-team
+  enrollment is still deferred.
+
+## oats.framework 1.3.1 (catalog pin)
+
+- **The catalog and this repo's workspace pin `oats.framework` to
+  `oats-framework/v1.3.1`.** Its only change is the default-team vocabulary
+  above, in `oats.core` 2.1.1 and `oats.setup` 2.1.2. A deployment on
+  `oats.framework: v1.3.0` keeps working, and moving the pin to `v1.3.1` picks
+  up the new skill text.
+
+## Desktop
+
+- **"Default team" everywhere** (#252). The teams panel reads oats.aweb 1.16's
+  `defaultTeam` and says where the team comes from: the workspace or host
+  setting, or the messaging root's active team. The spawn dialog, the soul
+  inspector and the teams panel say "Default team" in place of "Personal".
+  A 1.15 `personal` document no longer decodes, so this Desktop needs the
+  oats.aweb 1.16.0 pin.
+- The Desktop still accepts OATS CLIs `>=0.25.8 <0.30.0`.

package/docs/release-notes/v0.29.4.md

@@ -0,0 +1,90 @@
+# OATS 0.29.4
+
+## Security
+
+- **An automation's `model` could inject spawn options** (#255). A trigger's
+  `spawn.model` or a schedule's `model` such as `--task-file=<path>` was passed
+  to the child `oats spawn` as a flag of its own. It could make any readable
+  file the instance's `TASK.md`, or add `--work` or `--allow-child-spawns`,
+  past the automation schema. Three changes close it:
+  - `model` must be a model id; a schedule's `agent` and `repo` may not start
+    with `-`;
+  - every value reaches the child as one `--flag=value` token;
+  - the CLI refuses an inline value that is itself an option (`--model=--yolo`
+    is `E_BAD_ARGS`).
+- **oats.okf 4.0.1: a crafted Git base could write files anywhere the user
+  can write** (okf 3.0.0 and 4.0.0). Every tree entry of a base's accepted
+  commit is now contained, and a bad entry refuses the whole base with
+  `E_PATH`. Upgrade the pin; details under oats.okf 4.0.1 below.
+
+## Fixed
+
+- **A member repository named `local`** collided with this host's own
+  triggers and schedules (`local/<id>`): their state, live counts and CLI
+  edits. Such a member is now `E_AUTOMATION_DUPLICATE`, and its automations
+  are not listed (#256).
+- **A workspace command's `cwd` may no longer leave the deployment**, through
+  `..` or a symlink (#256).
+- **A newer push supersedes a pending `synchronize`** for an older head of the
+  same pull request (#256).
+- **A workspace trigger's `owner` and `on.repo` must be on the same GitHub
+  host** (#256).
+- **Upgrading from 0.28 re-fired every open pull request.** Trigger state kept
+  under a local trigger's bare id (0.28) is now carried to `local/<id>`, so
+  nothing re-fires. Homes that 0.28 spawned still count toward the trigger's
+  concurrency (#256).
+- **A package soul's command could get another soul's `OATS_SOUL`.** A command
+  run from the deployment with `--soul <package>/<soul>` read the soul's copy
+  under the bare name's agent directory. It ran without `OATS_SOUL`, or with a
+  same-named member soul's copy. It now reads `agents/<package>--<soul>/`
+  (#256).
+
+## Changed
+
+- **`helperInjection` is marked deprecated in the capability manifest
+  schema** (#257). It has been ignored since 0.26 and is still accepted, so
+  old manifests validate. oats.core 2.1.2 and oats.setup 2.1.3 no longer
+  declare it; the catalog and this repo's workspace pin `oats.framework` to
+  `oats-framework/v1.3.2`, which ships them.
+- **`triggersMaxConcurrent`** in the host registry
+  (`~/.oats/schedules/registry.json`) caps trigger-spawned live instances
+  across the host's scopes (#256). It is absent by default, which means no
+  host cap: each trigger's own `concurrency.max` applies. It is separate from
+  the schedules' `maxConcurrent`: neither counts the other's instances.
+
+## oats.okf 4.0.1 (catalog pin and bundled mirror)
+
+The catalog and this repo's workspace pin `oats.okf` to `v4.0.1`. The three
+bundled capabilities (`oats.okf`, `oats.okf-harvest`, `oats.okf-maintenance`)
+are the tag's trees. The kernel floor stays `>=0.29.0`.
+
+- **Security: a crafted Git base could write files anywhere the user can
+  write.** This affects okf 3.0.0 and 4.0.0: upgrade.
+  - Validating a Git base's accepted commit copied every tree entry into a
+    scratch directory with no containment check. Git accepts literal `..`
+    entries.
+  - The first `oats okf bases`, or a spawn against a crafted accepted commit,
+    could create any file that did not yet exist, with attacker content.
+  - Every entry is now checked against the canonical path rules, and its
+    target must stay inside the scratch. All entries are checked before
+    anything is written, and the first bad entry refuses the whole base with
+    `E_PATH`. The staging materializer asserts the same.
+  - GitHub probably blocks such a push; local and self-hosted bases do not.
+- **Credentials are never shown to agents.** A repository URL with a user or
+  token in it is refused at binding: use a Git credential helper or an SSH
+  key. Every repository in `bases` output and in errors is redacted,
+  including Git's own failure text.
+- **Knowledge review trusts only the accepted base.**
+  `review-context --checkout` takes node ownership from the base's accepted
+  `okf-base.json`, never from the PR. It lists the nodes a PR claims but the
+  source does not own, and flags any change to `okf-base.json`.
+- **A merge is tied to the reviewed head**
+  (`gh pr merge --match-head-commit`). **`okf-needs-human` is a hard stop**
+  for every PR event, until a human removes the label.
+- **Turning harvest off takes effect at once.** `run-source` and `retire`
+  re-read the harvest switch, including the soul's. A soul or deployment that
+  turns harvest off after spawn stops capture at the next run. Retire then
+  takes no final capture; inputs already in custody stay.
+- **`OATS_SETTINGS_ORIGINS` is an extra signal:** a harvest value that comes
+  from the soul never switches harvest on. `soul.yaml` stays the authority for
+  the absolute opt-out.

package/docs/schedules.md

@@ -27,7 +27,11 @@ and no queue.
 - `<workspace>/.agents/schedules/state.json` — last attempted minute and
   last run per job (gitignored), plus one lock directory per running job.
 - `~/.oats/schedules/registry.json` — the host registry: which scopes the
-  host ticks, `maxConcurrent` (default 1) and the tick interval. One host
+  host ticks, `maxConcurrent` (default 1: running scheduled jobs), the tick
+  interval, and `triggersMaxConcurrent` (absent by default: no host cap; a
+  positive integer caps trigger-spawned live instances across the host's
+  scopes). The two caps are separate: a running scheduled job never holds a
+  trigger, and a trigger's instances never hold a schedule. One host
   lock serializes ticks, run-now, reconcile and remove; it is never reclaimed
   by another process: a lock whose owner is unreadable or gone is reported
   with the directory to remove, and the holder removes its own lock on exit
@@ -41,7 +45,11 @@ see [Captured definitions](#captured-definitions-removed-in-026).
 - **spawn** `{id, enabled, cron, tz, kind: "spawn", agent, agentsRoot?,
   repo?, backend?, purpose?, task, launchConfig?, harness?, model?, yolo?, wake?}` — every
   due minute launches one disposable instance of `agent` with the same
-  options `oats spawn` takes. `agentsRoot` names the exact agents root that
+  options `oats spawn` takes. `model` is a model id (a letter or digit, then
+  letters, digits and `. _ : / @ + - [ ]`, at most 128 characters, or
+  `@native-default`), and `agent` and `repo` never start with `-`: an
+  automation's values reach the child `oats spawn` as single `--flag=value`
+  tokens and can never be read as options of their own. `agentsRoot` names the exact agents root that
   holds the soul (it must lie inside the workspace and defaults to the
   workspace's own root); it is what tells same-named souls in different
   member repositories apart. `repo` is the work repository, as `--repo`.
@@ -144,8 +152,14 @@ logged in with the keyring or its config file under your HOME works there. A
   finds its own earlier review, for example).
 - **Concurrency.** `max` (default 1) bounds the live instances of the trigger,
   `perKey` (default 1) those of one PR; both are counted from the homes'
-  `instance.json.trigger` records, so a retired instance frees its slot. An
-  event over the bound stays pending (`held`).
+  `instance.json.trigger` records, so a retired instance frees its slot. The
+  host registry's `triggersMaxConcurrent`, when set, bounds every trigger's
+  live instances together. An event over a bound stays pending (`held`). A
+  newer push supersedes a pending `synchronize` for an older head of the same
+  PR, so only the newest head is reviewed.
+- **The owner acts on the repository's host.** A workspace trigger's `owner`
+  and `on.repo` must be on the same GitHub host (`E_TRIGGER_INVALID`, field
+  `owner`): the owner check and the poll ask gh on that one host.
 - **The spawn** is `oats spawn` (the same path as a scheduled spawn). `soul` is
   bare or qualified (`<package>/<soul>`). `purpose` (default
   `{trigger}-{number}`, must render to a slug) and `task` are templated from

package/docs/workspaces.md

@@ -59,8 +59,8 @@ members:                                   # repo refs, NO @revision (E_WORKSPAC
   - git:github.com/acme/tools              # a member that ALSO publishes a package (see below)
 
 packages:                                  # the ONLY versioned things
-  oats.framework: v1.3.0                   # bare version → resolves through the official catalog
-  oats.okf: v4.0.0
+  oats.framework: v1.3.2                   # bare version → resolves through the official catalog
+  oats.okf: v4.0.1
   acme.tools: git:github.com/acme/tools@v0.4.0   # outside the catalog → git:<repo>@<tag|OID>; still a package
 
 teams:                                     # labels, declared once so they cannot drift
@@ -399,7 +399,7 @@ keys, with `byTeam` stripped) ⊕ soul slot payload ⊕ `local.settings[cap]`
 **No `byTeam[<label>]` is merged into it, the primary's included** (teams
 amendment K): each label's `base ⊕ byTeam[label]` reaches the provider only as
 that label's entry in `OATS_TEAMS` (the preview's `teams`). So `settings.team`
-(and `OATS_TEAM_ID`) is the personal team if the host, the soul or the spawn
+(and `OATS_TEAM_ID`) is the workspace's default team if the host, the soul or the spawn
 set one; empty means the provider's own default. The provider's own `binding` contract
 (`normalize → bind → check`) runs over the merged payload exactly as before.
 Two teams, two messaging identities, one workspace:
@@ -420,7 +420,7 @@ one. A label under `byTeam` that is not declared in `teams:` is
 act.** `spawn --preview` shows the merged `settings.<cap>` and the `teams`, so
 the delivery is verifiable, and `instance.json` records both. With oats.aweb
 1.13.1 (which reads `team` from its settings and ignores `OATS_TEAMS`) the
-primary identity therefore mints into the personal team: the `.aw` root's
+primary identity therefore mints into the workspace's default team: the `.aw` root's
 active team, or the one the host set. What the payload does not change is
 **where the `.aw` root is found**: the hook still searches
 bounded candidates, first hit wins — the instance home, the Git repository

package/lib/automations.mjs

@@ -43,6 +43,10 @@ export const PLACEMENT_REASONS = Object.freeze(["host-unnamed", "assigned-elsewh
 export const KIND_NAMES = Object.freeze(["trigger", "schedule"]);
 const NEVER_SCANNED = new Set(["oats-package", ".git", "node_modules"]);
 export const AUTOMATION_ID_RE = /^[a-z0-9-]{1,40}$/;
+/** A model id an automation may pass to `oats spawn --model`: a provider/model id, never an option.
+ *  The first character is alphanumeric (or the spawn CLI's own `@native-default`), so no value can
+ *  be read as a flag (re-review B #1). `[` `]` admit a harness's context-size alias (`opus[1m]`). */
+export const MODEL_RE = /^(?:@native-default|[A-Za-z0-9][A-Za-z0-9._:/@+\[\]-]{0,127})$/;
 export const HOST_NAME_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const OWNER_RE = /^([a-z0-9-]+(?:\.[a-z0-9-]+)+)\/([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))$/;
 const HEADER_KEYS = ["kind", "schemaVersion", "id", "description", "runsOn", "owner", "enabled"];
@@ -123,6 +127,9 @@ export async function discoverAutomations(discovery, { remote, memberName, kinds
   const names = new Map();
   for (const m of (discovery?.members || []).filter((x) => x.confirmed && x.commit)) {
     const name = memberName(m.key);
+    // `local/<id>` names this host's own automations (and their state, live counts and CLI edits):
+    // a member labelled `local` would collide with them (re-review B #3).
+    if (name === LOCAL) { problems.push({ code: "E_AUTOMATION_DUPLICATE", repoKey: m.key, path: "", message: `member name ${JSON.stringify(name)} is reserved for this host's own triggers and schedules (local/<id>), so ${m.key}'s are not listed — rename the repository to list them` }); continue; }
     if (names.has(name)) { problems.push({ code: "E_AUTOMATION_DUPLICATE", repoKey: m.key, path: "", message: `member name ${JSON.stringify(name)} is also ${names.get(name)}'s: triggers and schedules are named <member>/<id>, so ${m.key}'s are not listed` }); continue; }
     names.set(name, m.key);
     let candidates;

package/lib/core.mjs

@@ -1485,17 +1485,17 @@ export function instanceSoulDir(home, meta = undefined) {
 /** The team facts a lifecycle hook receives (workspace model only, lead decision
  * c3-7): the team SCOPE is the deployment directory, the team ID is the messaging
  * slot's merged payload `team` (workspace base ⊕ soul ⊕ host ⊕ spawn; no byTeam entry
- * is merged since teams amendment K): the personal team if one is set; empty = the
+ * is merged since teams amendment K): the workspace's default team if one is set; empty = the
  * provider's default (for oats.aweb, the root's active team). The provider also gets
  * the soul's primary team LABEL and the workspace's name and canonical key, so it can
- * derive a per-person, per-workspace personal team; each label's mapped payload is in
+ * derive the workspace's default team; each label's mapped payload is in
  * OATS_TEAMS.
  * OATS_TEAM_NAME (the 0.25 `team:` block's name) is always empty, so an ambient
  * value never reaches a hook. Human decision 2026-09-24 (messaging default).
  *
  * Teams contract 2026-09-25 (decision 4): `resolved.teams` is the ELIGIBLE teams,
  * `[{ label, team, mapped, payload }]` in soul order. OATS_TEAM_LABELS is their
- * labels comma-joined and OATS_TEAMS their JSON (`[]` = no label: personal only).
+ * labels comma-joined and OATS_TEAMS their JSON (`[]` = no label: the workspace's default team only).
  * Both are empty when the teams are not known (a home spawned before 0.26.0 whose
  * workspace cannot be read now) — empty means "unknown", never "none".
  * OATS_TEAMS_SOURCE says where the list came from: `live` (the workspace read now,

package/lib/packages.mjs

@@ -372,11 +372,8 @@ export async function packageSoulDigests(remote, remoteRef, commit, souls, detai
         if (e?.code === "E_REMOTE_PATH_MISSING") throw oatsError("E_PACKAGE_MANIFEST", `package soul ${soul.path} is missing at ${String(commit).slice(0, 12)}`, { ...details, soul: soul.name, path: soul.dir });
         throw e;
       }
-      // A fake remote reports a digest without copying: only a real copy can be checked for its files.
-      if (existsSync(dest)) {
-        for (const file of ["soul.yaml", "AGENTS.md"]) {
-          if (!existsSync(join(dest, file))) throw oatsError("E_PACKAGE_MANIFEST", `package soul ${soul.path} lacks ${file} at ${String(commit).slice(0, 12)} — a soul directory carries soul.yaml and AGENTS.md`, { ...details, soul: soul.name, path: soul.dir, missing: file });
-        }
+      for (const file of ["soul.yaml", "AGENTS.md"]) {
+        if (!existsSync(join(dest, file))) throw oatsError("E_PACKAGE_MANIFEST", `package soul ${soul.path} lacks ${file} at ${String(commit).slice(0, 12)} — a soul directory carries soul.yaml and AGENTS.md`, { ...details, soul: soul.name, path: soul.dir, missing: file });
       }
       out.push({ name: soul.name, path: soul.path, digest: assertDigest(`package soul ${soul.path} digest`, digest, details) });
     }

package/lib/resolve.mjs

@@ -346,7 +346,7 @@ export function teamLabelsOf(soulEntry) {
  * `{ label, team, mapped, payload }`. `payload` is workspace.messaging's base ⊕ byTeam[label] when the
  * workspace maps the label, else the base alone with `mapped: false`; `team` is the payload's team id
  * when mapped (null otherwise). Kernel-owned and delivered BESIDE a provider's settings, never inside
- * them; joining any of them is the messaging provider's explicit act. No label → [] ("personal only").
+ * them; joining any of them is the messaging provider's explicit act. No label → [] (the workspace's default team only).
  * Pure: resolveSoul validates every carried label's entry (reserved byTeam, hostOnly keys) first.
  */
 export function teamsOf(workspace, labels) {
@@ -731,7 +731,7 @@ export async function resolveSoul(discovery, soulEntry, { local = null, lock = n
       // Decision 23 as amended by K (teams contract, co-lead ruling): the provider's settings are
       // base ⊕ soul ⊕ host ⊕ spawn. No byTeam[<label>] is merged, the primary's included: each
       // label's base ⊕ byTeam[label] is delivered only in its `teams` entry (teamsOf → OATS_TEAMS),
-      // so settings.team is the personal team a host, soul or spawn set. `byTeam` never reaches the
+      // so settings.team is the default team a host, soul or spawn set. `byTeam` never reaches the
       // provider, and the primary team's own payload may still not nest one.
       const { byTeam, ...base } = workspace.messaging;
       committed(base, "/messaging", { kind: "workspace", at: "oats-workspace.yaml#/messaging" });

package/lib/schedule.mjs

@@ -21,7 +21,7 @@
  *  succeeded. A launch whose side effects cannot be confirmed stays
  *  `unknown` with its slot held until `reconcile` proves what happened. */
 import { spawnSync } from "node:child_process";
-import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
@@ -31,7 +31,7 @@ import { loadLocal } from "./workspace.mjs";
 import { noteRuntimeName } from "./deprecation.mjs";
 import { tickTriggers } from "./triggers.mjs";
 import { resolveMemberClone } from "./instance-resolution.mjs";
-import { AUTOMATION_ID_RE, automationContext, automationError, baseRow, localEntry, localId, soulOriginOf, splitId } from "./automations.mjs";
+import { AUTOMATION_ID_RE, MODEL_RE, automationContext, automationError, baseRow, localEntry, localId, soulOriginOf, splitId } from "./automations.mjs";
 import { RESERVED_LAUNCH_ENV, MAX_INSTANCE_NAME, findAgent, findInstanceHomes, inspectInstanceSession, inputInstanceSession, startInstanceSession, retirePendingMarkerPath } from "./core.mjs";
 
 export const SCHEDULE_FILE = "oats-schedules.json";
@@ -208,6 +208,12 @@ export function readRegistry() {
   if (!Array.isArray(reg.workspaces)) reg.workspaces = [];
   if (!Number.isInteger(reg.maxConcurrent) || reg.maxConcurrent < 1) reg.maxConcurrent = 1;
   if (!Number.isInteger(reg.tickIntervalSec) || reg.tickIntervalSec < 60) reg.tickIntervalSec = 60;
+  // The host cap on trigger-spawned live instances (re-review B #5): absent = unbounded (each
+  // trigger's own concurrency.max still applies). Separate from maxConcurrent: a running scheduled
+  // job never holds a trigger, and trigger homes never hold a schedule. Hand-edited, so refused loudly.
+  if (reg.triggersMaxConcurrent !== undefined && !(Number.isSafeInteger(reg.triggersMaxConcurrent) && reg.triggersMaxConcurrent >= 1)) {
+    throw scheduleError("E_SCHEDULE_INVALID", `${join(hostScheduleDir(), "registry.json")}: triggersMaxConcurrent must be a positive integer, or absent for no host cap (got ${JSON.stringify(reg.triggersMaxConcurrent)})`, { field: "triggersMaxConcurrent" });
+  }
   return reg;
 }
 export function writeRegistry(reg) { writeJson(join(hostScheduleDir(), "registry.json"), reg); }
@@ -300,14 +306,14 @@ export function validateDefinition(ws, def, { checkAgent = true } = {}) {
   validateCron(def.cron, def.tz);
   const out = { id, enabled, cron: def.cron.trim(), tz: def.tz.trim(), kind: def.kind };
   if (def.kind === "spawn") {
-    if (typeof def.agent !== "string" || !def.agent.trim()) throw scheduleError("E_SCHEDULE_INVALID", "agent: soul name required", { field: "agent" });
+    if (typeof def.agent !== "string" || !def.agent.trim() || def.agent.trim().startsWith("-")) throw scheduleError("E_SCHEDULE_INVALID", "agent: soul name required (not an option)", { field: "agent" });
     out.agent = def.agent.trim();
     if (def.agentsRoot !== undefined) {
       const known = scopeRoots(ws);
       if (typeof def.agentsRoot !== "string" || !isAbsolute(def.agentsRoot) || !inside(ws, def.agentsRoot) || !known.includes(resolve(def.agentsRoot))) throw scheduleError("E_SCHEDULE_INVALID", `agentsRoot: must be one of this scope's agents roots (${known.join(", ") || "none"})`, { field: "agentsRoot" });
       out.agentsRoot = resolve(def.agentsRoot);
     }
-    if (def.repo !== undefined) { if (typeof def.repo !== "string" || !def.repo.trim()) throw scheduleError("E_SCHEDULE_INVALID", "repo: the work repository path, as oats spawn --repo", { field: "repo" }); out.repo = def.repo; }
+    if (def.repo !== undefined) { if (typeof def.repo !== "string" || !def.repo.trim() || def.repo.startsWith("-")) throw scheduleError("E_SCHEDULE_INVALID", "repo: the work repository path, as oats spawn --repo", { field: "repo" }); out.repo = def.repo; }
     if (def.backend !== undefined) { if (!BACKENDS.has(def.backend)) throw scheduleError("E_SCHEDULE_INVALID", "backend: tmux or herdr", { field: "backend" }); out.backend = def.backend; }
     if (def.purpose !== undefined) { if (typeof def.purpose !== "string" || !/^[a-z0-9-]{1,40}$/.test(def.purpose)) throw scheduleError("E_SCHEDULE_INVALID", "purpose: lowercase letters, digits and dashes", { field: "purpose" }); out.purpose = def.purpose; }
     // A run spawns <agent>-<purpose|id>-<YYYYMMDDHHMM>; instance names are at most
@@ -323,7 +329,7 @@ export function validateDefinition(ws, def, { checkAgent = true } = {}) {
     }
     if (def.launchConfig !== undefined) { if (typeof def.launchConfig !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(def.launchConfig)) throw scheduleError("E_SCHEDULE_INVALID", "launchConfig: the name of a launch configuration on the running host (oats-local.yaml launch-configs)", { field: "launchConfig" }); out.launchConfig = def.launchConfig; }
     if (def.harness !== undefined) { if (!HARNESSES.has(def.harness)) throw scheduleError("E_SCHEDULE_INVALID", "harness: pi, claude or codex", { field: "harness" }); out.harness = def.harness; }
-    if (def.model !== undefined) { if (typeof def.model !== "string") throw scheduleError("E_SCHEDULE_INVALID", "model: string", { field: "model" }); out.model = def.model; }
+    if (def.model !== undefined) { if (typeof def.model !== "string" || !MODEL_RE.test(def.model)) throw scheduleError("E_SCHEDULE_INVALID", "model: a model id: a letter or digit, then letters, digits and . _ : / @ + - [ ] (at most 128 characters)", { field: "model" }); out.model = def.model; }
     if (def.yolo !== undefined) { if (typeof def.yolo !== "boolean") throw scheduleError("E_SCHEDULE_INVALID", "yolo: boolean", { field: "yolo" }); out.yolo = def.yolo; }
     if (def.wake !== undefined) {
       const w = def.wake;
@@ -402,6 +408,10 @@ export function validateWorkspaceSchedule(dep, a) {
   if (spec.kind === "command") {
     if (d.cwd !== undefined && (typeof d.cwd !== "string" || isAbsolute(d.cwd))) throw scheduleError("E_SCHEDULE_INVALID", "cwd: a directory relative to the deployment (a workspace schedule never names a machine path)", { field: "cwd" });
     spec.cwd = resolve(dep, d.cwd ?? ".");
+    // Inside the deployment, `..` and symlinks included (re-review B #4): Git content never picks a
+    // directory elsewhere on the host.
+    const real = (p) => { try { return realpathSync(p); } catch { return resolve(p); } };
+    if (!inside(real(dep), real(spec.cwd))) throw scheduleError("E_SCHEDULE_INVALID", `cwd: ${JSON.stringify(d.cwd)} leaves the deployment; a workspace command's cwd is a directory inside it`, { field: "cwd" });
   }
   const out = validateDefinition(dep, spec, { checkAgent: false });
   delete out.enabled;
@@ -521,19 +531,22 @@ export function workspaceSpawnContext(ws) {
  *  `io.oatsBin`, `io.commandTimeoutMs` and `io.noLaunch` are the test seams. */
 function spawnViaCli(ws, root, agent, opts, context, io) {
   if (context.error) throw scheduleError(context.error.code, `this deployment realizes a workspace (${context.dir}) but its oats-local.yaml cannot be read: ${context.error.message}`);
-  const argv = ["spawn", agent.name, "--dir", context.dir, ...(opts.discover ? [] : ["--agents-root", root]), "--purpose", opts.purpose, "--json"];
-  if (opts.launchConfig) argv.push("--launch-config", opts.launchConfig);
-  if (opts.harness) argv.push("--harness", opts.harness);
-  if (opts.model) argv.push("--model", opts.model);
-  if (opts.backend) argv.push("--backend", opts.backend);
-  if (opts.repo) argv.push("--repo", opts.repo);
+  // Every value travels as ONE `--flag=value` token, so no value can be read as a flag of its own;
+  // the soul is the one positional, and an option-shaped one is refused.
+  if (String(agent.name).startsWith("-")) throw scheduleError("E_SCHEDULE_INVALID", `agent: ${JSON.stringify(agent.name)} is not a soul name`, { field: "agent" });
+  const argv = ["spawn", agent.name, `--dir=${context.dir}`, ...(opts.discover ? [] : [`--agents-root=${root}`]), `--purpose=${opts.purpose}`, "--json"];
+  if (opts.launchConfig) argv.push(`--launch-config=${opts.launchConfig}`);
+  if (opts.harness) argv.push(`--harness=${opts.harness}`);
+  if (opts.model) argv.push(`--model=${opts.model}`);
+  if (opts.backend) argv.push(`--backend=${opts.backend}`);
+  if (opts.repo) argv.push(`--repo=${opts.repo}`);
   if (opts.yolo === true) argv.push("--yolo"); else if (opts.yolo === false) argv.push("--no-yolo");
   if (opts.launch === false) argv.push("--no-launch");
   // The task is multi-line text of arbitrary size: it travels as a private file, never in argv.
   mkdirSync(join(stateDir(ws), "tasks"), { recursive: true });
   const taskFile = join(stateDir(ws), "tasks", `${opts.purpose}-${process.pid}.md`);
   writeFileSync(taskFile, opts.task, { mode: 0o600 });
-  argv.push("--task-file", taskFile);
+  argv.push(`--task-file=${taskFile}`);
   let r;
   try { r = spawnSync(process.execPath, [io?.oatsBin || OATS_BIN, ...argv], { cwd: context.dir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: io?.commandTimeoutMs || COMMAND_TIMEOUT_MS, killSignal: "SIGTERM", maxBuffer: 16 * 1024 * 1024, env: childEnv() }); }
   finally { try { rmSync(taskFile, { force: true }); } catch { /* best effort */ } }
@@ -866,7 +879,7 @@ export function tickHost({ now = new Date(), io, dryRun = false } = {}) {
     }
     // Triggers: each scope's event-driven spawns, polled at their own interval (lib/triggers.mjs).
     for (const ws of wsList) {
-      try { considered.push(...tickTriggers(ws, { now, io, dryRun, ctx: contexts.get(ws) })); }
+      try { considered.push(...tickTriggers(ws, { now, io, dryRun, ctx: contexts.get(ws), reg, wsList })); }
       catch (e) { considered.push({ workspace: ws, action: "error", error: `triggers: ${e.message}` }); }
     }
     if (!dryRun) writeHostState({ ...readHostState(), lastTick: now.toISOString(), minute: minuteKey(minuteStart(now)) });
@@ -978,10 +991,11 @@ export function testSchedule(ws, qid, io, { now = new Date(), ctx = null } = {})
       const { root, discover } = resolveScheduledAgent(ws, def);
       const context = workspaceSpawnContext(ws);
       if (context.error) throw scheduleError(context.error.code, context.error.message);
-      const argv = ["spawn", def.agent, "--dir", context.dir, ...(discover ? [] : ["--agents-root", root]), "--preview", "--json"];
-      if (def.launchConfig) argv.push("--launch-config", def.launchConfig);
-      if (def.harness) argv.push("--harness", def.harness);
-      if (def.model) argv.push("--model", def.model);
+      if (String(def.agent).startsWith("-")) throw scheduleError("E_SCHEDULE_INVALID", `agent: ${JSON.stringify(def.agent)} is not a soul name`, { field: "agent" });
+      const argv = ["spawn", def.agent, `--dir=${context.dir}`, ...(discover ? [] : [`--agents-root=${root}`]), "--preview", "--json"];
+      if (def.launchConfig) argv.push(`--launch-config=${def.launchConfig}`);
+      if (def.harness) argv.push(`--harness=${def.harness}`);
+      if (def.model) argv.push(`--model=${def.model}`);
       const r = spawnSync(process.execPath, [io?.oatsBin || OATS_BIN, ...argv], { cwd: context.dir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: io?.commandTimeoutMs || COMMAND_TIMEOUT_MS, killSignal: "SIGTERM", maxBuffer: 16 * 1024 * 1024, env: childEnv() });
       const envelope = parseEnvelopeText(r.stdout);
       if (!envelope || typeof envelope.ok !== "boolean") throw scheduleError("E_SPAWN_FAILED", `the spawn preview answered no valid envelope (exit ${r.status ?? r.signal})`);

package/lib/triggers.mjs

@@ -28,8 +28,8 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { readDefinitions, writeDefinitions, stateDir, withScopeLock, childEnv, parseEnvelopeText, schedulerStatus } from "./schedule.mjs";
-import { automationError, baseRow, localEntry, localId, qualifiedId, soulOriginOf } from "./automations.mjs";
+import { readDefinitions, writeDefinitions, stateDir, withScopeLock, childEnv, parseEnvelopeText, schedulerStatus, readRegistry } from "./schedule.mjs";
+import { MODEL_RE, automationError, baseRow, localEntry, localId, parseOwner, qualifiedId, soulOriginOf } from "./automations.mjs";
 import { lockedPackageRef } from "./packages.mjs";
 
 export const TRIGGER_API = 1;
@@ -121,7 +121,7 @@ export function validateTrigger(def) {
   if (!Array.isArray(teams) || teams.some((t) => typeof t !== "string" || !LABEL_RE.test(t)) || new Set(teams).size !== teams.length) throw invalid("spawn.teams", "a list of distinct team labels");
   if (sp.launchConfig !== undefined && (typeof sp.launchConfig !== "string" || !LAUNCH_CONFIG_RE.test(sp.launchConfig))) throw invalid("spawn.launchConfig", "the name of a launch configuration on the running host (oats-local.yaml launch-configs)");
   if (sp.harness !== undefined && !HARNESSES.has(sp.harness)) throw invalid("spawn.harness", "pi, claude or codex");
-  if (sp.model !== undefined && (typeof sp.model !== "string" || !sp.model.trim())) throw invalid("spawn.model", "a model id");
+  if (sp.model !== undefined && (typeof sp.model !== "string" || !MODEL_RE.test(sp.model))) throw invalid("spawn.model", "a model id: a letter or digit, then letters, digits and . _ : / @ + - [ ] (at most 128 characters)");
   if (sp.yolo !== undefined && typeof sp.yolo !== "boolean") throw invalid("spawn.yolo", "boolean");
   if (sp.backend !== undefined && !BACKENDS.has(sp.backend)) throw invalid("spawn.backend", "tmux or herdr");
   const cc = def.concurrency === undefined ? {} : def.concurrency;
@@ -207,7 +207,12 @@ export function triggerKind({ lock = null, remote = null } = {}) {
     parseBody: parseTriggerBody,
     expand: async (a) => {
       const raw = a.source.from ? await packageTriggerTemplate(lock, a.source.from, a.source.set, { id: a.name, remote }) : { ...a.source.definition };
-      return validateTrigger({ ...raw, id: a.name, kind: "trigger", enabled: true });
+      const def = validateTrigger({ ...raw, id: a.name, kind: "trigger", enabled: true });
+      // The owner check asks gh on the OWNER's host, and the poll runs on the REPO's host: they must be
+      // one GitHub host, or polling would act as whoever is logged in there (re-review B #7).
+      const owner = parseOwner(a.owner), repo = parseRepo(def.on.repo);
+      if (owner && repo && owner.host.toLowerCase() !== repo.host) throw Object.assign(triggerError("E_TRIGGER_INVALID", `owner ${a.owner} is on ${owner.host}, but on.repo ${repo.key} is on ${repo.host}: a trigger acts as its owner on the repository's own GitHub host`), { field: "owner" });
+      return def;
     },
   };
 }
@@ -265,8 +270,28 @@ export function readTriggerState(ws) {
   let doc;
   try { doc = JSON.parse(readFileSync(file, "utf8")); } catch { doc = null; }
   if (!isObject(doc) || !isObject(doc.triggers)) return { version: 1, triggers: {} };
+  return carryUnqualifiedState(doc);
+}
+/** 0.28 kept a local trigger's state under its bare id, with event keys `<id>:…`; 0.29 qualifies
+ *  both as `local/<id>`. Carried on read (re-review B #2): without it the first 0.29 tick saw no
+ *  PR state, so every open matching PR emitted `opened` and spawned again. A bare id already
+ *  present in qualified form keeps the qualified state. */
+function carryUnqualifiedState(doc) {
+  for (const id of Object.keys(doc.triggers)) {
+    if (id.includes("/")) continue;
+    const qid = localId(id), old = doc.triggers[id];
+    delete doc.triggers[id];
+    if (doc.triggers[qid] || !isObject(old)) continue;
+    const rekey = (map) => Object.fromEntries(Object.entries(isObject(map) ? map : {}).map(([k, v]) => {
+      const key = k.startsWith(`${id}:`) ? `${qid}${k.slice(id.length)}` : k;
+      return [key, isObject(v) && "key" in v ? { ...v, key, ...(v.trigger === id ? { trigger: qid } : {}) } : v];
+    }));
+    doc.triggers[qid] = { ...old, prs: isObject(old.prs) ? old.prs : {}, fired: rekey(old.fired), pending: rekey(old.pending) };
+  }
   return doc;
 }
+/** Whether an instance's recorded trigger id is `id`: a 0.28 home records a local trigger's bare id. */
+const sameTrigger = (recorded, id) => recorded === id || (typeof recorded === "string" && !recorded.includes("/") && id === localId(recorded));
 function writeTriggerState(ws, st) {
   const file = statePath(ws);
   mkdirSync(dirname(file), { recursive: true });
@@ -290,7 +315,7 @@ export function liveTriggerInstances(ws, id) {
       if (!e.isDirectory()) continue;
       const home = join(instances, e.name);
       let meta; try { meta = JSON.parse(readFileSync(join(home, "instance.json"), "utf8")); } catch { continue; }
-      if (isObject(meta?.trigger) && meta.trigger.id === id) out.push({ instance: meta.instance ?? e.name, home, repo: meta.trigger.repo, number: meta.trigger.number, event: meta.trigger.event, key: meta.trigger.key ?? null });
+      if (isObject(meta?.trigger) && (id === null || sameTrigger(meta.trigger.id, id))) out.push({ instance: meta.instance ?? e.name, home, repo: meta.trigger.repo, number: meta.trigger.number, event: meta.trigger.event, key: meta.trigger.key ?? null });
     }
   }
   return out;
@@ -359,6 +384,9 @@ export function foldPoll(def, ts, poll, now) {
     for (const e of eventsFor(def, ts.prs[pr.number], pr)) {
       const key = eventKey(def, pr, e);
       if (ts.fired[key] || ts.pending[key]) continue;
+      // A newer push supersedes a pending `synchronize` for an older head of the same PR: only
+      // the newest head is reviewed (re-review B #6).
+      if (e.event === "synchronize") for (const [k, p] of Object.entries(ts.pending)) if (p.number === pr.number && p.event === "synchronize") delete ts.pending[k];
       ts.pending[key] = { trigger: def.qid ?? def.id, source: def.on.source, repo: def.on.repo, number: pr.number, url: pr.url, event: e.event, headSha: pr.headSha, labels: pr.labels, observedAt: now.toISOString(), key };
       added.push(key);
     }
@@ -384,7 +412,7 @@ function runOats(ws, argv, io) {
 /** What `oats spawn <soul> --preview` says about the soul: its qualified resolution and the
  *  capability filling its messaging slot. → { ok, result | error } */
 export function previewSoul(ws, def, io) {
-  const r = runOats(ws, ["spawn", def.spawn.soul, "--dir", ws, "--preview", "--json"], io);
+  const r = runOats(ws, ["spawn", def.spawn.soul, `--dir=${ws}`, "--preview", "--json"], io);
   if (!r.envelope || typeof r.envelope.ok !== "boolean") return { ok: false, error: { code: "E_SPAWN_FAILED", message: r.timedOut ? "spawn --preview timed out" : `spawn --preview answered no envelope${r.stderr ? `: ${r.stderr.trim().split("\n").pop()}` : ""}` } };
   if (!r.envelope.ok) return { ok: false, error: { code: r.envelope.error?.code ?? "E_SPAWN_FAILED", message: r.envelope.error?.message ?? "spawn --preview failed" } };
   const modules = Array.isArray(r.envelope.result?.modules) ? r.envelope.result.modules : [];
@@ -396,17 +424,18 @@ export function previewSoul(ws, def, io) {
 export function spawnForEvent(ws, def, ev, io) {
   const fields = { repo: ev.repo, number: ev.number, url: ev.url, event: ev.event, headSha: ev.headSha, trigger: def.id };
   const purpose = renderTemplate(def.spawn.purpose, fields);
-  const argv = ["spawn", def.spawn.soul, "--dir", ws, "--purpose", purpose, "--json"];
+  // Every value travels as ONE `--flag=value` token, so no value can be read as a flag of its own.
+  const argv = ["spawn", def.spawn.soul, `--dir=${ws}`, `--purpose=${purpose}`, "--json"];
   if (def.spawn.teams.length) {
     const pv = previewSoul(ws, def, io);
     if (!pv.ok) throw triggerError(pv.error.code, pv.error.message);
     if (!pv.messaging) throw triggerError("E_TRIGGER_TEAMS", `trigger ${def.id}: spawn.teams [${def.spawn.teams.join(", ")}] needs a messaging capability, and soul ${def.spawn.soul} resolves none`, { details: { soul: def.spawn.soul, teams: def.spawn.teams } });
     argv.push("--provider", pv.messaging, `join=${def.spawn.teams.join(",")}`);
   }
-  if (def.spawn.launchConfig) argv.push("--launch-config", def.spawn.launchConfig);
-  if (def.spawn.harness) argv.push("--harness", def.spawn.harness);
-  if (def.spawn.model) argv.push("--model", def.spawn.model);
-  if (def.spawn.backend) argv.push("--backend", def.spawn.backend);
+  if (def.spawn.launchConfig) argv.push(`--launch-config=${def.spawn.launchConfig}`);
+  if (def.spawn.harness) argv.push(`--harness=${def.spawn.harness}`);
+  if (def.spawn.model) argv.push(`--model=${def.spawn.model}`);
+  if (def.spawn.backend) argv.push(`--backend=${def.spawn.backend}`);
   if (def.spawn.yolo === true) argv.push("--yolo"); else if (def.spawn.yolo === false) argv.push("--no-yolo");
   if (io?.noLaunch === true) argv.push("--no-launch");
   // The task and the event travel as private files, never in argv.
@@ -416,7 +445,7 @@ export function spawnForEvent(ws, def, ev, io) {
   const taskFile = `${stem}.md`, eventFile = `${stem}.event.json`;
   writeFileSync(eventFile, JSON.stringify(ev, null, 2) + "\n", { mode: 0o600 });
   writeFileSync(taskFile, renderTemplate(def.spawn.task, fields).trimEnd() + triggerBlock(def, ev, "<home>/.oats/trigger-event.json"), { mode: 0o600 });
-  argv.push("--task-file", taskFile, "--trigger-event", eventFile);
+  argv.push(`--task-file=${taskFile}`, `--trigger-event=${eventFile}`);
   let r;
   try { r = runOats(ws, argv, io); }
   finally { for (const f of [taskFile, eventFile]) { try { rmSync(f, { force: true }); } catch { /* best effort */ } } }
@@ -438,10 +467,16 @@ function heldBy(def, ev, live) {
  *  whose poll is not due is not polled; pending events (a spawn that failed, or was held by
  *  concurrency) are retried whenever the trigger polls. `dryRun` reads only.
  *  → considered rows { workspace, trigger, action, … } */
-export function tickTriggers(ws, { now = new Date(), io, dryRun = false, ctx = null } = {}) {
+export function tickTriggers(ws, { now = new Date(), io, dryRun = false, ctx = null, reg = null, wsList = null } = {}) {
   let entries;
   try { entries = triggerEntries(ws, ctx); } catch (e) { return [{ workspace: ws, action: "error", error: e.message }]; }
   if (!entries.length) return [];
+  // The host cap (registry triggersMaxConcurrent; absent = unbounded) counts every trigger-spawned
+  // live home in the host's scopes, and nothing a schedule runs (re-review B #5).
+  let hostCap;
+  try { hostCap = (reg || readRegistry()).triggersMaxConcurrent; } catch (e) { return [{ workspace: ws, action: "error", error: e.message }]; }
+  const scopes = [...new Set([...(wsList || []), ws])];
+  let hostLive = hostCap ? scopes.reduce((n, w) => n + liveTriggerInstances(w, null).length, 0) : 0;
   const st = readTriggerState(ws);
   const considered = [];
   const rec = (id, action, extra = {}) => considered.push({ workspace: ws, trigger: id, action, ...extra });
@@ -471,15 +506,16 @@ export function tickTriggers(ws, { now = new Date(), io, dryRun = false, ctx = n
     const queue = Object.values(work.pending).sort((a, b) => a.observedAt.localeCompare(b.observedAt) || a.key.localeCompare(b.key));
     if (!queue.length) rec(id, "polled", { prs: work.lastPoll.prs, matching: work.lastPoll.matching });
     for (const ev of queue) {
-      const held = heldBy(def, ev, live);
+      const held = heldBy(def, ev, live) ?? (hostCap && hostLive >= hostCap ? `host triggersMaxConcurrent ${hostCap} reached (${hostLive} live)` : null);
       if (held) { rec(id, "held", { key: ev.key, reason: held }); continue; }
-      if (dryRun) { rec(id, "would-fire", { key: ev.key, event: ev.event, number: ev.number, url: ev.url }); live.push({ repo: ev.repo, number: ev.number }); continue; }
+      if (dryRun) { rec(id, "would-fire", { key: ev.key, event: ev.event, number: ev.number, url: ev.url }); live.push({ repo: ev.repo, number: ev.number }); hostLive++; continue; }
       try {
         const run = spawnForEvent(ws, def, ev, io);
         work.fired[ev.key] = { at: now.toISOString(), instance: run.instance ?? null, home: run.home ?? null, event: ev.event, number: ev.number };
         delete work.pending[ev.key];
         work.lastFiredAt = now.toISOString();
         live.push({ instance: run.instance, home: run.home, repo: ev.repo, number: ev.number });
+        hostLive++;
         rec(id, "fired", { key: ev.key, instance: run.instance ?? null, home: run.home ?? null });
       } catch (e) {
         work.lastError = { at: now.toISOString(), code: e.code || "E_SPAWN_FAILED", message: e.message, key: ev.key };

package/lib/workspace.mjs

@@ -753,8 +753,8 @@ export function workspaceWarnings(workspace, members, externalRows, packageSouls
 
 /** Teams contract decision 5: a soul label the workspace declares in `teams:` but does not map in
  *  `messaging.byTeam` is a WARNING, not a problem — the label stays eligible-but-unmapped and the
- *  messaging provider falls back to the personal team for it. (An undeclared label is E_TEAM_UNKNOWN.)
- *  ONE warning per unmapped label, naming its souls (a personal-only workspace would otherwise print
+ *  messaging provider falls back to the workspace's default team for it. (An undeclared label is E_TEAM_UNKNOWN.)
+ *  ONE warning per unmapped label, naming its souls (a workspace on its default team alone would otherwise print
  *  a line per soul): { code, label, souls, paths, message }, sorted by label. */
 const byCodepointOrder = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
 function unmappedLabelWarnings(workspace, members, externalRows, teams) {
@@ -774,7 +774,7 @@ function unmappedLabelWarnings(workspace, members, externalRows, teams) {
     const order = names.map((n, i) => i).sort((x, y) => byCodepointOrder(names[x], names[y]) || byCodepointOrder(paths[x], paths[y]));
     const sorted = order.map((i) => names[i]);
     return { code: "unmapped-team-label", label, souls: sorted, paths: order.map((i) => paths[i]),
-      message: `team ${show(label)} has no messaging.byTeam entry; its souls (${sorted.join(", ")}) fall back to the personal team for it` };
+      message: `team ${show(label)} has no messaging.byTeam entry; its souls (${sorted.join(", ")}) fall back to the workspace's default team for it` };
   });
 }