@huynle/hub 0.7.3 → 0.8.0

package/src/central/http.ts

@@ -2,12 +2,13 @@
 // Phones authenticate with the `voice_device` cookie (or, in native apps, the same secret as a bearer device
 // token; see ./agent/actor.ts); spokes with machine bearer tokens. Source IPs
 // (including loopback) are never trusted.
+import { BODY_LIMITS, readBounded, slowMessage } from "./agent/body"
 import type { Server } from "bun"
 import { diskAssets, type WebAssets } from "./assets"
 import path from "node:path"
 import { promisify } from "node:util"
 import { brotliCompress, constants as zlib, gzip } from "node:zlib"
-import { formAnswerProblem, PROMPT_IMAGE_MIMES, promptImagesProblem, type AvailableModel, type CoreOp, type EnrollStart, type FormAnswer, type ModelSelection, type PermissionDecision, type PromptImage } from "../protocol"
+import { formAnswerProblem, PROMPT_IMAGE_MIMES, WORKSPACE_LIMITS, promptImagesProblem, type AvailableModel, type CoreOp, type EnrollStart, type FormAnswer, type ModelSelection, type PermissionDecision, type PromptImage } from "../protocol"
 import { isLoopbackAddress, isLoopbackHost, isLoopbackURL, loopbackOrigins } from "../loopback"
 import { speakable } from "../speakable"
 import { Auth, RateLimitError, ValidationError } from "./auth"
@@ -17,7 +18,7 @@ import { isNotificationKind, Push, type PushSender } from "./push"
 import { pushEndpointProblem, resolveHost as systemResolveHost, type ResolveHost } from "./push-target"
 import { Webhooks } from "./agent/webhooks"
 import { issueAppToken } from "./agent/app-tokens"
-import { AGENT_EVENTS_AGE_MS, AGENT_EVENTS_MAX, AgentEvents, archiveEvent } from "./agent/events"
+import { AGENT_EVENTS_AGE_MS, AGENT_EVENTS_MAX, AgentEvents, archiveEvent, conciergeEvent, type AgentEvent } from "./agent/events"
 import { EventWriters } from "./agent/event-writers"
 import { MemoryEventLog } from "./backend/memory-events"
 import { WEBHOOK_SCOPE } from "./agent/webhook-routes"
@@ -26,8 +27,8 @@ import { createResolver, type AgentActor, type BearerVerifier, type CredentialMo
 import { ActingSwitch } from "./agent/acting-switch"
 import { AgentAudit } from "./agent/audit"
 import { Grants } from "./agent/grants"
-import { Decisions, type Decision } from "./agent/decisions"
-import type { Escalate } from "./agent/acting"
+import { ANSWER_VIAS, type AnswerVia, Decisions, type Decision, TAP_ONLY } from "./agent/decisions"
+import { Acting, type Escalate } from "./agent/acting"
 import { Escalations } from "./agent/escalation"
 import { GrantRequests } from "./agent/grant-requests"
 import { partyFromActor } from "./agent/envelope"
@@ -36,6 +37,7 @@ import { AgentError, type AgentErrorCode } from "./agent/errors"
 import type { Launch } from "./agent/launch-store"
 import { decisionStateQuery, MessageFeed } from "./agent/message-routes"
 import { hubDirectory } from "./agent/directory-routes"
+import type { Directory } from "./agent/directory"
 import { agentApi, agentRoutes, agentVerifiers, isAgentPath, wellKnown, type AgentRoute } from "./agent/routes"
 import { MCP_PATH, mcpHttp } from "./mcp-http"
 import { SessionTokens } from "./agent/session-tokens"
@@ -44,6 +46,7 @@ import { TokenKeys } from "./token-keys"
 import { EventLog } from "./events-log"
 import { BusyError, Registry } from "./registry"
 import { createActions, type Unsupported, unsupportedMessage } from "./actions"
+import { IntentRetention, SessionIntents, withPromptIntents } from "./agent/intents"
 import { audioFormat, SpeechError } from "./speech/provider"
 import { SpeechService } from "./speech/service"
 import { NodeRegistry } from "./nodes"
@@ -57,6 +60,46 @@ import { randomBytes, randomUUID } from "node:crypto"
 import { LaunchEngine } from "./agent/launch-engine"
 import { LaunchTokens } from "./agent/launch-tokens"
 import { LaunchFeed, launchInfo } from "./agent/launch-routes"
+import { ProfileApplier } from "./profiles/apply"
+import { ProfileStore } from "./profiles/store"
+import { WorkspaceStore } from "./workspaces/store"
+import { directoryPresence, MembershipStore } from "./workspaces/members"
+import { SupervisionStore } from "./workspaces/supervision"
+import { WorkspaceLifecycle } from "./workspaces/lifecycle"
+import { registryBoardSessions } from "./workspaces/board"
+import { CheckpointStore, journalCursors } from "./workspaces/checkpoints"
+import { coordinatorActor, SupervisorCoordinator } from "./workspaces/coordinator"
+import { artifactJournalEvent } from "./artifacts/events"
+import { ArtifactMaintenance } from "./artifacts/maintenance"
+import { ARTIFACT_UPLOAD_LIMITS } from "./artifacts/routes"
+import { ArtifactStore } from "./artifacts/store"
+import { artifactHost, isArtifactHostPath } from "./artifacts/host"
+import { ArtifactHostCaps } from "./artifacts/host-caps"
+import { artifactWorkspacesFromState } from "./artifacts/workspaces"
+import { teamDeniedEvent, TeamPolicy } from "./teams/policy"
+import { TeamSeatStore } from "./teams/seats"
+import { TeamStaffingService } from "./teams/staffing"
+import { intakeActor, TeamIntakeService } from "./teams/intake"
+import { TeamStore } from "./teams/store"
+import { ActivityTracker } from "./concierge/activity"
+import { ResultTracker } from "./concierge/board-results"
+import { BoardRevisions } from "./concierge/board"
+import { conciergeBoard } from "./concierge/board-routes"
+import { ContextPusher } from "./concierge/context"
+import { C1_ENTITLEMENTS } from "./concierge/entitlements"
+import { conciergeActor, conciergeInbound, conciergeProtects } from "./concierge/inbound"
+import { conciergeModules, type ConciergePorts, type ConciergeTiers } from "./concierge/index"
+import { watchedSessions } from "./concierge/notifier"
+import { NotesStore } from "./concierge/notes"
+import { conciergeSessionGate } from "./concierge/session-routes"
+import { conciergeAwareNotifier, isConciergeSession } from "./concierge/push-remap"
+import { ConciergeService, type MachineFacts } from "./concierge/service"
+import { SettingsStore } from "./concierge/settings"
+import { CONCIERGE_TAMPERED, isConciergeLaunch, recordIdentity, StatusStore, Supervisor } from "./concierge/supervisor"
+import { CONCIERGE_AGENT } from "../../packages/protocol/src/concierge"
+import { CONCIERGE_FORCED_PUSH_MS, INTERNAL_AGENTS, KNOWN_PRIMARY_AGENTS } from "./concierge/context"
+import { grantState } from "./agent/grants"
+import { catalogHarnesses, TeamDiscovery } from "./teams/discovery"
 import { DRAIN_RETRY_AFTER_MS, DRAIN_TIMEOUT_MS, RequestTimeoutError, RequestTooLargeError, SpokeError, SpokeHub, type DrainOptions, type Notifier, type SpokeHubOptions, type SpokeSocketData } from "./spoke-ws"
 import { ACTIVITY_INTERVAL_MAX, ACTIVITY_INTERVAL_MIN, LOCAL_USER, PUSH_PREF_KEYS, quietHoursInput, Store, VIEW_PREF_KEYS, VIEW_PREF_MAX_ARCHIVED, type DeviceRecord, type LegacyPushPrefs, type PushPrefs, type UserRecord, type ViewPrefs } from "./store"
 
@@ -143,10 +186,18 @@ export interface Central {
   readonly webhooks: Webhooks
   /** The canonical agent event journal (GET /api/agent/events, MCP events): compact events per user, 24 h / 10,000. */
   readonly agentEvents: AgentEvents
+  /** The agent directory (names, roles, address resolution). */
+  readonly directory: Directory
+  /** (CON-04) The Concierge service (settings, supervisor, context). */
+  readonly concierge: ConciergeService
   /** The journal's writers (state, blockers, presence, messages, launches); settled() waits for queued appends. */
   readonly agentEventWriters: EventWriters
+  /** (CON-02) Session intent retention (its leader runs it every 6 h; tests run a pass with runOnce). */
+  readonly intentRetention: IntentRetention
   /** The JSON API's route table (method, path, access), for audits and tests. */
   readonly routes: readonly RouteInfo[]
+  /** Teams (HWA-33..37): definitions, seats (the delivery policy's) and staffing; HWA-37 routes reuse these. */
+  readonly teams: { readonly store: TeamStore; readonly seats: TeamSeatStore; readonly staffing: TeamStaffingService; readonly intake: TeamIntakeService }
   /**
    * Draining before a shutdown (design §10; SIGTERM): /readyz fails, new /spoke/ws upgrades are refused, spokes and
    * nodes get bye{reason:"draining", retryAfterMs} (once their requests in flight are answered), the leader leases
@@ -164,8 +215,8 @@ interface Listener {
   readonly deviceID: string
   /** Leaves out streamed text and reasoning (except of `session`'s tree). */
   readonly lite: boolean
-  /** The session the page shows: its tree's text and reasoning stream even when lite. */
-  readonly session?: string
+  /** The sessions the page shows (one, or one per visible pane): their trees' text and reasoning stream even when lite. */
+  readonly sessions?: readonly string[]
   /** Sends a message; `id` is its event id (EventSource's lastEventId). */
   send(message: Message, id?: string): void
   close(): void
@@ -176,6 +227,23 @@ interface Listener {
 /** Messages a lite stream leaves out (unless they are of the listener's session tree). */
 const STREAMED = new Set(["delta", "reasoning"])
 
+/**
+ * The sessions a console stream shows (HWA-07 panes): `session` (the focused one; all an older console sends)
+ * then `sessions` (comma-separated, one per visible pane), each once, blanks ignored. At most
+ * WORKSPACE_LIMITS.panes; an ID over 300 characters or too many sessions is a problem (400), never truncated.
+ */
+function streamSessionsQuery(url: URL): { sessions: string[]; multi: boolean } | { problem: string } {
+  const listed = url.searchParams.getAll("sessions").flatMap((v) => v.split(","))
+  const sessions: string[] = []
+  for (const id of [url.searchParams.get("session") ?? "", ...listed]) {
+    if (!id || sessions.includes(id)) continue
+    if (id.length > 300) return { problem: "a session ID is too long" }
+    sessions.push(id)
+  }
+  if (sessions.length > WORKSPACE_LIMITS.panes) return { problem: `a stream shows at most ${WORKSPACE_LIMITS.panes} sessions` }
+  return { sessions, multi: url.searchParams.has("sessions") }
+}
+
 /**
  * Who may call a route: anyone, any signed-in user, admins, or the owner of the :session / :machine in the path;
  * "agent": an /api/agent route (src/central/agent), checked per credential kind there.
@@ -229,6 +297,10 @@ const LAUNCH_STOP_TIMEOUT_MS = 180_000
  */
 export const TURN_ACCEPT_MS = 1500
 const NO_OWNER = "No OpenCode process for this session is connected"
+/** The spoke's refusal of a revert while the session runs (src/spoke/fork-revert.ts REVERT_BUSY). */
+const REVERT_BUSY = "The session is working; wait for it to finish (or stop it) before reverting"
+/** A message ID in a fork or revert request (as the spoke protocol bounds it). */
+const MESSAGE_ID = /^[A-Za-z0-9_.:@/+~-]{1,300}$/
 const AUTO_NAME_OUTDATED = "Update the Hub plugin to use Auto-name"
 const NOT_EXPOSED = "Voice is not enabled for this session"
 /** A permission or question that is not pending any more: someone answered it elsewhere, or it expired. */
@@ -251,13 +323,15 @@ const WEB_NOT_BUILT = [
   "This hub has no built web app (web/dist).",
   "",
   "To run a hub, install it from npm (`opencode plugin add @huynle/hub`, or `bunx --package @huynle/hub hub-server`)",
-  "or use a release binary (https://github.com/huynle/hub/releases), which ship the web app.",
+  "or use a release binary (https://github.com/huynle/hub-releases/releases), which ship the web app.",
   "In a source checkout, run `npm install && npm run build:web` first.",
 ].join("\n")
 /** Preview text for POST /api/settings/speech/test. */
 const SPEECH_TEST_TEXT = "Hi! This is how I will sound when I read replies to you."
 const SPEECH_TEST_MAX_CHARS = 300
-const APP_ROUTES = /^\/(?:|pair|approve|new|settings|s\/[^/]+)$/
+// Primary-navigation destinations (web/src/app/nav.ts) and one sub-path level, plus legacy routes the console
+// redirects (birds-eye → watchtower, nav.ts LEGACY_ROUTES); test/central-web.test.ts checks the registry.
+const APP_ROUTES = /^\/(?:|pair|approve|new|settings(?:\/[a-z-]+)?|panes|concierge(?:\/[^/]+)?|s\/[^/]+|(?:artifacts|teams|watchtower|birds-eye|profiles)(?:\/[^/]+)?)$/
 const STATIC_PATH = /^(?:\/[A-Za-z0-9_-][A-Za-z0-9._-]*)+$/
 /** Where a one-time sign-in link may land: home, or a session (with Voice mode starting: `?voice=1`). */
 const LOGIN_NEXT = /^\/(?:s\/[A-Za-z0-9_-]+(?:\?voice=1)?)?$/
@@ -302,16 +376,18 @@ class HttpError extends Error {
     message: string,
     /** Machine-readable reason, e.g. not_exposed. */
     readonly code?: string,
+    /** Answer with Connection: close (a request body was left unread on the socket: agent/body.ts). */
+    readonly close?: boolean,
   ) {
     super(message)
   }
 }
 
 /** A core op the session's spoke does not serve (another harness's spoke): 409 code unsupported, like plugin_outdated. */
-const unsupportedError = (lacking: Pick<Unsupported, "feature" | "harness">) => new HttpError(409, unsupportedMessage(lacking), "unsupported")
+const unsupportedError = (lacking: { readonly feature: Unsupported["feature"] | "fork" | "revert"; readonly harness: string }) => new HttpError(409, unsupportedMessage(lacking), "unsupported")
 
-const error = (status: number, message: string, code?: string) =>
-  Response.json({ error: message, ...(code ? { code } : {}) }, { status })
+const error = (status: number, message: string, code?: string, headers?: Record<string, string>) =>
+  Response.json({ error: message, ...(code ? { code } : {}) }, { status, ...(headers ? { headers } : {}) })
 
 export function startCentral(options: CentralOptions): Central {
   const { config } = options
@@ -330,7 +406,12 @@ export function startCentral(options: CentralOptions): Central {
   const registry = new Registry(now, undefined, (machineID) => store.machines().find((m) => m.id === machineID)?.ownerID)
   const nodes = new NodeRegistry((machineID) => store.machines().find((m) => m.id === machineID)?.ownerID, now)
   const push = new Push({ store, subject: config.vapidSubject, sender: options.pushSender, kv: backends.kv })
-  const notifier = options.notifier ?? push
+  // CON-04: the Concierge's state record is read early (the Concierge-only authority, hiding, the inbound rule and
+  // push remapping all follow it); the service itself is built below, once its parts exist.
+  const conciergeStatus = new StatusStore(backends.state, now)
+  const conciergeIdentity = recordIdentity(conciergeStatus)
+  // Pushes about the Concierge's hidden sessions become kind "concierge" (/concierge) or are dropped.
+  const notifier = conciergeAwareNotifier(options.notifier ?? push, () => conciergeIdentity)
   /** SSE subscribers, one user each. */
   const listeners = new Set<Listener>()
   /** Recent messages per user, replayed to a stream that reconnects with Last-Event-ID. */
@@ -338,9 +419,10 @@ export function startCentral(options: CentralOptions): Central {
   /** Whether a listener wants a message (lite streams skip other sessions' streamed text). */
   const wants = (listener: Listener, message: Message): boolean => {
     if (!listener.lite || !STREAMED.has(message.type)) return true
-    if (!listener.session) return false
-    const root = registry.status(listener.session)?.[0]?.id ?? listener.session
-    return message.sessionID === listener.session || message.rootID === root || message.sessionID === root
+    return (listener.sessions ?? []).some((session) => {
+      const root = registry.status(session)?.[0]?.id ?? session
+      return message.sessionID === session || message.rootID === root || message.sessionID === root
+    })
   }
   /**
    * Cluster mode (design §9): a user's events go to every pod over the Bus (user.<id>.live), logged in the shared
@@ -439,7 +521,11 @@ export function startCentral(options: CentralOptions): Central {
     hostname: config.host,
     port: config.port,
     idleTimeout: 255,
-    maxRequestBodySize: Math.max(config.maxAudioBytes + 1024, 1 << 20),
+    // Staged artifact blobs stream up to ARTIFACT_UPLOAD_LIMITS.blobBytes (the routes bound every body themselves).
+    // Plus headroom for the drain past a route's bound (BODY_LIMITS.drainBytes, overshot by up to one chunk): Bun ≥ 1.4
+    // enforces this limit on chunked bodies too, answering a bare 413 and closing the socket before the route can
+    // give its own 400/413. It stays a backstop; the routes' bounds decide.
+    maxRequestBodySize: Math.max(config.maxAudioBytes + 1024, ARTIFACT_UPLOAD_LIMITS.blobBytes + 65_536, 1 << 20) + 2 * BODY_LIMITS.drainBytes,
     fetch: (request, server) => handle(request, server),
     websocket: {
       open: (ws) => spokes.websocket.open?.(ws),
@@ -536,7 +622,11 @@ export function startCentral(options: CentralOptions): Central {
     // Push goes to the session owner's devices only; an alert without an owner goes nowhere.
     if (!alert.owner) return
     // Activity updates are collected and throttled per device by the push layer.
-    if (alert.kind === "activity") return push.activity(alert)
+    if (alert.kind === "activity") {
+      // The Concierge's own activity is never pushed (its session is hidden).
+      void isConciergeSession(conciergeIdentity, alert.owner, alert.sessionID).then((hidden) => (hidden ? undefined : push.activity(alert)))
+      return
+    }
     const extra = {
       ...(alert.requestID ? { requestID: alert.requestID } : {}),
       ...(alert.subject ? { subject: alert.subject } : {}),
@@ -688,7 +778,25 @@ export function startCentral(options: CentralOptions): Central {
   }
   // Agent messages (design §3): delivered through spokes that announce "deliver"; pending ones flush on every
   // sessions frame; human turns (console turn/utterance, prompts typed in the harness) reset hop chains.
+  // Teams (HWA-33) and their communication policy in delivery (HWA-34): a denial is audited and journaled (IDs only).
+  let teamSeats: TeamSeatStore | undefined
+  const teamStore = new TeamStore({ state: backends.state, now, pinnedVersions: (userID, teamID) => teamSeats!.pinnedVersions(userID, teamID) })
+  const teamPresence = directoryPresence(directory, (userID) => store.agentData(userID).sessions ?? [])
+  teamSeats = new TeamSeatStore({ state: backends.state, teams: teamStore, now, knowsSession: async (userID, sessionID) => !["unknown", "deleted"].includes(await teamPresence(userID, sessionID)) })
+  const teamPolicy = new TeamPolicy({
+    teams: teamStore,
+    seats: teamSeats,
+    directory,
+    denied: async (userID, denial) => {
+      const target = denial.recipientID !== undefined ? { sessionID: denial.recipientID } : {}
+      const reason = `team policy: ${denial.reason} (${denial.kind})`
+      await Promise.all([audit.record(userID, { actor: { kind: "session", sessionID: denial.senderID }, verb: "team.denied", target, decision: "forbidden", reason, outcome: "refused" }), agentEvents.append(userID, teamDeniedEvent(denial))])
+    },
+  })
   const delivery = new Delivery({
+    teams: teamPolicy,
+    // CON-04 inbound rule: only the user, app:concierge and replies to its asks reach a Concierge session.
+    inbound: conciergeInbound({ identity: conciergeIdentity, audit: { record: (userID, entry) => audit.record(userID, entry) } }),
     state: backends.state,
     counters: backends.counters,
     registry,
@@ -714,6 +822,8 @@ export function startCentral(options: CentralOptions): Central {
   const feed = new MessageFeed()
   // Cluster mode: messages stored on any pod reach this pod's listeners (ask waiters, agent watches).
   if (config.cluster) feed.attach({ bus: backends.bus, podID: config.cluster.podID }).catch((cause) => console.error(`[hub] message feed did not attach: ${(cause as Error).message}`))
+  /** (CON-06) The Concierge tiers (set below, once the Concierge modules exist): proposals' act, via, disarm. */
+  let conciergeTierHooks: ConciergeTiers | undefined
   // Decisions (design §12.1): asks to @me; deadlines run over every user's Decisions (survive restarts).
   const decisions = new Decisions({
     state: backends.state,
@@ -722,10 +832,26 @@ export function startCentral(options: CentralOptions): Central {
     users: () => store.users().map((u) => u.id),
     notify: (userID, decision, reason) => pushUser("decision", userID, decision.sessionID ?? "", `${decision.id}:${reason}`, decision.id),
     // The console's live Decision cards: opened, answered (here, by timeout), escalated, expired.
-    changed: (userID, decision) => broadcast({ type: "decision", decision }, { tenant: userID }),
-    // Escalations' Decisions reply to the permission as the user; grant requests' create the grant as the user
-    // (both are set up below).
-    act: (userID, decision, choice, by) => (decision.action?.kind === "grant" ? grantRequests.act(userID, decision, choice, by) : escalations.act(userID, decision, choice, by)),
+    changed: (userID, decision) => {
+      broadcast({ type: "decision", decision }, { tenant: userID })
+      conciergeTierHooks?.decisionChanged?.(userID, decision)
+    },
+    // Escalations' Decisions reply to the permission as the user; grant requests' create the grant as the user;
+    // (CON-06) Concierge proposals run their verb as the user (all set up below).
+    act: (userID, decision, choice, by) => {
+      const kind = decision.action?.kind
+      if (kind === "act") {
+        if (!conciergeTierHooks?.act) throw new Error("This decision's action cannot run on this hub")
+        return conciergeTierHooks.act(userID, decision, choice, by)
+      }
+      return kind === "grant" ? grantRequests.act(userID, decision, choice, by) : escalations.act(userID, decision, choice, by)
+    },
+    // (CON-06) Voice/text answers: only what the Concierge tiers admit (armed, presence, the user's device).
+    via: async (userID, decision, via, by) => {
+      if (!conciergeTierHooks?.checkVia) throw new AgentError("forbidden", TAP_ONLY)
+      await conciergeTierHooks.checkVia(userID, decision, via, by)
+    },
+    concierge: (userID, sessionID) => isConciergeSession(conciergeIdentity, userID, sessionID),
     ...(loopTickMs !== undefined ? { tickMs: loopTickMs } : {}),
   })
   leader("decisions", { onElected: () => decisions.start(), onDeposed: () => decisions.stop() })
@@ -737,15 +863,26 @@ export function startCentral(options: CentralOptions): Central {
   }
   registry.onSessions((connID) => void delivery.onSessions(connID).catch((cause) => console.error(`[hub] message flush failed: ${(cause as Error).message}`)))
   registry.onHumanTurn((sessionID) => void humanTurn(sessionID))
-  /** Permission, form, prompt and stop execution, shared by the console routes and the agent act verbs. */
-  const actions = createActions({
+  // (CON-02) Session intents; the journal is created below (appends happen only once requests arrive).
+  const intents = new SessionIntents({
+    state: backends.state,
+    now,
+    events: { append: (userID, event) => agentEvents.append(userID, event) },
+    // The owner's consoles refetch the intent (the Details rail's card); the text never rides the stream.
+    onChange: (userID, sessionID, source, revision) => broadcast({ type: "intent", sessionID, source, revision }, { tenant: userID }),
+  })
+  /**
+   * Permission, form, prompt and stop execution, shared by the console routes and the agent act verbs. Every
+   * prompt the hub carries derives the session's intent once (CON-02).
+   */
+  const actions = withPromptIntents(createActions({
     registry,
     spokes,
     humanTurn,
     kv: backends.kv,
     // Cluster mode: a turn also holds the session's lease, so two pods never start turns in it at once.
     ...(config.cluster ? { turns: { locks: backends.locks, owner: leaseOwner, ttlMs: config.turnTimeoutMs + TURN_LEASE_SLACK_MS } } : {}),
-  })
+  }), intents, (sessionID) => registry.sessionTenant(sessionID), (sessionID) => registry.session(sessionID)?.title)
   leader("delivery", { onElected: () => delivery.start(), onDeposed: () => delivery.stop() })
   // Launches (design §6): placement onto the user's nodes, prepare on the node, the session through the machine's
   // service spoke, then its end; restart recovery runs on start. Every change goes to launchFeed: the owner's
@@ -755,6 +892,8 @@ export function startCentral(options: CentralOptions): Central {
   // launch's connections and webhooks run only on the publishing pod (origin): they reach every pod themselves.
   if (config.cluster) launchFeed.attach({ bus: backends.bus, podID: config.cluster.podID }).catch((cause) => console.error(`[hub] launch feed did not attach: ${(cause as Error).message}`))
   launchFeed.subscribe((userID, launch) => broadcast({ type: "launch", launch: launchInfo(launch) }, { tenant: userID }), { origin: true })
+  // Profile application (HWA-15), created with the profile store below; a launch naming a profile applies it.
+  let profileApplier: ProfileApplier | undefined
   const launches = new LaunchEngine({
     state: backends.state,
     counters: backends.counters,
@@ -775,6 +914,8 @@ export function startCentral(options: CentralOptions): Central {
     users: () => store.users().map((u) => u.id),
     now,
     onLaunchChanged: (launch) => launchFeed.publish(launch.owner, launch),
+    intents,
+    profiles: { applyAtLaunch: async (userID, sessionID, ref) => (profileApplier ? profileApplier.applyAtLaunch(userID, sessionID, ref) : [`profile ${ref.profileID} v${ref.version} not applied: the hub is starting`]) },
     // Cluster mode: the supervisor runs on the launches leader; other pods kick it and send it their stops.
     ...(config.cluster
       ? {
@@ -839,11 +980,19 @@ export function startCentral(options: CentralOptions): Central {
   })
   // The canonical agent event journal (lifecycle design, Events): each change appended once across the cluster;
   // presence by the agent-events leader, everything else where it happens (event-writers.ts).
+  let teamIntake: TeamIntakeService | undefined // HWA-36: drains queued intake on staffing/presence events (below)
+  /** (CON-04) Journal appends for the Concierge (context refresh, CON-05's notifier); set once the service exists. */
+  let conciergeOnAppend: ((userID: string, event: AgentEvent) => void) | undefined
+  // CON-01: the Concierge watchlist's lastActiveAt per session, from appends (best effort, never awaited; observe never
+  // rejects, and the catch keeps it that way: an unhandled rejection would end the process).
+  const conciergeActivity = new ActivityTracker({ state: backends.state, now })
+  // CON-03: the board's last result per root session, from appends (best effort, as above).
+  const conciergeResults = new ResultTracker({ state: backends.state, now })
   const agentEvents = new AgentEvents({
     log: backends.agentEvents ?? new MemoryEventLog({ now, max: AGENT_EVENTS_MAX, maxAgeMs: AGENT_EVENTS_AGE_MS }),
     kv: backends.kv,
     now,
-    onAppend: (userID, record) => webhooks.publishCanonical(userID, record.event, record.family, record.audience).then((queued) => (queued && !webhookLeader.isLeader() ? webhookLeader.kick() : undefined)),
+    onAppend: (userID, record) => (void teamIntake?.onEvent(userID, record.event), conciergeOnAppend?.(userID, record.event), void conciergeActivity.observe(userID, record.event).catch(() => {}), void conciergeResults.observe(userID, record.event).catch(() => {}), webhooks.publishCanonical(userID, record.event, record.family, record.audience).then((queued) => (queued && !webhookLeader.isLeader() ? webhookLeader.kick() : undefined))),
   })
   const agentEventWriters = new EventWriters({
     events: agentEvents,
@@ -856,13 +1005,58 @@ export function startCentral(options: CentralOptions): Central {
   })
   agentEventWriters.start()
   leader("agent-events", { onElected: () => agentEventWriters.elected(), onDeposed: () => agentEventWriters.deposed() })
+  // Persistent artifacts (HWA-21): metadata in the StateStore, bytes in Backends.blobs (files standalone, Postgres
+  // in a cluster (HWA-22); a bundle without blobs answers unsupported). Events go to the journal (family artifact); recovery
+  // and archive purging run on a leader.
+  const artifacts = backends.blobs
+    ? new ArtifactStore({
+        state: backends.state,
+        blobs: backends.blobs,
+        now,
+        workspaces: artifactWorkspacesFromState(backends.state),
+        onEvent: (userID, event) => void agentEvents.append(userID, artifactJournalEvent(event)).catch((cause) => console.error(`[hub] artifact event failed: ${(cause as Error).message}`)),
+      })
+    : undefined
+  const artifactMaintenance = artifacts ? new ArtifactMaintenance({ artifacts, users: allUsers }) : undefined
+  // Isolated artifact host (HWA-26): /artifact-host/v1/<capability>/… on this process (opaque-origin sandbox).
+  const artifactHostCaps = new ArtifactHostCaps({ state: backends.state, keys: tokenKeys, now })
+  const artifactHostServer = artifactHost({ caps: artifactHostCaps, ...(artifacts ? { artifacts } : {}), consoleOrigins: () => [...origins], deviceActive: (userID, id) => store.devices().some((d) => d.id === id && d.ownerID === userID), now })
+  // (CON-02) Session intent retention (agent/intents.ts sweep), on one leader every 6 h: online sessions (the
+  // registry, whatever the directory holds) are kept; records of deleted sessions and of sessions neither seen nor
+  // written for 30 days are dropped. The directory (at most 2000 records per user) only adds lastSeen/deletedAt.
+  const intentRetention = new IntentRetention({
+    intents,
+    users: allUsers,
+    now,
+    // (CON-10) Run Concierge prompt proposals: the build before CON-09a derived them as the session's intent.
+    proposed: async (userID) =>
+      (await decisions.list(userID, { state: "answered" })).flatMap((d) =>
+        d.as === "concierge" && d.action?.kind === "act" && d.action.verb === "prompt" && d.answer?.option === "go" && typeof d.action.input.text === "string"
+          ? [{ sessionID: d.action.target, text: d.action.input.text, at: d.answer.at }]
+          : [],
+      ),
+    facts: (userID) => {
+      const known = new Map((store.agentData(userID).sessions ?? []).map((s) => [s.sessionID, s]))
+      return (sessionID) => {
+        const s = known.get(sessionID)
+        const lastSeen = s?.lastSeen ?? s?.firstSeen
+        return {
+          online: registry.sessionTenant(sessionID) === userID && registry.hasSession(sessionID),
+          ...(lastSeen !== undefined ? { lastSeen } : {}),
+          ...(s?.deletedAt !== undefined ? { deletedAt: s.deletedAt } : {}),
+        }
+      }
+    },
+  })
+  leader("session-intents", { onElected: () => intentRetention.start(), onDeposed: () => intentRetention.stop() })
+  if (artifactMaintenance) leader("artifacts", { onElected: () => artifactMaintenance.start(), onDeposed: () => artifactMaintenance.stop() })
   for (const loop of leaders) void loop.start()
 
   // One credential resolver for every /api request: device cookie, device token, session and app tokens.
   // Every stored agent message also goes to the user's console streams (live transcript rows).
   feed.subscribe((userID, message) => broadcast({ type: "message", message }, { tenant: userID }), { origin: true })
-  const audit = new AgentAudit({ state: backends.state, now, admin: store, recorded: (userID, entry) => broadcast({ type: "agent", entry }, { tenant: userID }) })
-  const grants = new Grants({ state: backends.state, counters: backends.counters, directory, store, admin: store, now })
+  const audit = new AgentAudit({ state: backends.state, now, admin: store, recorded: (userID, entry) => broadcast({ type: "agent", entry }, { tenant: userID }), concierge: (userID, sessionID) => isConciergeSession(conciergeIdentity, userID, sessionID) })
+  const grants = new Grants({ state: backends.state, counters: backends.counters, directory, store, admin: store, now, concierge: async (owner) => (await conciergeIdentity.current(owner)).hiddenSessionIDs })
   const acting = new ActingSwitch({ store, never: config.agentsNever, audit })
   /** An agent as envelopes name it (a session by its directory name). */
   const describeActor = (userID: string, actor: AgentActor) => {
@@ -909,7 +1103,269 @@ export function startCentral(options: CentralOptions): Central {
     void escalations.closed(tenant, requestID).catch((cause) => console.error(`[hub] escalation close failed: ${(cause as Error).message}`))
   })
   const escalate: Escalate = (escalation) => escalations.escalate(escalation)
-  const agentDeps = { draining: drainSignal.signal, store, sessionTokens, directory, registry, spokes, delivery, decisions, feed, heartbeatMs, now, audit, grants, grantRequests, acting, actions, escalate, launches, webhooks, agentEvents, eventCursorKeys: tokenKeys, maxPromptChars: MAX_PROMPT_CHARS }
+  const profiles: ProfileStore = new ProfileStore({ state: backends.state, now, ack: (userID, assignment, version) => profileApplier!.ackFor(userID, assignment, version) })
+  profileApplier = new ProfileApplier({ profiles, registry, spokes, events: agentEvents, now })
+  profileApplier.start()
+  const workspaceStore = new WorkspaceStore({ state: backends.state, now, ownsMachine: (userID, machineID) => ownMachine(userID, machineID) !== undefined })
+  const workspaceMembers = new MembershipStore({ state: backends.state, workspaces: workspaceStore, now, presence: directoryPresence(directory, (userID) => store.agentData(userID).sessions ?? []) })
+  const workspaceSupervision = new SupervisionStore({ state: backends.state, workspaces: workspaceStore, members: workspaceMembers, now })
+  const workspaceLifecycle = new WorkspaceLifecycle({ workspaces: workspaceStore, members: workspaceMembers, supervision: workspaceSupervision, events: agentEvents })
+  registry.onSessionDeleted((sessionID, tenant) => void workspaceLifecycle.sessionEnded(tenant, sessionID).catch((cause) => console.error(`[hub] workspace session end failed: ${(cause as Error).message}`)))
+  const workspaces = { workspaces: workspaceStore, members: workspaceMembers, supervision: workspaceSupervision, lifecycle: workspaceLifecycle }
+  // Team staffing (HWA-35): seats end on session deletion; launched members are staffed when their launch runs.
+  const sessionDirectory = (userID: string, sessionID: string) => (registry.sessionTenant(sessionID) === userID ? registry.session(sessionID)?.directory : undefined)
+  const teamStaffing = new TeamStaffingService({ state: backends.state, teams: teamStore, seats: teamSeats, workspaces: workspaceStore, members: workspaceMembers, supervision: workspaceSupervision, presence: teamPresence, sessionDirectory, launches, grants, acting, audit, profiles, events: agentEvents, now })
+  registry.onSessionDeleted((sessionID, tenant) => void teamStaffing.sessionEnded(tenant, sessionID).catch((cause) => console.error(`[hub] team session end failed: ${(cause as Error).message}`)))
+  launchFeed.subscribe((userID, launch) => void teamStaffing.launchChanged(userID, launch).catch((cause) => console.error(`[hub] team staffing launch failed: ${(cause as Error).message}`)), { origin: true })
+  // Team intake (HWA-36): delivered to an entry seat from the fixed party app:team-intake (never the submitter).
+  teamIntake = new TeamIntakeService({ state: backends.state, teams: teamStore, seats: teamSeats, staffing: teamStaffing, members: workspaceMembers, presence: teamPresence, events: agentEvents, now, deliver: async (userID, sessionID, text) => ({ messageID: (await delivery.send(userID, intakeActor(userID), sessionID, "msg", text)).message.id }) })
+  // Supervisor checkpoints and batched digests (HWA-11): acknowledgments flush before answering; digests reach
+  // supervisor sessions through Delivery (as coordinatorActor) from the workspace-coordinator leader.
+  const workspaceCursors = journalCursors(tokenKeys, agentEvents)
+  let workspaceCoordinator: SupervisorCoordinator | undefined
+  const workspaceCheckpoints = new CheckpointStore({ ...workspaces, state: backends.state, cursors: workspaceCursors, now, onAck: async (u, w, m, b) => workspaceCoordinator?.acknowledged(u, w, m, b) })
+  const coordinatorLeader = leader("workspace-coordinator", { onElected: () => workspaceCoordinator?.start(), onDeposed: () => workspaceCoordinator?.stop() })
+  workspaceCoordinator = new SupervisorCoordinator({
+    ...workspaces,
+    state: backends.state,
+    events: agentEvents,
+    cursors: workspaceCursors,
+    checkpoints: workspaceCheckpoints,
+    sessions: registryBoardSessions(directory, registry),
+    send: async (userID, sessionID, text, options) => {
+      const sent = await delivery.send(userID, coordinatorActor(userID), sessionID, "msg", text, options)
+      return { messageID: sent.message.id, ...(sent.delivery ? { delivery: sent.delivery } : {}), ...(sent.woke !== undefined ? { woke: sent.woke } : {}) }
+    },
+    users: allUsers,
+    isLeader: () => coordinatorLeader.isLeader(),
+    owner: leaseOwner,
+    now,
+    ...(loopTickMs !== undefined ? { tickMs: loopTickMs } : {}),
+  })
+  void coordinatorLeader.start() // created after the other leaders were started
+  const teamDiscovery = new TeamDiscovery({ teams: teamStore, seats: teamSeats, directory, harnesses: catalogHarnesses(registry) })
+
+  // ---- CON-04 the Concierge: settings, launch, supervise, hide, context ----
+  const conciergeSettings = new SettingsStore(backends.state, now)
+  const conciergeNotes = new NotesStore(backends.state, now)
+  const conciergeLabels = async (userID: string) => {
+    const out = new Map<string, Readonly<Record<string, string>>>()
+    for (const launch of await launches.list(userID)) if (launch.sessionID !== undefined) out.set(launch.sessionID, launch.spec.labels)
+    return out
+  }
+  // The board's `armed` flag reads the tiers slot (built below).
+  const conciergeArmed = async (userID: string) => conciergeTierHooks?.armedID?.(userID)
+  // (CON-13) The board's inGrant: the tiers' acting engine (made below) checks whether the current Concierge's grant
+  // would approve a pending request once, without acting.
+  let conciergeActing: Acting | undefined
+  const conciergeCoverage = async (userID: string, conciergeSessionID: string, sessionID: string, requestID: string) =>
+    conciergeActing ? conciergeActing.coverage({ userID, actor: { kind: "session", userID, machineID: "", sessionID: conciergeSessionID, via: "act" } }, sessionID, requestID) : { inGrant: false, auto: false }
+  const conciergeBoardDeps = { coverage: conciergeCoverage, identity: conciergeIdentity, state: backends.state, activity: conciergeActivity, directory, store, registry, decisions, labels: conciergeLabels, intents, results: conciergeResults, armed: conciergeArmed, timeZone: async (userID: string) => (await conciergeSettings.get(userID)).timeZone, now }
+  const conciergeRevisions = new BoardRevisions(backends.state)
+  const conciergeContext = new ContextPusher({
+    registry,
+    send: (connID, req) => spokes.request(connID, req),
+    board: async (userID) => (await conciergeBoard(conciergeBoardDeps, conciergeRevisions, userID, (await conciergeIdentity.current(userID)).hiddenSessionIDs)).rendered,
+    notes: conciergeNotes,
+    settings: conciergeSettings,
+    grant: async (userID, grantID) => {
+      try {
+        const grant = await grants.get(userID, grantID)
+        return { ...grant, state: grantState(grant, now()) }
+      } catch {
+        return undefined
+      }
+    },
+    // (CON-09a) Voice and voice confirm are in the instructions only when speech is set up for the user.
+    voice: (userID) => options.speech !== undefined || !speechSettings.view(speechScope(userID)).ready.reason,
+    now,
+  })
+  /** The user's machines as the Concierge's eligibility sees them (store, nodes, registry). */
+  const conciergeMachines = (userID: string): MachineFacts[] => {
+    const online = new Set(registry.catalog().map((m) => m.id))
+    return store
+      .machines()
+      .filter((m) => !m.revoked && m.ownerID === userID)
+      .map((m) => {
+        const node = nodes.forMachine(m.id)
+        const own = node && node.ownerID === userID ? node : undefined
+        const conn = registry.serviceFor(m.id)
+        return {
+          id: m.id,
+          name: m.name,
+          online: online.has(m.id) || own !== undefined,
+          ...(own ? { node: { runtimes: own.runtimes, workspaceRoots: own.workspaceRoots, draining: own.draining } } : {}),
+          ...(conn !== undefined ? { service: { launch: registry.supports(conn, "launch"), sessionContext: registry.supports(conn, "sessionContext") } } : {}),
+        }
+      })
+  }
+  let conciergeService: ConciergeService | undefined
+  let conciergeModulesNow: ReturnType<typeof conciergeModules> | undefined
+  const conciergeSupervisor = new Supervisor({
+    state: backends.state,
+    settings: conciergeSettings,
+    launches,
+    directory,
+    grants,
+    eligibility: (userID, machineID) => conciergeService!.eligibility(userID, machineID),
+    entitlements: C1_ENTITLEMENTS,
+    context: { push: (userID, sessionID) => conciergeContext.push(userID, sessionID, { force: true }).then(() => undefined), clear: (userID, sessionID) => conciergeContext.clear(userID, sessionID), retire: async (userID, sessionID) => {
+      // (CON-10) Hub updates still pending for it are dropped: never delivered to (or shown waiting for) an ended session.
+      const dropped = await delivery.dropPending(userID, sessionID).catch((cause) => (console.error(`[hub] concierge pending drop failed: ${(cause as Error).message}`), 0))
+      // Audited as a count only (never the updates' text).
+      if (dropped > 0) await store.audit({ actor: userID, action: "concierge.updates_dropped", target: sessionID, detail: String(dropped) }).catch(() => undefined)
+      await conciergeContext.retire(userID, sessionID)
+    } },
+    onStatus: (userID, status) => {
+      broadcast({ type: "concierge", status }, { tenant: userID })
+      void agentEvents.append(userID, conciergeEvent({ what: "status", state: status.state, generation: status.generation })).catch((cause) => console.error(`[hub] concierge event failed: ${(cause as Error).message}`))
+      if (status.state === "disabled") void conciergeModulesNow?.notifier.disabled(userID).catch(() => undefined)
+    },
+    audit: async (userID, action) => void (await store.audit({ actor: userID, action })),
+    // A session that becomes the Concierge leaves every workspace (member, master) and team seat it held: hub-owned.
+    onAdopted: async (userID, sessionID) => {
+      const [members, seats] = await Promise.all([workspaceLifecycle.sessionEnded(userID, sessionID), teamStaffing.sessionEnded(userID, sessionID)])
+      if (members.length || seats.length) await store.audit({ actor: userID, action: "concierge.detached", target: sessionID, detail: `${members.length} workspace memberships, ${seats.length} team seats` })
+    },
+    onSuspended: (userID, sessionID) => void notifier.notify("concierge", sessionID, "Concierge", undefined, userID, { key: `suspended:${sessionID}` }).catch(() => 0),
+    users: allUsers,
+    now,
+  })
+  conciergeService = new ConciergeService({
+    settings: conciergeSettings,
+    notes: conciergeNotes,
+    supervisor: conciergeSupervisor,
+    grants,
+    machines: conciergeMachines,
+    entitlements: C1_ENTITLEMENTS,
+    audit: async (userID, action) => void (await store.audit({ actor: userID, action })),
+    // The file store buffers writes (FILE_STATE_DEBOUNCE_MS); Postgres writes through.
+    ...(backends.state.flush ? { flush: () => backends.state.flush!() } : {}),
+  })
+  const conciergePorts: ConciergePorts = {
+    identity: conciergeIdentity,
+    status: (userID) => conciergeSupervisor.status(userID),
+    settings: (userID) => conciergeSettings.get(userID),
+    beforeWake: async (userID) => {
+      const { sessionID } = await conciergeIdentity.current(userID)
+      return sessionID !== undefined ? conciergeContext.beforeWake(userID, sessionID) : false
+    },
+    send: async (userID, text, sendOptions) => {
+      const { sessionID } = await conciergeIdentity.current(userID)
+      if (sessionID === undefined) throw new AgentError("not_found", "The Concierge is not running")
+      const sent = await delivery.send(userID, conciergeActor(userID), sessionID, "msg", text, { wake: sendOptions.wake, ...(sendOptions.urgent ? { urgent: true } : {}) })
+      return { messageID: sent.message.id, ...(sent.woke !== undefined ? { woke: sent.woke } : {}) }
+    },
+    entitlements: C1_ENTITLEMENTS,
+    users: allUsers,
+    // CON-05 the notifier's journal (cursor), ledger store, watchlist view, board revision and the concierge lease.
+    journal: {
+      events: agentEvents,
+      state: backends.state,
+      watched: (userID, hidden) => watchedSessions(conciergeBoardDeps, userID, hidden),
+      boardRevision: async (userID, hidden) => (await conciergeBoard(conciergeBoardDeps, conciergeRevisions, userID, hidden)).board.revision,
+      decisionOf: async (userID, messageID) => {
+        const decision = await decisions.byMessage(userID, messageID)
+        return decision ? { id: decision.id, about: decision.about } : undefined
+      },
+      isLeader: () => conciergeLeader.isLeader(),
+      owner: leaseOwner,
+      now,
+      ...(loopTickMs !== undefined ? { tickMs: loopTickMs } : {}),
+    },
+    // CON-06: proposals run through the same acting engine as the act verbs (agent/routes.ts actVerbRoutes).
+    tiers: {
+      state: backends.state,
+      counters: backends.counters,
+      decisions,
+      acting: (conciergeActing = new Acting({ registry, directory, actions, spokes: { request: (connID, req) => spokes.request(connID, req) }, grants, acting, audit, escalate, maxPromptChars: MAX_PROMPT_CHARS, protect: conciergeProtects(conciergeIdentity), conciergeActor: conciergeProtects(conciergeIdentity) })),
+      audit,
+      protects: conciergeProtects(conciergeIdentity),
+      published: (userID, message) => feed.publish(userID, message),
+      describe: describeActor,
+      present: (deviceID, sessionID) => registry.present(deviceID, sessionID),
+      deviceOwner: (deviceID) => store.devices().find((d) => d.id === deviceID)?.ownerID,
+      // The board shows the armed Decision: refresh the Concierge's context too.
+      armed: (userID, armed) => (broadcast({ type: "concierge", armed }, { tenant: userID }), conciergeTouch(userID)),
+      now,
+    },
+  }
+  const conciergeParts = conciergeModules(conciergePorts)
+  conciergeModulesNow = conciergeParts
+  conciergeTierHooks = conciergeParts.tiers
+  /** The user's current Concierge session, for a debounced context refresh. */
+  const conciergeTouch = (userID: string, soon = false) => conciergeContext.touch(userID, async () => (await conciergeIdentity.current(userID)).sessionID, soon ? { soon } : {})
+  conciergeOnAppend = (userID, event) => {
+    try {
+      // (CON-13) A blocker opened or closed reaches the Concierge's board within a second.
+      conciergeTouch(userID, event.type === "blocker.opened" || event.type === "blocker.closed")
+      conciergeParts.notifier.observe(userID, event)
+    } catch (cause) {
+      console.error(`[hub] concierge append hook failed: ${(cause as Error).message}`)
+    }
+  }
+  // Kicks: a Concierge launch changed, a node connected, a spoke reported its sessions (also re-sends the context
+  // to a restarted spoke: a new connection reports the session).
+  launchFeed.subscribe((userID, launch) => (isConciergeLaunch(launch) ? conciergeSupervisor.kick(userID) : undefined), { origin: true })
+  nodes.subscribe((event) => (event.type === "connected" && event.node.ownerID !== undefined ? conciergeSupervisor.kick(event.node.ownerID) : undefined), { remote: true })
+  /**
+   * What the spoke reports about the user's current Concierge session (each sessions frame): on another agent than
+   * `concierge` → suspended at once (grant revoked, authority gone; only the user restarts it); without the
+   * context revision the hub sent (a restarted or reconnected spoke) → the context is re-sent now, not debounced.
+   */
+  const conciergeForced = new Map<string, number>()
+  const conciergeReported = async (tenant: string) => {
+    const { sessionID, hiddenSessionIDs } = await conciergeIdentity.current(tenant)
+    // (CON-09a) A previous Concierge session a spoke reports without the retired context's revision (a restarted
+    // spoke, or one that lost it) is retired again (locked, powerless): forced, at most once per CONCIERGE_FORCED_PUSH_MS.
+    for (const id of hiddenSessionIDs) {
+      if (id === sessionID || registry.sessionTenant(id) !== tenant) continue
+      const view = registry.session(id)
+      if (!view || view.contextRevision === conciergeContext.revisionOf(tenant, id)) continue
+      // A reported revision that is not ours: the spoke lost it, so the same connection gets it again (forced).
+      // None reported (a new connection, an older spoke): sent once per connection (not forced).
+      const force = view.contextRevision !== undefined
+      const key = `retire\n${tenant}\n${id}`
+      const at = now()
+      if (force && at - (conciergeForced.get(key) ?? -Infinity) < CONCIERGE_FORCED_PUSH_MS) continue
+      // Re-read: a relaunch may have adopted this very session meanwhile (never retire the current one).
+      if ((await conciergeIdentity.current(tenant)).sessionID === id) continue
+      if (force) conciergeForced.set(key, at)
+      await conciergeContext.retire(tenant, id, { force })
+    }
+    if (sessionID === undefined || registry.sessionTenant(sessionID) !== tenant) return
+    const view = registry.session(sessionID)
+    if (!view) return
+    // OpenCode's internal agents (title, compaction, summary) are not tamper; every other agent is.
+    if (view.agent !== undefined && view.agent !== CONCIERGE_AGENT && !INTERNAL_AGENTS.has(view.agent)) {
+      if (!KNOWN_PRIMARY_AGENTS.has(view.agent)) console.warn(`[hub] concierge session ${sessionID} reported on unknown agent ${view.agent.slice(0, 60)}: suspending`)
+      await conciergeSupervisor.suspend(tenant, sessionID, CONCIERGE_TAMPERED)
+      await backends.state.flush?.()
+      return
+    }
+    const revision = conciergeContext.revisionOf(tenant, sessionID)
+    if (revision !== undefined && view.contextRevision === revision) return
+    // At most one forced push per session every CONCIERGE_FORCED_PUSH_MS (the debounced refresh still runs).
+    const key = `${tenant}\n${sessionID}`
+    const at = now()
+    if (at - (conciergeForced.get(key) ?? -Infinity) < CONCIERGE_FORCED_PUSH_MS) return
+    conciergeForced.set(key, at)
+    if (conciergeForced.size > 1000) conciergeForced.delete(conciergeForced.keys().next().value as string)
+    await conciergeContext.push(tenant, sessionID, { force: true })
+  }
+  registry.onSessions((connID) => {
+    const tenant = registry.connTenant(connID)
+    if (tenant === undefined) return
+    conciergeSupervisor.kick(tenant)
+    conciergeTouch(tenant)
+    void conciergeReported(tenant).catch((cause) => console.error(`[hub] concierge report check failed: ${(cause as Error).message}`))
+  })
+  const conciergeLeader = leader("concierge", {
+    onElected: () => (conciergeSupervisor.start(), conciergeParts.notifier.start()),
+    onDeposed: () => (conciergeSupervisor.stop(), conciergeParts.notifier.stop()),
+  })
+  void conciergeLeader.start()
+  const agentDeps = { intents, teamDiscovery, draining: drainSignal.signal, store, sessionTokens, directory, registry, spokes, delivery, decisions, feed, heartbeatMs, now, audit, grants, grantRequests, acting, actions, escalate, launches, webhooks, agentEvents, eventCursorKeys: tokenKeys, maxPromptChars: MAX_PROMPT_CHARS, profiles, workspaces, workspaceCheckpoints, teamIntake, graph: { teams: { teams: teamStore, seats: teamSeats! } }, teams: { teams: teamStore, seats: teamSeats!, staffing: teamStaffing }, artifacts: { ...(artifacts && backends.blobs ? { artifacts, blobs: backends.blobs } : {}), state: backends.state, now }, artifactHost: { caps: artifactHostCaps, ...(artifacts ? { artifacts } : {}) }, concierge: { state: backends.state, activity: conciergeActivity, results: conciergeResults, identity: conciergeIdentity, protects: conciergeProtects(conciergeIdentity), service: conciergeService, routes: () => conciergeParts.tiers.routes(), armed: conciergeArmed, timeZone: conciergeBoardDeps.timeZone, coverage: conciergeCoverage } }
   const resolveActor = createResolver({
     cookieName: COOKIE,
     findDevice: (token) => deviceOfToken(token),
@@ -926,6 +1382,8 @@ export function startCentral(options: CentralOptions): Central {
       void store.touchUser(user.id)
     },
     routes: [...agentRoutes(agentDeps), ...(options.agent?.routes ?? [])],
+    // CON-04: a Concierge session's tokens reach only an explicit route allow-list (fail closed).
+    gate: conciergeSessionGate(conciergeIdentity, () => conciergeParts.tiers.routes()),
   })
 
   // POST /mcp (MCP Streamable HTTP): `hub mcp`'s tools as the bearer's caller; their /api/agent calls are dispatched
@@ -987,6 +1445,7 @@ export function startCentral(options: CentralOptions): Central {
       if (method === "GET" && pathname === "/login") return login(request, url)
       if (oidc && method === "GET" && pathname === "/auth/login") return await authLogin(url)
       if (oidc && method === "GET" && pathname === "/auth/callback") return await authCallback(request, url)
+      if (isArtifactHostPath(pathname)) return await artifactHostServer.handle(request, url)
       if (pathname === MCP_PATH) return await mcp(request)
       if (isAgentPath(pathname)) return await agent.handle(request, url)
       if (pathname.startsWith("/api/")) return await api(request, server, url)
@@ -1093,19 +1552,24 @@ export function startCentral(options: CentralOptions): Central {
     ),
     route("GET", "/api/machines", "user", ({ user }) => Response.json({ machines: machines(user.id) })),
     route("GET", "/api/events", "user", ({ request, server, user, device, url }) => {
+      const shown = streamSessionsQuery(url)
+      if ("problem" in shown) return error(400, shown.problem)
       server.timeout(request, 0)
-      const session = url.searchParams.get("session")
+      // Only the user's own sessions; others are left out silently (no hint whether they exist).
+      const sessions = shown.sessions.filter((session) => registry.owns(user.id, session))
       return events(request.signal, user.id, device.id, {
         lastID: request.headers.get("last-event-id") ?? url.searchParams.get("last") ?? undefined,
         lite: url.searchParams.get("lite") === "1",
-        ...(session && session.length <= 300 && registry.owns(user.id, session) ? { session } : {}),
+        ...(sessions.length ? { sessions } : {}),
+        // A pane console learns what is streamed (an older console, with ?session= only, gets no new message).
+        scope: shown.multi,
       })
     }),
     // The phone's session view (hidden/pinned sessions and workspaces), per user, synced to their other devices.
     route("GET", "/api/prefs/view", "user", ({ user }) => Response.json({ prefs: store.viewPrefs(user.id) }, { headers: NO_STORE })),
     route("PUT", "/api/prefs/view", "user", async ({ request, user, device }) => {
       const before = new Set(store.viewPrefs(user.id).hiddenSessions)
-      const prefs = await store.setViewPrefs(user.id, viewPrefsInput(await request.json()))
+      const prefs = await store.setViewPrefs(user.id, viewPrefsInput(await jsonBody(request)))
       // The user's other devices only: never another user, and not the device that made the change.
       toUser(user.id, { type: "prefs", prefs }, device.id)
       // Archive changes made in the console go to the agent event journal like the agent API's.
@@ -1220,9 +1684,12 @@ export function startCentral(options: CentralOptions): Central {
     // The caller's own settings (pairing mode: the single owner's are the server default).
     route("GET", "/api/settings/speech", "user", ({ user }) => Response.json(speechSettings.view(speechScope(user.id)), { headers: NO_STORE })),
     // Raw JSON: anything but an object is refused by the validator.
-    route("PUT", "/api/settings/speech", "user", async ({ request, user }) =>
-      Response.json(await speechSettings.update(await request.json(), speechScope(user.id)), { headers: NO_STORE }),
-    ),
+    route("PUT", "/api/settings/speech", "user", async ({ request, user }) => {
+      const view = await speechSettings.update(await jsonBody(request), speechScope(user.id))
+      // (CON-10) The Concierge's instructions mention voice only while speech is ready: refresh its context.
+      conciergeTouch(user.id)
+      return Response.json(view, { headers: NO_STORE })
+    }),
     route("GET", "/api/settings/speech/models", "user", async ({ url, user }) => {
       const kind = url.searchParams.get("kind")
       if (kind !== "stt" && kind !== "tts") return error(400, "Expected kind=stt or kind=tts")
@@ -1267,6 +1734,16 @@ export function startCentral(options: CentralOptions): Central {
       return Response.json(stopped.result, { headers: NO_STORE })
     }),
     route("POST", "/api/sessions/:session/rename", "session", ({ request, params }) => rename(request, params.session!)),
+    // Fork and revert (feature "fork"/"revert"; console only, audited): see docs/session-view.md.
+    route("POST", "/api/sessions/:session/fork", "session", ({ request, params, user }) => forkSession(request, params.session!, user.id)),
+    route("GET", "/api/sessions/:session/revert/preview", "session", async ({ params, url }) => {
+      const messageID = messageIDInput(url.searchParams.get("messageID"))
+      const preview = await spokes.request(featureOwner(params.session!, "revert"), { op: "revertPreview", sessionID: params.session!, messageID })
+      return Response.json(preview, { headers: NO_STORE })
+    }),
+    route("POST", "/api/sessions/:session/revert", "session", ({ request, params, user }) => revertSession(request, params.session!, user.id)),
+    route("POST", "/api/sessions/:session/revert/restore", "session", ({ params, user }) => revertEnd(params.session!, user.id, "revertRestore")),
+    route("POST", "/api/sessions/:session/revert/commit", "session", ({ params, user }) => revertEnd(params.session!, user.id, "revertCommit")),
     route("POST", "/api/sessions/:session/conversation", "session", ({ request, params }) => conversation(request, params.session!), true),
     route("GET", "/api/sessions/:session/models", "session", async ({ params }) =>
       Response.json(await spokes.request(ownerOf(params.session!), { op: "models", sessionID: params.session! }), { headers: NO_STORE })),
@@ -1281,7 +1758,7 @@ export function startCentral(options: CentralOptions): Central {
       return Response.json({ prefs, defaults: defaults.defaults }, { headers: NO_STORE })
     }),
     route("PUT", "/api/sessions/:session/model-prefs", "session", async ({ request, params, user }) => {
-      const change = modelPrefsInput(await request.json())
+      const change = modelPrefsInput(await jsonBody(request))
       await checkModelSelections(ownerOf(params.session!), params.session!, change)
       const reply = await spokes.request(ownerOf(params.session!), { op: "setModelPrefs", sessionID: params.session!, ...change })
       const prefs = await store.setModelPrefs(user.id, params.session!, change)
@@ -1332,8 +1809,8 @@ export function startCentral(options: CentralOptions): Central {
       "session",
       async ({ params }) => Response.json(await spokes.request(ownerOf(params.session!), { op: "context", sessionID: params.session! })),
     ),
-    route("POST", "/api/sessions/:session/permission", "session", ({ request, params }) => permission(request, params.session!)),
-    route("POST", "/api/sessions/:session/form", "session", ({ request, params }) => form(request, params.session!)),
+    route("POST", "/api/sessions/:session/permission", "session", ({ request, params, user }) => permission(request, params.session!, user.id)),
+    route("POST", "/api/sessions/:session/form", "session", ({ request, params, user }) => form(request, params.session!, user.id)),
     route("GET", "/api/sessions/:session/summary", "session", async ({ params }) =>
       Response.json(await spokes.request(ownerOf(params.session!), { op: "summary", sessionID: params.session! }), { headers: NO_STORE })),
     route("GET", "/api/sessions/:session/diff", "session", async ({ params, url }) => {
@@ -1402,6 +1879,8 @@ export function startCentral(options: CentralOptions): Central {
       const decision = await decisions.get(user.id, params.id!)
       return decision ? Response.json({ decision }, { headers: NO_STORE }) : error(404, "No such decision", "not_found")
     }),
+    // CON-06: `via: "voice" | "text"` (the Concierge panel) only for an armed confirm Decision on a device present on
+    // the current Concierge session (tiers.ts); else 403 "Answer this decision with a tap".
     route("POST", "/api/decisions/:id/answer", "user", async ({ request, params, user, device }) => {
       const input = await body(request)
       const via = (await resolveActor.mode(request)) === "bearer" ? "device-token" : "cookie"
@@ -1416,7 +1895,7 @@ export function startCentral(options: CentralOptions): Central {
     }),
     route("GET", "/api/settings/speech/default", "admin", () => Response.json(speechSettings.view(), { headers: NO_STORE })),
     route("PUT", "/api/settings/speech/default", "admin", async ({ request, user }) => {
-      const view = await speechSettings.update(await request.json())
+      const view = await speechSettings.update(await jsonBody(request))
       await store.audit({ actor: user.id, action: "speech.default" })
       return Response.json(view, { headers: NO_STORE })
     }),
@@ -1646,6 +2125,64 @@ export function startCentral(options: CentralOptions): Central {
     return connID
   }
 
+  /**
+   * The process that runs a fork or revert op: the session's owner, else another process reporting it, that
+   * announced the feature; 409 unsupported {feature, harness} when none did (another harness, an older plugin, or
+   * an OpenCode process that cannot reach its own server).
+   */
+  function featureOwner(sessionID: string, feature: "fork" | "revert"): string {
+    const targets = registry.sessionTargets(sessionID)
+    if (!targets.length) throw new HttpError(409, NO_OWNER)
+    const connID = targets.find((c) => registry.supports(c, feature))
+    if (!connID) throw unsupportedError({ feature, harness: registry.harnessOf(targets[0]!) ?? "unknown" })
+    return connID
+  }
+
+  /** A user message ID from a request (1–300 ID characters), else 400. */
+  function messageIDInput(raw: unknown): string {
+    if (typeof raw !== "string" || !MESSAGE_ID.test(raw)) throw new HttpError(400, "Expected {messageID}: one of the session's user messages")
+    return raw
+  }
+
+  /** A spoke's refusal of a revert while the session runs, as 409 busy; anything else unchanged. */
+  function busyRefusal(cause: unknown): unknown {
+    return cause instanceof SpokeError && cause.message === REVERT_BUSY ? new HttpError(409, REVERT_BUSY, "busy") : cause
+  }
+
+  /** POST …/fork {messageID}: a new session with the conversation before that user message (201). */
+  async function forkSession(request: Request, sessionID: string, userID: string): Promise<Response> {
+    const messageID = messageIDInput((await body(request)).messageID)
+    const connID = featureOwner(sessionID, "fork")
+    const result = await spokes.request(connID, { op: "fork", sessionID, messageID })
+    await store.audit({ actor: userID, action: "session.fork", target: sessionID, detail: `${messageID} -> ${result.sessionID}` })
+    return Response.json(result, { status: 201, headers: NO_STORE })
+  }
+
+  /** POST …/revert {messageID, files?}: stages a revert (files restored unless files: false); 409 while it runs. */
+  async function revertSession(request: Request, sessionID: string, userID: string): Promise<Response> {
+    const input = await body(request)
+    const messageID = messageIDInput(input.messageID)
+    if (input.files !== undefined && typeof input.files !== "boolean") return error(400, "files must be true or false")
+    const files = input.files !== false
+    const connID = featureOwner(sessionID, "revert")
+    if (registry.running(sessionID)) throw new HttpError(409, REVERT_BUSY, "busy")
+    const result = await spokes.request(connID, { op: "revert", sessionID, messageID, files }).catch((cause) => {
+      throw busyRefusal(cause)
+    })
+    await store.audit({ actor: userID, action: "session.revert", target: sessionID, detail: files ? messageID : `${messageID} (messages only)` })
+    return Response.json(result, { headers: NO_STORE })
+  }
+
+  /** POST …/revert/restore (undo) or …/revert/commit (make permanent): 204. */
+  async function revertEnd(sessionID: string, userID: string, op: "revertRestore" | "revertCommit"): Promise<Response> {
+    const connID = featureOwner(sessionID, "revert")
+    await spokes.request(connID, { op, sessionID }).catch((cause) => {
+      throw busyRefusal(cause)
+    })
+    await store.audit({ actor: userID, action: op === "revertRestore" ? "session.revert.restore" : "session.revert.commit", target: sessionID })
+    return new Response(null, { status: 204 })
+  }
+
   /** Conversation mode: steer the utterance into the session (allowed while it is busy) and return at once. */
   async function utterance(request: Request, sessionID: string): Promise<Response> {
     const raw = (await body(request)).text
@@ -1766,17 +2303,27 @@ export function startCentral(options: CentralOptions): Central {
     return Response.json({ sessionID: result.sessionID, ...(openedIn ? { openedIn } : {}), ...(warning ? { warning } : {}) }, { status: 201 })
   }
 
-  async function permission(request: Request, rootID: string): Promise<Response> {
+  /**
+   * (CON-13) The user's own answer on a session's card, in the agent audit as actor user (as the acting engine records
+   * a user's act through /api/agent): Settings → Agents → Activity then shows "you denied …" next to the agents'
+   * answers. The asking session (a subagent's request is answered through its root) is the target. Best effort.
+   */
+  const auditUserAnswer = (userID: string, verb: "approve" | "deny" | "answer", target: { sessionID: string; requestID?: string; formID?: string }) =>
+    void audit.record(userID, { actor: { kind: "user" }, verb, target, decision: "allow", outcome: "ok" }).catch((cause: unknown) => console.error(`[hub] audit of a console answer failed: ${(cause as Error).message}`))
+
+  async function permission(request: Request, rootID: string, userID: string): Promise<Response> {
     const input = await body(request)
     const decision = input.decision as PermissionDecision
     if (typeof input.requestID !== "string" || !DECISIONS.has(decision)) return error(400, "Invalid decision")
+    const asking = registry.permissionRequest(input.requestID)?.sessionID ?? rootID
     const answered = await actions.answerPermission({ rootID, requestID: input.requestID, decision })
     if (answered.outcome === "unsupported") throw unsupportedError(answered)
+    if (answered.outcome === "done") auditUserAnswer(userID, decision === "reject" ? "deny" : "approve", { sessionID: asking, requestID: input.requestID })
     return answered.outcome === "done" ? new Response(null, { status: 204 }) : error(409, PERMISSION_GONE, "gone")
   }
 
   /** Answers or cancels a pending form (question) in the session's tree, through a process that holds it. */
-  async function form(request: Request, rootID: string): Promise<Response> {
+  async function form(request: Request, rootID: string, userID: string): Promise<Response> {
     const input = await body(request)
     if (typeof input.formID !== "string" || !input.formID || input.formID.length > 300) return error(400, "Expected {formID, answer} or {formID, cancel: true}")
     const cancel = input.cancel === true
@@ -1785,10 +2332,12 @@ export function startCentral(options: CentralOptions): Central {
       const problem = formAnswerProblem(input.answer)
       if (problem) return error(400, problem)
     }
+    const asking = registry.status(rootID)?.find((s) => s.blockers.some((b) => b.kind === "form" && b.id === input.formID))?.id ?? rootID
     const answered = await actions.answerForm(
       cancel ? { rootID, formID: input.formID, cancel: true } : { rootID, formID: input.formID, answer: input.answer as FormAnswer },
     )
     if (answered.outcome === "unsupported") throw unsupportedError(answered)
+    if (answered.outcome === "done") auditUserAnswer(userID, "answer", { sessionID: asking, formID: input.formID })
     return answered.outcome === "done" ? new Response(null, { status: 204 }) : error(409, PERMISSION_GONE, "gone")
   }
 
@@ -1798,8 +2347,7 @@ export function startCentral(options: CentralOptions): Central {
     if (Number(request.headers.get("content-length") ?? 0) > config.maxAudioBytes) {
       return error(413, "Recording too large")
     }
-    const audio = new Uint8Array(await request.arrayBuffer())
-    if (audio.length > config.maxAudioBytes) return error(413, "Recording too large")
+    const audio = await boundedBytes(request, config.maxAudioBytes, "Recording too large")
     if (audio.length === 0) return error(400, "Empty recording")
     return Response.json({ text: await speech.transcribe(audio, format) })
   }
@@ -1809,7 +2357,7 @@ export function startCentral(options: CentralOptions): Central {
    * after it when its log still covers the gap (one fresh catalog if catalogs changed meanwhile), else it starts
    * over: the catalog, then a `resync` marker so the page refetches what it shows. Heartbeats are `ping` events.
    */
-  function events(signal: AbortSignal, userID: string, deviceID: string, options: { lastID?: string; lite: boolean; session?: string }): Response {
+  function events(signal: AbortSignal, userID: string, deviceID: string, options: { lastID?: string; lite: boolean; sessions?: readonly string[]; scope?: boolean }): Response {
     // Draining: come back (to another pod) shortly.
     if (draining) return new Response(SSE_RETRY, { headers: { "content-type": "text/event-stream", "cache-control": "no-cache" } })
     const encoder = new TextEncoder()
@@ -1827,7 +2375,7 @@ export function startCentral(options: CentralOptions): Central {
           userID,
           deviceID,
           lite: options.lite,
-          ...(options.session ? { session: options.session } : {}),
+          ...(options.sessions ? { sessions: options.sessions } : {}),
           send: (message, id) => write(`${id ? `id: ${id}\n` : ""}data: ${JSON.stringify(message)}\n\n`),
           close: () => {
             cleanup()
@@ -1840,6 +2388,12 @@ export function startCentral(options: CentralOptions): Central {
             listener.close()
           },
         }
+        // At once, whatever follows: Bun sends the response head with the first body chunk, and a resumed stream
+        // with nothing to replay would otherwise stay silent until the first heartbeat, so the page's EventSource
+        // would not open (its "Reconnecting…" showing) for up to heartbeatMs (RP-10). A comment: the page ignores it.
+        write(": open\n\n")
+        // Before anything else, so the page can tell a hub that streams several sessions from one that does not.
+        if (options.scope) listener.send({ type: "scope", sessions: options.sessions ?? [] })
         if (live) return clusterStream(listener, write)
         eventLog.open(userID)
         const missed = options.lastID ? eventLog.since(userID, options.lastID) : undefined
@@ -2012,7 +2566,11 @@ export function startCentral(options: CentralOptions): Central {
     launchTokens,
     webhooks,
     agentEvents,
+    directory,
+    concierge: conciergeService,
     agentEventWriters,
+    intentRetention,
+    teams: { store: teamStore, seats: teamSeats, staffing: teamStaffing, intake: teamIntake },
     routes: [...routes.map(({ method, path, access }) => ({ method, path, access })), ...agent.routes.map(({ method, path }) => ({ method, path, access: "agent" as const }))],
     drain(drainOptions: DrainOptions = {}) {
       draining ??= runDrain(drainOptions)
@@ -2022,7 +2580,12 @@ export function startCentral(options: CentralOptions): Central {
       // Step down first (releasing the leases), so another pod takes the timed jobs over at once.
       await Promise.allSettled([...leaders.map((loop) => loop.stop()), recommendations?.stop()])
       launches.shutdown()
+      conciergeSupervisor.stop()
+      conciergeContext.stop()
+      conciergeParts.tiers.stop?.()
       webhooks.stop()
+      artifactMaintenance?.stop()
+      profileApplier?.stop()
       agentEventWriters.stop()
       tokenPush.stop()
       delivery.stop()
@@ -2047,18 +2610,19 @@ const optionalState = (url: URL): { state?: Decision["state"] } => {
   return state ? { state } : {}
 }
 
-/** {option?, text?} of a Decision answer (types only; Decisions validates). */
-function decisionAnswer(input: Record<string, unknown>): { option?: string; text?: string } {
+/** {option?, text?, via?} of a Decision answer (types only; Decisions validates). */
+function decisionAnswer(input: Record<string, unknown>): { option?: string; text?: string; via?: AnswerVia } {
   for (const key of ["option", "text"] as const) {
     if (input[key] !== undefined && typeof input[key] !== "string") throw new AgentError("invalid", `${key} must be a string`)
   }
-  return { ...(typeof input.option === "string" ? { option: input.option } : {}), ...(typeof input.text === "string" ? { text: input.text } : {}) }
+  if (input.via !== undefined && !(ANSWER_VIAS as readonly unknown[]).includes(input.via)) throw new AgentError("invalid", `via is one of ${ANSWER_VIAS.join(", ")}`)
+  return { ...(typeof input.option === "string" ? { option: input.option } : {}), ...(typeof input.text === "string" ? { text: input.text } : {}), ...(input.via !== undefined ? { via: input.via as AnswerVia } : {}) }
 }
 
 /** Console envelope for a Decision failure: gone → 409 (the web app's toast), the rest by code. */
 function decisionFailure(cause: unknown): Response {
   if (!(cause instanceof AgentError)) throw cause
-  const status: Partial<Record<string, number>> = { gone: 409, not_found: 404, forbidden: 403, invalid: 400, rate_limited: 429, paused: 423 }
+  const status: Partial<Record<string, number>> = { gone: 409, not_found: 404, forbidden: 403, invalid: 400, rate_limited: 429, paused: 423, offline: 503, unsupported: 422 }
   return Response.json({ error: cause.message, code: cause.code, ...(cause.options.hint ? { hint: cause.options.hint } : {}) }, { status: status[cause.code] ?? 500 })
 }
 
@@ -2172,13 +2736,32 @@ function param(raw: string): string {
 
 const sleep = (ms: number) => new Promise<undefined>((resolve) => setTimeout(() => resolve(undefined), ms))
 
+/**
+ * Console and public JSON bodies: at most this many bytes (agent/body.ts bounds the bytes and time read). Generous:
+ * a prompt may carry up to 4 images (MAX_PROMPT_IMAGES; the validator refuses more than MAX_PROMPT_IMAGES_BASE64).
+ */
+const CONSOLE_JSON_BODY_MAX = 4 << 20
+
+/** The bytes of a console/public request body, or HttpError 413 (too large) / 408 (too slow). */
+async function boundedBytes(request: Request, max: number, tooLarge: string): Promise<Uint8Array> {
+  const read = await readBounded(request, max)
+  if (read.ok) return read.bytes
+  if (read.reason === "timeout") throw new HttpError(408, slowMessage(), undefined, true)
+  throw new HttpError(413, tooLarge, undefined, read.close)
+}
+
+/** A console/public JSON body (a SyntaxError for invalid JSON, as request.json() threw). */
+async function jsonBody(request: Request): Promise<unknown> {
+  return JSON.parse(Buffer.from(await boundedBytes(request, CONSOLE_JSON_BODY_MAX, `Request body too large (at most ${CONSOLE_JSON_BODY_MAX} bytes)`)).toString("utf8"))
+}
+
 async function body(request: Request): Promise<Record<string, unknown>> {
-  const value = (await request.json()) as unknown
+  const value = await jsonBody(request)
   return typeof value === "object" && value !== null && !Array.isArray(value) ? (value as Record<string, unknown>) : {}
 }
 
 function failure(cause: unknown): Response {
-  if (cause instanceof HttpError) return error(cause.status, cause.message, cause.code)
+  if (cause instanceof HttpError) return error(cause.status, cause.message, cause.code, cause.close ? { connection: "close" } : undefined)
   if (cause instanceof BusyError) return error(409, cause.message)
   if (cause instanceof RateLimitError) return error(429, cause.message)
   if (cause instanceof ValidationError) return error(400, cause.message)