@huynle/hub 0.7.4 → 0.8.0

package/src/central/agent/app-tokens.ts

@@ -7,6 +7,7 @@
 //
 // Management (create, list, revoke) is for user actors only (allow {}): a session or app token cannot mint or
 // see tokens (escalation guard).
+import { boundedJson } from "./body"
 import { randomBytes, timingSafeEqual } from "node:crypto"
 import type { AppToken } from "../agent-data"
 import { hashToken, type Store } from "../store"
@@ -19,7 +20,7 @@ import type { AgentRoute } from "./routes"
  * acting on sessions (approve, deny, answer, prompt, stop) and launching sessions (phase 4), each of which still
  * needs a grant held by the token (with the act verb, or `launch` covering the repo).
  */
-export const APP_SCOPES: readonly string[] = ["sessions:read", "sessions:manage", "messages:send", "messages:read", "sessions:act", "sessions:launch", "events:subscribe"]
+export const APP_SCOPES: readonly string[] = ["sessions:read", "sessions:manage", "messages:send", "messages:read", "sessions:act", "sessions:launch", "events:subscribe", "profiles:read", "profiles:manage", "profiles:assign", "workspaces:read", "workspaces:manage", "artifacts:read", "artifacts:write", "artifacts:ai", "teams:submit", "teams:read", "teams:manage"]
 export const DEFAULT_APP_SCOPES: readonly string[] = ["sessions:read"]
 /** What `hub login` (the CLI login device code) asks for unless it asks for more: reading sessions and messaging. */
 export const DEFAULT_CLI_LOGIN_SCOPES: readonly string[] = ["sessions:read", "messages:send", "messages:read"]
@@ -121,7 +122,7 @@ export function appTokenRoutes(store: Store): AgentRoute[] {
       path: PREFIX,
       allow: {},
       async handle({ request, user }) {
-        const { record, token } = await issueAppToken(store, user.id, parseCreate(await request.json()))
+        const { record, token } = await issueAppToken(store, user.id, parseCreate(await boundedJson(request)))
         return Response.json({ ...view(record), token }, { status: 201, headers: NO_STORE })
       },
     },

package/src/central/agent/audit.ts

@@ -10,6 +10,9 @@
 //   fails the record.
 // - Admins see only a hub-wide summary in the Store's audit (who: the user ID; kind: agent.<verb> and the actor
 //   kind; when), never targets, reasons or text (design §7).
+// - (CON-06) `as: "concierge"`: entries whose actor is one of the user's Concierge sessions (current or past) are
+//   marked here, centrally, so every recording route (acting, launch, message, roles) gets it; the console says
+//   "by @@concierge". A failed identity read leaves the entry unmarked (it is still recorded).
 import type { Clock, StateStore } from "../backend/types"
 import type { AuditEntry } from "../store"
 import { type Party, sanitizeText } from "./envelope"
@@ -50,6 +53,8 @@ export interface AuditInput {
   /** The agent's reason (`--why`) or the policy's. */
   readonly reason?: string
   readonly outcome: AuditOutcome
+  /** (CON-06) Done by one of the user's Concierge sessions (current or past). */
+  readonly as?: "concierge"
 }
 
 export interface AgentAuditEntry extends AuditInput {
@@ -80,6 +85,8 @@ export interface AgentAuditDeps {
   readonly recorded?: (userID: string, entry: AgentAuditEntry) => void
   /** Ring size (default AGENT_AUDIT_LIMIT). */
   readonly limit?: number
+  /** (CON-06) Whether a session is one of the user's Concierge sessions (current or past). */
+  readonly concierge?: (userID: string, sessionID: string) => Promise<boolean>
 }
 
 const ENTRIES = "agent-audit"
@@ -122,6 +129,7 @@ export class AgentAudit {
     const seq = (await updateVersioned<number>(state, userID, SEQ, SEQ_KEY, (current) => (current ?? 0) + 1))!
     const grant = cleanID(input.grant)
     const reason = cleanReason(input.reason)
+    const as = input.as === "concierge" || (input.actor.kind === "session" && (await this.isConcierge(userID, input.actor.sessionID))) ? ("concierge" as const) : undefined
     const entry: AgentAuditEntry = {
       seq,
       at: this.now(),
@@ -132,6 +140,7 @@ export class AgentAudit {
       decision: input.decision,
       ...(reason ? { reason } : {}),
       outcome: input.outcome,
+      ...(as ? { as } : {}),
     }
     await state.put(userID, ENTRIES, keyOf(seq), entry)
     if (seq > this.limit) await state.delete(userID, ENTRIES, keyOf(seq - this.limit))
@@ -144,6 +153,14 @@ export class AgentAudit {
     return entry
   }
 
+  private async isConcierge(userID: string, sessionID: string): Promise<boolean> {
+    try {
+      return (await this.deps.concierge?.(userID, sessionID)) === true
+    } catch {
+      return false
+    }
+  }
+
   /** The user's entries, newest first, a page at a time. */
   async list(userID: string, options: AuditListOptions = {}): Promise<AuditPage> {
     const limit = Math.min(Math.max(Math.floor(options.limit ?? AUDIT_PAGE_DEFAULT), 1), AUDIT_PAGE_MAX)

package/src/central/agent/body.ts

@@ -0,0 +1,163 @@
+// Bounded request bodies for JSON routes (HWA-28 review of HWA-21/24). The server's maxRequestBodySize is ~41 MiB
+// (artifact blob uploads plus drain headroom; Bun 1.3.5 did not even enforce it for a chunked body the handler keeps
+// up with), so every JSON route keeps its own bounds, in bytes AND time:
+//   - a declared content-length over the bound is refused without keeping anything (read and discarded within the
+//     drain budget below, else unread with Connection: close);
+//   - a streamed (chunked) body is kept only up to the bound; the rest is then read and discarded, but at most
+//     BODY_LIMITS.drainBytes more within BODY_LIMITS.drainMs. A body that ends within that budget leaves the
+//     kept-alive connection clean (cancelling mid-stream made Bun answer the client's NEXT request on it with a bare
+//     400, quirk cmramwb8). One that doesn't (endless, huge or dripping) is cancelled and the answer carries
+//     `Connection: close`, so clients and proxies do not reuse the dirty socket;
+//   - time is budgeted by RATE, not a fixed deadline: a body may take graceMs + received / minBytesPerSecond
+//     (so at most graceMs + max / minBytesPerSecond for the route's byte limit), and no gap between bytes may exceed
+//     idleMs. Slow but steady clients succeed (a 1.4 MB body at 20 KiB/s); a drip cannot hold a handler.
+//   - the body is read continuously (nothing but the next read is awaited), so Bun never gathers a flood into one
+//     huge chunk while JS waits on something else (a full-speed endless body stays at a few MiB of memory).
+// Over the bound answers 400 invalid "The body is larger than N bytes" (extra.limit) before any validation; too slow
+// answers 400 invalid "The body arrived too slowly …" (Connection: close).
+//
+// Limit of the platform (Bun 1.3.5, measured with raw sockets): after a handler answered, Bun keeps reading — and
+// discarding — whatever a client goes on sending on that socket, even with `Connection: close`, a cancelled body or
+// server.timeout(); the handler and its memory are free, but the socket stays open while bytes flow. That holds for
+// every route, including ones that never read a body. Only a front proxy with a request body limit ends it there.
+// Bun 1.4.4 (the pinned runtime) closes the socket after a `Connection: close` answer instead, and enforces the
+// server's maxRequestBodySize on chunked bodies (see its headroom in ../http.ts).
+import { AgentError } from "./errors"
+
+/** The default bound of an agent JSON body (messages, launches, grants, workspaces, …). */
+export const AGENT_JSON_BODY_MAX = 1 << 20
+/** Profiles carry versions of up to 512 KiB (PROFILE_LIMITS.versionBytes), JSON-escaped. */
+export const PROFILE_JSON_BODY_MAX = 4 << 20
+
+export interface BodyLimits {
+  /** At most this many bytes past the bound are read (and discarded) to keep the connection clean. */
+  readonly drainBytes: number
+  /** …within this long after the bound was crossed. */
+  readonly drainMs: number
+  /** Time every body gets before the rate counts. */
+  readonly graceMs: number
+  /** Each byte received earns 1 / minBytesPerSecond seconds more. */
+  readonly minBytesPerSecond: number
+  /** The longest gap without bytes. */
+  readonly idleMs: number
+}
+
+export const BODY_LIMITS: BodyLimits = { drainBytes: 8 << 20, drainMs: 2_000, graceMs: 30_000, minBytesPerSecond: 8 * 1024, idleMs: 30_000 }
+
+/** Where a body's time budget ends (ms, same clock as the inputs): the rate budget or the idle limit, whichever first. */
+export function bodyDeadline(progress: { readonly startedAt: number; readonly lastByteAt: number; readonly received: number }, limits: Pick<BodyLimits, "graceMs" | "minBytesPerSecond" | "idleMs">): number {
+  const earned = progress.startedAt + limits.graceMs + (progress.received * 1000) / limits.minBytesPerSecond
+  return Math.min(earned, progress.lastByteAt + limits.idleMs)
+}
+
+export type BoundedBody = { readonly ok: true; readonly bytes: Uint8Array } | { readonly ok: false; readonly reason: "too_large" | "timeout"; readonly close: boolean }
+
+const TIMEOUT = Symbol("timeout")
+type Read = Awaited<ReturnType<ReadableStreamDefaultReader<Uint8Array>["read"]>>
+
+/** reader.read(), or TIMEOUT once `deadline` (performance.now()) has passed. */
+export async function readBefore(reader: ReadableStreamDefaultReader<Uint8Array>, deadline: number): Promise<Read | typeof TIMEOUT> {
+  const left = deadline - performance.now()
+  if (left <= 0) return TIMEOUT
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    return await Promise.race([reader.read(), new Promise<typeof TIMEOUT>((resolve) => (timer = setTimeout(() => resolve(TIMEOUT), left)))])
+  } finally {
+    clearTimeout(timer)
+  }
+}
+export const isTimeout = (value: unknown): value is typeof TIMEOUT => value === TIMEOUT
+
+const cancel = (reader: ReadableStreamDefaultReader<Uint8Array>) => reader.cancel().catch(() => {})
+
+/**
+ * Discards what is left of a body within the byte and time budget: true when the body ended (the connection is
+ * clean), false when the budget ran out (the reader is cancelled: answer with Connection: close).
+ */
+export async function drainBounded(reader: ReadableStreamDefaultReader<Uint8Array>, limits: Partial<BodyLimits> = {}): Promise<boolean> {
+  const { drainBytes, drainMs } = { ...BODY_LIMITS, ...limits }
+  const deadline = performance.now() + drainMs
+  let drained = 0
+  try {
+    for (;;) {
+      const next = await readBefore(reader, deadline)
+      if (next === TIMEOUT) break
+      if (next.done) return true
+      drained += next.value.byteLength
+      if (drained > drainBytes) break
+    }
+  } catch {
+    return false // the client went away
+  }
+  await cancel(reader)
+  return false
+}
+
+/** The body's bytes, at most `max` of them, within the byte and time limits (see the file comment). */
+export async function readBounded(request: Request, max: number, limits: Partial<BodyLimits> = {}): Promise<BoundedBody> {
+  const declared = Number(request.headers.get("content-length") ?? "")
+  if (Number.isFinite(declared) && declared > max) {
+    // Declared too large: nothing is kept. Bun 1.3.5 does not skip unread declared bytes either (a client reusing the
+    // socket got 431 for its next request), so a body within the drain budget is read and discarded; a bigger one
+    // is refused unread, with Connection: close.
+    if (!request.body) return { ok: false, reason: "too_large", close: false }
+    const reader = request.body.getReader()
+    const { drainBytes } = { ...BODY_LIMITS, ...limits }
+    if (declared - max > drainBytes) {
+      await cancel(reader)
+      return { ok: false, reason: "too_large", close: true }
+    }
+    return { ok: false, reason: "too_large", close: !(await drainBounded(reader, { ...limits, drainBytes: declared })) }
+  }
+  if (!request.body) return { ok: true, bytes: new Uint8Array(0) }
+  const budget = { ...BODY_LIMITS, ...limits }
+  const startedAt = performance.now()
+  let lastByteAt = startedAt
+  const reader = request.body.getReader()
+  const chunks: Uint8Array[] = []
+  let size = 0
+  for (;;) {
+    let next: Read | typeof TIMEOUT
+    try {
+      next = await readBefore(reader, bodyDeadline({ startedAt, lastByteAt, received: size }, budget))
+    } catch {
+      return { ok: false, reason: "timeout", close: true } // the client went away mid-body
+    }
+    if (next === TIMEOUT) {
+      await cancel(reader)
+      return { ok: false, reason: "timeout", close: true }
+    }
+    if (next.done) break
+    lastByteAt = performance.now()
+    size += next.value.byteLength
+    // Past the bound (one oversized chunk included): nothing more is kept, this chunk neither.
+    if (size > max) return { ok: false, reason: "too_large", close: !(await drainBounded(reader, limits)) }
+    chunks.push(next.value)
+  }
+  return { ok: true, bytes: Buffer.concat(chunks) }
+}
+
+/** Why a body was cut off for time, with the limits in force. */
+export function slowMessage(limits: Partial<BodyLimits> = {}): string {
+  const { graceMs, minBytesPerSecond, idleMs } = { ...BODY_LIMITS, ...limits }
+  const s = (ms: number) => `${Math.round(ms / 100) / 10} s`
+  return `The body arrived too slowly (no bytes for ${s(idleMs)}, or under ${Math.round(minBytesPerSecond / 102.4) / 10} KiB/s after ${s(graceMs)})`
+}
+
+/** The AgentError for a refused body (Connection: close when the socket is left dirty). */
+export function bodyError(result: Extract<BoundedBody, { ok: false }>, max: number, limits: Partial<BodyLimits> = {}): AgentError {
+  if (result.reason === "timeout") return new AgentError("invalid", slowMessage(limits), { close: true })
+  return new AgentError("invalid", `The body is larger than ${max} bytes`, { extra: { limit: max }, ...(result.close ? { close: true } : {}) })
+}
+
+/** The body as UTF-8 text of at most `max` bytes ("" without a body); AgentError invalid over the limits. */
+export async function boundedText(request: Request, max: number, limits: Partial<BodyLimits> = {}): Promise<string> {
+  const result = await readBounded(request, max, limits)
+  if (!result.ok) throw bodyError(result, max, limits)
+  return Buffer.from(result.bytes).toString("utf8")
+}
+
+/** JSON.parse of a bounded body (a SyntaxError for invalid JSON, as request.json() threw). */
+export async function boundedJson(request: Request, max = AGENT_JSON_BODY_MAX): Promise<unknown> {
+  return JSON.parse(await boundedText(request, max))
+}

package/src/central/agent/decisions.ts

@@ -20,6 +20,11 @@
 // - close(): a Decision whose subject went away (a permission answered elsewhere) is closed, not answered; the asker
 //   hears why.
 // - Every open and change (answer, timeout, escalation, expiry, close) goes to `changed` (the console's 'decision' event).
+// - (CON-06) `via`: an answer is a tap unless it says voice or text. Voice/text answers only a confirm-tier
+//   Decision, and only when the hub's `via` check admits it (the Concierge tiers: armed, presence, the user's
+//   device); otherwise forbidden "Answer this decision with a tap". Never a model: only the user's device answers.
+// - (CON-06) `as: "concierge"`: set when the asker is one of the user's Concierge sessions (current or past), so
+//   the console can say "by @@concierge". The `act` action kind is a Concierge proposal (concierge/proposals.ts).
 import type { Clock, StateStore, Timers } from "../backend/types"
 import type { AgentActor, UserActor } from "./actor"
 import type { Delivery } from "./delivery"
@@ -37,6 +42,22 @@ export type DecisionState = "open" | "answered" | "expired" | "closed"
 export const URGENCIES: readonly Urgency[] = ["low", "normal", "high"]
 export const TIERS: readonly Tier[] = ["confirm", "tap"]
 export const DECISION_STATES: readonly DecisionState[] = ["open", "answered", "expired", "closed"]
+/** (CON-06) How the user answered: tap (the default, absent), or voice/text in the Concierge panel. */
+export type AnswerVia = "tap" | "voice" | "text"
+export const ANSWER_VIAS: readonly AnswerVia[] = ["tap", "voice", "text"]
+/** The refusal of a voice/text answer the hub does not admit. */
+export const TAP_ONLY = "Answer this decision with a tap"
+/** The refusal of a voice/text answer that picks a lasting option (coordinator decision, 93265or7). */
+export const ALWAYS_TAP_ONLY = "Answer 'always' with a tap"
+
+/**
+ * Whether an option is not once-off: `always` (saves a lasting rule, e.g. an escalated permission approved for
+ * good), or approving a grant request (creates a lasting grant). Voice and text pick only once-off options.
+ */
+export function lastingOption(decision: Pick<Decision, "action" | "options">, option: string | undefined): boolean {
+  if (option === "always") return true
+  return decision.action?.kind === "grant" && !decision.options.some((o) => o.id === option && o.safe)
+}
 
 /** Options a Decision offers. */
 export const OPTIONS_MAX = 8
@@ -67,10 +88,25 @@ export interface DecisionAnswer {
   readonly at: number
   /** The device the user answered from. */
   readonly deviceID?: string
+  /** (CON-06) voice or text; absent = tap. */
+  readonly via?: "voice" | "text"
 }
 
 /** What answering a Decision does besides replying: an escalated permission request (P3-T8) or a grant request (P3-T9). */
-export type DecisionAction = PermissionAction | GrantRequestAction
+export type DecisionAction = PermissionAction | GrantRequestAction | ActAction
+
+/**
+ * (CON-06) A Concierge proposal (concierge/proposals.ts): answering `go` runs the act verb on the target AS THE USER
+ * through the acting engine (tenancy re-checked); `hold` does nothing.
+ */
+export interface ActAction {
+  readonly kind: "act"
+  readonly verb: "stop" | "deny" | "prompt" | "answer"
+  /** The session ID it was proposed for (resolved when proposed). */
+  readonly target: string
+  /** The verb's validated input (requestID, formID, answer, text). */
+  readonly input: Readonly<Record<string, unknown>>
+}
 
 /** An escalated permission request: the answer replies to it as the user. */
 export interface PermissionAction {
@@ -121,6 +157,8 @@ export interface Decision {
   readonly closed?: { readonly at: number; readonly reason: string }
   /** Run (as the answering user) when the user answers; set by the hub only, never by an asker. */
   readonly action?: DecisionAction
+  /** (CON-06) Asked by one of the user's Concierge sessions: the console says "by @@concierge". */
+  readonly as?: "concierge"
 }
 
 /** What the hub (never an asker's request) adds to an ask. */
@@ -148,8 +186,13 @@ export interface AskInput {
 export interface AnswerInput {
   readonly option?: string
   readonly text?: string
+  /** (CON-06) Absent = tap. */
+  readonly via?: AnswerVia
 }
 
+/** (CON-06) Admits a voice/text answer (throws forbidden otherwise). */
+export type ViaCheck = (userID: string, decision: Decision, via: "voice" | "text", by: UserActor) => Promise<void>
+
 export type NotifyReason = "opened" | "escalated"
 
 /**
@@ -177,6 +220,10 @@ export interface DecisionsDeps {
   readonly changed?: (userID: string, decision: Decision) => void
   /** Runs Decisions' actions (escalations); a Decision with an action cannot be answered without it. */
   readonly act?: DecisionActor
+  /** (CON-06) Admits voice/text answers; without it every voice/text answer is refused. */
+  readonly via?: ViaCheck
+  /** (CON-06) Whether a session is one of the user's Concierge sessions (current or past): the Decision's `as`. */
+  readonly concierge?: (userID: string, sessionID: string) => Promise<boolean>
 }
 
 const DECISIONS = "decisions"
@@ -274,6 +321,7 @@ export class Decisions {
     const v = validate(input)
     const about = [...new Set(input.about ?? (actor.kind === "session" ? [actor.sessionID] : []))]
     const { message } = await this.deps.delivery.send(userID, actor, "@me", "ask", input.question, { expiresInMs: v.expiresInMs })
+    const asConcierge = actor.kind === "session" && (await this.isConcierge(userID, actor.sessionID))
     const decision: Decision = {
       id: this.newID(),
       messageID: message.id,
@@ -291,6 +339,7 @@ export class Decisions {
       at: message.at,
       expiresAt: message.expiresAt ?? message.at + v.expiresInMs,
       ...(extra.action ? { action: extra.action } : {}),
+      ...(asConcierge ? { as: "concierge" as const } : {}),
     }
     const written = await this.deps.state.put(userID, DECISIONS, decision.id, decision, { ifVersion: 0 })
     if (!written.ok) throw new Error("decision id collision")
@@ -331,9 +380,18 @@ export class Decisions {
     if (!current || by.userID !== userID) throw notFound()
     if (current.state !== "open") throw gone()
     if (current.tier === "tap" && by.via !== "cookie") throw new AgentError("forbidden", "This decision needs a tap in the signed-in console", { hint: "Answer it in the console" })
+    const via = input.via ?? "tap"
+    if (!ANSWER_VIAS.includes(via)) throw invalid(`via is one of ${ANSWER_VIAS.join(", ")}`)
     const choice = this.choice(current, input)
+    if (via !== "tap") {
+      // Voice/text: confirm tier only, and only what the hub's check admits (never without one).
+      if (current.tier !== "confirm" || !this.deps.via) throw new AgentError("forbidden", TAP_ONLY, { hint: "Tap an option" })
+      // Only once-off options by voice or text: a lasting one (always, a grant) needs a tap.
+      if (lastingOption(current, choice.option)) throw new AgentError("forbidden", ALWAYS_TAP_ONLY, { hint: "Tap the option" })
+      await this.deps.via(userID, current, via, by)
+    }
     const at = this.now()
-    const answer: DecisionAnswer = { ...choice, answeredBy: "user", at, deviceID: by.deviceID }
+    const answer: DecisionAnswer = { ...choice, answeredBy: "user", at, deviceID: by.deviceID, ...(via !== "tap" ? { via } : {}) }
     const decision = await this.settle(userID, id, answer)
     if (!decision) throw gone()
     const note = decision.action ? await this.runAction(userID, decision, choice, by) : undefined
@@ -399,6 +457,15 @@ export class Decisions {
 
   // ---- internals ----------------------------------------------------------------------------------------
 
+  /** Whether the session is one of the user's Concierge sessions; a failed read is no label (never fails the ask). */
+  private async isConcierge(userID: string, sessionID: string): Promise<boolean> {
+    try {
+      return (await this.deps.concierge?.(userID, sessionID)) === true
+    } catch {
+      return false
+    }
+  }
+
   /** Tells the changed listener (its failure never fails the caller). */
   private emit(userID: string, decision: Decision): void {
     try {

package/src/central/agent/delivery.ts

@@ -11,10 +11,15 @@
 // - Roles: one holder, the idle one (by real evidence) else the most recently active, else (all offline) the
 //   one seen last; the message records the holder generation. sendAll: every holder, a message each. A session
 //   never messages itself: it is left out of a role it holds, and an address naming only it is invalid.
-// - Pending: no deliver-capable connection reports the recipient (offline) or every one failed → kept for
+// - Pending: no deliver-capable connection reports the recipient (offline) or every one failed (including an
+//   OpenCode spoke refusing a routine wake:false msg while the recipient's turn runs, RF-05) → kept for
 //   PENDING_MS in the StateStore and delivered oldest first on the user's next sessions frame (onSessions). In a
 //   cluster (deps.locks) each (user, session) flush holds a lease (deliver:<user>:<session>) and re-reads the
-//   entry under it, so a spoke reconnecting to another pod meanwhile never gets a message twice.
+//   entry under it, so a spoke reconnecting to another pod meanwhile never gets a message twice. A flush stops at a
+//   session's first failed delivery (its later messages wait, in order, for the next frame: one round trip per busy
+//   or unreachable session per frame), and a waking message first flushes only its own session's pending ones.
+//   Ordering limit: a waking message to a session that is still busy is admitted (queued after the turn) before the
+//   quiet ones pending for it, which follow when the turn ends.
 //   OpenCode holds admitted messages itself across forms, interrupts and restarts (P2-T0), so there is no
 //   "retained" retry loop on the hub.
 // - Re-wake: an open ask to an idle recipient (Registry.idle: native or hooks evidence) is woken again after
@@ -37,6 +42,7 @@ import type { DeliverRequest, DeliverResult, DeliveryMode, MessageKind as WireKi
 import { isDeliverResult } from "../../protocol"
 import { randomBytes } from "node:crypto"
 import type { Clock, Counters, Locks, StateStore, Timers } from "../backend/types"
+import type { TeamPolicy } from "../teams/policy"
 import type { AgentActor } from "./actor"
 import type { DirectoryEntry, NamedListener, Resolved } from "./directory"
 import { type Party, type PartyInfo, partyFromActor, partyKey, partyLabel, renderEnvelope, renderPrimer } from "./envelope"
@@ -82,6 +88,19 @@ export interface DeliveryAlert {
   readonly text: string
 }
 
+/** What a message to a session is, for the inbound policy. */
+export type InboundKind = "msg" | "ask" | "reply" | "decline"
+
+/**
+ * (CON-04) Who may message a session, beyond the existing rules: `admit` throws (forbidden) to refuse before anything
+ * is stored. `original`: the message a reply or decline answers. The hub passes the Concierge inbound rule.
+ */
+export interface InboundPolicy {
+  admit(userID: string, from: Party, sessionID: string, kind: InboundKind, original?: Message): Promise<void>
+  /** Who a sender may reach at all (the Concierge: only @me, and replies to asks addressed to it); throws to refuse. */
+  outbound?(userID: string, from: Party, kind: InboundKind, original?: Message): Promise<void>
+}
+
 export interface DeliveryDeps {
   readonly state: StateStore
   readonly counters: Counters
@@ -104,6 +123,10 @@ export interface DeliveryDeps {
   readonly owner?: string
   /** How often the re-wake loop runs (default REWAKE_TICK_MS). */
   readonly tickMs?: number
+  /** Team communication policy (HWA-34, ../teams/policy.ts): team addresses and verdicts before anything is stored. */
+  readonly teams?: Pick<TeamPolicy, "prepare" | "answer">
+  /** (CON-04) Inbound policy per recipient session (the Concierge inbound rule), checked next to team policy. */
+  readonly inbound?: InboundPolicy
 }
 
 export interface SendOptions {
@@ -119,6 +142,8 @@ export interface Sent {
   readonly message: Message
   /** How it reached the recipient; undefined when the recipient is not a session (stored only). */
   readonly delivery?: DeliveryState
+  /** Whether it was sent to wake its recipient (false: wake:false, a subagent, the hop cap or a spent wake budget). */
+  readonly woke?: boolean
 }
 
 /** A reply or decline as sent, with the message it answered. */
@@ -202,6 +227,11 @@ export class Delivery {
   private readonly newID: () => string
   /** Per user: the flush in progress (flushes run one at a time). */
   private readonly flushing = new Map<string, Promise<void>>()
+  /**
+   * Pending flush counters since start (no message text): attempts that failed (offline spokes, a busy OpenCode
+   * session refusing a routine quiet msg) and messages skipped behind such a failure until the next frame.
+   */
+  readonly flushStats = { failed: 0, skipped: 0 }
   /** Per user and session: the primer in flight (one at a time); true once it was admitted. */
   private readonly priming = new Map<string, Promise<boolean>>()
   /** Users seen since start (sent a message, or one of their spokes reported sessions): the loop looks at these. */
@@ -250,7 +280,7 @@ export class Delivery {
   async send(userID: string, actor: AgentActor, addr: string, kind: "msg" | "ask", text: string, options: SendOptions = {}): Promise<Sent> {
     if (isUserAddress(addr)) return this.sendToUser(userID, actor, addr, kind, text, options)
     const from = this.party(userID, actor)
-    const resolved = this.others(actor, this.deps.directory.resolve(userID, addr))
+    const resolved = await this.resolveFor(userID, actor, from, addr, kind)
     return this.sendTo(userID, from, addr, resolved, this.pick(resolved), kind, text, options)
   }
 
@@ -258,7 +288,7 @@ export class Delivery {
   async sendAll(userID: string, actor: AgentActor, addr: string, kind: "msg" | "ask", text: string, options: SendOptions = {}): Promise<Sent[]> {
     if (isUserAddress(addr)) return [await this.sendToUser(userID, actor, addr, kind, text, options)]
     const from = this.party(userID, actor)
-    const resolved = this.others(actor, this.deps.directory.resolve(userID, addr))
+    const resolved = await this.resolveFor(userID, actor, from, addr, kind)
     const sent: Sent[] = []
     for (const entry of resolved.sessions) sent.push(await this.sendTo(userID, from, addr, resolved, entry, kind, text, options))
     return sent
@@ -266,12 +296,12 @@ export class Delivery {
 
   /** Replies to a message, from its recipient to its real sender (never via a role), and delivers the reply. */
   reply(userID: string, actor: AgentActor, replyTo: string, text: string, options: SendOptions = {}): Promise<Replied> {
-    return this.answer(userID, actor, replyTo, options, (input) => this.messages.reply(userID, { ...input, text }))
+    return this.answer(userID, actor, replyTo, options, "reply", (input) => this.messages.reply(userID, { ...input, text }))
   }
 
   /** Declines an ask, with a reason, and delivers the decline to the asker. */
   decline(userID: string, actor: AgentActor, replyTo: string, why: string, options: SendOptions = {}): Promise<Replied> {
-    return this.answer(userID, actor, replyTo, options, (input) => this.messages.decline(userID, { ...input, why }))
+    return this.answer(userID, actor, replyTo, options, "decline", (input) => this.messages.decline(userID, { ...input, why }))
   }
 
   /** A human turn in the session (console prompt or utterance, or typed in the harness): its hop chain starts over. */
@@ -280,9 +310,10 @@ export class Delivery {
   }
 
   /** Delivers the user's pending messages whose sessions a deliver-capable spoke reports now, oldest first. */
-  flush(userID: string): Promise<void> {
+  /** Delivers the user's pending messages (only `sessionID`'s when given); flushes run one at a time per user. */
+  flush(userID: string, sessionID?: string): Promise<void> {
     const previous = this.flushing.get(userID) ?? Promise.resolve()
-    const run = previous.then(() => this.flushNow(userID))
+    const run = previous.then(() => this.flushNow(userID, sessionID))
     const tracked = run.finally(() => {
       if (this.flushing.get(userID) === tracked) this.flushing.delete(userID)
     })
@@ -290,6 +321,21 @@ export class Delivery {
     return run
   }
 
+  /**
+   * (CON-10) Drops the messages still pending for a session that ended for good (a retired Concierge session): they
+   * are never delivered later, and their delivery reads "dropped" (never waiting). Answers how many were dropped.
+   */
+  async dropPending(userID: string, sessionID: string): Promise<number> {
+    let dropped = 0
+    for (const { key, value, version } of await this.deps.state.list<Pending>(userID, PENDING)) {
+      if (value.sessionID !== sessionID) continue
+      if (!(await this.deps.state.delete(userID, PENDING, key, { ifVersion: version })).ok) continue
+      await this.messages.setDelivery(userID, value.messageID, "dropped")
+      dropped++
+    }
+    return dropped
+  }
+
   /** Registry.onSessions: a spoke reported its sessions (connected, reconnected, or its periodic snapshot). */
   async onSessions(connID: string): Promise<void> {
     const userID = this.deps.registry.connTenant(connID)
@@ -378,10 +424,12 @@ export class Delivery {
   private async sendTo(userID: string, from: Party, addr: string, resolved: Resolved, entry: DirectoryEntry, kind: "msg" | "ask", text: string, options: SendOptions): Promise<Sent> {
     const sessionID = entry.sessionID
     const recipient: Party = { kind: "session", sessionID, ...(entry.name ? { name: entry.name } : {}) }
+    await this.deps.inbound?.outbound?.(userID, from, kind)
+    await this.deps.inbound?.admit(userID, from, sessionID, kind)
     this.gate(userID, sessionID)
     await this.limiter.admit(userID, from, recipient)
     const hop = await this.hops.next(userID, from)
-    const generation = resolved.address.kind === "role" ? roleGeneration(entry, resolved.address) : undefined
+    const generation = resolved.address.kind === "role" && !("team" in resolved) ? roleGeneration(entry, resolved.address) : undefined
     const message = await this.messages.send(userID, {
       from,
       to: addr,
@@ -463,6 +511,13 @@ export class Delivery {
     return (await this.request(userID, sessionID, req)) !== undefined
   }
 
+  /** The address's sessions (team-aware, HWA-34) without the sender, narrowed to those team policy permits. */
+  private async resolveFor(userID: string, actor: AgentActor, from: Party, addr: string, kind: "msg" | "ask"): Promise<Resolved> {
+    const team = await this.deps.teams?.prepare(userID, from, addr)
+    const resolved = this.others(actor, team?.resolved ?? this.deps.directory.resolve(userID, addr))
+    return team ? { ...resolved, sessions: await team.admit(resolved.sessions, kind, this.limiter) } : resolved
+  }
+
   /** The resolved sessions without the sending session itself; invalid when only it is left (no self-messages). */
   private others(actor: AgentActor, resolved: Resolved): Resolved {
     if (actor.kind !== "session") return resolved
@@ -487,12 +542,18 @@ export class Delivery {
     actor: AgentActor,
     replyTo: string,
     options: SendOptions,
+    kind: "reply" | "decline",
     store: (input: { from: Party; replyTo: string; hop: number; generation?: number }) => Promise<{ message: Message; original: Message }>,
   ): Promise<Replied> {
     const from = this.party(userID, actor)
     const original = await this.messages.get(userID, replyTo)
     const to = original && partyKey(original.recipient) === partyKey(from) ? original.from : undefined
-    if (to?.kind === "session") this.gate(userID, to.sessionID)
+    if (original) await this.deps.inbound?.outbound?.(userID, from, kind, original)
+    if (to?.kind === "session") {
+      await this.deps.inbound?.admit(userID, from, to.sessionID, kind, original)
+      this.gate(userID, to.sessionID)
+    }
+    if (to && original) await this.deps.teams?.answer(userID, from, original, to, kind, this.limiter)
     if (to) await this.limiter.admit(userID, from, to)
     const hop = await this.hops.next(userID, from)
     const generation = original && actor.kind === "session" ? this.holderGeneration(userID, actor.sessionID, original) : undefined
@@ -559,12 +620,15 @@ export class Delivery {
 
   /** Delivers now, or queues the message as pending when no spoke takes it. */
   private async deliver(userID: string, message: Message, sessionID: string, wake: boolean, urgent: boolean): Promise<Sent> {
+    // Messages still pending for this session go first (e.g. a quiet one a busy spoke refused, RF-05): the turn this
+    // one starts then carries them, instead of them arriving inside it.
+    if (wake && (await this.deps.state.list<Pending>(userID, PENDING)).some((p) => p.value.sessionID === sessionID)) await this.flush(userID, sessionID)
     const delivered = await this.attempt(userID, message, sessionID, wake, urgent)
-    if (delivered) return delivered
+    if (delivered) return { ...delivered, woke: wake }
     const at = this.now()
     const pending: Pending = { messageID: message.id, sessionID, wake, urgent, at, expiresAt: at + PENDING_MS }
     await this.deps.state.put(userID, PENDING, message.id, pending)
-    return { message: (await this.messages.setDelivery(userID, message.id, "pending")) ?? message, delivery: "pending" }
+    return { message: (await this.messages.setDelivery(userID, message.id, "pending")) ?? message, delivery: "pending", woke: wake }
   }
 
   /** Tries each deliver-capable connection in turn (same message id: the harness dedupes it). */
@@ -593,12 +657,20 @@ export class Delivery {
     return undefined
   }
 
-  private async flushNow(userID: string): Promise<void> {
-    const entries = (await this.deps.state.list<Pending>(userID, PENDING)).sort((a, b) => a.value.at - b.value.at || (a.key < b.key ? -1 : 1))
+  private async flushNow(userID: string, only?: string): Promise<void> {
+    const entries = (await this.deps.state.list<Pending>(userID, PENDING))
+      .filter((e) => only === undefined || e.value.sessionID === only)
+      .sort((a, b) => a.value.at - b.value.at || (a.key < b.key ? -1 : 1))
     /** Cluster mode: the sessions whose lease this flush holds (true) or another process holds (false). */
     const leases = new Map<string, boolean>()
+    /** Sessions whose delivery failed in this flush: their later messages wait for the next frame (in order). */
+    const failed = new Set<string>()
     try {
       for (const { key, value, version } of entries) {
+        if (failed.has(value.sessionID)) {
+          this.flushStats.skipped++
+          continue
+        }
         const message = value.expiresAt > this.now() ? await this.messages.get(userID, value.messageID) : undefined
         // Gone, or an ask that closed (expired) while it waited: nothing to deliver.
         if (!message || (message.kind === "ask" && message.state !== "open")) {
@@ -610,6 +682,10 @@ export class Delivery {
         // Another process may have delivered it before this one took the lease.
         if (this.deps.locks && !(await this.deps.state.get(userID, PENDING, key))) continue
         if (await this.attempt(userID, message, value.sessionID, value.wake, value.urgent)) await this.deps.state.delete(userID, PENDING, key)
+        else {
+          failed.add(value.sessionID)
+          this.flushStats.failed++
+        }
       }
     } finally {
       const { locks } = this.deps
@@ -635,7 +711,11 @@ export class Delivery {
     return held
   }
 
-  /** `steer`: urgent, or the first msg after a primer to an idle session (see attempt). */
+  /**
+   * `steer`: urgent, or the first msg after a primer to an idle session (see attempt). A wake:false msg keeps
+   * "queue" unless urgent: that marks it routine, and the OpenCode spoke (RF-05) admits it steered without resume,
+   * refusing it while a turn runs so it stays pending here until the turn ends (never a model call of its own).
+   */
   private deliverRequest(message: Message, sessionID: string, wake: boolean, steer: boolean): DeliverRequest {
     const delivery: DeliveryMode = message.kind === "msg" && !steer ? "queue" : "steer"
     return {