@huynle/hub 0.7.4 → 0.8.1

package/CHANGELOG.md

@@ -1,6 +1,435 @@
 # Changelog
 
-## Unreleased
+## 0.8.1
+
+A fix-up release after 0.8.0. App and gateway messages keep waking idle sessions (per-conversation hops with a relay
+guard, and the reason when a wake is skipped); launches say why they wait; the Concierge gets per-machine Directory
+and Model dropdowns, full-detail Decision cards (tap-tier ones too, never by voice), plainer Activity and fail-closed
+hardening; the console uses in-page dialogs, collapsible sidebar sections and names instead of raw IDs; the right
+rail's Branch and Changes work for background-service sessions; the hub state dir honours `XDG_STATE_HOME` without
+moving existing state; MCP gains profile lifecycle tools. No migration is needed. Codex and Claude Code fork/revert
+remain for a later release.
+
+### MCP: profile lifecycle and team staffing
+- **Profile lifecycle over MCP** (`hub mcp`, `POST /mcp`): `profile_show`, `profile_versions`, `profile_create`,
+  `profile_update`, `profile_version_create` (content or `fromVersion` rollback), `profile_skill_set` /
+  `profile_skill_remove`, `profile_command_set` / `profile_command_remove` (attach or detach one skill or command as
+  the next immutable version), `profile_archive` / `profile_restore` and `profile_assign` / `profile_unassign`. Each
+  is an existing `/api/agent/profiles…` route with its scopes (`profiles:read`, `profiles:manage`,
+  `profiles:assign` + `sessions:read`); no server change ([docs/profiles.md](docs/profiles.md#sdk-and-mcp)).
+- **`team_staff` / `team_replace` describe the nested launch spec** (`workspace{repo, mode, branch, base, remote}`,
+  `placement{machine, labels, mode}`, `runtime{kind, profile}`, `end{when, timeout, cleanup}` and the top-level
+  fields) in their input schema ([docs/teams.md](docs/teams.md#mcp-tools)).
+- **Launch specs name misplaced fields**: an unknown launch field answers every unknown field at once and where each
+  belongs (`Unknown launch fields repo, cleanup: did you mean workspace.repo, end.cleanup?`), with the nested shape
+  as the hint, for `POST /api/agent/launches`, team staffing and the MCP tools.
+
+### Messaging and Concierge settings
+- **Settings → Concierge: Directory and Model are dropdowns of the picked machine.** Directory lists the projects its
+  OpenCode service reports under (or at) its node's workspace roots, then the other roots, with **Other folder…** for
+  a typed path (a project that is the root itself is listed once, as a project, and the hint names the roots: FX-11);
+  picking another machine clears a directory that machine does not report. Model lists the machine's OpenCode models
+  with **Machine default** and **Other model…**; picking another machine resets a model its list lacks. Loading,
+  offline and error states keep the typed fallback; hints are linked to the dropdowns (`aria-describedby`). New
+  user-only route `GET /api/agent/concierge/machines/:id/models` (404 for a machine that is not yours, 503
+  `offline` without a connected service, a reported session, or a spoke answer).
+- **App asks stop waking sessions after 4 round trips (S1, wge0vjdz).** An app token was one hop-depth party for all
+  its conversations and had no human turn to reset it, so every ask/reply round trip raised it by 2 and from the 5th
+  ask on (hop 9 > the cap of 8) nothing it sent woke anyone for 24 h; the spoke answered a bare `queued`. Apps now
+  count hops per conversation: a new `msg`/`ask` from an app is hop 1, replies and declines to an app raise nothing,
+  and an app's own reply or decline is the hop of the message it answers + 1 (reply ping-pong still hits the cap).
+  Session-to-session chains, human-turn resets, the pair limit (20/10 min) and the wake budget (30/10 min, which
+  bound an app answering one session with new messages forever) are unchanged. Covers app tokens, `app:concierge`,
+  the workspace coordinator and team intake.
+- **Relay guard for apps.** For 5 minutes (the relay window, a code-level default, not a config setting) after a session sends an app something, the app's new
+  msg/ask to *another* session carries that hop + 1, so a relay loop A → app → B → app → A reaches the hop cap after
+  about 8 hops instead of only the rate limits; spaced-out asks and one-to-one app conversations still start at hop
+  1. The hub's own parties (Concierge, workspace coordinator, team intake) keep no relay depth: they send on events
+  and submissions, not on what they receive.
+- **Team intake continues the submitter's chain.** A session's submission is delivered from `app:team-intake` at
+  the submitter's depth + 1 (kept while it is queued), not hop 1.
+- **Hop-cap alert wording.** "Agent messages went 8 hops without you (latest: A → B) …" instead of "Sessions
+  messaged each other", which was wrong when an app was in the chain.
+- **Never give agents an app token** (README): it lets them send at a fresh hop depth.
+- **Why a message did not wake.** `POST /api/agent/msg|ask|reply|decline` answers carry `woke` and, when false,
+  `wakeSkipped: wake_false | subagent | hop_cap | budget` (additive; SDK `Sent.woke`, `Sent.wakeSkipped`, type
+  `WakeSkip`, and `wakeSkipNote`/`WAKE_SKIP_TEXT` for the shared wording). `hub msg`/`ask`/`reply`/`decline`, the
+  MCP tools and the OpenCode `hub` tool (text and metadata) print it: `queued (read at its next turn) — wake
+  skipped: hop limit reached (8 agent messages without a human turn)`; `wake_false` reads "sent without a wake".
+
+### Launches say why they wait
+- A queued launch stores why it waits: `GET /api/agent/launches/:id` carries `waiting: {wait, reason, since}` and
+  `reason` is the same text. Written only when it changes, announced as a `launch` event and logged once per change
+  (`[hub] launch <id> waits (<wait>): <reason>`); cleared once placed. Before, it said only "Queued".
+- Specific reasons: the active cap names who holds it (`4 of 4 active launches: 3 by app "ci-bot", 1 by you`), a
+  full node gives its counts (`baruch (4/4 used, 0 reserved)`), a node that does not fit its first problem.
+- `hub launches list|show` and the MCP launch tools print the wait; Settings → Agents & access has a new **Launches**
+  list (live launches, updated from the event stream, why each waits, Stop with a per-row accessible name; the
+  Concierge's own launch is managed in Settings → Concierge); the Concierge's status says "Waiting: …" instead of
+  "Starting".
+- An app or session sees its own launch's wait in a launcher-safe form: counts only for the cap ("1 yours, 3 by
+  others"), no machine names. The user sees the full text.
+- Only a new wait kind is a launch change (journal `launch.changed` with `data.wait`, SSE); never a webhook, so
+  webhooks keep one delivery per state (`launch.queued` once). Text-only updates (slot counts) go to the console's
+  live stream only; artifact jobs show them without a new job revision.
+- The Concierge's own launch no longer counts toward `agents.launches.maxActive` (it still takes a node slot).
+- Revoking an app token does not stop its launches; they are flagged (`launcherRevoked`) in the user's lists and in
+  the cap's waiting reason so the user can stop them. Launches record the app token's label (`byLabel`).
+- A node cleanup that failed while the node stayed connected is retried (capacity reports, the 15 s sweep, up to 5
+  times; and on reconnect), so the node no longer keeps a slot for an ended launch.
+- A running launch ends `lost` when the same node instance that reported it leaves it out of its reports for 5
+  minutes while no spoke reports its session, freeing its reserved slot. Never on a disconnected node, a short gap,
+  or a restarted node daemon (a new instance) that never reported it; a lost launch whose session is still reported
+  keeps its workspace. `agents.launches.lostAfterMinutes`: 0–1440, or 0/false to turn it off.
+- A launch stopped between placement's placing and provisioning steps (e.g. the Concierge reaping an orphan) is
+  skipped quietly instead of logging a placement error.
+- Engine timers are clamped to setTimeout's 32-bit limit; an `end.timeout` over 24.8 days (up to 30) no longer fires
+  at once.
+
+### Concierge hardening
+- **Activity in plain words.** Settings → Agents → Activity says what the Concierge did without internal terms:
+  "Approved by the Concierge inside your grant. Its note: «…»", "Needed your tap: shell commands, outside folders
+  and tools always do", "The Concierge proposed this for your answer", "Refused: only you can message the
+  Concierge". Its note is framed as data (its own « » become ‹ ›, bidi and invisible controls dropped, one line, at
+  most 300 characters), so it cannot fake text after it.
+  No `inGrant`, `auto` or raw Decision IDs; the Concierge is told to write its why in plain words too
+  (Concierge prompt v7).
+- **Decision lookups in the Concierge panel** skip IDs in a reply that is still streaming (half an ID was looked up
+  and remembered as unknown), back off on 429/5xx/network failures (2 s doubling, ≤ 1 min) instead of retrying on
+  every render, and run at most 4 at once.
+- **Watchlist after a reconnect.** A process counts as reporting its sessions only after its first sessions frame
+  (catalog `sessionsPending`, additive), so the watchlist and board no longer empty for a moment after `hello`.
+- **`concierge_find`** with no letters or digits ("@", "?!") no longer lists every session: the hub's
+  `GET /api/agent/sessions?q=` matches nothing for such a `q` (a blank `q` still filters nothing).
+- **Concierge session lock file** (`concierge-sessions.json`): writes from several OpenCode processes are serialized
+  under an exclusive `<file>.lock` (a stale one is broken), so no process drops another's locks.
+- **Identity:** a Concierge session older than the 500 the hub keeps still counts as one while its machine reports
+  it locked (spokes mark locked sessions `locked: true` from their first sessions frame after a restart). Concierge
+  identity reads (route gate, manage guard, acting guard, inbound/outbound rules, team staffing, Decision and audit
+  labels) wait at most 5 s, and a user whose read timed out is answered at once for the next 5 s; a stuck or failed
+  read refuses with a neutral 503 `busy` "Hub state is busy, try again" (new error code, CLI exit 7), audited as
+  decision `busy`, outcome `refused`; team staffing
+  (attach, replace, a staffing launch) refuses a Concierge session in the service as well as the route.
+- **Arm badge:** the console lapses an arm at its expiry itself, so a missed `armed: null` never leaves a stale ✨.
+
+### Console polish
+- **Collapsible sidebar sections**: Needs you, Running, Pinned, the session groups, Recents and Workspaces collapse
+  from their heading (mouse or keyboard, `aria-expanded`), remembered on this device. A collapsed section shows its
+  count; Needs you always shows its count, so collapsing it never hides that something waits.
+- **In-page confirm dialog** instead of the browser's `window.confirm` (Revert, stopping a launch, turning the Concierge off, revoking app tokens, grants,
+  machines and devices, turning agent actions off, signing out, admin user actions, resetting speech settings):
+  focus starts on the primary action (Enter confirms), on Cancel for destructive (red) actions; Tab stays inside; a
+  held Enter (key auto-repeat) is ignored; Escape or Cancel cancels (Escape closes only the dialog, not the
+  Concierge panel or a popover behind it); 44 px buttons on touch screens.
+- **/new**: a machine that reports exactly one project has it chosen; Enter without a project says so and moves the
+  focus to the Project chip, which stands out while nothing is chosen.
+- **Concierge panel** is fitted with the sidebar and rail: at 1280 px the transcript keeps 420 px (it had 345); at
+  1024 px it gets 304 px with every panel at its minimum (it had 119), 420 px without a rail.
+- Fixes: a path with a leading dot in the Changes list (`.claude/settings.local.json`) no longer shows the dot at the
+  end; "Denied by you" shows once when a denial stops the turn; a grant's expiry rounds to the nearest whole day
+  everywhere (no more "7 d" on one page and "6 d" on another); Decision links in the Concierge panel no longer push
+  the text after them to a new line; the panel's disabled Send button looks disabled.
+- **The right rail's Branch and Changes come from the session's own directory** (FX-10). OpenCode's plugin `vcs`
+  API answers for the plugin instance's own location whatever location is passed, and the spoke used the first
+  instance's (the background service's is its `$HOME`), so a service session in a project showed "No changes." and
+  Branch "—" (and the per-file diff read the wrong tree). The spoke now reads through the plugin instance whose
+  location is the session's directory, else the own server's API (which honours the location), else shows nothing;
+  a read that takes over 5 s (a hung server) is left out, so the rest of the summary still answers.
+
+### Robustness and the hub state directory
+- **State dir honours `XDG_STATE_HOME`, sticky**: the plugin (launchers, Concierge lock), the local hub, the hub
+  server and the Claude Code and Codex spokes resolve it the same way: `$HUB_STATE_DIR`; else `$XDG_STATE_HOME/hub`
+  if it exists; else an existing `~/.local/state/hub`; else `$XDG_STATE_HOME/hub` when XDG_STATE_HOME is set (fresh
+  installs); else `~/.local/state/hub`. The legacy `opencode-hub` / `opencode-voice` state migrates from under
+  `$XDG_STATE_HOME` and `~/.local/state`. `hub claude-code install` / `hub codex-spoke install` carry
+  `XDG_STATE_HOME` into the service. The Concierge lock is read from both default places (written to the resolved
+  one), so a session locked before the upgrade stays locked; with `HUB_STATE_DIR` set (an isolated preview or test)
+  it is read and written only there.
+  **Upgrade note:** nothing moves. If `XDG_STATE_HOME` is set and you have `~/.local/state/hub`, the hub keeps using
+  it and logs one line at startup with the command to switch: stop the hub and OpenCode, then
+  `mv ~/.local/state/hub "$XDG_STATE_HOME/hub"`. Isolated test/preview instances must set `HUB_STATE_DIR` and their
+  own `HOME`; `XDG_STATE_HOME` alone does not isolate them from an existing `~/.local/state/hub`.
+  A dir counts only when it holds hub state (`state.json`, `token-keys.json`, `agent/`, `blobs/`,
+  `concierge-sessions.json`, `bin/`, `hub.log`, `hub.pid`, `claude-code/`, `codex/`), never `bootstrap/` alone, and
+  `hubctl setup` now writes `bootstrap/` into the dir the hub resolves (its state root follows the resolver; other
+  roots unchanged). The legacy `opencode-hub` / `opencode-voice` copy also fills a hub dir that holds no hub state
+  yet (e.g. only `bootstrap/` from an earlier setup), next to `bootstrap/` and never over it. A relative
+  `XDG_STATE_HOME` is ignored (XDG spec). **Service units must carry the same `XDG_STATE_HOME` as your shell** (or `HUB_STATE_DIR`), or a
+  shell and a unit can use different dirs: hub's own `claude-code` / `codex-spoke` units already pass it; a unit you
+  wrote for `opencode serve --service` needs it set.
+- **Warmer hardening** (`hub node`): OpenCode's `service.json` is used only when it is a regular file owned by this
+  user and not group/world-writable (no symlinks), and its pid is this user's live process (EPERM is not ours). Warm
+  requests wait 30 s by default (was 10 s), configurable with node.json `opencode.timeoutSeconds` (1–300).
+- `hubctl setup --verify-launch` warns about a stored plain-http (non-loopback) login, like every `hub` command.
+- Refused hub URLs (`hub login`, `hubctl machine enroll`) no longer echo user info: shown as `https://***@host`
+  (also `http:/u:p@h`, `http:u:p@h`, `http:\\u:p@h`, leading whitespace and scheme-less `user:pass@host`).
+- **Listings are cancelled**: a session listing that times out aborts its signal (`SpokeHost.listRecent` gets
+  `signal`, passed to every OpenCode request), so a hung server does not collect abandoned listings.
+- **Pending messages tell their sender when they expire**: a message still pending after 24 h (recipient offline or
+  busy) gets delivery `"expired"` (new `MessageDelivery` value), its sending session gets a quiet hub notice
+  (`wake: false`, never the text), the user an alert (push kind `message`), and the change is journaled
+  (`message.changed`).
+- `HEAD /healthz` and `HEAD /readyz` answer like GET (same status and headers, no body) instead of 404, for uptime
+  monitors and `curl -I`. No other route changed.
+- Docs: README "Testing and preview isolation" (`HUB_STATE_DIR`, own `HOME`/`XDG_*`, `herdr: false`,
+  `autoStartLocalHub: false`, sessions only in scratch repos).
+
+### Decision cards and the Concierge panel
+- **Decision cards say what they ask for** (FX-05): the Concierge panel's armed and listed cards, and every Decision
+  card on Home and in sessions, show the requested action as a session's own permission card does: the permission
+  kind, the exact command, paths or patterns (the session's live request when the console has it), who asked, why it
+  is outside the grant and the stated purpose. A Concierge proposal shows its verb ("Send a prompt as you", "Stop the
+  session", …), the target session, the exact prompt or form answer, and the Concierge's why; its question heads the
+  card without repeating the body. A plain ask about a session that waits on one permission shows that request.
+  Long commands and prompts wrap and are cut with **Show all** (a session's permission card too). All of it is
+  rendered as plain text, from the user's own console data: the Concierge's board and update lines still carry no
+  blocker summaries or Decision text.
+- **The card says where its detail comes from** (FX-05): "Live request" (the session's pending request), "The hub's
+  record of the request" (new structured fields on Decisions: `action.request {action, resources, save?}` and
+  `action.reason` on escalations, `action.request` on deny proposals; bounded to 20 × 2,000 characters), or "From
+  the request text" for older Decisions, now parsed without splitting a command at ", " or at a ". Outside its
+  grant: " inside it. Bidi and invisible characters in commands, paths and prompts show as markers ("⟨U+202E⟩"),
+  also on a session's permission card (tag characters U+E0000–E007F, separators, fillers too; a valid subdivision
+  flag and ZWJ emoji stay intact); text is cut by grapheme; **Show all** buttons name their field and control the
+  text they open. What the hub did not store is recorded with the request (`resourcesTotal`, `savesTotal`, `cut`
+  [{field, index, length}], `truncated`) and shown on the card ("… cut at 2,000 characters (of 3,017)", "+10 more
+  items not stored", "The hub received this request already shortened"), so a shortened command never reads as
+  complete. The structured request and reason are for the user's console only: the Concierge's Decision reads
+  (`/api/agent/concierge/decisions`, `concierge_decision`) return the records exactly as before.
+- **Tap-tier Decisions in the Concierge panel** (FX-05b): the panel lists the Concierge's tap-tier Decisions (shell,
+  outside folders, tools, prompt/answer proposals) with the same detail, answered by a tap on the card. They are
+  never armed and never answered by voice or text; the button's badge and the panel's list now agree.
+- **Fix: Decisions and the armed card no longer vanish at random** (quirk pgd96twg): the open list and the armed
+  Decision reloaded on every stream open replaced what the stream had said while the reload was out. A reload's
+  snapshot now merges the Decision events that came meanwhile (and an older reload never overrides a newer one),
+  and an arm event that came while `GET …/arm` was out wins over its answer. A load out for over 30 s is forgotten
+  (no events buffered forever), and an older `GET …/arm` never overrides a newer one.
+
+- **Sessions by name, never a raw ID** (FX-12): Decision cards (their heading, "from", Requested by and Session), a
+  session's permission card (the recommender, who answered), hub message rows, Settings → Agents & access Activity
+  and Settings → Concierge's watch and mute lists name a session by its @name (the hub directory), else its title,
+  else its project folder and a short ID ("hub · ses_e6256f…"); the full ID is in the tooltip. An escalation's
+  heading is built from the hub's structured request ("API refactor asks to approve shell"; the command and reason
+  are in the details), other hub-written questions have their `ses_…` IDs named. Activity says "a permission
+  request", "a form" and "grant", with the IDs on hover. Display only: the data, the hub and what the Concierge
+  model sees are unchanged.
+
+## 0.8.0
+
+Workspaces, supervision, split panes and side chats, shared agent profiles, persistent AI-powered artifacts, teams,
+and the Watchtower. All new state is additive. Cluster hubs need `hub-server migrate` (schema v2) before the new
+pods start. See [docs/operations.md](docs/operations.md) for the rollout, rollback, backup and front-proxy notes.
+
+### Fork and revert a message
+- Hovering (or focusing) one of your messages in the console shows **Copy · Fork · Revert**, like the OpenCode app;
+  on a phone, long-press it or tap its ⋯ button. **Fork** opens a new session with the conversation before the
+  message and the message in its composer. **Revert** hides the message and everything after it, restores the files
+  the session changed since then (confirming first, with the list), and puts the message back in the composer; a
+  banner offers **Restore**; sending the next message makes it permanent. Works across devices and in panes.
+- New console routes (user-only, audited): `POST /api/sessions/:id/fork`, `GET …/revert/preview`, `POST …/revert`,
+  `POST …/revert/restore`, `POST …/revert/commit`. Spoke features `fork` and `revert` (OpenCode processes that reach
+  their own server) with ops `fork`, `revertPreview`, `revert`, `revertRestore`, `revertCommit`; a staged revert is
+  reported as `SessionInfo.revert` (additive: older hubs ignore it). Other harnesses show the actions disabled
+  ("not supported yet"). Contract: [docs/session-view.md](docs/session-view.md#fork-and-revert-a-message).
+
+### Workspaces and supervision
+- **Workspaces** ([docs/workspaces.md](docs/workspaces.md)): durable, cross-machine coordination units with host repo
+  bindings, members (`master`/`worker`/`observer`, generations), explicit assignments and a supervision graph
+  (acyclic, ≤ 6 levels) kept apart from native `parentID`. Membership and supervision grant nothing. New routes under
+  `/api/agent/workspaces…`, SDK `hub.workspaces`, 15 `workspace_*` MCP tools, and compact `workspace.*` events.
+- **Drag to supervise**: the sidebar's **Workspaces** tree shows each workspace's members under their supervisors.
+  Drag (or use Alt+arrows or the Move menu) to supervise, reorder or detach. "Spawned by" and "supervised by" are
+  shown separately.
+- **Situation board** (`GET …/board`): one bounded, text-free snapshot of members, presence, blockers, assignments,
+  Decisions and artifacts, with `stale`/`omitted`/`failed` sections instead of guesses.
+- **Supervisor digests and checkpoints**: masters and supervisors get batched, at-least-once digests as hub messages
+  from `app:workspace-coordinator`. `POST …/checkpoints` acknowledges them durably (flushed before the answer).
+- **Quieter digests**: routine updates (including snapshots) are delivered without waking an idle supervisor (2 min
+  quiet, 15 min max) and repeats of already-known states are dropped; assignment closures wake without interrupting
+  (30 s quiet, 5 min max); blockers, errors and urgent snapshots still wake and interrupt. A cleared error is still
+  reported, followed by the recovery. A member's session that disappears and comes back within one batch (a spoke
+  restart or reconnect) is not reported.
+- **Master replacement** (`POST …/master {sessionID | launchID}`): explicit, fenced, with the next generation. Supervised
+  members move to the new master. No grants move.
+
+### Panes and side chats
+- **Split panes**: **Open beside** shows up to 4 sessions or artifacts side by side, stacked or in a grid. The focused
+  pane owns the composer and Voice. Layouts are per device. On phones the panes are tabs. `/api/events` takes
+  `sessions=a,b` for the visible panes.
+- **Drag into panes**: drag a session (sidebar, Workspaces tree, Watchtower detail), an artifact (library) or a pane
+  (header grip) onto a pane: edges split side by side or stacked, the centre replaces, the layout reflows to a grid
+  when needed, and a fifth pane is refused with a notice. **Open in pane → left/right/top/bottom** in the session
+  menu is the keyboard equivalent. The layout switch is now a compact segmented control with icons.
+- **Side chats**: **Start side chat…** copies a bounded snapshot of a session into a new session on the workspace's
+  host binding (any machine), in a pane beside it, with **Refresh** and a confirmed **Send to main**. Neither
+  interrupts a running turn.
+
+### Agent profiles
+- **Shared, versioned profiles** ([docs/profiles.md](docs/profiles.md)): instructions, skills and commands (with
+  `{{param}}`, `{{arguments}}` and spoke-side `{{secret:NAME}}`), immutable versions, and import from
+  `AGENTS.md`/`CLAUDE.md`, `skills/*/SKILL.md` and `commands/*.md`. You pin an exact version to a session at runtime
+  (the profile chip), to a launch (`agentProfile`) or to a team role. The **Agent profiles** page is the library.
+  **Ctrl+Alt+P** inserts a rendered command into the composer.
+- **Per-harness application** through the new spoke feature `profileApply`, with honest acknowledgments (`applied`,
+  `partial`, `restart_required`, `unsupported`, `rejected`, `pending`): OpenCode (system prompt + `hub_profile`
+  tool), Claude Code (hook context, `set_model` in launched sessions), Codex (developer message + skill files);
+  presets are always `unsupported`. Local instructions win. No global harness config is written.
+- **Profile metadata and usage**: optional `metadata` and `projects` on a profile, and **Used by**
+  (`GET /api/agent/profiles/:id/usage`, SDK `hub.profiles.usage()`, MCP `profile_usage`): pinned sessions with
+  requested vs running version and an explicit Upgrade, team roles, launches and workspaces, each shown only under the
+  caller's existing read rules (`hidden` names what was left out). The library rows show usage chips, with filters and
+  sort.
+
+### Artifacts and AI
+- **Persistent artifacts** ([docs/artifacts.md](docs/artifacts.md)): revisions of content-addressed blobs (files
+  standalone, chunked Postgres in a cluster), `private` or `workspace` visibility, archive and delete, staged uploads up
+  to 25 MiB, and downloads always served as attachments. New routes, SDK `hub.artifacts`, and `artifact_*` MCP tools.
+- **Viewers and dashboards**: markdown, code, images, tables, charts, and declarative dashboards (schema v1, bindings
+  to other artifacts only, no URLs or scripts), plus a text editor with conflict-safe drafts.
+- **AI jobs**: ask, propose an edit or run a declared action. The job runs on a handler you choose (a new launch or an
+  existing session), always with the requester's authority. Proposals apply only when you **Accept**. Jobs survive hub
+  restarts, and each job times out after 2 h.
+- **Viewer redesign**: a header bar with kind icon, version picker (**Back to latest**), Copy, Download, Edit, Open in
+  pane and a details popover; content in a framed card (code with file/language header, line numbers, wrap; markdown
+  at reading width; dashboards and apps full-bleed); inline editing; and AI as a chat-style side panel (thread,
+  composer, Ask / Edit / Action or slash commands, compact handler picker that never preselects), resizable, a
+  bottom sheet on phones.
+
+### Isolated artifact host
+- Interactive `html`/`app` artifacts run only at `/artifact-host/v1/<capability>/…`: an opaque-origin sandbox with a
+  strict CSP, short-lived, viewer-bound and revocable capabilities, and a bridge (`resize`, `askAI`). Every `askAI`
+  becomes a consent card in the artifact's AI panel thread ([docs/artifact-host.md](docs/artifact-host.md)).
+
+### Teams
+- **Teams** ([docs/teams.md](docs/teams.md)): versioned definitions with roles, one entry role, `open` or `restricted`
+  communication paths (`one-way`/`two-way`, `msg`/`ask`), and a draft → publish flow. A session can belong to many
+  teams. The hub **enforces** the policy on delivery (`403 forbidden` with `extra.policy`). Team members cannot contact
+  sessions outside their teams unless a role has `externalContact`. Sessions in no team are unchanged.
+- **Staffing** with existing or newly launched sessions under your grants (`403 needs_user` lists what is missing).
+  **Intake** gives work to the team's entry role and tracks it as an assignment ([docs/teams-intake.md](docs/teams-intake.md)).
+- **Team addresses** `@@role#team` and `@@role.project#team` (quote `#` in shells). `/who`, `status` and `show` are
+  team-aware for team members.
+- Malformed addresses answer `Not an address: use ses_…, @name, @@role or @@role#team` with a syntax-only hint (for
+  `@engineer#support`: `@@engineer#support` or `@engineer`); the hint never reveals whether a name exists.
+- Entry-role sessions report and close their intake from the harness: OpenCode `hub` tool verbs `intake` and
+  `intake_update`, MCP `team_intake_update` (`expectedRevision` now optional). The intake message says how.
+- **Teams page** (`/teams`, in the primary navigation): team cards (mode, entry role, seats, vacant roles, open work),
+  **New team** in a dialog, and per team **Members** (one block per role, **+ Add member** with a searchable session
+  picker that shows other memberships, **Launch new …**), **Work** (Submit a task, live intake status with links to
+  the entry session and its assignment), **Communication** and **Details** (draft → Review and publish, history),
+  Pause/Archive and **Edit in Watchtower**. The Watchtower's team panel uses the same components and links back.
+- **Team isolation** (owner setting, default off): Settings → Teams, or `GET/PUT /api/agent/team-settings`
+  `{teamIsolation, expectedRevision}` (users only; SDK `hub.teams.settings()` / `setSettings()`). On: team members
+  see only their teams' sessions.
+
+### Watchtower
+- Renamed from **Bird's-eye view** (new lookout icon). `/birds-eye` links redirect to `/watchtower` with their
+  filters, and the browser's saved view and presets (`birdsEye.*`) move to `watchtower.*` once.
+- A full-screen page ([docs/watchtower.md](docs/watchtower.md)) of machines, sessions, you, your apps and teams, with
+  live message flow: 3D (lazy `3d-force-graph`), a deterministic 2D canvas, or a list (also used for reduced motion).
+  It has URL-state filters and presets, team clusters, drawn vs actual paths and denied attempts, and a **team
+  editor** to assemble, staff, publish and submit work. New read API `GET /api/agent/graph` (+ `/edges/:id`,
+  `/nodes/:id`).
+- Graph first: the controls are a floating **dock** at the bottom centre (view, Filters with an active count, Legend,
+  Teams, Hub details, Reset view, Pause motion, Search) that fades when idle. **Filters** is closed by default and
+  shows only the filters you add; active filters are removable chips over the canvas. The **Legend** has a visible
+  close and Escape closes it. On phones, filters, legend, details and the team editor are bottom sheets.
+- A look in the style of Brain Graph (MIT, credited in the docs): glowing points in coloured group regions, fibers that
+  brighten towards the receiver, depth of field, labels on the most connected nodes, and a stable layout kept per
+  device (`watchtower.layout`). Flow pulses fade with message age and stop once nothing on a link is working or
+  pending. Rendering is on demand (none while still or hidden), and the 3D view draws in about 25 batched calls.
+- Staffed seats are tied to their role by a tether and vacant roles are drawn hollow; the legend uses the same glyphs;
+  **More → Re-layout** clears the saved layout; the empty state sits below the hub core with **Connect a machine**.
+
+### Navigation
+- A primary navigation above the session groups: **All sessions**, **Artifacts** (a library across workspaces),
+  **Watchtower** and **Agent profiles**.
+- **Settings sections**: General, Notifications, Voice & speech, Machines & devices, Agents & access, Teams and Admin,
+  each its own page `/settings/<section>` (deep links, back/forward; old `/settings#speech`-style links still work).
+  A section sidebar on desktop, a section list with drill-in on phones, and a **Search settings** box that jumps to a
+  setting and highlights it. Notification kinds are collapsed by group with an on/off summary; the device's push
+  status is one line with **Details**.
+
+### Security hardening
+- **Bounded request bodies** everywhere: agent JSON 1 MiB, profiles 4 MiB, console JSON 4 MiB, `/mcp` 1 MiB, staged
+  blobs 25 MiB, all read by a rate-budgeted streaming reader. Oversized bodies are refused with `Connection: close`.
+  **Set a front-proxy request-body limit (26 MiB)**: the k8s ingress example now uses `proxy-body-size: 26m` (it was
+  `16m`).
+- A session seated in a team no longer sees sessions seated only in *other* teams: they are left out of `who`,
+  `status`, `show`, `log`, `/watch` and `/events`, and their addresses answer `404` like unknown ones. Sessions in no
+  team stay visible unless the owner turns on `teamIsolation` (Settings → Teams). Users, apps and team-less sessions
+  keep the owner-wide view.
+- New app-token scopes `workspaces:*`, `profiles:*`, `artifacts:*` and `teams:*`. **Existing tokens gain nothing**,
+  and session tokens are refused on workspace routes.
+- **Plain http only by opt-in**: `hub login` (device code, `--token` or a piped token) and `hub`/`hubctl machine enroll`
+  refuse plain http except on loopback, or with `--allow-insecure-http` for a private-network IP address (never a
+  host name), with a warning every time; nothing remembers the flag, and later commands using a stored plain-http
+  login warn on stderr. A loopback hub's approval link on this machine's LAN address is shown; other origins are
+  replaced with a warning.
+
+### Fixes
+- Counts pluralise correctly ("2 OpenCode processes", not "processs"); a team role's seat counter reads "1 of 2
+  required", "3 members · up to 16" or "full (16)" instead of "1 of 0–16".
+- The artifact AI panel lists handler sessions by `@name` (searchable by name, title or ID) and names a handler picked
+  in the console by its `@name` instead of its session ID.
+- The console's live stream opens at once when it resumes (the hub writes a first chunk immediately); before, it waited
+  for the 20 s heartbeat and **Reconnecting…** stayed up, across pages. Over plain http, Chrome still allows only 6
+  connections per host, so more than about 6 console tabs stall; https avoids this.
+- The sidebar, Details rail and pane resize handles show their resize pointer again (a hidden character had broken
+  those CSS rules).
+- `hub node` keeps OpenCode's background service warm (loopback only, every 30 s) so a freshly started service's
+  machine comes online without anyone opening a project (OpenCode has no server-start plugin hook).
+- **Routine `wake: false` messages no longer cost an OpenCode session a turn** (routine digests, `--no-wake`
+  messages). OpenCode gives every queued inbox item its own model call once a turn ends, resume or not, so a
+  supervisor answered each routine digest in a turn of its own. The OpenCode spoke now admits every non-waking
+  message steered without resume, and refuses a routine one (a `wake: false` `msg` that is not urgent, to a top-level
+  session) while a turn runs: the hub keeps it `pending` and delivers it after the turn, so it reaches the model with
+  the next real turn, before its prompt (CLI and MCP say "pending (offline or busy; …)"). A waking message to the
+  same session sends the pending ones first (if the session is still busy, the waking one goes first, queued after
+  the turn). A flush stops at a session's first failed delivery, so a busy session costs one try per sessions frame.
+  Urgent
+  ones, asks, replies, primers and anything for a subagent still go into a running turn. Live check:
+  `HUB_IT_OPENCODE=1 bun test test/e2e-quiet-delivery.it.test.ts`.
+- **Repeated blocks of one member no longer wake its supervisor each time**: blocked again for the same reason (same
+  blocker kind, or the same blocked/error state) within 15 min of a wake about it that the hub carried out, the
+  digest line is routine.
+- **A run that fails at once shows as failed** (a model or provider that does not exist, auth, quota). OpenCode ends
+  such a run within ~50 ms of `session.created`, before the spoke's debounced sessions snapshot (500 ms), and the hub
+  keeps status only for sessions it was told about, so it dropped the failure and listed the session idle: no banner,
+  no "!" badge, not under Needs you, no `providerError` push (also in 0.7.3). The spoke now sends the snapshot first
+  when a run event is about a session the hub has not been told about yet (creating sessions alone still waits for the
+  debounce), and resends a failure once a snapshot lists its session if the session's details were still being
+  fetched when it failed. Live check: `HUB_IT_OPENCODE=1 bun test test/spoke-run-failure.it.test.ts`.
+- **A session is never routed to another harness's spoke.** When no process owns a session and none of its
+  reporters is a service, the hub falls back to a background service on the reporter's machine; it took any service,
+  so an OpenCode session reported by a foreground `opencode serve` on a machine that also runs the Claude Code (or
+  Codex) service went to that service: "The claude-code spoke does not serve "timeline"" and `unsupported: summary`
+  (also in 0.7.3). The fallback now takes only a service of the session's own harness, else the reporter itself.
+
+### Runtime
+- **Bun 1.4.4**, pinned: the image (`oven/bun:1.4.4-slim` by digest, both stages), CI and release workflows, and
+  `engines.bun` (`>=1.4.4`). Bun 1.3.x's `Bun.SQL` auto-pipelining could stall a pooled Postgres connection under
+  concurrent writes (oven-sh/bun#33985; fixed in Bun 1.4.0 by oven-sh/bun#33627): a cluster pod's state queries then
+  never answered (the supervision IT's "many concurrent internal moves" hung or timed out in 3 of 15 runs on 1.3.5,
+  0 of 40 on 1.4.4).
+- Cluster: the Postgres pools set `statement_timeout` (30 s by default, `HUB_DATABASE_STATEMENT_TIMEOUT_MS`, `0`
+  off), so a query stuck on the database fails with an error instead of holding its caller and connection.
+- Bun 1.4 enforces the server's request ceiling on chunked bodies too; the ceiling now leaves 16 MiB above the
+  largest route bound, so an over-limit upload still gets the route's own `400`/`413` with `Connection: close`. Bun
+  1.4 then closes the socket instead of reading and discarding whatever the client keeps sending.
+- The image build copies the protocol and SDK sources into the console stage, which imports them (without them
+  `docker build` failed in the console's `vite build`).
+
+### Behavior notes
+- New agent error code `conflict` (409, with `currentRevision`) for stale `expectedRevision`s and reused
+  `Idempotency-Key`s. The SDK `ErrorCode` includes it, and the CLI exits 3.
+- The server's request ceiling rises from about 10 MiB to about 41 MiB (25 MiB blobs plus drain headroom). A JSON body
+  that was accepted before can now be refused as too large (by its route's bound).
+- SDK `parseAddress` refuses `#` in a role's project scope (`@@role#team` is only ever team-resolved).
+- Send to main and AI jobs handled by a session use normal delivery: they never interrupt a running turn. The first
+  message to an idle session right after the hub's primer may be delivered as steer.
+- Cluster: schema v2 (`artifact-blobs`). Run `hub-server migrate` before rolling pods, and don't create restricted
+  teams while old and new pods are mixed.
 
 ## 0.7.4
 

package/Dockerfile

@@ -7,6 +7,8 @@
 # Legacy VOICE_* variables still work, except that the HUB_HOST/HUB_PORT/HUB_STATE_DIR defaults below
 # win over VOICE_HOST/VOICE_PORT/VOICE_STATE_DIR: rename those overrides to HUB_*.
 # The console (web/, Solid + Vite) is built in its own stage; the image ships only web/dist.
+# Bun is pinned (tag and multi-arch index digest) to 1.4.4: it has the Bun.SQL pipelining fix (oven-sh/bun#33627,
+# in since 1.4.0; 1.3.x stalls pooled Postgres connections in cluster mode). Bump both stages together.
 FROM node:22-slim AS web
 WORKDIR /build
 COPY package.json package-lock.json ./
@@ -24,9 +26,12 @@ COPY packages/preset/package.json ./packages/preset/
 COPY packages/codex/package.json ./packages/codex/
 RUN npm ci --no-audit --no-fund --ignore-scripts
 COPY web ./web
+# The console imports the protocol and SDK sources (web/src/… ../packages/{protocol,sdk}/src).
+COPY packages/protocol/src ./packages/protocol/src
+COPY packages/sdk/src ./packages/sdk/src
 RUN npx vite build --config web/vite.config.ts
 
-FROM oven/bun:1.3-slim AS deps
+FROM oven/bun:1.4.4-slim@sha256:1846adf22496bd711036aae8be147e57bdebbaea2e5264e3e0b5af1db187d9a4 AS deps
 WORKDIR /build
 COPY package.json package-lock.json ./
 COPY packages/protocol/package.json ./packages/protocol/
@@ -47,7 +52,7 @@ COPY docker/hub-deps.ts ./
 # Keep only what the hub loads at runtime (the @opencode/* packages are for the plugin).
 RUN bun hub-deps.ts /deps web-push
 
-FROM oven/bun:1.3-slim
+FROM oven/bun:1.4.4-slim@sha256:1846adf22496bd711036aae8be147e57bdebbaea2e5264e3e0b5af1db187d9a4
 LABEL org.opencontainers.image.title="hub" \
       org.opencontainers.image.description="Hub: a central hub for AI agent harnesses (OpenCode first): remote console, pairing, push and optional Voice" \
       org.opencontainers.image.licenses="MIT" \