@huynle/hub 0.7.4 → 0.8.1

package/src/central/agent/acting.ts

@@ -19,6 +19,9 @@
 // - Every outcome after the address resolves is in the agent audit: decision (allow, needs_user, forbidden,
 //   paused, rate_limited) and outcome (ok, gone, offline, unsupported, escalated, refused, failed).
 // - Races: the request answered elsewhere first is gone (410).
+// - (CON-06) preflight: a Concierge proposal is checked exactly like the act verb would check the agent, short of
+//   its grant (kill switch, tenancy, the Concierge guard, pending request/form, self-tree, prompt rules); nothing is
+//   consumed, audited or sent. When the user says go, the verb runs as the user (no grant, tenancy re-checked).
 import {
   DELIVER_TEXT_MAX,
   type Delivered,
@@ -35,7 +38,8 @@ import {
 import { type Actions, type Unsupported, unsupportedMessage } from "../actions"
 import { BusyError, type Registry } from "../registry"
 import { SpokeError } from "../spoke-ws"
-import type { PermissionRequest } from "../../status"
+import type { FormFieldSpec, PermissionRequest } from "../../status"
+import { formAnswerFieldProblem } from "./form-check"
 import type { ActingSwitch } from "./acting-switch"
 import type { AgentActor } from "./actor"
 import type { AgentAudit, AuditDecision, AuditOutcome, AuditTarget } from "./audit"
@@ -51,7 +55,9 @@ import { evaluatePermission, formatPattern, type GrantVerb, parsePattern, type P
 export type ActingRegistry = Pick<
   Registry,
   "sessionTenant" | "session" | "rootOf" | "permissionRequest" | "permissionTargets" | "formTargets" | "owner" | "supports" | "harnessOf"
->
+> &
+  /** (CON-13) The tree's live status: a pending form's fields (its schema). Without it no answer is checked. */
+  Partial<Pick<Registry, "status">>
 
 /** Why a request needs the user, as the policy saw it. */
 export interface Evaluation {
@@ -97,8 +103,20 @@ export interface ActingDeps {
   readonly newMessageID?: () => string
   /** Longest prompt a user sends (the console's limit); agents' prompts are at most DELIVER_TEXT_MAX. */
   readonly maxPromptChars?: number
+  /** (CON-04) Sessions only the user acts on (the Concierge's): agents get forbidden {policy: "concierge"}. */
+  readonly protect?: (userID: string, sessionID: string) => Promise<boolean>
+  /**
+   * (CON-13 decision, design §11.4) Whether the acting session is a Concierge session (current or past). Such an
+   * actor never executes a tap-tier approval (shell, outside folders, MCP and unknown tools, near-never) or an
+   * "always", even inside its grant: needs_user, a tap Decision. A failed read counts as yes (fail closed).
+   */
+  readonly conciergeActor?: (userID: string, sessionID: string) => Promise<boolean>
 }
 
+/** (CON-13 decision) Why the Concierge escalates a covered request. */
+export const CONCIERGE_TAP_REASON = "Shell, outside folders and tools always need the user's tap"
+export const CONCIERGE_ALWAYS_REASON = "The Concierge never answers “always”: the user decides"
+
 /** Who acts, for which user. */
 export interface Caller {
   readonly actor: AgentActor
@@ -162,6 +180,8 @@ export interface PromptInput {
   /** Agents' prompts always wake the session: false is refused. */
   readonly wake?: boolean
   readonly why?: string
+  /** (CON-09a) false: not the user's own text (a proposal run as the user): never the session's first-prompt intent. */
+  readonly intent?: false
 }
 
 /** An agent's prompt, admitted by the spoke under its provenance header. */
@@ -176,6 +196,28 @@ export interface AgentPrompted {
 /** The user's prompt: steered into the running tree, or a new turn (its reply streams to the console). */
 export type UserPrompted = { readonly sessionID: string; readonly mode: "steer"; readonly inboxID: string } | { readonly sessionID: string; readonly mode: "turn" }
 
+/** (CON-13) A pending form's schema, as an agent may read it: the fields it takes (bounded by the spoke). */
+export interface PendingForm {
+  readonly sessionID: string
+  readonly formID: string
+  /** The session in the tree that asked (a subagent's form is answered through its root). */
+  readonly askedBy: string
+  readonly title: string
+  readonly question?: true
+  readonly fields: readonly FormFieldSpec[]
+}
+
+/** (CON-06) The verbs a Concierge proposal covers, and what preflight answers about the target. */
+export type ProposalVerb = "stop" | "deny" | "prompt" | "answer"
+export interface Preflighted {
+  readonly sessionID: string
+  readonly rootID: string
+  /** The target's @name. */
+  readonly name?: string
+  /** deny: the pending request's details (when known). */
+  readonly request?: PermissionRequest
+}
+
 /** The console's prompt limit (http.ts MAX_PROMPT_CHARS; Central passes it). */
 const DEFAULT_MAX_PROMPT_CHARS = 100_000
 
@@ -258,9 +300,10 @@ export class Acting {
     const origin = this.pendingPermission(target, input.requestID)
     const always = input.always === true
     const decision: PermissionDecision = always ? "always" : "once"
+    const concierge = await this.isConcierge(caller)
     return this.act(caller, "approve", target, { requestID: input.requestID }, input.why, {
       selfTree: true,
-      choose: (usable) => this.choosePermission(usable, origin.request, always),
+      choose: (usable) => this.choosePermission(usable, origin.request, always, concierge),
       escalation: (evaluation) => ({
         verb: "approve",
         target: target.sessionID,
@@ -281,6 +324,39 @@ export class Acting {
     })
   }
 
+  /**
+   * (CON-06) Checks an agent's proposed act as the verb would, short of its grant: kill switch (paused), tenancy
+   * (not_found/offline), the Concierge guard (forbidden {policy: concierge}), the pending request or form
+   * (not_found), self-tree (forbidden), the prompt rules (invalid). Consumes, audits and sends nothing.
+   */
+  async preflight(caller: Caller, verb: ProposalVerb, addr: string, ids: { readonly requestID?: string; readonly formID?: string; readonly text?: string; readonly answer?: FormAnswer }): Promise<Preflighted> {
+    const { actor, userID } = caller
+    if (actor.kind !== "user") this.deps.acting.ensureActing(userID)
+    if (verb === "prompt" && actor.kind !== "user") {
+      const text = (ids.text ?? "").trim()
+      if (!text) throw invalid("Empty prompt")
+      if (text.length > DELIVER_TEXT_MAX) throw invalid(`Prompt longer than ${DELIVER_TEXT_MAX} characters`)
+    }
+    const target = this.locate(userID, addr)
+    if (actor.kind !== "user") await this.guard(userID, target)
+    let request: PermissionRequest | undefined
+    if (verb === "deny") request = this.pendingPermission(target, ids.requestID ?? "").request
+    if (verb === "answer" && !this.deps.registry.formTargets(target.rootID, ids.formID ?? "").length) throw new AgentError("not_found", `No pending form ${ids.formID} in this session's tree`)
+    if (verb === "answer" && ids.answer !== undefined && actor.kind !== "user") this.checkAnswer(target, ids.formID ?? "", ids.answer)
+    if ((verb === "deny" || verb === "answer") && actor.kind === "session" && (this.deps.registry.rootOf(actor.sessionID) ?? actor.sessionID) === target.rootID) {
+      throw forbidden("A session never answers requests in its own session tree")
+    }
+    if (verb === "prompt" && actor.kind !== "user") {
+      if (target.parentID) throw invalid("Prompts go to root sessions, not subagent sessions")
+      if (actor.kind === "session" && actor.sessionID === target.sessionID) throw invalid("A session never prompts itself")
+    }
+    let name: string | undefined
+    try {
+      name = this.deps.directory.resolveOne(userID, target.sessionID).name
+    } catch {}
+    return { sessionID: target.sessionID, rootID: target.rootID, ...(name ? { name } : {}), ...(request ? { request } : {}) }
+  }
+
   /** Rejects a pending permission request (any request: a reject is always safe), with an optional reason. */
   async deny(caller: Caller, addr: string, input: DenyInput): Promise<Denied> {
     const target = this.locate(caller.userID, addr)
@@ -306,6 +382,8 @@ export class Acting {
     if (!this.deps.registry.formTargets(target.rootID, input.formID).length) throw new AgentError("not_found", `No pending form ${input.formID} in this session's tree`)
     return this.act(caller, "answer", target, { formID: input.formID }, input.why, {
       selfTree: true,
+      // (CON-13) Checked after the grant's checks (a holder without the verb learns nothing of the form), before it runs.
+      check: () => (input.cancel || caller.actor.kind === "user" ? undefined : this.checkAnswer(target, input.formID, input.answer)),
       run: async (grant) => {
         const form = input.cancel
           ? { rootID: target.rootID, formID: input.formID, cancel: true as const }
@@ -318,6 +396,88 @@ export class Acting {
     })
   }
 
+  /**
+   * (CON-13) A pending form's schema in the addressed session's tree: its title and fields (keys, types, options,
+   * required…), never anything else of the session. Checked like the answer verb short of its grant: kill switch,
+   * tenancy, the Concierge guard, the pending form, self-tree. Consumes, audits and sends nothing.
+   */
+  async form(caller: Caller, addr: string, formID: string): Promise<PendingForm> {
+    const { actor, userID } = caller
+    if (actor.kind !== "user") this.deps.acting.ensureActing(userID)
+    const target = this.locate(userID, addr)
+    if (actor.kind !== "user") await this.guard(userID, target)
+    if (!this.deps.registry.formTargets(target.rootID, formID).length) throw new AgentError("not_found", `No pending form ${formID} in this session's tree`)
+    if (actor.kind === "session" && (this.deps.registry.rootOf(actor.sessionID) ?? actor.sessionID) === target.rootID) throw forbidden("A session never answers requests in its own session tree")
+    const found = this.formBlocker(target, formID)
+    return {
+      sessionID: target.sessionID,
+      formID,
+      askedBy: found?.sessionID ?? target.sessionID,
+      title: found?.blocker.summary ?? "question",
+      ...(found?.blocker.question ? { question: true as const } : {}),
+      fields: found?.blocker.fields ?? [],
+    }
+  }
+
+  /**
+   * (CON-13) Whether the agent's grant would approve this pending request once, as approve() decides it: kill switch,
+   * tenancy, the Concierge guard, pending in the tree, self-tree, a usable grant with approve, then every never rule
+   * and the allow rules (choosePermission). Never acts, consumes, audits or escalates; any refusal is false. The
+   * hourly cap is not counted (the act may still be rate limited). The board's `inGrant` (the model never decides).
+   */
+  async covers(caller: Caller, addr: string, requestID: string): Promise<boolean> {
+    const { actor, userID } = caller
+    if (actor.kind === "user") return false
+    try {
+      this.deps.acting.ensureActing(userID)
+      const target = this.locate(userID, addr)
+      await this.guard(userID, target)
+      const { request } = this.pendingPermission(target, requestID)
+      if (actor.kind === "session" && (this.deps.registry.rootOf(actor.sessionID) ?? actor.sessionID) === target.rootID) return false
+      const usable = await this.deps.grants.usable(actor, "approve", { directory: target.directory })
+      if (!usable.length) return false
+      this.choosePermission(usable, request, false)
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  /**
+   * (CON-13 decision) The board's facts for a pending request: `inGrant` (covers(): the policy's truth) and `auto`:
+   * inGrant and not the tap risk tier, i.e. the Concierge may approve it once without the user.
+   */
+  async coverage(caller: Caller, addr: string, requestID: string): Promise<{ inGrant: boolean; auto: boolean }> {
+    const inGrant = await this.covers(caller, addr, requestID)
+    if (!inGrant) return { inGrant, auto: false }
+    try {
+      const target = this.locate(caller.userID, addr)
+      const { request } = this.pendingPermission(target, requestID)
+      if (!request) return { inGrant, auto: false }
+      const usable = await this.deps.grants.usable(caller.actor, "approve", { directory: target.directory })
+      const never = [...this.deps.acting.hubNever(), ...usable.flatMap((g) => patterns(g.permissions.never))]
+      return { inGrant, auto: riskTier(request, never) !== "tap" }
+    } catch {
+      return { inGrant, auto: false }
+    }
+  }
+
+  /** The form's blocker in the target's tree (with the session that shows it), when the registry reports it. */
+  private formBlocker(target: Located, formID: string) {
+    for (const s of this.deps.registry.status?.(target.rootID) ?? []) {
+      const blocker = s.blockers.find((b) => b.kind === "form" && b.id === formID)
+      if (blocker) return { sessionID: s.id, blocker }
+    }
+    return undefined
+  }
+
+  /** (CON-13) 400 invalid with the precise problem when an agent's answer does not fit the form's fields. */
+  private checkAnswer(target: Located, formID: string, answer: FormAnswer): void {
+    const fields = this.formBlocker(target, formID)?.blocker.fields
+    const problem = fields ? formAnswerFieldProblem(fields, answer) : undefined
+    if (problem) throw new AgentError("invalid", problem, { hint: "Read the form's fields first (concierge_form, or show) and answer with their keys and option values" })
+  }
+
   /** Stops the addressed session's tree. */
   async stop(caller: Caller, addr: string, input: StopInput): Promise<StoppedSession> {
     const target = this.locate(caller.userID, addr)
@@ -361,16 +521,16 @@ export class Acting {
     }
     return this.act(caller, "prompt", target, {}, input.why, {
       run: async (grant) => {
-        if (!grant) return this.userPrompt(target.sessionID, text, images)
+        if (!grant) return this.userPrompt(target.sessionID, text, images, input.intent)
         return this.agentPrompt(caller, addr, target.sessionID, text, grant, input.delivery)
       },
     })
   }
 
-  private async userPrompt(sessionID: string, text: string, images: readonly PromptImage[] | undefined): Promise<UserPrompted> {
+  private async userPrompt(sessionID: string, text: string, images: readonly PromptImage[] | undefined, intent?: false): Promise<UserPrompted> {
     let started
     try {
-      started = await this.deps.actions.prompt({ sessionID, text, ...(images ? { images } : {}), resetHops: true })
+      started = await this.deps.actions.prompt({ sessionID, text, ...(images ? { images } : {}), resetHops: true, ...(intent === false ? { intent } : {}) })
     } catch (cause) {
       if (cause instanceof BusyError) throw new AgentError("rate_limited", "Another turn is starting in this session", { hint: "Try again", extra: { retryAfter: 1 } })
       throw cause
@@ -427,6 +587,8 @@ export class Acting {
       /** The grant to act under (default: the newest usable); throws NeedsUser or forbidden. */
       readonly choose?: (usable: Grant[]) => Grant
       readonly escalation?: (evaluation: Evaluation) => Omit<Escalation, "userID" | "actor">
+      /** (CON-13) Input checks that need the target (throw invalid): after the grant's checks, before it is consumed. */
+      readonly check?: () => void
       readonly run: (grant: Grant | undefined) => Promise<T>
     },
   ): Promise<T> {
@@ -446,16 +608,21 @@ export class Acting {
     try {
       if (actor.kind !== "user") {
         acting.ensureActing(userID)
+        await this.guard(userID, target)
         const usable = await grants.usable(actor, verb, { directory: target.directory })
         if (!usable.length) throw forbidden(`No grant lets this ${actor.kind} ${verb} in this session`)
         if (plan.selfTree && actor.kind === "session" && (this.deps.registry.rootOf(actor.sessionID) ?? actor.sessionID) === target.rootID) {
           throw forbidden("A session never answers requests in its own session tree")
         }
         grant = plan.choose ? plan.choose(usable) : usable[0]!
+        plan.check?.()
         await grants.consume(grant)
         acting.ensureActing(userID)
       }
-      const result = await plan.run(grant)
+      // (CON-13) What the spoke said when it refused, never a bare 500.
+      const result = await plan.run(grant).catch((cause: unknown) => {
+        throw refusedBySession(cause)
+      })
       await record("allow", "ok", why)
       return result
     } catch (cause) {
@@ -474,6 +641,13 @@ export class Acting {
     }
   }
 
+  /** (CON-04) Sessions only the user acts on (the Concierge's): agents are forbidden {policy: concierge}. */
+  private async guard(userID: string, target: Located): Promise<void> {
+    if (this.deps.protect && ((await this.deps.protect(userID, target.rootID)) || (await this.deps.protect(userID, target.sessionID)))) {
+      throw new AgentError("forbidden", "Only the user acts on the Concierge", { extra: { policy: "concierge" } })
+    }
+  }
+
   /** Hands the escalation to the hook: undefined when there is none or it failed. */
   private async escalate(caller: Caller, escalation: Omit<Escalation, "userID" | "actor"> | undefined): Promise<{ decisionID?: string } | undefined> {
     if (!this.deps.escalate || !escalation) return undefined
@@ -485,10 +659,25 @@ export class Acting {
     }
   }
 
-  /** The grant that covers the request, after every never rule; NeedsUser when none does. */
-  private choosePermission(usable: Grant[], request: PermissionRequest | undefined, always: boolean): Grant {
+  /** (CON-13 decision) The actor is a Concierge session (current or past); a failed read counts as yes. */
+  private async isConcierge(caller: Caller): Promise<boolean> {
+    const { actor } = caller
+    if (actor.kind !== "session" || !this.deps.conciergeActor) return false
+    try {
+      return await this.deps.conciergeActor(caller.userID, actor.sessionID)
+    } catch {
+      return true
+    }
+  }
+
+  /**
+   * The grant that covers the request, after every never rule; NeedsUser when none does. (CON-13 decision)
+   * `concierge`: a Concierge actor's "always", or a covered request of the tap risk tier, is NeedsUser at tap tier.
+   */
+  private choosePermission(usable: Grant[], request: PermissionRequest | undefined, always: boolean, concierge = false): Grant {
     const hubNever = this.deps.acting.hubNever()
     const ids = usable.map((g) => g.id)
+    if (concierge && always) throw new NeedsUser({ verdict: "outside", reason: CONCIERGE_ALWAYS_REASON, tier: "tap", grants: ids })
     if (!request) throw new NeedsUser({ verdict: "outside", reason: "The request's details are unknown", tier: "tap", grants: ids })
     const rules = usable.map((g) => ({ grant: g, allow: patterns(g.permissions.allow), never: patterns(g.permissions.never) }))
     for (const form of neverForms(request)) {
@@ -504,7 +693,10 @@ export class Acting {
     let reason: string | undefined
     for (const { grant, allow, never } of rules) {
       const verdict = evaluatePermission(request, { grant: { allow, never }, hubNever, always, allowAlways: grant.allowAlways })
-      if (verdict.verdict === "allow") return grant
+      if (verdict.verdict === "allow") {
+        if (concierge && riskTier(request, allNever) === "tap") throw new NeedsUser({ verdict: "outside", reason: CONCIERGE_TAP_REASON, tier: "tap", grants: ids })
+        return grant
+      }
       if (verdict.verdict === "outside") reason ??= verdict.reason
     }
     throw new NeedsUser({ verdict: "outside", reason: reason ?? "Outside the grant", tier: riskTier(request, allNever), grants: ids })
@@ -570,12 +762,25 @@ function bounded(text: string, max: number): string {
 }
 
 const gone = () => new AgentError("gone", "Already answered, expired or ended")
+
+/**
+ * (CON-13) The session's harness refused the act (OpenCode said why, e.g. "Unknown form field: Questions"): 400
+ * invalid with its words (bounded, one line), never a 500 "Internal error" a model would repeat to the user. The
+ * audit keeps it as allowed · failed. A disconnect stays offline; hub errors pass through.
+ */
+export function refusedBySession(cause: unknown): unknown {
+  if (cause instanceof AgentError || cause instanceof NeedsUser || cause instanceof BusyError) return cause
+  if (cause instanceof SpokeError && /disconnected/i.test(cause.message)) return new AgentError("offline", "The session's spoke disconnected")
+  const said = sanitizeText(cause instanceof Error ? cause.message : String(cause)).replace(/\s+/g, " ").trim().slice(0, 300) || "no reason given"
+  return new AgentError("invalid", `The session refused it: ${said}`, { extra: { refusedBy: "session" } })
+}
 /** The spoke lacks the core op: unsupported {feature, harness}, as the read routes answer. */
 const unsupported = ({ feature, harness }: Unsupported) => new AgentError("unsupported", unsupportedMessage({ feature, harness }), { extra: { feature, harness } })
 
 /** An error's audit decision and outcome (shared with the launch routes). */
 export function auditOf(cause: unknown): [AuditDecision, AuditOutcome] {
   if (!(cause instanceof AgentError)) return ["allow", "failed"]
+  if (cause.options.extra?.refusedBy === "session") return ["allow", "failed"]
   switch (cause.code) {
     case "paused":
       return ["paused", "refused"]
@@ -585,6 +790,9 @@ export function auditOf(cause: unknown): [AuditDecision, AuditOutcome] {
       return ["forbidden", "refused"]
     case "rate_limited":
       return ["rate_limited", "refused"]
+    // (FX-07) The hub's state did not answer in time: refused, and Activity says the hub was busy.
+    case "busy":
+      return ["busy", "refused"]
     case "needs_user":
       return ["needs_user", "refused"]
     case "gone":

package/src/central/agent/app-tokens.ts

@@ -7,6 +7,7 @@
 //
 // Management (create, list, revoke) is for user actors only (allow {}): a session or app token cannot mint or
 // see tokens (escalation guard).
+import { boundedJson } from "./body"
 import { randomBytes, timingSafeEqual } from "node:crypto"
 import type { AppToken } from "../agent-data"
 import { hashToken, type Store } from "../store"
@@ -19,7 +20,7 @@ import type { AgentRoute } from "./routes"
  * acting on sessions (approve, deny, answer, prompt, stop) and launching sessions (phase 4), each of which still
  * needs a grant held by the token (with the act verb, or `launch` covering the repo).
  */
-export const APP_SCOPES: readonly string[] = ["sessions:read", "sessions:manage", "messages:send", "messages:read", "sessions:act", "sessions:launch", "events:subscribe"]
+export const APP_SCOPES: readonly string[] = ["sessions:read", "sessions:manage", "messages:send", "messages:read", "sessions:act", "sessions:launch", "events:subscribe", "profiles:read", "profiles:manage", "profiles:assign", "workspaces:read", "workspaces:manage", "artifacts:read", "artifacts:write", "artifacts:ai", "teams:submit", "teams:read", "teams:manage"]
 export const DEFAULT_APP_SCOPES: readonly string[] = ["sessions:read"]
 /** What `hub login` (the CLI login device code) asks for unless it asks for more: reading sessions and messaging. */
 export const DEFAULT_CLI_LOGIN_SCOPES: readonly string[] = ["sessions:read", "messages:send", "messages:read"]
@@ -121,7 +122,7 @@ export function appTokenRoutes(store: Store): AgentRoute[] {
       path: PREFIX,
       allow: {},
       async handle({ request, user }) {
-        const { record, token } = await issueAppToken(store, user.id, parseCreate(await request.json()))
+        const { record, token } = await issueAppToken(store, user.id, parseCreate(await boundedJson(request)))
         return Response.json({ ...view(record), token }, { status: 201, headers: NO_STORE })
       },
     },

package/src/central/agent/audit.ts

@@ -10,6 +10,9 @@
 //   fails the record.
 // - Admins see only a hub-wide summary in the Store's audit (who: the user ID; kind: agent.<verb> and the actor
 //   kind; when), never targets, reasons or text (design §7).
+// - (CON-06) `as: "concierge"`: entries whose actor is one of the user's Concierge sessions (current or past) are
+//   marked here, centrally, so every recording route (acting, launch, message, roles) gets it; the console says
+//   "by @@concierge". A failed identity read leaves the entry unmarked (it is still recorded).
 import type { Clock, StateStore } from "../backend/types"
 import type { AuditEntry } from "../store"
 import { type Party, sanitizeText } from "./envelope"
@@ -26,7 +29,7 @@ export const AUDIT_PAGE_DEFAULT = 100
 export const AUDIT_PAGE_MAX = 500
 
 /** The policy's decision: allowed, or why not. */
-export type AuditDecision = "allow" | "needs_user" | "forbidden" | "paused" | "rate_limited"
+export type AuditDecision = "allow" | "needs_user" | "forbidden" | "paused" | "rate_limited" | "busy"
 /** What happened: done, failed, raced (gone), the spoke could not (offline, unsupported), escalated or refused. */
 export type AuditOutcome = "ok" | "failed" | "gone" | "offline" | "unsupported" | "escalated" | "refused"
 
@@ -50,6 +53,8 @@ export interface AuditInput {
   /** The agent's reason (`--why`) or the policy's. */
   readonly reason?: string
   readonly outcome: AuditOutcome
+  /** (CON-06) Done by one of the user's Concierge sessions (current or past). */
+  readonly as?: "concierge"
 }
 
 export interface AgentAuditEntry extends AuditInput {
@@ -80,6 +85,8 @@ export interface AgentAuditDeps {
   readonly recorded?: (userID: string, entry: AgentAuditEntry) => void
   /** Ring size (default AGENT_AUDIT_LIMIT). */
   readonly limit?: number
+  /** (CON-06) Whether a session is one of the user's Concierge sessions (current or past). */
+  readonly concierge?: (userID: string, sessionID: string) => Promise<boolean>
 }
 
 const ENTRIES = "agent-audit"
@@ -122,6 +129,7 @@ export class AgentAudit {
     const seq = (await updateVersioned<number>(state, userID, SEQ, SEQ_KEY, (current) => (current ?? 0) + 1))!
     const grant = cleanID(input.grant)
     const reason = cleanReason(input.reason)
+    const as = input.as === "concierge" || (input.actor.kind === "session" && (await this.isConcierge(userID, input.actor.sessionID))) ? ("concierge" as const) : undefined
     const entry: AgentAuditEntry = {
       seq,
       at: this.now(),
@@ -132,6 +140,7 @@ export class AgentAudit {
       decision: input.decision,
       ...(reason ? { reason } : {}),
       outcome: input.outcome,
+      ...(as ? { as } : {}),
     }
     await state.put(userID, ENTRIES, keyOf(seq), entry)
     if (seq > this.limit) await state.delete(userID, ENTRIES, keyOf(seq - this.limit))
@@ -144,6 +153,14 @@ export class AgentAudit {
     return entry
   }
 
+  private async isConcierge(userID: string, sessionID: string): Promise<boolean> {
+    try {
+      return (await this.deps.concierge?.(userID, sessionID)) === true
+    } catch {
+      return false
+    }
+  }
+
   /** The user's entries, newest first, a page at a time. */
   async list(userID: string, options: AuditListOptions = {}): Promise<AuditPage> {
     const limit = Math.min(Math.max(Math.floor(options.limit ?? AUDIT_PAGE_DEFAULT), 1), AUDIT_PAGE_MAX)

package/src/central/agent/body.ts

@@ -0,0 +1,163 @@
+// Bounded request bodies for JSON routes (HWA-28 review of HWA-21/24). The server's maxRequestBodySize is ~41 MiB
+// (artifact blob uploads plus drain headroom; Bun 1.3.5 did not even enforce it for a chunked body the handler keeps
+// up with), so every JSON route keeps its own bounds, in bytes AND time:
+//   - a declared content-length over the bound is refused without keeping anything (read and discarded within the
+//     drain budget below, else unread with Connection: close);
+//   - a streamed (chunked) body is kept only up to the bound; the rest is then read and discarded, but at most
+//     BODY_LIMITS.drainBytes more within BODY_LIMITS.drainMs. A body that ends within that budget leaves the
+//     kept-alive connection clean (cancelling mid-stream made Bun answer the client's NEXT request on it with a bare
+//     400, quirk cmramwb8). One that doesn't (endless, huge or dripping) is cancelled and the answer carries
+//     `Connection: close`, so clients and proxies do not reuse the dirty socket;
+//   - time is budgeted by RATE, not a fixed deadline: a body may take graceMs + received / minBytesPerSecond
+//     (so at most graceMs + max / minBytesPerSecond for the route's byte limit), and no gap between bytes may exceed
+//     idleMs. Slow but steady clients succeed (a 1.4 MB body at 20 KiB/s); a drip cannot hold a handler.
+//   - the body is read continuously (nothing but the next read is awaited), so Bun never gathers a flood into one
+//     huge chunk while JS waits on something else (a full-speed endless body stays at a few MiB of memory).
+// Over the bound answers 400 invalid "The body is larger than N bytes" (extra.limit) before any validation; too slow
+// answers 400 invalid "The body arrived too slowly …" (Connection: close).
+//
+// Limit of the platform (Bun 1.3.5, measured with raw sockets): after a handler answered, Bun keeps reading — and
+// discarding — whatever a client goes on sending on that socket, even with `Connection: close`, a cancelled body or
+// server.timeout(); the handler and its memory are free, but the socket stays open while bytes flow. That holds for
+// every route, including ones that never read a body. Only a front proxy with a request body limit ends it there.
+// Bun 1.4.4 (the pinned runtime) closes the socket after a `Connection: close` answer instead, and enforces the
+// server's maxRequestBodySize on chunked bodies (see its headroom in ../http.ts).
+import { AgentError } from "./errors"
+
+/** The default bound of an agent JSON body (messages, launches, grants, workspaces, …). */
+export const AGENT_JSON_BODY_MAX = 1 << 20
+/** Profiles carry versions of up to 512 KiB (PROFILE_LIMITS.versionBytes), JSON-escaped. */
+export const PROFILE_JSON_BODY_MAX = 4 << 20
+
+export interface BodyLimits {
+  /** At most this many bytes past the bound are read (and discarded) to keep the connection clean. */
+  readonly drainBytes: number
+  /** …within this long after the bound was crossed. */
+  readonly drainMs: number
+  /** Time every body gets before the rate counts. */
+  readonly graceMs: number
+  /** Each byte received earns 1 / minBytesPerSecond seconds more. */
+  readonly minBytesPerSecond: number
+  /** The longest gap without bytes. */
+  readonly idleMs: number
+}
+
+export const BODY_LIMITS: BodyLimits = { drainBytes: 8 << 20, drainMs: 2_000, graceMs: 30_000, minBytesPerSecond: 8 * 1024, idleMs: 30_000 }
+
+/** Where a body's time budget ends (ms, same clock as the inputs): the rate budget or the idle limit, whichever first. */
+export function bodyDeadline(progress: { readonly startedAt: number; readonly lastByteAt: number; readonly received: number }, limits: Pick<BodyLimits, "graceMs" | "minBytesPerSecond" | "idleMs">): number {
+  const earned = progress.startedAt + limits.graceMs + (progress.received * 1000) / limits.minBytesPerSecond
+  return Math.min(earned, progress.lastByteAt + limits.idleMs)
+}
+
+export type BoundedBody = { readonly ok: true; readonly bytes: Uint8Array } | { readonly ok: false; readonly reason: "too_large" | "timeout"; readonly close: boolean }
+
+const TIMEOUT = Symbol("timeout")
+type Read = Awaited<ReturnType<ReadableStreamDefaultReader<Uint8Array>["read"]>>
+
+/** reader.read(), or TIMEOUT once `deadline` (performance.now()) has passed. */
+export async function readBefore(reader: ReadableStreamDefaultReader<Uint8Array>, deadline: number): Promise<Read | typeof TIMEOUT> {
+  const left = deadline - performance.now()
+  if (left <= 0) return TIMEOUT
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    return await Promise.race([reader.read(), new Promise<typeof TIMEOUT>((resolve) => (timer = setTimeout(() => resolve(TIMEOUT), left)))])
+  } finally {
+    clearTimeout(timer)
+  }
+}
+export const isTimeout = (value: unknown): value is typeof TIMEOUT => value === TIMEOUT
+
+const cancel = (reader: ReadableStreamDefaultReader<Uint8Array>) => reader.cancel().catch(() => {})
+
+/**
+ * Discards what is left of a body within the byte and time budget: true when the body ended (the connection is
+ * clean), false when the budget ran out (the reader is cancelled: answer with Connection: close).
+ */
+export async function drainBounded(reader: ReadableStreamDefaultReader<Uint8Array>, limits: Partial<BodyLimits> = {}): Promise<boolean> {
+  const { drainBytes, drainMs } = { ...BODY_LIMITS, ...limits }
+  const deadline = performance.now() + drainMs
+  let drained = 0
+  try {
+    for (;;) {
+      const next = await readBefore(reader, deadline)
+      if (next === TIMEOUT) break
+      if (next.done) return true
+      drained += next.value.byteLength
+      if (drained > drainBytes) break
+    }
+  } catch {
+    return false // the client went away
+  }
+  await cancel(reader)
+  return false
+}
+
+/** The body's bytes, at most `max` of them, within the byte and time limits (see the file comment). */
+export async function readBounded(request: Request, max: number, limits: Partial<BodyLimits> = {}): Promise<BoundedBody> {
+  const declared = Number(request.headers.get("content-length") ?? "")
+  if (Number.isFinite(declared) && declared > max) {
+    // Declared too large: nothing is kept. Bun 1.3.5 does not skip unread declared bytes either (a client reusing the
+    // socket got 431 for its next request), so a body within the drain budget is read and discarded; a bigger one
+    // is refused unread, with Connection: close.
+    if (!request.body) return { ok: false, reason: "too_large", close: false }
+    const reader = request.body.getReader()
+    const { drainBytes } = { ...BODY_LIMITS, ...limits }
+    if (declared - max > drainBytes) {
+      await cancel(reader)
+      return { ok: false, reason: "too_large", close: true }
+    }
+    return { ok: false, reason: "too_large", close: !(await drainBounded(reader, { ...limits, drainBytes: declared })) }
+  }
+  if (!request.body) return { ok: true, bytes: new Uint8Array(0) }
+  const budget = { ...BODY_LIMITS, ...limits }
+  const startedAt = performance.now()
+  let lastByteAt = startedAt
+  const reader = request.body.getReader()
+  const chunks: Uint8Array[] = []
+  let size = 0
+  for (;;) {
+    let next: Read | typeof TIMEOUT
+    try {
+      next = await readBefore(reader, bodyDeadline({ startedAt, lastByteAt, received: size }, budget))
+    } catch {
+      return { ok: false, reason: "timeout", close: true } // the client went away mid-body
+    }
+    if (next === TIMEOUT) {
+      await cancel(reader)
+      return { ok: false, reason: "timeout", close: true }
+    }
+    if (next.done) break
+    lastByteAt = performance.now()
+    size += next.value.byteLength
+    // Past the bound (one oversized chunk included): nothing more is kept, this chunk neither.
+    if (size > max) return { ok: false, reason: "too_large", close: !(await drainBounded(reader, limits)) }
+    chunks.push(next.value)
+  }
+  return { ok: true, bytes: Buffer.concat(chunks) }
+}
+
+/** Why a body was cut off for time, with the limits in force. */
+export function slowMessage(limits: Partial<BodyLimits> = {}): string {
+  const { graceMs, minBytesPerSecond, idleMs } = { ...BODY_LIMITS, ...limits }
+  const s = (ms: number) => `${Math.round(ms / 100) / 10} s`
+  return `The body arrived too slowly (no bytes for ${s(idleMs)}, or under ${Math.round(minBytesPerSecond / 102.4) / 10} KiB/s after ${s(graceMs)})`
+}
+
+/** The AgentError for a refused body (Connection: close when the socket is left dirty). */
+export function bodyError(result: Extract<BoundedBody, { ok: false }>, max: number, limits: Partial<BodyLimits> = {}): AgentError {
+  if (result.reason === "timeout") return new AgentError("invalid", slowMessage(limits), { close: true })
+  return new AgentError("invalid", `The body is larger than ${max} bytes`, { extra: { limit: max }, ...(result.close ? { close: true } : {}) })
+}
+
+/** The body as UTF-8 text of at most `max` bytes ("" without a body); AgentError invalid over the limits. */
+export async function boundedText(request: Request, max: number, limits: Partial<BodyLimits> = {}): Promise<string> {
+  const result = await readBounded(request, max, limits)
+  if (!result.ok) throw bodyError(result, max, limits)
+  return Buffer.from(result.bytes).toString("utf8")
+}
+
+/** JSON.parse of a bounded body (a SyntaxError for invalid JSON, as request.json() threw). */
+export async function boundedJson(request: Request, max = AGENT_JSON_BODY_MAX): Promise<unknown> {
+  return JSON.parse(await boundedText(request, max))
+}