@huynle/hub 0.8.0 → 0.8.1

package/src/central/concierge/routes.ts

@@ -5,6 +5,9 @@
 //   POST /api/agent/concierge/enable           user {expectedRevision, timeZone?} → {settings, status}
 //   POST /api/agent/concierge/disable          user {expectedRevision} → {settings, status}
 //   POST /api/agent/concierge/restart          user → {status}
+//   GET  /api/agent/concierge/machines/:id/models  user → {models: [{providerID, modelID, name, enabled}]} (FX-04:
+//        the Model dropdown; the machine's OpenCode service catalog, read through a session it reports; 404 for a
+//        machine that is not the user's, 503 offline without a connected service or when the spoke cannot answer)
 //   GET  /api/agent/concierge/notes            user; the Concierge → {text, revision, updatedAt?}
 //   PUT  /api/agent/concierge/notes            user; the Concierge {text, expectedRevision} → {text, revision, updatedAt}
 //
@@ -32,14 +35,71 @@ export async function admitConcierge(identity: ConciergeIdentity, actor: AgentAc
   throw new AgentError("not_found", "Not found")
 }
 
-export function conciergeRoutes(deps: { readonly service: ConciergeService; readonly identity: ConciergeIdentity }): AgentRoute[] {
-  const { service, identity } = deps
+/** (FX-04) One entry of a machine's model list: names only (never provider options or keys). */
+export interface MachineModel {
+  readonly providerID: string
+  readonly modelID: string
+  readonly name: string
+  readonly enabled: boolean
+}
+
+/** (FX-04) What the models route needs of the registry and the spokes. */
+export interface MachineModelPorts {
+  /** The machine's connected OpenCode service connection. */
+  readonly serviceFor: (machineID: string) => string | undefined
+  readonly reportedSessions: (connID: string) => readonly string[]
+  readonly request: (connID: string, req: { readonly op: "models"; readonly sessionID: string }) => Promise<{ readonly models?: readonly unknown[] }>
+}
+
+const isObject = (v: unknown): v is Record<string, unknown> => typeof v === "object" && v !== null && !Array.isArray(v)
+
+/**
+ * (FX-04) The machine's OpenCode model list. The spoke's `models` op is machine-wide but addressed through a session it
+ * reports (any: its catalog is the same); a service that reports no session yet cannot be asked (the console falls back
+ * to typing the model).
+ */
+export function machineModels(ports: MachineModelPorts): (machineID: string) => Promise<MachineModel[]> {
+  return async (machineID) => {
+    const connID = ports.serviceFor(machineID)
+    if (connID === undefined) throw new AgentError("offline", "No OpenCode service is connected on that machine")
+    const sessionID = ports.reportedSessions(connID)[0]
+    if (sessionID === undefined) throw new AgentError("offline", "Its OpenCode service reports no session yet, so its model list cannot be read")
+    let result: { readonly models?: readonly unknown[] }
+    try {
+      result = await ports.request(connID, { op: "models", sessionID })
+    } catch (cause) {
+      throw new AgentError("offline", `Could not read the machine's model list: ${String(cause instanceof Error ? cause.message : cause).slice(0, 200)}`)
+    }
+    return (result.models ?? []).flatMap((m) =>
+      isObject(m) && typeof m.providerID === "string" && typeof m.modelID === "string"
+        ? [{ providerID: m.providerID, modelID: m.modelID, name: typeof m.name === "string" ? m.name : m.modelID, enabled: m.enabled !== false }]
+        : [],
+    )
+  }
+}
+
+export function conciergeRoutes(deps: { readonly service: ConciergeService; readonly identity: ConciergeIdentity; readonly models?: (machineID: string) => Promise<MachineModel[]> }): AgentRoute[] {
+  const { service, identity, models } = deps
   return [
     { method: "GET", path: PATH, allow: {}, handle: async ({ user }) => ok(await service.view(user.id)) },
     { method: "PUT", path: `${PATH}/settings`, allow: {}, handle: async ({ request, user }) => ok(await service.updateSettings(user.id, await boundedJson(request))) },
     { method: "POST", path: `${PATH}/enable`, allow: {}, handle: async ({ request, user }) => ok(await service.enable(user.id, await boundedJson(request))) },
     { method: "POST", path: `${PATH}/disable`, allow: {}, handle: async ({ request, user }) => ok(await service.disable(user.id, await boundedJson(request))) },
     { method: "POST", path: `${PATH}/restart`, allow: {}, handle: async ({ user }) => ok(await service.restart(user.id)) },
+    ...(models
+      ? [
+          {
+            method: "GET",
+            path: `${PATH}/machines/:id/models`,
+            allow: {},
+            handle: async ({ params, user }) => {
+              // Another user's machine and an unknown one answer alike.
+              if (!service.machineViews(user.id).some((m) => m.id === params.id)) throw new AgentError("not_found", "No such machine")
+              return ok({ models: await models(params.id!) })
+            },
+          } satisfies AgentRoute,
+        ]
+      : []),
     {
       method: "GET",
       path: `${PATH}/notes`,

package/src/central/concierge/session-routes.ts

@@ -47,23 +47,79 @@ export const CONCIERGE_SESSION_ROUTES: readonly { readonly method: string; reado
 
 const key = (method: string, path: string) => `${method} ${path}`
 
+/**
+ * (FX-07) How long a Concierge identity check waits for the state store (the route gate, the acting guard, the inbound
+ * and outbound rules, team staffing): past it the check fails closed with `busy` (503).
+ */
+export const IDENTITY_TIMEOUT_MS = 5_000
+
+/** (FX-07) The refusal while the hub's state does not answer: neutral (no Concierge wording), retried by clients. */
+export const stateBusy = () => new AgentError("busy", "Hub state is busy, try again", { extra: { retryAfter: Math.ceil(IDENTITY_TIMEOUT_MS / 1000) } })
+
+/** `read`, or a `busy` rejection once `ms` passed (the timer never outlives the answer; a late answer is ignored). */
+function within<T>(read: Promise<T>, ms: number): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const late = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => reject(stateBusy()), ms)
+  })
+  read.catch(() => {}) // a late rejection is not unhandled
+  return Promise.race([read, late]).finally(() => clearTimeout(timer))
+}
+
+const TIMED = Symbol("concierge.timedIdentity")
+
+/**
+ * (FX-07) The identity with a time limit on each read: past it, the read rejects `busy`. A user whose read timed out
+ * is answered `busy` at once for the next `ms` (no new store read: a stuck store is not asked again per check, so
+ * the checks of one request share one wait and reads do not pile up). Wrapping a timed identity returns it as is.
+ */
+export function timedIdentity(identity: ConciergeIdentity, ms: number = IDENTITY_TIMEOUT_MS, now: () => number = Date.now): ConciergeIdentity {
+  if ((identity as { [TIMED]?: true })[TIMED]) return identity
+  const stuckUntil = new Map<string, number>()
+  const timed = {
+    [TIMED]: true as const,
+    async current(userID: string) {
+      const until = stuckUntil.get(userID)
+      if (until !== undefined) {
+        if (now() < until) throw stateBusy()
+        stuckUntil.delete(userID)
+      }
+      try {
+        return await within(identity.current(userID), ms)
+      } catch (cause) {
+        if (cause instanceof AgentError && cause.code === "busy") stuckUntil.set(userID, now() + ms)
+        throw cause
+      }
+    },
+  }
+  return timed
+}
+
 /**
  * The gate agentApi runs for every session actor before the route's own checks: a Concierge session (current or
- * previous) may call only the allow-list and `extra` (the tiers slot's routes). A failed identity read refuses.
+ * previous) may call only the allow-list and `extra` (the tiers slot's routes). (FX-07) An identity read that fails or
+ * has not answered within `timeoutMs` refuses every other route with a neutral 503 `busy` (fail closed, without
+ * telling an ordinary session it is the Concierge); the allow-list still passes.
  */
-export function conciergeSessionGate(identity: ConciergeIdentity, extra: () => readonly AgentRoute[] = () => []): (actor: AgentActor, route: Pick<AgentRoute, "method" | "path">) => Promise<void> {
+export function conciergeSessionGate(
+  identity: ConciergeIdentity,
+  extra: () => readonly AgentRoute[] = () => [],
+  options: { readonly timeoutMs?: number } = {},
+): (actor: AgentActor, route: Pick<AgentRoute, "method" | "path">) => Promise<void> {
   const allowed = new Set(CONCIERGE_SESSION_ROUTES.map((r) => key(r.method, r.path)))
+  const timed = timedIdentity(identity, options.timeoutMs ?? IDENTITY_TIMEOUT_MS)
   return async (actor, route) => {
     if (actor.kind !== "session") return
+    const listed = () => allowed.has(key(route.method, route.path)) || extra().some((r) => r.method === route.method && r.path === route.path)
     let concierge: boolean
     try {
-      const current = await identity.current(actor.userID)
+      const current = await timed.current(actor.userID)
       concierge = current.sessionID === actor.sessionID || current.hiddenSessionIDs.includes(actor.sessionID)
     } catch {
-      concierge = true
+      if (listed()) return
+      throw stateBusy()
     }
-    if (!concierge) return
-    if (allowed.has(key(route.method, route.path)) || extra().some((r) => r.method === route.method && r.path === route.path)) return
+    if (!concierge || listed()) return
     throw new AgentError("forbidden", "The Concierge cannot use this route", { extra: { policy: "concierge" } })
   }
 }

package/src/central/concierge/supervisor.ts

@@ -126,13 +126,30 @@ export class StatusStore {
   }
 }
 
-/** The Concierge-only authority read from the state record: the current session and every hidden one. */
-export function recordIdentity(store: StatusStore): { current(userID: string): Promise<{ sessionID?: string; hiddenSessionIDs: readonly string[] }> } {
+export interface IdentityOptions {
+  /**
+   * (FX-07) The user's sessions a machine reports locked now (its spoke holds them as Concierge sessions: they carry
+   * an agent or a context revision). The state record keeps only PAST_SESSIONS_MAX past sessions; an older one its
+   * machine still reports is still a Concierge session (and one no machine reports cannot use its tokens).
+   */
+  readonly reported?: (userID: string) => Iterable<string>
+}
+
+/**
+ * The Concierge-only authority read from the state record: the current session and every hidden one (plus, FX-07,
+ * those a machine reports locked). A failing report adds nothing; the record's own sessions always count.
+ */
+export function recordIdentity(store: StatusStore, options: IdentityOptions = {}): { current(userID: string): Promise<{ sessionID?: string; hiddenSessionIDs: readonly string[] }> } {
   return {
     current: async (userID) => {
       const r = await store.get(userID)
-      const all = [...new Set([...(r.pastSessionIDs ?? []), ...r.hiddenSessionIDs])]
-      return { ...(r.sessionID !== undefined ? { sessionID: r.sessionID } : {}), hiddenSessionIDs: all }
+      const all = new Set([...(r.pastSessionIDs ?? []), ...r.hiddenSessionIDs])
+      try {
+        if (options.reported) for (const id of options.reported(userID)) all.add(id)
+      } catch (cause) {
+        console.error(`[hub] concierge locked-session report failed: ${(cause as Error).message}`)
+      }
+      return { ...(r.sessionID !== undefined ? { sessionID: r.sessionID } : {}), hiddenSessionIDs: [...all] }
     },
   }
 }
@@ -158,6 +175,9 @@ export function conciergeLaunchSpec(userID: string, settings: ConciergeSettings,
   }
 }
 
+/** A queued launch's waiting reason as the Concierge's status: "Waiting: …" (kept when it already says Waiting). */
+const waitingText = (reason: string): string => (reason.startsWith("Waiting") ? reason : `Waiting: ${reason}`)
+
 /** Whether a launch is a Concierge launch (its label). */
 export const isConciergeLaunch = (launch: Pick<Launch, "spec">): boolean => launch.spec.labels?.["hub/system"] === "concierge"
 
@@ -410,12 +430,19 @@ export class Supervisor {
     await this.follow(userID, settings, await this.store.read(userID))
   }
 
-  /** The recorded launch: running → adopt it; ended → back off; else wait. */
+  /** The recorded launch: running → adopt it; ended → back off; else wait (starting says why it waits, FX-02). */
   private async follow(userID: string, settings: ConciergeSettings, snap: RecordSnapshot): Promise<void> {
-    const r = snap.record
-    const launch = await this.deps.launches.view(userID, r.launchID!)
+    const launch = await this.deps.launches.view(userID, snap.record.launchID!)
     if (!launch || launch.state === "ended") return this.ended(userID, snap, launch)
     if (launch.state === "running" && launch.sessionID !== undefined) return this.adopt(userID, snap, launch.sessionID, launch.machineID)
+    if (snap.record.state === "starting") {
+      const reason = launch.state === "queued" && launch.waiting ? waitingText(launch.waiting.reason) : "Starting"
+      if (snap.record.reason !== reason) {
+        if (!(await this.write(userID, snap, { ...snap.record, reason }))) return
+        snap = await this.store.read(userID)
+      }
+    }
+    const r = snap.record
     if (launch.sessionID !== undefined && !r.hiddenSessionIDs.includes(launch.sessionID)) {
       // Hidden from the console's lists as soon as the session exists, and never auto-named from its title.
       if (await this.write(userID, snap, { ...r, hiddenSessionIDs: addHidden(r.hiddenSessionIDs, launch.sessionID) })) await this.unname(userID, [launch.sessionID])

package/src/central/concierge/watchlist-routes.ts

@@ -140,8 +140,10 @@ export async function watchFacts(deps: WatchFactDeps, userID: string, hidden: re
   }
   const prefs = deps.store.viewPrefs(userID)
   const archived = new Set(prefs.hiddenSessions)
-  // (CON-12) Machines that report their sessions now: a session one of them no longer reports went away.
-  const reporting = new Set(catalog.filter((m) => m.processes.length > 0).map((m) => m.id))
+  // (CON-12) Machines that report their sessions now: a session one of them no longer reports went away. (FX-07) A
+  // process reports only once its first sessions frame came (right after hello it lists none yet), so a machine with
+  // a process still pending is not reporting: its sessions are offline for that moment, never gone.
+  const reporting = new Set(catalog.filter((m) => m.processes.length > 0 && m.processes.every((p) => !p.sessionsPending)).map((m) => m.id))
   for (const record of deps.store.agentData(userID).sessions ?? []) {
     const known = facts.get(record.sessionID)
     if (!known) {

package/src/central/config.ts

@@ -7,7 +7,7 @@ import path from "node:path"
 import { hubEnv } from "../env"
 import { isLoopbackHost } from "../loopback"
 import { formatPattern, parsePattern } from "./agent/policy"
-import { APP_DIR, configBase, legacyPaths, migrateFirst, stateBase } from "../migrate"
+import { APP_DIR, configBase, legacyPaths, migrateFirst, migrateStateDir, resolveHubStateDir, stateLegacyPaths } from "../migrate"
 import { updateSpeech, type StoredSpeech } from "./speech/settings"
 
 export const GOOGLE_ISSUER = "https://accounts.google.com"
@@ -99,6 +99,11 @@ export interface HubLaunches {
   readonly maxActive?: number
   /** New launches per clock hour. */
   readonly perHour?: number
+  /**
+   * Minutes the same node instance may leave a running launch out of its reports (its session gone) before it ends
+   * lost (default 5; 0 or false: never).
+   */
+  readonly lostAfterMinutes?: number | false
 }
 
 /** hub.json `agents`, validated. */
@@ -133,7 +138,9 @@ const HUB_KEYS = new Set(["host", "port", "publicURL", "stateDir", "speech", "au
 const CLUSTER_KEYS = ["database", "valkey"] as const
 const AGENTS_KEYS = new Set(["never", "launches", "webhooks"])
 const WEBHOOK_KEYS = new Set(["allowPrivate"])
-const LAUNCH_CAP_KEYS = ["maxQueued", "maxActive", "perHour"] as const
+const LAUNCH_CAP_KEYS = ["maxQueued", "maxActive", "perHour", "lostAfterMinutes"] as const
+/** The longest lostAfterMinutes (a day): far below setTimeout's 32-bit limit. */
+const LOST_AFTER_MAX = 1440
 const LAUNCH_CAP_MAX = 100_000
 const AUTH_KEYS = new Set(["mode", "issuer", "clientId", "clientSecret", "allowed", "admins"])
 const EMAIL = /^[^\s@,]+@[^\s@,]+\.[^\s@,]+$/
@@ -322,13 +329,20 @@ function readHubWebhooks(raw: unknown, file: string, warnings: string[], fail: (
 function readHubLaunches(raw: unknown, file: string, warnings: string[], fail: (message: string) => never): HubLaunches {
   if (!isObj(raw)) fail("agents.launches must be an object")
   const input = raw as Record<string, unknown>
-  const caps: Record<string, number> = {}
+  const caps: Record<string, number | false> = {}
   for (const key of Object.keys(input)) {
     if (!(LAUNCH_CAP_KEYS as readonly string[]).includes(key)) {
       warnings.push(`${file}: unknown key "agents.launches.${key}" ignored`)
       continue
     }
     const value = input[key]
+    if (key === "lostAfterMinutes") {
+      if (value !== false && (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > LOST_AFTER_MAX)) {
+        fail(`agents.launches.lostAfterMinutes must be a whole number from 0 to ${LOST_AFTER_MAX}, or false (0 and false: never)`)
+      }
+      caps[key] = value as number | false
+      continue
+    }
     if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > LAUNCH_CAP_MAX) {
       fail(`agents.launches.${key} must be a whole number from 1 to ${LAUNCH_CAP_MAX}`)
     }
@@ -462,7 +476,7 @@ export function centralConfig(rawEnv: Env = process.env, home: string = homedir(
     host,
     port,
     publicURL,
-    stateDir: env.HUB_STATE_DIR || file.stateDir || path.join(stateBase(home), APP_DIR),
+    stateDir: env.HUB_STATE_DIR || file.stateDir || resolveHubStateDir(env, home).dir,
     apiKey: env.OPENROUTER_API_KEY || undefined,
     sttModel: env.HUB_STT_MODEL || "openai/gpt-4o-mini-transcribe",
     ttsModel: env.HUB_TTS_MODEL || "microsoft/mai-voice-2.1-flash",
@@ -504,7 +518,9 @@ export function loadCentralConfig(
   const config = centralConfig(env, home, hub)
   if (!resolved.HUB_STATE_DIR && !hub?.stateDir) {
     // hub.pid is the spoke's auto-start lock for the legacy location, not state.
-    migrateFirst(legacyPaths(stateBase(home)), config.stateDir, { ...migrate, skip: ["hub.pid"] })
+    migrateStateDir(stateLegacyPaths(env, home), config.stateDir, { ...migrate, skip: ["hub.pid"] })
+    const resolvedDir = resolveHubStateDir(env, home)
+    if (resolvedDir.hint) warnings.push(resolvedDir.hint)
   }
   return { config, warnings, path: file, loaded: hub !== undefined }
 }

package/src/central/http.ts

@@ -91,9 +91,10 @@ import { conciergeActor, conciergeInbound, conciergeProtects } from "./concierge
 import { conciergeModules, type ConciergePorts, type ConciergeTiers } from "./concierge/index"
 import { watchedSessions } from "./concierge/notifier"
 import { NotesStore } from "./concierge/notes"
-import { conciergeSessionGate } from "./concierge/session-routes"
+import { conciergeSessionGate, timedIdentity } from "./concierge/session-routes"
 import { conciergeAwareNotifier, isConciergeSession } from "./concierge/push-remap"
 import { ConciergeService, type MachineFacts } from "./concierge/service"
+import { machineModels } from "./concierge/routes"
 import { SettingsStore } from "./concierge/settings"
 import { CONCIERGE_TAMPERED, isConciergeLaunch, recordIdentity, StatusStore, Supervisor } from "./concierge/supervisor"
 import { CONCIERGE_AGENT } from "../../packages/protocol/src/concierge"
@@ -409,7 +410,12 @@ export function startCentral(options: CentralOptions): Central {
   // CON-04: the Concierge's state record is read early (the Concierge-only authority, hiding, the inbound rule and
   // push remapping all follow it); the service itself is built below, once its parts exist.
   const conciergeStatus = new StatusStore(backends.state, now)
-  const conciergeIdentity = recordIdentity(conciergeStatus)
+  // (FX-07) Beyond the past sessions the record keeps: those a machine reports locked (its spoke holds them as Concierge sessions).
+  const conciergeIdentity = recordIdentity(conciergeStatus, { reported: (userID) => registry.lockedSessions(userID) })
+  // (FX-07) The identity checks on request paths (route gate, manage guard, acting guard, inbound/outbound rules, team
+  // staffing, Decision and audit labels) wait at most IDENTITY_TIMEOUT_MS for the store: past it they refuse with busy
+  // (503), never hang; one shared breaker answers busy at once for a while after a read timed out.
+  const conciergeTimedIdentity = timedIdentity(conciergeIdentity)
   // Pushes about the Concierge's hidden sessions become kind "concierge" (/concierge) or are dropped.
   const notifier = conciergeAwareNotifier(options.notifier ?? push, () => conciergeIdentity)
   /** SSE subscribers, one user each. */
@@ -796,7 +802,7 @@ export function startCentral(options: CentralOptions): Central {
   const delivery = new Delivery({
     teams: teamPolicy,
     // CON-04 inbound rule: only the user, app:concierge and replies to its asks reach a Concierge session.
-    inbound: conciergeInbound({ identity: conciergeIdentity, audit: { record: (userID, entry) => audit.record(userID, entry) } }),
+    inbound: conciergeInbound({ identity: conciergeTimedIdentity, audit: { record: (userID, entry) => audit.record(userID, entry) } }),
     state: backends.state,
     counters: backends.counters,
     registry,
@@ -814,6 +820,8 @@ export function startCentral(options: CentralOptions): Central {
     },
     // Push kind "message": a msg to @me, an ask left unanswered, a message loop (sent even while watched).
     alert: (userID, alert) => pushUser("message", userID, alert.sessionID, `${alert.kind}:${alert.messageID}`),
+    // A message pending for 24 h expired undelivered: journaled (message.changed, delivery "expired") for its sender.
+    expired: (userID, message) => feed.publish(userID, message),
     ...(loopTickMs !== undefined ? { tickMs: loopTickMs } : {}),
     // Cluster mode: the re-wake loop (leader) looks at every user; each pending flush holds a (user, session) lease.
     ...(config.cluster ? { users: allUsers, locks: backends.locks, owner: leaseOwner } : {}),
@@ -851,7 +859,8 @@ export function startCentral(options: CentralOptions): Central {
       if (!conciergeTierHooks?.checkVia) throw new AgentError("forbidden", TAP_ONLY)
       await conciergeTierHooks.checkVia(userID, decision, via, by)
     },
-    concierge: (userID, sessionID) => isConciergeSession(conciergeIdentity, userID, sessionID),
+    // (FX-07) Time-limited and fail closed: a timed-out read refuses the ask with busy (no label silently dropped).
+    concierge: conciergeProtects(conciergeTimedIdentity),
     ...(loopTickMs !== undefined ? { tickMs: loopTickMs } : {}),
   })
   leader("decisions", { onElected: () => decisions.start(), onDeposed: () => decisions.stop() })
@@ -891,7 +900,8 @@ export function startCentral(options: CentralOptions): Central {
   // Cluster mode: launch changes made on any pod reach this pod's agent watches. The console broadcast, closing a
   // launch's connections and webhooks run only on the publishing pod (origin): they reach every pod themselves.
   if (config.cluster) launchFeed.attach({ bus: backends.bus, podID: config.cluster.podID }).catch((cause) => console.error(`[hub] launch feed did not attach: ${(cause as Error).message}`))
-  launchFeed.subscribe((userID, launch) => broadcast({ type: "launch", launch: launchInfo(launch) }, { tenant: userID }), { origin: true })
+  // The user's live view: flagged when the launch's app token was revoked (launches is set below, before any change).
+  launchFeed.subscribe((userID, launch) => broadcast({ type: "launch", launch: launchInfo(launches.live(launch)) }, { tenant: userID }), { origin: true })
   // Profile application (HWA-15), created with the profile store below; a launch naming a profile applies it.
   let profileApplier: ProfileApplier | undefined
   const launches = new LaunchEngine({
@@ -914,7 +924,15 @@ export function startCentral(options: CentralOptions): Central {
     users: () => store.users().map((u) => u.id),
     now,
     onLaunchChanged: (launch) => launchFeed.publish(launch.owner, launch),
+    // FX-02: a waiting text change of the same kind: the console's live stream (and the Concierge's status) only,
+    // never the journal or webhooks.
+    onLaunchWaiting: (launch) => {
+      broadcast({ type: "launch", launch: launchInfo(launches.live(launch)) }, { tenant: launch.owner })
+      if (isConciergeLaunch(launch)) conciergeSupervisor.kick(launch.owner)
+    },
     intents,
+    // FX-02: a launch of a revoked app token (`app:<16 hex>` no longer among the user's tokens) is flagged, not stopped.
+    launchers: { revoked: (userID, by) => /^app:[0-9a-f]{16}$/.test(by) && !(store.user(userID)?.agent?.appTokens ?? []).some((t) => `app:${t.id}` === by) },
     profiles: { applyAtLaunch: async (userID, sessionID, ref) => (profileApplier ? profileApplier.applyAtLaunch(userID, sessionID, ref) : [`profile ${ref.profileID} v${ref.version} not applied: the hub is starting`]) },
     // Cluster mode: the supervisor runs on the launches leader; other pods kick it and send it their stops.
     ...(config.cluster
@@ -1055,7 +1073,7 @@ export function startCentral(options: CentralOptions): Central {
   // One credential resolver for every /api request: device cookie, device token, session and app tokens.
   // Every stored agent message also goes to the user's console streams (live transcript rows).
   feed.subscribe((userID, message) => broadcast({ type: "message", message }, { tenant: userID }), { origin: true })
-  const audit = new AgentAudit({ state: backends.state, now, admin: store, recorded: (userID, entry) => broadcast({ type: "agent", entry }, { tenant: userID }), concierge: (userID, sessionID) => isConciergeSession(conciergeIdentity, userID, sessionID) })
+  const audit = new AgentAudit({ state: backends.state, now, admin: store, recorded: (userID, entry) => broadcast({ type: "agent", entry }, { tenant: userID }), concierge: (userID, sessionID) => isConciergeSession(conciergeTimedIdentity, userID, sessionID) })
   const grants = new Grants({ state: backends.state, counters: backends.counters, directory, store, admin: store, now, concierge: async (owner) => (await conciergeIdentity.current(owner)).hiddenSessionIDs })
   const acting = new ActingSwitch({ store, never: config.agentsNever, audit })
   /** An agent as envelopes name it (a session by its directory name). */
@@ -1114,11 +1132,11 @@ export function startCentral(options: CentralOptions): Central {
   const workspaces = { workspaces: workspaceStore, members: workspaceMembers, supervision: workspaceSupervision, lifecycle: workspaceLifecycle }
   // Team staffing (HWA-35): seats end on session deletion; launched members are staffed when their launch runs.
   const sessionDirectory = (userID: string, sessionID: string) => (registry.sessionTenant(sessionID) === userID ? registry.session(sessionID)?.directory : undefined)
-  const teamStaffing = new TeamStaffingService({ state: backends.state, teams: teamStore, seats: teamSeats, workspaces: workspaceStore, members: workspaceMembers, supervision: workspaceSupervision, presence: teamPresence, sessionDirectory, launches, grants, acting, audit, profiles, events: agentEvents, now })
+  const teamStaffing = new TeamStaffingService({ state: backends.state, teams: teamStore, seats: teamSeats, workspaces: workspaceStore, members: workspaceMembers, supervision: workspaceSupervision, presence: teamPresence, sessionDirectory, launches, grants, acting, audit, profiles, events: agentEvents, now, protects: conciergeProtects(conciergeTimedIdentity) })
   registry.onSessionDeleted((sessionID, tenant) => void teamStaffing.sessionEnded(tenant, sessionID).catch((cause) => console.error(`[hub] team session end failed: ${(cause as Error).message}`)))
   launchFeed.subscribe((userID, launch) => void teamStaffing.launchChanged(userID, launch).catch((cause) => console.error(`[hub] team staffing launch failed: ${(cause as Error).message}`)), { origin: true })
   // Team intake (HWA-36): delivered to an entry seat from the fixed party app:team-intake (never the submitter).
-  teamIntake = new TeamIntakeService({ state: backends.state, teams: teamStore, seats: teamSeats, staffing: teamStaffing, members: workspaceMembers, presence: teamPresence, events: agentEvents, now, deliver: async (userID, sessionID, text) => ({ messageID: (await delivery.send(userID, intakeActor(userID), sessionID, "msg", text)).message.id }) })
+  teamIntake = new TeamIntakeService({ state: backends.state, teams: teamStore, seats: teamSeats, staffing: teamStaffing, members: workspaceMembers, presence: teamPresence, events: agentEvents, now, deliver: async (userID, sessionID, text, options = {}) => ({ messageID: (await delivery.send(userID, intakeActor(userID), sessionID, "msg", text, options.hop === undefined ? {} : { chainHop: options.hop })).message.id }), hopOf: (userID, sessionID) => delivery.hops.next(userID, { kind: "session", sessionID }) })
   // Supervisor checkpoints and batched digests (HWA-11): acknowledgments flush before answering; digests reach
   // supervisor sessions through Delivery (as coordinatorActor) from the workspace-coordinator leader.
   const workspaceCursors = journalCursors(tokenKeys, agentEvents)
@@ -1278,7 +1296,7 @@ export function startCentral(options: CentralOptions): Central {
       state: backends.state,
       counters: backends.counters,
       decisions,
-      acting: (conciergeActing = new Acting({ registry, directory, actions, spokes: { request: (connID, req) => spokes.request(connID, req) }, grants, acting, audit, escalate, maxPromptChars: MAX_PROMPT_CHARS, protect: conciergeProtects(conciergeIdentity), conciergeActor: conciergeProtects(conciergeIdentity) })),
+      acting: (conciergeActing = new Acting({ registry, directory, actions, spokes: { request: (connID, req) => spokes.request(connID, req) }, grants, acting, audit, escalate, maxPromptChars: MAX_PROMPT_CHARS, protect: conciergeProtects(conciergeTimedIdentity), conciergeActor: conciergeProtects(conciergeTimedIdentity) })),
       audit,
       protects: conciergeProtects(conciergeIdentity),
       published: (userID, message) => feed.publish(userID, message),
@@ -1365,7 +1383,7 @@ export function startCentral(options: CentralOptions): Central {
     onDeposed: () => (conciergeSupervisor.stop(), conciergeParts.notifier.stop()),
   })
   void conciergeLeader.start()
-  const agentDeps = { intents, teamDiscovery, draining: drainSignal.signal, store, sessionTokens, directory, registry, spokes, delivery, decisions, feed, heartbeatMs, now, audit, grants, grantRequests, acting, actions, escalate, launches, webhooks, agentEvents, eventCursorKeys: tokenKeys, maxPromptChars: MAX_PROMPT_CHARS, profiles, workspaces, workspaceCheckpoints, teamIntake, graph: { teams: { teams: teamStore, seats: teamSeats! } }, teams: { teams: teamStore, seats: teamSeats!, staffing: teamStaffing }, artifacts: { ...(artifacts && backends.blobs ? { artifacts, blobs: backends.blobs } : {}), state: backends.state, now }, artifactHost: { caps: artifactHostCaps, ...(artifacts ? { artifacts } : {}) }, concierge: { state: backends.state, activity: conciergeActivity, results: conciergeResults, identity: conciergeIdentity, protects: conciergeProtects(conciergeIdentity), service: conciergeService, routes: () => conciergeParts.tiers.routes(), armed: conciergeArmed, timeZone: conciergeBoardDeps.timeZone, coverage: conciergeCoverage } }
+  const agentDeps = { intents, teamDiscovery, draining: drainSignal.signal, store, sessionTokens, directory, registry, spokes, delivery, decisions, feed, heartbeatMs, now, audit, grants, grantRequests, acting, actions, escalate, launches, webhooks, agentEvents, eventCursorKeys: tokenKeys, maxPromptChars: MAX_PROMPT_CHARS, profiles, workspaces, workspaceCheckpoints, teamIntake, graph: { teams: { teams: teamStore, seats: teamSeats! } }, teams: { teams: teamStore, seats: teamSeats!, staffing: teamStaffing }, artifacts: { ...(artifacts && backends.blobs ? { artifacts, blobs: backends.blobs } : {}), state: backends.state, now }, artifactHost: { caps: artifactHostCaps, ...(artifacts ? { artifacts } : {}) }, concierge: { state: backends.state, activity: conciergeActivity, results: conciergeResults, identity: conciergeTimedIdentity, protects: conciergeProtects(conciergeTimedIdentity), service: conciergeService, models: machineModels({ serviceFor: (machineID) => registry.serviceFor(machineID), reportedSessions: (connID) => registry.reportedSessions(connID), request: (connID, req) => spokes.request(connID, req) }), routes: () => conciergeParts.tiers.routes(), armed: conciergeArmed, timeZone: conciergeBoardDeps.timeZone, coverage: conciergeCoverage } }
   const resolveActor = createResolver({
     cookieName: COOKIE,
     findDevice: (token) => deviceOfToken(token),
@@ -1383,7 +1401,7 @@ export function startCentral(options: CentralOptions): Central {
     },
     routes: [...agentRoutes(agentDeps), ...(options.agent?.routes ?? [])],
     // CON-04: a Concierge session's tokens reach only an explicit route allow-list (fail closed).
-    gate: conciergeSessionGate(conciergeIdentity, () => conciergeParts.tiers.routes()),
+    gate: conciergeSessionGate(conciergeTimedIdentity, () => conciergeParts.tiers.routes()),
   })
 
   // POST /mcp (MCP Streamable HTTP): `hub mcp`'s tools as the bearer's caller; their /api/agent calls are dispatched
@@ -1401,11 +1419,12 @@ export function startCentral(options: CentralOptions): Central {
     const { pathname } = url
     const method = request.method
     try {
-      if (method === "GET" && pathname === "/readyz") return readyz()
-      if (pathname === "/spoke/ws") return spokes.upgrade(request, server)
-      if (method === "GET" && pathname === "/healthz") {
-        return Response.json({ ok: true, version: options.version ?? "0.0.0", spokes: registry.connections(), nodes: nodes.count() })
+      // HEAD (uptime monitors, `curl -I`) gets GET's status and headers without a body, on the health routes only.
+      if ((method === "GET" || method === "HEAD") && (pathname === "/readyz" || pathname === "/healthz")) {
+        const response = pathname === "/readyz" ? await readyz() : healthz()
+        return method === "HEAD" ? new Response(null, { status: response.status, headers: response.headers }) : response
       }
+      if (pathname === "/spoke/ws") return spokes.upgrade(request, server)
       // A shared (cluster) store loads its records on first use; the file store is ready at once.
       await store.ready()
       if (method === "POST" && pathname === "/spoke/enroll") {
@@ -2472,6 +2491,10 @@ export function startCentral(options: CentralOptions): Central {
   }
 
   /** /readyz (design §10): 503 while draining or (cluster mode) when the database or Valkey does not answer in time. */
+  function healthz(): Response {
+    return Response.json({ ok: true, version: options.version ?? "0.0.0", spokes: registry.connections(), nodes: nodes.count() })
+  }
+
   async function readyz(): Promise<Response> {
     if (draining) return Response.json({ ok: false, draining: true }, { status: 503, headers: NO_STORE })
     if (config.cluster) {

package/src/central/main.ts

@@ -68,7 +68,7 @@ Usage: hub-server [--help | --version]   (also installed as opencode-hub and ope
 Configuration: environment variables over ~/.config/hub/hub.json ($HUB_CONFIG).
   HUB_HOST / HUB_PORT       listen address (default 127.0.0.1 / 4097)
   HUB_PUBLIC_URL            origin used in links and cookies (default http://<host>:<port>)
-  HUB_STATE_DIR             machines, devices, keys (default ~/.local/state/hub)
+  HUB_STATE_DIR             machines, devices, keys (default $XDG_STATE_HOME/hub or ~/.local/state/hub)
   OPENROUTER_API_KEY        default speech key; or set speech providers in the web app (Settings → Speech)
   HUB_CONFIG                path of hub.json
 

package/src/central/registry.ts

@@ -253,6 +253,8 @@ export interface CatalogProcess {
   readonly connected: number
   readonly lastSeen: number
   readonly sessions: CatalogSession[]
+  /** (FX-07) Connected, but its first sessions frame has not come yet: an empty `sessions` says nothing then. */
+  readonly sessionsPending?: true
 }
 
 /** A machine's terminal context: its Herdr workspaces (latest terminals frame of the machine). */
@@ -279,6 +281,8 @@ interface Conn {
   sessions: Map<string, SessionInfo>
   /** The last sessions frame as JSON, to skip unchanged snapshots. */
   sessionsKey: string
+  /** (FX-07) No sessions frame yet. */
+  sessionsPending?: true
   /** sessionID → activity sequence number of the last event this process sent for it. */
   activity: Map<string, number>
   /**
@@ -304,6 +308,8 @@ export interface SliceConn {
   readonly launchID?: string
   /** The machine's terminal context, when this connection sent the latest one. */
   readonly terminals?: MachineTerminals
+  /** (FX-07) No sessions frame yet (absent from older pods: reported). */
+  readonly sessionsPending?: true
 }
 
 /** A root session's status tree (live: run starts and recommendations included) and activity feed. */
@@ -598,6 +604,7 @@ export class Registry {
       lastSeen: t,
       sessions: new Map(),
       sessionsKey: "[]",
+      sessionsPending: true,
       activity: new Map(),
     })
     this.changed(this.tenant(this.conns.get(connID)!))
@@ -640,7 +647,9 @@ export class Registry {
     conn.lastSeen = this.now()
     // Spokes re-send their snapshot periodically; only changes reach the phones.
     const key = JSON.stringify(sessions)
-    if (key !== conn.sessionsKey) {
+    const first = conn.sessionsPending === true
+    delete conn.sessionsPending
+    if (key !== conn.sessionsKey || first) {
       conn.sessionsKey = key
       conn.sessions = new Map(sessions.map((s) => [s.id, s]))
       this.syncBoards()
@@ -1232,6 +1241,7 @@ export class Registry {
         features: [...conn.features].sort(),
         connected: conn.connected,
         lastSeen: conn.lastSeen,
+        ...(conn.sessionsPending ? { sessionsPending: true as const } : {}),
         sessions: this.visible(conn).map((s) => {
           const fields = this.browserFields(s.id)
           return {
@@ -1249,6 +1259,19 @@ export class Registry {
     return [...machines.values()]
   }
 
+  /**
+   * (FX-07) The tenant's sessions a spoke reports locked now (the Concierge's: `locked`, from the first frame after a
+   * restart, and `agent` / `contextRevision`, sent only for locked sessions), on this pod's connections and other pods'.
+   */
+  lockedSessions(tenant: string): string[] {
+    const out = new Set<string>()
+    for (const conn of this.all()) {
+      if (this.tenant(conn) !== tenant) continue
+      for (const s of conn.sessions.values()) if (s.locked === true || s.agent !== undefined || s.contextRevision !== undefined) out.add(s.id)
+    }
+    return [...out]
+  }
+
   /** The session as reported by any process plus its live status; undefined when nobody reports it. */
   session(sessionID: string): SessionView | undefined {
     let info: SessionInfo | undefined
@@ -1893,6 +1916,7 @@ export class Registry {
           activity: [...conn.activity],
           ...(conn.launchID !== undefined ? { launchID: conn.launchID } : {}),
           ...(terminals?.connID === conn.id ? { terminals: terminals.terminals } : {}),
+          ...(conn.sessionsPending ? { sessionsPending: true as const } : {}),
         }
       })
     const boards: SliceBoard[] = [...this.boards]
@@ -1966,6 +1990,7 @@ export class Registry {
             sessionsKey: "",
             activity: new Map(c.activity ?? []),
             ...(c.launchID !== undefined ? { launchID: c.launchID } : {}),
+            ...(c.sessionsPending === true ? { sessionsPending: true as const } : {}),
             remote: { pod, tenant },
           })
           if (c.terminals) terminals.set(c.machine.id, c.terminals)