@huynle/hub 0.8.0 → 0.8.2

package/src/central/concierge/session-routes.ts

@@ -47,23 +47,79 @@ export const CONCIERGE_SESSION_ROUTES: readonly { readonly method: string; reado
 
 const key = (method: string, path: string) => `${method} ${path}`
 
+/**
+ * (FX-07) How long a Concierge identity check waits for the state store (the route gate, the acting guard, the inbound
+ * and outbound rules, team staffing): past it the check fails closed with `busy` (503).
+ */
+export const IDENTITY_TIMEOUT_MS = 5_000
+
+/** (FX-07) The refusal while the hub's state does not answer: neutral (no Concierge wording), retried by clients. */
+export const stateBusy = () => new AgentError("busy", "Hub state is busy, try again", { extra: { retryAfter: Math.ceil(IDENTITY_TIMEOUT_MS / 1000) } })
+
+/** `read`, or a `busy` rejection once `ms` passed (the timer never outlives the answer; a late answer is ignored). */
+function within<T>(read: Promise<T>, ms: number): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const late = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => reject(stateBusy()), ms)
+  })
+  read.catch(() => {}) // a late rejection is not unhandled
+  return Promise.race([read, late]).finally(() => clearTimeout(timer))
+}
+
+const TIMED = Symbol("concierge.timedIdentity")
+
+/**
+ * (FX-07) The identity with a time limit on each read: past it, the read rejects `busy`. A user whose read timed out
+ * is answered `busy` at once for the next `ms` (no new store read: a stuck store is not asked again per check, so
+ * the checks of one request share one wait and reads do not pile up). Wrapping a timed identity returns it as is.
+ */
+export function timedIdentity(identity: ConciergeIdentity, ms: number = IDENTITY_TIMEOUT_MS, now: () => number = Date.now): ConciergeIdentity {
+  if ((identity as { [TIMED]?: true })[TIMED]) return identity
+  const stuckUntil = new Map<string, number>()
+  const timed = {
+    [TIMED]: true as const,
+    async current(userID: string) {
+      const until = stuckUntil.get(userID)
+      if (until !== undefined) {
+        if (now() < until) throw stateBusy()
+        stuckUntil.delete(userID)
+      }
+      try {
+        return await within(identity.current(userID), ms)
+      } catch (cause) {
+        if (cause instanceof AgentError && cause.code === "busy") stuckUntil.set(userID, now() + ms)
+        throw cause
+      }
+    },
+  }
+  return timed
+}
+
 /**
  * The gate agentApi runs for every session actor before the route's own checks: a Concierge session (current or
- * previous) may call only the allow-list and `extra` (the tiers slot's routes). A failed identity read refuses.
+ * previous) may call only the allow-list and `extra` (the tiers slot's routes). (FX-07) An identity read that fails or
+ * has not answered within `timeoutMs` refuses every other route with a neutral 503 `busy` (fail closed, without
+ * telling an ordinary session it is the Concierge); the allow-list still passes.
  */
-export function conciergeSessionGate(identity: ConciergeIdentity, extra: () => readonly AgentRoute[] = () => []): (actor: AgentActor, route: Pick<AgentRoute, "method" | "path">) => Promise<void> {
+export function conciergeSessionGate(
+  identity: ConciergeIdentity,
+  extra: () => readonly AgentRoute[] = () => [],
+  options: { readonly timeoutMs?: number } = {},
+): (actor: AgentActor, route: Pick<AgentRoute, "method" | "path">) => Promise<void> {
   const allowed = new Set(CONCIERGE_SESSION_ROUTES.map((r) => key(r.method, r.path)))
+  const timed = timedIdentity(identity, options.timeoutMs ?? IDENTITY_TIMEOUT_MS)
   return async (actor, route) => {
     if (actor.kind !== "session") return
+    const listed = () => allowed.has(key(route.method, route.path)) || extra().some((r) => r.method === route.method && r.path === route.path)
     let concierge: boolean
     try {
-      const current = await identity.current(actor.userID)
+      const current = await timed.current(actor.userID)
       concierge = current.sessionID === actor.sessionID || current.hiddenSessionIDs.includes(actor.sessionID)
     } catch {
-      concierge = true
+      if (listed()) return
+      throw stateBusy()
     }
-    if (!concierge) return
-    if (allowed.has(key(route.method, route.path)) || extra().some((r) => r.method === route.method && r.path === route.path)) return
+    if (!concierge || listed()) return
     throw new AgentError("forbidden", "The Concierge cannot use this route", { extra: { policy: "concierge" } })
   }
 }

package/src/central/concierge/supervisor.ts

@@ -126,13 +126,30 @@ export class StatusStore {
   }
 }
 
-/** The Concierge-only authority read from the state record: the current session and every hidden one. */
-export function recordIdentity(store: StatusStore): { current(userID: string): Promise<{ sessionID?: string; hiddenSessionIDs: readonly string[] }> } {
+export interface IdentityOptions {
+  /**
+   * (FX-07) The user's sessions a machine reports locked now (its spoke holds them as Concierge sessions: they carry
+   * an agent or a context revision). The state record keeps only PAST_SESSIONS_MAX past sessions; an older one its
+   * machine still reports is still a Concierge session (and one no machine reports cannot use its tokens).
+   */
+  readonly reported?: (userID: string) => Iterable<string>
+}
+
+/**
+ * The Concierge-only authority read from the state record: the current session and every hidden one (plus, FX-07,
+ * those a machine reports locked). A failing report adds nothing; the record's own sessions always count.
+ */
+export function recordIdentity(store: StatusStore, options: IdentityOptions = {}): { current(userID: string): Promise<{ sessionID?: string; hiddenSessionIDs: readonly string[] }> } {
   return {
     current: async (userID) => {
       const r = await store.get(userID)
-      const all = [...new Set([...(r.pastSessionIDs ?? []), ...r.hiddenSessionIDs])]
-      return { ...(r.sessionID !== undefined ? { sessionID: r.sessionID } : {}), hiddenSessionIDs: all }
+      const all = new Set([...(r.pastSessionIDs ?? []), ...r.hiddenSessionIDs])
+      try {
+        if (options.reported) for (const id of options.reported(userID)) all.add(id)
+      } catch (cause) {
+        console.error(`[hub] concierge locked-session report failed: ${(cause as Error).message}`)
+      }
+      return { ...(r.sessionID !== undefined ? { sessionID: r.sessionID } : {}), hiddenSessionIDs: [...all] }
     },
   }
 }
@@ -158,6 +175,9 @@ export function conciergeLaunchSpec(userID: string, settings: ConciergeSettings,
   }
 }
 
+/** A queued launch's waiting reason as the Concierge's status: "Waiting: …" (kept when it already says Waiting). */
+const waitingText = (reason: string): string => (reason.startsWith("Waiting") ? reason : `Waiting: ${reason}`)
+
 /** Whether a launch is a Concierge launch (its label). */
 export const isConciergeLaunch = (launch: Pick<Launch, "spec">): boolean => launch.spec.labels?.["hub/system"] === "concierge"
 
@@ -410,12 +430,19 @@ export class Supervisor {
     await this.follow(userID, settings, await this.store.read(userID))
   }
 
-  /** The recorded launch: running → adopt it; ended → back off; else wait. */
+  /** The recorded launch: running → adopt it; ended → back off; else wait (starting says why it waits, FX-02). */
   private async follow(userID: string, settings: ConciergeSettings, snap: RecordSnapshot): Promise<void> {
-    const r = snap.record
-    const launch = await this.deps.launches.view(userID, r.launchID!)
+    const launch = await this.deps.launches.view(userID, snap.record.launchID!)
     if (!launch || launch.state === "ended") return this.ended(userID, snap, launch)
     if (launch.state === "running" && launch.sessionID !== undefined) return this.adopt(userID, snap, launch.sessionID, launch.machineID)
+    if (snap.record.state === "starting") {
+      const reason = launch.state === "queued" && launch.waiting ? waitingText(launch.waiting.reason) : "Starting"
+      if (snap.record.reason !== reason) {
+        if (!(await this.write(userID, snap, { ...snap.record, reason }))) return
+        snap = await this.store.read(userID)
+      }
+    }
+    const r = snap.record
     if (launch.sessionID !== undefined && !r.hiddenSessionIDs.includes(launch.sessionID)) {
       // Hidden from the console's lists as soon as the session exists, and never auto-named from its title.
       if (await this.write(userID, snap, { ...r, hiddenSessionIDs: addHidden(r.hiddenSessionIDs, launch.sessionID) })) await this.unname(userID, [launch.sessionID])

package/src/central/concierge/watchlist-routes.ts

@@ -140,8 +140,10 @@ export async function watchFacts(deps: WatchFactDeps, userID: string, hidden: re
   }
   const prefs = deps.store.viewPrefs(userID)
   const archived = new Set(prefs.hiddenSessions)
-  // (CON-12) Machines that report their sessions now: a session one of them no longer reports went away.
-  const reporting = new Set(catalog.filter((m) => m.processes.length > 0).map((m) => m.id))
+  // (CON-12) Machines that report their sessions now: a session one of them no longer reports went away. (FX-07) A
+  // process reports only once its first sessions frame came (right after hello it lists none yet), so a machine with
+  // a process still pending is not reporting: its sessions are offline for that moment, never gone.
+  const reporting = new Set(catalog.filter((m) => m.processes.length > 0 && m.processes.every((p) => !p.sessionsPending)).map((m) => m.id))
   for (const record of deps.store.agentData(userID).sessions ?? []) {
     const known = facts.get(record.sessionID)
     if (!known) {

package/src/central/config.ts

@@ -7,7 +7,7 @@ import path from "node:path"
 import { hubEnv } from "../env"
 import { isLoopbackHost } from "../loopback"
 import { formatPattern, parsePattern } from "./agent/policy"
-import { APP_DIR, configBase, legacyPaths, migrateFirst, stateBase } from "../migrate"
+import { APP_DIR, configBase, legacyPaths, migrateFirst, migrateStateDir, resolveHubStateDir, stateLegacyPaths } from "../migrate"
 import { updateSpeech, type StoredSpeech } from "./speech/settings"
 
 export const GOOGLE_ISSUER = "https://accounts.google.com"
@@ -99,6 +99,11 @@ export interface HubLaunches {
   readonly maxActive?: number
   /** New launches per clock hour. */
   readonly perHour?: number
+  /**
+   * Minutes the same node instance may leave a running launch out of its reports (its session gone) before it ends
+   * lost (default 5; 0 or false: never).
+   */
+  readonly lostAfterMinutes?: number | false
 }
 
 /** hub.json `agents`, validated. */
@@ -133,7 +138,9 @@ const HUB_KEYS = new Set(["host", "port", "publicURL", "stateDir", "speech", "au
 const CLUSTER_KEYS = ["database", "valkey"] as const
 const AGENTS_KEYS = new Set(["never", "launches", "webhooks"])
 const WEBHOOK_KEYS = new Set(["allowPrivate"])
-const LAUNCH_CAP_KEYS = ["maxQueued", "maxActive", "perHour"] as const
+const LAUNCH_CAP_KEYS = ["maxQueued", "maxActive", "perHour", "lostAfterMinutes"] as const
+/** The longest lostAfterMinutes (a day): far below setTimeout's 32-bit limit. */
+const LOST_AFTER_MAX = 1440
 const LAUNCH_CAP_MAX = 100_000
 const AUTH_KEYS = new Set(["mode", "issuer", "clientId", "clientSecret", "allowed", "admins"])
 const EMAIL = /^[^\s@,]+@[^\s@,]+\.[^\s@,]+$/
@@ -322,13 +329,20 @@ function readHubWebhooks(raw: unknown, file: string, warnings: string[], fail: (
 function readHubLaunches(raw: unknown, file: string, warnings: string[], fail: (message: string) => never): HubLaunches {
   if (!isObj(raw)) fail("agents.launches must be an object")
   const input = raw as Record<string, unknown>
-  const caps: Record<string, number> = {}
+  const caps: Record<string, number | false> = {}
   for (const key of Object.keys(input)) {
     if (!(LAUNCH_CAP_KEYS as readonly string[]).includes(key)) {
       warnings.push(`${file}: unknown key "agents.launches.${key}" ignored`)
       continue
     }
     const value = input[key]
+    if (key === "lostAfterMinutes") {
+      if (value !== false && (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > LOST_AFTER_MAX)) {
+        fail(`agents.launches.lostAfterMinutes must be a whole number from 0 to ${LOST_AFTER_MAX}, or false (0 and false: never)`)
+      }
+      caps[key] = value as number | false
+      continue
+    }
     if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > LAUNCH_CAP_MAX) {
       fail(`agents.launches.${key} must be a whole number from 1 to ${LAUNCH_CAP_MAX}`)
     }
@@ -462,7 +476,7 @@ export function centralConfig(rawEnv: Env = process.env, home: string = homedir(
     host,
     port,
     publicURL,
-    stateDir: env.HUB_STATE_DIR || file.stateDir || path.join(stateBase(home), APP_DIR),
+    stateDir: env.HUB_STATE_DIR || file.stateDir || resolveHubStateDir(env, home).dir,
     apiKey: env.OPENROUTER_API_KEY || undefined,
     sttModel: env.HUB_STT_MODEL || "openai/gpt-4o-mini-transcribe",
     ttsModel: env.HUB_TTS_MODEL || "microsoft/mai-voice-2.1-flash",
@@ -504,7 +518,9 @@ export function loadCentralConfig(
   const config = centralConfig(env, home, hub)
   if (!resolved.HUB_STATE_DIR && !hub?.stateDir) {
     // hub.pid is the spoke's auto-start lock for the legacy location, not state.
-    migrateFirst(legacyPaths(stateBase(home)), config.stateDir, { ...migrate, skip: ["hub.pid"] })
+    migrateStateDir(stateLegacyPaths(env, home), config.stateDir, { ...migrate, skip: ["hub.pid"] })
+    const resolvedDir = resolveHubStateDir(env, home)
+    if (resolvedDir.hint) warnings.push(resolvedDir.hint)
   }
   return { config, warnings, path: file, loaded: hub !== undefined }
 }

package/src/central/http.ts

@@ -8,7 +8,7 @@ import { diskAssets, type WebAssets } from "./assets"
 import path from "node:path"
 import { promisify } from "node:util"
 import { brotliCompress, constants as zlib, gzip } from "node:zlib"
-import { formAnswerProblem, PROMPT_IMAGE_MIMES, WORKSPACE_LIMITS, promptImagesProblem, type AvailableModel, type CoreOp, type EnrollStart, type FormAnswer, type ModelSelection, type PermissionDecision, type PromptImage } from "../protocol"
+import { formAnswerProblem, NOT_A_USER_MESSAGE, REVERT_BUSY, REVERT_END_BUSY, PROMPT_IMAGE_MIMES, WORKSPACE_LIMITS, promptImagesProblem, redactEmbeddedMedia, type AvailableModel, type CoreOp, type EnrollStart, type FormAnswer, type ModelSelection, type PermissionDecision, type PromptImage } from "../protocol"
 import { isLoopbackAddress, isLoopbackHost, isLoopbackURL, loopbackOrigins } from "../loopback"
 import { speakable } from "../speakable"
 import { Auth, RateLimitError, ValidationError } from "./auth"
@@ -33,7 +33,7 @@ import { Escalations } from "./agent/escalation"
 import { GrantRequests } from "./agent/grant-requests"
 import { partyFromActor } from "./agent/envelope"
 import { Delivery } from "./agent/delivery"
-import { AgentError, type AgentErrorCode } from "./agent/errors"
+import { AGENT_ERROR_STATUS, AgentError, type AgentErrorCode } from "./agent/errors"
 import type { Launch } from "./agent/launch-store"
 import { decisionStateQuery, MessageFeed } from "./agent/message-routes"
 import { hubDirectory } from "./agent/directory-routes"
@@ -91,15 +91,17 @@ import { conciergeActor, conciergeInbound, conciergeProtects } from "./concierge
 import { conciergeModules, type ConciergePorts, type ConciergeTiers } from "./concierge/index"
 import { watchedSessions } from "./concierge/notifier"
 import { NotesStore } from "./concierge/notes"
-import { conciergeSessionGate } from "./concierge/session-routes"
+import { conciergeSessionGate, timedIdentity } from "./concierge/session-routes"
 import { conciergeAwareNotifier, isConciergeSession } from "./concierge/push-remap"
 import { ConciergeService, type MachineFacts } from "./concierge/service"
+import { machineModels } from "./concierge/routes"
 import { SettingsStore } from "./concierge/settings"
 import { CONCIERGE_TAMPERED, isConciergeLaunch, recordIdentity, StatusStore, Supervisor } from "./concierge/supervisor"
 import { CONCIERGE_AGENT } from "../../packages/protocol/src/concierge"
 import { CONCIERGE_FORCED_PUSH_MS, INTERNAL_AGENTS, KNOWN_PRIMARY_AGENTS } from "./concierge/context"
 import { grantState } from "./agent/grants"
 import { catalogHarnesses, TeamDiscovery } from "./teams/discovery"
+import { inRevertWindow, RevertWindows } from "./revert-windows"
 import { DRAIN_RETRY_AFTER_MS, DRAIN_TIMEOUT_MS, RequestTimeoutError, RequestTooLargeError, SpokeError, SpokeHub, type DrainOptions, type Notifier, type SpokeHubOptions, type SpokeSocketData } from "./spoke-ws"
 import { ACTIVITY_INTERVAL_MAX, ACTIVITY_INTERVAL_MIN, LOCAL_USER, PUSH_PREF_KEYS, quietHoursInput, Store, VIEW_PREF_KEYS, VIEW_PREF_MAX_ARCHIVED, type DeviceRecord, type LegacyPushPrefs, type PushPrefs, type UserRecord, type ViewPrefs } from "./store"
 
@@ -297,8 +299,6 @@ const LAUNCH_STOP_TIMEOUT_MS = 180_000
  */
 export const TURN_ACCEPT_MS = 1500
 const NO_OWNER = "No OpenCode process for this session is connected"
-/** The spoke's refusal of a revert while the session runs (src/spoke/fork-revert.ts REVERT_BUSY). */
-const REVERT_BUSY = "The session is working; wait for it to finish (or stop it) before reverting"
 /** A message ID in a fork or revert request (as the spoke protocol bounds it). */
 const MESSAGE_ID = /^[A-Za-z0-9_.:@/+~-]{1,300}$/
 const AUTO_NAME_OUTDATED = "Update the Hub plugin to use Auto-name"
@@ -409,7 +409,12 @@ export function startCentral(options: CentralOptions): Central {
   // CON-04: the Concierge's state record is read early (the Concierge-only authority, hiding, the inbound rule and
   // push remapping all follow it); the service itself is built below, once its parts exist.
   const conciergeStatus = new StatusStore(backends.state, now)
-  const conciergeIdentity = recordIdentity(conciergeStatus)
+  // (FX-07) Beyond the past sessions the record keeps: those a machine reports locked (its spoke holds them as Concierge sessions).
+  const conciergeIdentity = recordIdentity(conciergeStatus, { reported: (userID) => registry.lockedSessions(userID) })
+  // (FX-07) The identity checks on request paths (route gate, manage guard, acting guard, inbound/outbound rules, team
+  // staffing, Decision and audit labels) wait at most IDENTITY_TIMEOUT_MS for the store: past it they refuse with busy
+  // (503), never hang; one shared breaker answers busy at once for a while after a read timed out.
+  const conciergeTimedIdentity = timedIdentity(conciergeIdentity)
   // Pushes about the Concierge's hidden sessions become kind "concierge" (/concierge) or are dropped.
   const notifier = conciergeAwareNotifier(options.notifier ?? push, () => conciergeIdentity)
   /** SSE subscribers, one user each. */
@@ -796,7 +801,7 @@ export function startCentral(options: CentralOptions): Central {
   const delivery = new Delivery({
     teams: teamPolicy,
     // CON-04 inbound rule: only the user, app:concierge and replies to its asks reach a Concierge session.
-    inbound: conciergeInbound({ identity: conciergeIdentity, audit: { record: (userID, entry) => audit.record(userID, entry) } }),
+    inbound: conciergeInbound({ identity: conciergeTimedIdentity, audit: { record: (userID, entry) => audit.record(userID, entry) } }),
     state: backends.state,
     counters: backends.counters,
     registry,
@@ -814,6 +819,8 @@ export function startCentral(options: CentralOptions): Central {
     },
     // Push kind "message": a msg to @me, an ask left unanswered, a message loop (sent even while watched).
     alert: (userID, alert) => pushUser("message", userID, alert.sessionID, `${alert.kind}:${alert.messageID}`),
+    // A message pending for 24 h expired undelivered: journaled (message.changed, delivery "expired") for its sender.
+    expired: (userID, message) => feed.publish(userID, message),
     ...(loopTickMs !== undefined ? { tickMs: loopTickMs } : {}),
     // Cluster mode: the re-wake loop (leader) looks at every user; each pending flush holds a (user, session) lease.
     ...(config.cluster ? { users: allUsers, locks: backends.locks, owner: leaseOwner } : {}),
@@ -851,7 +858,8 @@ export function startCentral(options: CentralOptions): Central {
       if (!conciergeTierHooks?.checkVia) throw new AgentError("forbidden", TAP_ONLY)
       await conciergeTierHooks.checkVia(userID, decision, via, by)
     },
-    concierge: (userID, sessionID) => isConciergeSession(conciergeIdentity, userID, sessionID),
+    // (FX-07) Time-limited and fail closed: a timed-out read refuses the ask with busy (no label silently dropped).
+    concierge: conciergeProtects(conciergeTimedIdentity),
     ...(loopTickMs !== undefined ? { tickMs: loopTickMs } : {}),
   })
   leader("decisions", { onElected: () => decisions.start(), onDeposed: () => decisions.stop() })
@@ -862,6 +870,15 @@ export function startCentral(options: CentralOptions): Central {
     await delivery.humanTurn(tenant, sessionID).catch((cause) => console.error(`[hub] hop reset failed: ${(cause as Error).message}`))
   }
   registry.onSessions((connID) => void delivery.onSessions(connID).catch((cause) => console.error(`[hub] message flush failed: ${(cause as Error).message}`)))
+  // Committed revert windows (./revert-windows): the hub message rows of a removed history stay hidden for good.
+  const revertWindows = new RevertWindows(backends.state)
+  registry.onSessions((connID) => {
+    const tenant = registry.connTenant(connID)
+    if (tenant === undefined) return
+    for (const { sessionID, committed } of registry.revertCommits(connID)) {
+      void revertWindows.observe(tenant, sessionID, committed).catch((cause) => console.error(`[hub] revert window not kept: ${(cause as Error).message}`))
+    }
+  })
   registry.onHumanTurn((sessionID) => void humanTurn(sessionID))
   // (CON-02) Session intents; the journal is created below (appends happen only once requests arrive).
   const intents = new SessionIntents({
@@ -891,7 +908,8 @@ export function startCentral(options: CentralOptions): Central {
   // Cluster mode: launch changes made on any pod reach this pod's agent watches. The console broadcast, closing a
   // launch's connections and webhooks run only on the publishing pod (origin): they reach every pod themselves.
   if (config.cluster) launchFeed.attach({ bus: backends.bus, podID: config.cluster.podID }).catch((cause) => console.error(`[hub] launch feed did not attach: ${(cause as Error).message}`))
-  launchFeed.subscribe((userID, launch) => broadcast({ type: "launch", launch: launchInfo(launch) }, { tenant: userID }), { origin: true })
+  // The user's live view: flagged when the launch's app token was revoked (launches is set below, before any change).
+  launchFeed.subscribe((userID, launch) => broadcast({ type: "launch", launch: launchInfo(launches.live(launch)) }, { tenant: userID }), { origin: true })
   // Profile application (HWA-15), created with the profile store below; a launch naming a profile applies it.
   let profileApplier: ProfileApplier | undefined
   const launches = new LaunchEngine({
@@ -914,7 +932,15 @@ export function startCentral(options: CentralOptions): Central {
     users: () => store.users().map((u) => u.id),
     now,
     onLaunchChanged: (launch) => launchFeed.publish(launch.owner, launch),
+    // FX-02: a waiting text change of the same kind: the console's live stream (and the Concierge's status) only,
+    // never the journal or webhooks.
+    onLaunchWaiting: (launch) => {
+      broadcast({ type: "launch", launch: launchInfo(launches.live(launch)) }, { tenant: launch.owner })
+      if (isConciergeLaunch(launch)) conciergeSupervisor.kick(launch.owner)
+    },
     intents,
+    // FX-02: a launch of a revoked app token (`app:<16 hex>` no longer among the user's tokens) is flagged, not stopped.
+    launchers: { revoked: (userID, by) => /^app:[0-9a-f]{16}$/.test(by) && !(store.user(userID)?.agent?.appTokens ?? []).some((t) => `app:${t.id}` === by) },
     profiles: { applyAtLaunch: async (userID, sessionID, ref) => (profileApplier ? profileApplier.applyAtLaunch(userID, sessionID, ref) : [`profile ${ref.profileID} v${ref.version} not applied: the hub is starting`]) },
     // Cluster mode: the supervisor runs on the launches leader; other pods kick it and send it their stops.
     ...(config.cluster
@@ -1055,7 +1081,7 @@ export function startCentral(options: CentralOptions): Central {
   // One credential resolver for every /api request: device cookie, device token, session and app tokens.
   // Every stored agent message also goes to the user's console streams (live transcript rows).
   feed.subscribe((userID, message) => broadcast({ type: "message", message }, { tenant: userID }), { origin: true })
-  const audit = new AgentAudit({ state: backends.state, now, admin: store, recorded: (userID, entry) => broadcast({ type: "agent", entry }, { tenant: userID }), concierge: (userID, sessionID) => isConciergeSession(conciergeIdentity, userID, sessionID) })
+  const audit = new AgentAudit({ state: backends.state, now, admin: store, recorded: (userID, entry) => broadcast({ type: "agent", entry }, { tenant: userID }), concierge: (userID, sessionID) => isConciergeSession(conciergeTimedIdentity, userID, sessionID) })
   const grants = new Grants({ state: backends.state, counters: backends.counters, directory, store, admin: store, now, concierge: async (owner) => (await conciergeIdentity.current(owner)).hiddenSessionIDs })
   const acting = new ActingSwitch({ store, never: config.agentsNever, audit })
   /** An agent as envelopes name it (a session by its directory name). */
@@ -1114,11 +1140,11 @@ export function startCentral(options: CentralOptions): Central {
   const workspaces = { workspaces: workspaceStore, members: workspaceMembers, supervision: workspaceSupervision, lifecycle: workspaceLifecycle }
   // Team staffing (HWA-35): seats end on session deletion; launched members are staffed when their launch runs.
   const sessionDirectory = (userID: string, sessionID: string) => (registry.sessionTenant(sessionID) === userID ? registry.session(sessionID)?.directory : undefined)
-  const teamStaffing = new TeamStaffingService({ state: backends.state, teams: teamStore, seats: teamSeats, workspaces: workspaceStore, members: workspaceMembers, supervision: workspaceSupervision, presence: teamPresence, sessionDirectory, launches, grants, acting, audit, profiles, events: agentEvents, now })
+  const teamStaffing = new TeamStaffingService({ state: backends.state, teams: teamStore, seats: teamSeats, workspaces: workspaceStore, members: workspaceMembers, supervision: workspaceSupervision, presence: teamPresence, sessionDirectory, launches, grants, acting, audit, profiles, events: agentEvents, now, protects: conciergeProtects(conciergeTimedIdentity) })
   registry.onSessionDeleted((sessionID, tenant) => void teamStaffing.sessionEnded(tenant, sessionID).catch((cause) => console.error(`[hub] team session end failed: ${(cause as Error).message}`)))
   launchFeed.subscribe((userID, launch) => void teamStaffing.launchChanged(userID, launch).catch((cause) => console.error(`[hub] team staffing launch failed: ${(cause as Error).message}`)), { origin: true })
   // Team intake (HWA-36): delivered to an entry seat from the fixed party app:team-intake (never the submitter).
-  teamIntake = new TeamIntakeService({ state: backends.state, teams: teamStore, seats: teamSeats, staffing: teamStaffing, members: workspaceMembers, presence: teamPresence, events: agentEvents, now, deliver: async (userID, sessionID, text) => ({ messageID: (await delivery.send(userID, intakeActor(userID), sessionID, "msg", text)).message.id }) })
+  teamIntake = new TeamIntakeService({ state: backends.state, teams: teamStore, seats: teamSeats, staffing: teamStaffing, members: workspaceMembers, presence: teamPresence, events: agentEvents, now, deliver: async (userID, sessionID, text, options = {}) => ({ messageID: (await delivery.send(userID, intakeActor(userID), sessionID, "msg", text, options.hop === undefined ? {} : { chainHop: options.hop })).message.id }), hopOf: (userID, sessionID) => delivery.hops.next(userID, { kind: "session", sessionID }) })
   // Supervisor checkpoints and batched digests (HWA-11): acknowledgments flush before answering; digests reach
   // supervisor sessions through Delivery (as coordinatorActor) from the workspace-coordinator leader.
   const workspaceCursors = journalCursors(tokenKeys, agentEvents)
@@ -1278,7 +1304,7 @@ export function startCentral(options: CentralOptions): Central {
       state: backends.state,
       counters: backends.counters,
       decisions,
-      acting: (conciergeActing = new Acting({ registry, directory, actions, spokes: { request: (connID, req) => spokes.request(connID, req) }, grants, acting, audit, escalate, maxPromptChars: MAX_PROMPT_CHARS, protect: conciergeProtects(conciergeIdentity), conciergeActor: conciergeProtects(conciergeIdentity) })),
+      acting: (conciergeActing = new Acting({ registry, directory, actions, spokes: { request: (connID, req) => spokes.request(connID, req) }, grants, acting, audit, escalate, maxPromptChars: MAX_PROMPT_CHARS, protect: conciergeProtects(conciergeTimedIdentity), conciergeActor: conciergeProtects(conciergeTimedIdentity), currentConcierge: async (userID, sessionID) => (await conciergeTimedIdentity.current(userID)).sessionID === sessionID })),
       audit,
       protects: conciergeProtects(conciergeIdentity),
       published: (userID, message) => feed.publish(userID, message),
@@ -1365,7 +1391,7 @@ export function startCentral(options: CentralOptions): Central {
     onDeposed: () => (conciergeSupervisor.stop(), conciergeParts.notifier.stop()),
   })
   void conciergeLeader.start()
-  const agentDeps = { intents, teamDiscovery, draining: drainSignal.signal, store, sessionTokens, directory, registry, spokes, delivery, decisions, feed, heartbeatMs, now, audit, grants, grantRequests, acting, actions, escalate, launches, webhooks, agentEvents, eventCursorKeys: tokenKeys, maxPromptChars: MAX_PROMPT_CHARS, profiles, workspaces, workspaceCheckpoints, teamIntake, graph: { teams: { teams: teamStore, seats: teamSeats! } }, teams: { teams: teamStore, seats: teamSeats!, staffing: teamStaffing }, artifacts: { ...(artifacts && backends.blobs ? { artifacts, blobs: backends.blobs } : {}), state: backends.state, now }, artifactHost: { caps: artifactHostCaps, ...(artifacts ? { artifacts } : {}) }, concierge: { state: backends.state, activity: conciergeActivity, results: conciergeResults, identity: conciergeIdentity, protects: conciergeProtects(conciergeIdentity), service: conciergeService, routes: () => conciergeParts.tiers.routes(), armed: conciergeArmed, timeZone: conciergeBoardDeps.timeZone, coverage: conciergeCoverage } }
+  const agentDeps = { intents, teamDiscovery, draining: drainSignal.signal, store, sessionTokens, directory, registry, spokes, delivery, decisions, feed, heartbeatMs, now, audit, grants, grantRequests, acting, actions, escalate, launches, webhooks, agentEvents, eventCursorKeys: tokenKeys, maxPromptChars: MAX_PROMPT_CHARS, profiles, workspaces, workspaceCheckpoints, teamIntake, graph: { teams: { teams: teamStore, seats: teamSeats! } }, teams: { teams: teamStore, seats: teamSeats!, staffing: teamStaffing }, artifacts: { ...(artifacts && backends.blobs ? { artifacts, blobs: backends.blobs } : {}), state: backends.state, now }, artifactHost: { caps: artifactHostCaps, ...(artifacts ? { artifacts } : {}) }, concierge: { state: backends.state, activity: conciergeActivity, results: conciergeResults, identity: conciergeTimedIdentity, protects: conciergeProtects(conciergeTimedIdentity), service: conciergeService, models: machineModels({ serviceFor: (machineID) => registry.serviceFor(machineID), reportedSessions: (connID) => registry.reportedSessions(connID), request: (connID, req) => spokes.request(connID, req) }), routes: () => conciergeParts.tiers.routes(), armed: conciergeArmed, timeZone: conciergeBoardDeps.timeZone, coverage: conciergeCoverage } }
   const resolveActor = createResolver({
     cookieName: COOKIE,
     findDevice: (token) => deviceOfToken(token),
@@ -1383,7 +1409,7 @@ export function startCentral(options: CentralOptions): Central {
     },
     routes: [...agentRoutes(agentDeps), ...(options.agent?.routes ?? [])],
     // CON-04: a Concierge session's tokens reach only an explicit route allow-list (fail closed).
-    gate: conciergeSessionGate(conciergeIdentity, () => conciergeParts.tiers.routes()),
+    gate: conciergeSessionGate(conciergeTimedIdentity, () => conciergeParts.tiers.routes()),
   })
 
   // POST /mcp (MCP Streamable HTTP): `hub mcp`'s tools as the bearer's caller; their /api/agent calls are dispatched
@@ -1401,11 +1427,12 @@ export function startCentral(options: CentralOptions): Central {
     const { pathname } = url
     const method = request.method
     try {
-      if (method === "GET" && pathname === "/readyz") return readyz()
-      if (pathname === "/spoke/ws") return spokes.upgrade(request, server)
-      if (method === "GET" && pathname === "/healthz") {
-        return Response.json({ ok: true, version: options.version ?? "0.0.0", spokes: registry.connections(), nodes: nodes.count() })
+      // HEAD (uptime monitors, `curl -I`) gets GET's status and headers without a body, on the health routes only.
+      if ((method === "GET" || method === "HEAD") && (pathname === "/readyz" || pathname === "/healthz")) {
+        const response = pathname === "/readyz" ? await readyz() : healthz()
+        return method === "HEAD" ? new Response(null, { status: response.status, headers: response.headers }) : response
       }
+      if (pathname === "/spoke/ws") return spokes.upgrade(request, server)
       // A shared (cluster) store loads its records on first use; the file store is ready at once.
       await store.ready()
       if (method === "POST" && pathname === "/spoke/enroll") {
@@ -1738,7 +1765,7 @@ export function startCentral(options: CentralOptions): Central {
     route("POST", "/api/sessions/:session/fork", "session", ({ request, params, user }) => forkSession(request, params.session!, user.id)),
     route("GET", "/api/sessions/:session/revert/preview", "session", async ({ params, url }) => {
       const messageID = messageIDInput(url.searchParams.get("messageID"))
-      const preview = await spokes.request(featureOwner(params.session!, "revert"), { op: "revertPreview", sessionID: params.session!, messageID })
+      const preview = await spokes.request(featureOwner(params.session!, "revert"), { op: "revertPreview", sessionID: params.session!, messageID }).catch(refused())
       return Response.json(preview, { headers: NO_STORE })
     }),
     route("POST", "/api/sessions/:session/revert", "session", ({ request, params, user }) => revertSession(request, params.session!, user.id)),
@@ -1797,11 +1824,18 @@ export function startCentral(options: CentralOptions): Central {
       const raw = url.searchParams.get("limit")
       const limit = raw === null ? undefined : Number(raw)
       if (limit !== undefined && (!Number.isInteger(limit) || limit < 1 || limit > 200)) return error(400, "limit must be 1–200")
-      const messages = await delivery.messages.list(user.id, { kind: "session", sessionID: params.session! }, limit === undefined ? {} : { limit })
+      const [listed, windows] = await Promise.all([
+        delivery.messages.list(user.id, { kind: "session", sessionID: params.session! }, limit === undefined ? {} : { limit }),
+        revertWindows.list(user.id, params.session!),
+      ])
+      // Rows of a history a committed revert removed stay out.
+      const messages = windows.length ? listed.filter((m) => !inRevertWindow(m.at, windows)) : listed
       return Response.json({ messages }, { headers: NO_STORE })
     }),
+    // (M1) Embedded images become placeholders here too, so a spoke that still sends them (older versions, other
+    // harnesses) never ships image bytes to the console in a tool detail.
     route("GET", "/api/sessions/:session/timeline/messages/:message/parts/:part", "session", async ({ params }) =>
-      Response.json(await spokes.request(ownerOf(params.session!), { op: "timelinePart", sessionID: params.session!, messageID: params.message!, partID: params.part! }), { headers: NO_STORE })),
+      Response.json(redactEmbeddedMedia(await spokes.request(ownerOf(params.session!), { op: "timelinePart", sessionID: params.session!, messageID: params.message!, partID: params.part! })), { headers: NO_STORE })),
     route("GET", "/api/sessions/:session/timeline/messages/:message/files/:index", "session", ({ params }) => timelineFile(params.session!, params.message!, params.index!)),
     route(
       "GET",
@@ -2144,16 +2178,26 @@ export function startCentral(options: CentralOptions): Central {
     return raw
   }
 
-  /** A spoke's refusal of a revert while the session runs, as 409 busy; anything else unchanged. */
-  function busyRefusal(cause: unknown): unknown {
-    return cause instanceof SpokeError && cause.message === REVERT_BUSY ? new HttpError(409, REVERT_BUSY, "busy") : cause
+  /**
+   * A spoke's refusal of a fork or revert op: code "busy" → 409 busy, "not_found" → 404 (failure() maps both). Older
+   * spokes send no code: their busy texts (the spoke's REVERT_BUSY, OpenCode's "Session is busy: …") and
+   * NOT_A_USER_MESSAGE are recognised instead; anything else unchanged (502).
+   */
+  function forkRevertRefusal(cause: unknown, busy = REVERT_BUSY): unknown {
+    if (!(cause instanceof SpokeError) || cause.code !== undefined) return cause
+    if (cause.message === REVERT_BUSY || /Session is busy/i.test(cause.message)) return new HttpError(409, busy, "busy")
+    if (cause.message === NOT_A_USER_MESSAGE) return new HttpError(404, NOT_A_USER_MESSAGE, "not_found")
+    return cause
+  }
+  const refused = (busy?: string) => (cause: unknown) => {
+    throw forkRevertRefusal(cause, busy)
   }
 
   /** POST …/fork {messageID}: a new session with the conversation before that user message (201). */
   async function forkSession(request: Request, sessionID: string, userID: string): Promise<Response> {
     const messageID = messageIDInput((await body(request)).messageID)
     const connID = featureOwner(sessionID, "fork")
-    const result = await spokes.request(connID, { op: "fork", sessionID, messageID })
+    const result = await spokes.request(connID, { op: "fork", sessionID, messageID }).catch(refused())
     await store.audit({ actor: userID, action: "session.fork", target: sessionID, detail: `${messageID} -> ${result.sessionID}` })
     return Response.json(result, { status: 201, headers: NO_STORE })
   }
@@ -2166,9 +2210,7 @@ export function startCentral(options: CentralOptions): Central {
     const files = input.files !== false
     const connID = featureOwner(sessionID, "revert")
     if (registry.running(sessionID)) throw new HttpError(409, REVERT_BUSY, "busy")
-    const result = await spokes.request(connID, { op: "revert", sessionID, messageID, files }).catch((cause) => {
-      throw busyRefusal(cause)
-    })
+    const result = await spokes.request(connID, { op: "revert", sessionID, messageID, files }).catch(refused())
     await store.audit({ actor: userID, action: "session.revert", target: sessionID, detail: files ? messageID : `${messageID} (messages only)` })
     return Response.json(result, { headers: NO_STORE })
   }
@@ -2176,9 +2218,8 @@ export function startCentral(options: CentralOptions): Central {
   /** POST …/revert/restore (undo) or …/revert/commit (make permanent): 204. */
   async function revertEnd(sessionID: string, userID: string, op: "revertRestore" | "revertCommit"): Promise<Response> {
     const connID = featureOwner(sessionID, "revert")
-    await spokes.request(connID, { op, sessionID }).catch((cause) => {
-      throw busyRefusal(cause)
-    })
+    if (registry.running(sessionID)) throw new HttpError(409, REVERT_END_BUSY, "busy")
+    await spokes.request(connID, { op, sessionID }).catch(refused(REVERT_END_BUSY))
     await store.audit({ actor: userID, action: op === "revertRestore" ? "session.revert.restore" : "session.revert.commit", target: sessionID })
     return new Response(null, { status: 204 })
   }
@@ -2472,6 +2513,10 @@ export function startCentral(options: CentralOptions): Central {
   }
 
   /** /readyz (design §10): 503 while draining or (cluster mode) when the database or Valkey does not answer in time. */
+  function healthz(): Response {
+    return Response.json({ ok: true, version: options.version ?? "0.0.0", spokes: registry.connections(), nodes: nodes.count() })
+  }
+
   async function readyz(): Promise<Response> {
     if (draining) return Response.json({ ok: false, draining: true }, { status: 503, headers: NO_STORE })
     if (config.cluster) {
@@ -2619,11 +2664,15 @@ function decisionAnswer(input: Record<string, unknown>): { option?: string; text
   return { ...(typeof input.option === "string" ? { option: input.option } : {}), ...(typeof input.text === "string" ? { text: input.text } : {}), ...(input.via !== undefined ? { via: input.via as AnswerVia } : {}) }
 }
 
-/** Console envelope for a Decision failure: gone → 409 (the web app's toast), the rest by code. */
+/**
+ * Console envelope for a Decision failure: gone → 409 (the web app's toast), the rest by the agent API's code
+ * table (a revert-staged `conflict` 409, a `busy` 503 with retryAfter), never a bare 500 for a known code.
+ */
 function decisionFailure(cause: unknown): Response {
   if (!(cause instanceof AgentError)) throw cause
-  const status: Partial<Record<string, number>> = { gone: 409, not_found: 404, forbidden: 403, invalid: 400, rate_limited: 429, paused: 423, offline: 503, unsupported: 422 }
-  return Response.json({ error: cause.message, code: cause.code, ...(cause.options.hint ? { hint: cause.options.hint } : {}) }, { status: status[cause.code] ?? 500 })
+  const status = cause.code === "gone" ? 409 : AGENT_ERROR_STATUS[cause.code] ?? 500
+  const extra = cause.options.extra && typeof cause.options.extra.retryAfter === "number" ? { retryAfter: cause.options.extra.retryAfter } : {}
+  return Response.json({ error: cause.message, code: cause.code, ...(cause.options.hint ? { hint: cause.options.hint } : {}), ...extra }, { status })
 }
 
 /** Deep-link scheme of the native apps: `hubapp://link?hub=<public URL>&code=<link code>`. */
@@ -2767,6 +2816,9 @@ function failure(cause: unknown): Response {
   if (cause instanceof ValidationError) return error(400, cause.message)
   if (cause instanceof SyntaxError) return error(400, "Invalid JSON")
   if (cause instanceof SpeechError) return error(502, cause.message)
+  // A spoke's coded refusal (Res.code): busy → 409, not found → 404; anything else from a spoke is a bad gateway.
+  if (cause instanceof SpokeError && cause.code === "busy") return error(409, cause.message, "busy")
+  if (cause instanceof SpokeError && cause.code === "not_found") return error(404, cause.message, "not_found")
   if (cause instanceof SpokeError) return error(502, cause.message)
   if (cause instanceof RequestTooLargeError) return error(413, cause.message)
   if (cause instanceof OidcError) return authPage(cause.status, "Sign-in failed", cause.message)

package/src/central/main.ts

@@ -68,7 +68,7 @@ Usage: hub-server [--help | --version]   (also installed as opencode-hub and ope
 Configuration: environment variables over ~/.config/hub/hub.json ($HUB_CONFIG).
   HUB_HOST / HUB_PORT       listen address (default 127.0.0.1 / 4097)
   HUB_PUBLIC_URL            origin used in links and cookies (default http://<host>:<port>)
-  HUB_STATE_DIR             machines, devices, keys (default ~/.local/state/hub)
+  HUB_STATE_DIR             machines, devices, keys (default $XDG_STATE_HOME/hub or ~/.local/state/hub)
   OPENROUTER_API_KEY        default speech key; or set speech providers in the web app (Settings → Speech)
   HUB_CONFIG                path of hub.json