@huynle/hub 0.8.1 → 0.8.3

package/src/central/http.ts

@@ -8,7 +8,7 @@ import { diskAssets, type WebAssets } from "./assets"
 import path from "node:path"
 import { promisify } from "node:util"
 import { brotliCompress, constants as zlib, gzip } from "node:zlib"
-import { formAnswerProblem, PROMPT_IMAGE_MIMES, WORKSPACE_LIMITS, promptImagesProblem, type AvailableModel, type CoreOp, type EnrollStart, type FormAnswer, type ModelSelection, type PermissionDecision, type PromptImage } from "../protocol"
+import { formAnswerProblem, NOT_A_USER_MESSAGE, RECORDING_AUDIO_RESULT_HEADER, REVERT_BUSY, REVERT_END_BUSY, PROMPT_IMAGE_MIMES, WORKSPACE_LIMITS, promptImagesProblem, redactEmbeddedMedia, type AvailableModel, type CoreOp, type EnrollStart, type FormAnswer, type ModelSelection, type PermissionDecision, type PromptImage } from "../protocol"
 import { isLoopbackAddress, isLoopbackHost, isLoopbackURL, loopbackOrigins } from "../loopback"
 import { speakable } from "../speakable"
 import { Auth, RateLimitError, ValidationError } from "./auth"
@@ -33,7 +33,7 @@ import { Escalations } from "./agent/escalation"
 import { GrantRequests } from "./agent/grant-requests"
 import { partyFromActor } from "./agent/envelope"
 import { Delivery } from "./agent/delivery"
-import { AgentError, type AgentErrorCode } from "./agent/errors"
+import { AGENT_ERROR_STATUS, AgentError, type AgentErrorCode } from "./agent/errors"
 import type { Launch } from "./agent/launch-store"
 import { decisionStateQuery, MessageFeed } from "./agent/message-routes"
 import { hubDirectory } from "./agent/directory-routes"
@@ -71,9 +71,14 @@ import { CheckpointStore, journalCursors } from "./workspaces/checkpoints"
 import { coordinatorActor, SupervisorCoordinator } from "./workspaces/coordinator"
 import { artifactJournalEvent } from "./artifacts/events"
 import { ArtifactMaintenance } from "./artifacts/maintenance"
+import { MemoryBlobStore } from "./backend/memory-blobs"
+import { RecordingService } from "./recording"
+import { recordingRoutes } from "./recording/routes"
+import { wrapConciergeSend } from "./recording/concierge-taps"
 import { ARTIFACT_UPLOAD_LIMITS } from "./artifacts/routes"
 import { ArtifactStore } from "./artifacts/store"
 import { artifactHost, isArtifactHostPath } from "./artifacts/host"
+import { CONSOLE_CSP, cspHeader } from "./csp"
 import { ArtifactHostCaps } from "./artifacts/host-caps"
 import { artifactWorkspacesFromState } from "./artifacts/workspaces"
 import { teamDeniedEvent, TeamPolicy } from "./teams/policy"
@@ -101,6 +106,7 @@ import { CONCIERGE_AGENT } from "../../packages/protocol/src/concierge"
 import { CONCIERGE_FORCED_PUSH_MS, INTERNAL_AGENTS, KNOWN_PRIMARY_AGENTS } from "./concierge/context"
 import { grantState } from "./agent/grants"
 import { catalogHarnesses, TeamDiscovery } from "./teams/discovery"
+import { inRevertWindow, RevertWindows } from "./revert-windows"
 import { DRAIN_RETRY_AFTER_MS, DRAIN_TIMEOUT_MS, RequestTimeoutError, RequestTooLargeError, SpokeError, SpokeHub, type DrainOptions, type Notifier, type SpokeHubOptions, type SpokeSocketData } from "./spoke-ws"
 import { ACTIVITY_INTERVAL_MAX, ACTIVITY_INTERVAL_MIN, LOCAL_USER, PUSH_PREF_KEYS, quietHoursInput, Store, VIEW_PREF_KEYS, VIEW_PREF_MAX_ARCHIVED, type DeviceRecord, type LegacyPushPrefs, type PushPrefs, type UserRecord, type ViewPrefs } from "./store"
 
@@ -195,6 +201,8 @@ export interface Central {
   readonly agentEventWriters: EventWriters
   /** (CON-02) Session intent retention (its leader runs it every 6 h; tests run a pass with runOnce). */
   readonly intentRetention: IntentRetention
+  /** (REC-01) Voice & Concierge recordings (developer): the owner-only store, taps, export and retention. */
+  readonly recordings: RecordingService
   /** The JSON API's route table (method, path, access), for audits and tests. */
   readonly routes: readonly RouteInfo[]
   /** Teams (HWA-33..37): definitions, seats (the delivery policy's) and staffing; HWA-37 routes reuse these. */
@@ -298,8 +306,6 @@ const LAUNCH_STOP_TIMEOUT_MS = 180_000
  */
 export const TURN_ACCEPT_MS = 1500
 const NO_OWNER = "No OpenCode process for this session is connected"
-/** The spoke's refusal of a revert while the session runs (src/spoke/fork-revert.ts REVERT_BUSY). */
-const REVERT_BUSY = "The session is working; wait for it to finish (or stop it) before reverting"
 /** A message ID in a fork or revert request (as the spoke protocol bounds it). */
 const MESSAGE_ID = /^[A-Za-z0-9_.:@/+~-]{1,300}$/
 const AUTO_NAME_OUTDATED = "Update the Hub plugin to use Auto-name"
@@ -830,6 +836,8 @@ export function startCentral(options: CentralOptions): Central {
   const feed = new MessageFeed()
   // Cluster mode: messages stored on any pod reach this pod's listeners (ask waiters, agent watches).
   if (config.cluster) feed.attach({ bus: backends.bus, podID: config.cluster.podID }).catch((cause) => console.error(`[hub] message feed did not attach: ${(cause as Error).message}`))
+  /** (REC-01) The recording service (set below, once its ports exist); the Decision hook reads it late. */
+  let recordings: RecordingService | undefined
   /** (CON-06) The Concierge tiers (set below, once the Concierge modules exist): proposals' act, via, disarm. */
   let conciergeTierHooks: ConciergeTiers | undefined
   // Decisions (design §12.1): asks to @me; deadlines run over every user's Decisions (survive restarts).
@@ -843,6 +851,8 @@ export function startCentral(options: CentralOptions): Central {
     changed: (userID, decision) => {
       broadcast({ type: "decision", decision }, { tenant: userID })
       conciergeTierHooks?.decisionChanged?.(userID, decision)
+      // (REC-01) decision.opened / decision.answered of a recorded session (best effort).
+      recordings?.decisionChanged(userID, decision)
     },
     // Escalations' Decisions reply to the permission as the user; grant requests' create the grant as the user;
     // (CON-06) Concierge proposals run their verb as the user (all set up below).
@@ -871,6 +881,15 @@ export function startCentral(options: CentralOptions): Central {
     await delivery.humanTurn(tenant, sessionID).catch((cause) => console.error(`[hub] hop reset failed: ${(cause as Error).message}`))
   }
   registry.onSessions((connID) => void delivery.onSessions(connID).catch((cause) => console.error(`[hub] message flush failed: ${(cause as Error).message}`)))
+  // Committed revert windows (./revert-windows): the hub message rows of a removed history stay hidden for good.
+  const revertWindows = new RevertWindows(backends.state)
+  registry.onSessions((connID) => {
+    const tenant = registry.connTenant(connID)
+    if (tenant === undefined) return
+    for (const { sessionID, committed } of registry.revertCommits(connID)) {
+      void revertWindows.observe(tenant, sessionID, committed).catch((cause) => console.error(`[hub] revert window not kept: ${(cause as Error).message}`))
+    }
+  })
   registry.onHumanTurn((sessionID) => void humanTurn(sessionID))
   // (CON-02) Session intents; the journal is created below (appends happen only once requests arrive).
   const intents = new SessionIntents({
@@ -1074,6 +1093,34 @@ export function startCentral(options: CentralOptions): Central {
   // Every stored agent message also goes to the user's console streams (live transcript rows).
   feed.subscribe((userID, message) => broadcast({ type: "message", message }, { tenant: userID }), { origin: true })
   const audit = new AgentAudit({ state: backends.state, now, admin: store, recorded: (userID, entry) => broadcast({ type: "agent", entry }, { tenant: userID }), concierge: (userID, sessionID) => isConciergeSession(conciergeTimedIdentity, userID, sessionID) })
+  // (REC-01) Voice & Concierge recordings (docs/voice-recording.md): records in the StateStore, bytes in the BlobStore
+  // under the tenant rec~<userID> (never the artifact tenant: artifact recovery would delete them); the retention sweep
+  // runs on the voice-recordings leader. SSE `recording` messages go to the user's own devices only.
+  const recordingService = new RecordingService({
+    state: backends.state,
+    blobs: backends.blobs ?? new MemoryBlobStore({ now }),
+    bus: backends.bus,
+    now,
+    ...(config.cluster ? { podID: config.cluster.podID } : {}),
+    version: options.version ?? "0.0.0",
+    owns: (userID, sessionID) => registry.owns(userID, sessionID),
+    sessionTitle: (sessionID) => registry.session(sessionID)?.title,
+    conversation: (sessionID) => registry.conversation(sessionID),
+    isConcierge: (userID, sessionID) => isConciergeSession(conciergeTimedIdentity, userID, sessionID),
+    speech: (userID) => {
+      const view = speechSettings.view(speechScope(userID)) as unknown as { stt?: Record<string, unknown>; tts?: Record<string, unknown> }
+      const pick = (o: Record<string, unknown> | undefined, keys: readonly string[]) => (o ? Object.fromEntries(keys.filter((k) => typeof o[k] === "string").map((k) => [k, (o[k] as string).slice(0, 120)])) : undefined)
+      return { ...(view.stt ? { stt: pick(view.stt, ["provider", "model"]) } : {}), ...(view.tts ? { tts: pick(view.tts, ["provider", "model", "voice"]) } : {}) }
+    },
+    notify: (userID, message, exceptDevice) => toUser(userID, message, exceptDevice),
+    audit: (entry) => store.audit(entry),
+    users: allUsers,
+    log: (message) => console.error(message),
+  })
+  recordings = recordingService
+  registry.recordingTap = recordingService.registryTap
+  registry.onSessionDeleted((sessionID, tenant) => void recordingService.sessionDeleted(tenant, sessionID).catch((cause) => console.error(`[hub] recording session end failed: ${(cause as Error).message}`)))
+  void leader("voice-recordings", { onElected: () => recordingService.retention.start(), onDeposed: () => recordingService.retention.stop() }).start()
   const grants = new Grants({ state: backends.state, counters: backends.counters, directory, store, admin: store, now, concierge: async (owner) => (await conciergeIdentity.current(owner)).hiddenSessionIDs })
   const acting = new ActingSwitch({ store, never: config.agentsNever, audit })
   /** An agent as envelopes name it (a session by its directory name). */
@@ -1268,12 +1315,13 @@ export function startCentral(options: CentralOptions): Central {
       const { sessionID } = await conciergeIdentity.current(userID)
       return sessionID !== undefined ? conciergeContext.beforeWake(userID, sessionID) : false
     },
-    send: async (userID, text, sendOptions) => {
+    // (REC-01) A successful send is recorded as wake.arrived in a recording of the Concierge session.
+    send: wrapConciergeSend(async (userID, text, sendOptions) => {
       const { sessionID } = await conciergeIdentity.current(userID)
       if (sessionID === undefined) throw new AgentError("not_found", "The Concierge is not running")
       const sent = await delivery.send(userID, conciergeActor(userID), sessionID, "msg", text, { wake: sendOptions.wake, ...(sendOptions.urgent ? { urgent: true } : {}) })
       return { messageID: sent.message.id, ...(sent.woke !== undefined ? { woke: sent.woke } : {}) }
-    },
+    }, { current: async (userID) => (recordingService.mayRecord(userID) ? (await conciergeIdentity.current(userID)).sessionID : undefined), wake: (userID, sessionID, fields) => recordingService.wake(userID, sessionID, fields) }),
     entitlements: C1_ENTITLEMENTS,
     users: allUsers,
     // CON-05 the notifier's journal (cursor), ledger store, watchlist view, board revision and the concierge lease.
@@ -1296,7 +1344,7 @@ export function startCentral(options: CentralOptions): Central {
       state: backends.state,
       counters: backends.counters,
       decisions,
-      acting: (conciergeActing = new Acting({ registry, directory, actions, spokes: { request: (connID, req) => spokes.request(connID, req) }, grants, acting, audit, escalate, maxPromptChars: MAX_PROMPT_CHARS, protect: conciergeProtects(conciergeTimedIdentity), conciergeActor: conciergeProtects(conciergeTimedIdentity) })),
+      acting: (conciergeActing = new Acting({ registry, directory, actions, spokes: { request: (connID, req) => spokes.request(connID, req) }, grants, acting, audit, escalate, maxPromptChars: MAX_PROMPT_CHARS, protect: conciergeProtects(conciergeTimedIdentity), conciergeActor: conciergeProtects(conciergeTimedIdentity), currentConcierge: async (userID, sessionID) => (await conciergeTimedIdentity.current(userID)).sessionID === sessionID })),
       audit,
       protects: conciergeProtects(conciergeIdentity),
       published: (userID, message) => feed.publish(userID, message),
@@ -1383,7 +1431,7 @@ export function startCentral(options: CentralOptions): Central {
     onDeposed: () => (conciergeSupervisor.stop(), conciergeParts.notifier.stop()),
   })
   void conciergeLeader.start()
-  const agentDeps = { intents, teamDiscovery, draining: drainSignal.signal, store, sessionTokens, directory, registry, spokes, delivery, decisions, feed, heartbeatMs, now, audit, grants, grantRequests, acting, actions, escalate, launches, webhooks, agentEvents, eventCursorKeys: tokenKeys, maxPromptChars: MAX_PROMPT_CHARS, profiles, workspaces, workspaceCheckpoints, teamIntake, graph: { teams: { teams: teamStore, seats: teamSeats! } }, teams: { teams: teamStore, seats: teamSeats!, staffing: teamStaffing }, artifacts: { ...(artifacts && backends.blobs ? { artifacts, blobs: backends.blobs } : {}), state: backends.state, now }, artifactHost: { caps: artifactHostCaps, ...(artifacts ? { artifacts } : {}) }, concierge: { state: backends.state, activity: conciergeActivity, results: conciergeResults, identity: conciergeTimedIdentity, protects: conciergeProtects(conciergeTimedIdentity), service: conciergeService, models: machineModels({ serviceFor: (machineID) => registry.serviceFor(machineID), reportedSessions: (connID) => registry.reportedSessions(connID), request: (connID, req) => spokes.request(connID, req) }), routes: () => conciergeParts.tiers.routes(), armed: conciergeArmed, timeZone: conciergeBoardDeps.timeZone, coverage: conciergeCoverage } }
+  const agentDeps = { recording: { call: (userID: string, sessionID: string, fields: Parameters<RecordingService["conciergeCall"]>[2]) => recordingService.conciergeCall(userID, sessionID, fields) }, intents, teamDiscovery, draining: drainSignal.signal, store, sessionTokens, directory, registry, spokes, delivery, decisions, feed, heartbeatMs, now, audit, grants, grantRequests, acting, actions, escalate, launches, webhooks, agentEvents, eventCursorKeys: tokenKeys, maxPromptChars: MAX_PROMPT_CHARS, profiles, workspaces, workspaceCheckpoints, teamIntake, graph: { teams: { teams: teamStore, seats: teamSeats! } }, teams: { teams: teamStore, seats: teamSeats!, staffing: teamStaffing }, artifacts: { ...(artifacts && backends.blobs ? { artifacts, blobs: backends.blobs } : {}), state: backends.state, now }, artifactHost: { caps: artifactHostCaps, ...(artifacts ? { artifacts } : {}) }, concierge: { state: backends.state, activity: conciergeActivity, results: conciergeResults, identity: conciergeTimedIdentity, protects: conciergeProtects(conciergeTimedIdentity), service: conciergeService, models: machineModels({ serviceFor: (machineID) => registry.serviceFor(machineID), reportedSessions: (connID) => registry.reportedSessions(connID), request: (connID, req) => spokes.request(connID, req) }), routes: () => conciergeParts.tiers.routes(), armed: conciergeArmed, timeZone: conciergeBoardDeps.timeZone, coverage: conciergeCoverage } }
   const resolveActor = createResolver({
     cookieName: COOKIE,
     findDevice: (token) => deviceOfToken(token),
@@ -1632,15 +1680,19 @@ export function startCentral(options: CentralOptions): Central {
       await store.removeDevice(device.id)
       return new Response(null, { status: 204, headers: { "set-cookie": cookie("", 0) } })
     }),
-    route("POST", "/api/transcribe", "user", ({ request, user }) => transcribe(request, speechFor(user.id))),
-    route("POST", "/api/speak", "user", async ({ request, user }) => {
+    route("POST", "/api/transcribe", "user", ({ request, user, device }) => transcribe(request, speechFor(user.id), user.id, device.id)),
+    route("POST", "/api/speak", "user", async ({ request, user, device }) => {
       const text = speakable(String((await body(request)).text ?? ""), config.maxSpeechChars)
       if (!text) return error(400, "Nothing to speak")
       const speech = speechFor(user.id)
+      // (REC-01) x-hub-recording (+ x-hub-tts-ref): tts.synth timing; best effort, the audio is never stored.
+      const tap = await recordingService.speakTap(user.id, device.id, request.headers, text.length).catch(() => undefined)
       // Passed through as the provider sends it, so the phone can start playing before synthesis ends.
       const audio = speech.speakStream ? await speech.speakStream(text, request.signal) : await speech.speak(text)
-      return new Response(audio, { headers: { "content-type": "audio/mpeg" } })
+      return new Response(tap ? tap.wrap(audio) : audio, { headers: { "content-type": "audio/mpeg" } })
     }),
+    // (REC-01) Recording routes: console only ("user": the user's cookie or device token), see docs/voice-recording.md.
+    ...recordingRoutes(recordingService, { version: options.version ?? "0.0.0", now, audit: (entry) => store.audit(entry) }).map((r) => route(r.method, r.path, "user", (context) => r.handle(context))),
     route("GET", "/api/push/key", "user", async () => Response.json({ publicKey: await push.publicKey() })),
     route("POST", "/api/push/subscribe", "user", async ({ request, device }) => {
       const input = await body(request)
@@ -1743,6 +1795,7 @@ export function startCentral(options: CentralOptions): Central {
       async ({ params }) => {
         await spokes.request(ownerOf(params.session!, "interrupt"), { op: "interrupt", sessionID: params.session! })
         registry.cancelTurns(params.session!)
+        recordingTap(params.session!, "interrupt", {})
         return new Response(null, { status: 204 })
       },
     ),
@@ -1753,11 +1806,20 @@ export function startCentral(options: CentralOptions): Central {
       return Response.json(stopped.result, { headers: NO_STORE })
     }),
     route("POST", "/api/sessions/:session/rename", "session", ({ request, params }) => rename(request, params.session!)),
+    // The hub forgets the error first; every process reporting the session that can (feature "dismissError")
+    // forgets it too, best effort: an older or offline one may seed it again, which the board ignores (StatusBoard).
+    route("POST", "/api/sessions/:session/error/dismiss", "session", async ({ params }) => {
+      const sessionID = params.session!
+      registry.dismissError(sessionID)
+      const targets = registry.sessionTargets(sessionID).filter((c) => registry.supports(c, "dismissError"))
+      await Promise.allSettled(targets.map((connID) => spokes.request(connID, { op: "dismissError", sessionID })))
+      return new Response(null, { status: 204 })
+    }),
     // Fork and revert (feature "fork"/"revert"; console only, audited): see docs/session-view.md.
     route("POST", "/api/sessions/:session/fork", "session", ({ request, params, user }) => forkSession(request, params.session!, user.id)),
     route("GET", "/api/sessions/:session/revert/preview", "session", async ({ params, url }) => {
       const messageID = messageIDInput(url.searchParams.get("messageID"))
-      const preview = await spokes.request(featureOwner(params.session!, "revert"), { op: "revertPreview", sessionID: params.session!, messageID })
+      const preview = await spokes.request(featureOwner(params.session!, "revert"), { op: "revertPreview", sessionID: params.session!, messageID }).catch(refused())
       return Response.json(preview, { headers: NO_STORE })
     }),
     route("POST", "/api/sessions/:session/revert", "session", ({ request, params, user }) => revertSession(request, params.session!, user.id)),
@@ -1816,11 +1878,18 @@ export function startCentral(options: CentralOptions): Central {
       const raw = url.searchParams.get("limit")
       const limit = raw === null ? undefined : Number(raw)
       if (limit !== undefined && (!Number.isInteger(limit) || limit < 1 || limit > 200)) return error(400, "limit must be 1–200")
-      const messages = await delivery.messages.list(user.id, { kind: "session", sessionID: params.session! }, limit === undefined ? {} : { limit })
+      const [listed, windows] = await Promise.all([
+        delivery.messages.list(user.id, { kind: "session", sessionID: params.session! }, limit === undefined ? {} : { limit }),
+        revertWindows.list(user.id, params.session!),
+      ])
+      // Rows of a history a committed revert removed stay out.
+      const messages = windows.length ? listed.filter((m) => !inRevertWindow(m.at, windows)) : listed
       return Response.json({ messages }, { headers: NO_STORE })
     }),
+    // (M1) Embedded images become placeholders here too, so a spoke that still sends them (older versions, other
+    // harnesses) never ships image bytes to the console in a tool detail.
     route("GET", "/api/sessions/:session/timeline/messages/:message/parts/:part", "session", async ({ params }) =>
-      Response.json(await spokes.request(ownerOf(params.session!), { op: "timelinePart", sessionID: params.session!, messageID: params.message!, partID: params.part! }), { headers: NO_STORE })),
+      Response.json(redactEmbeddedMedia(await spokes.request(ownerOf(params.session!), { op: "timelinePart", sessionID: params.session!, messageID: params.message!, partID: params.part! })), { headers: NO_STORE })),
     route("GET", "/api/sessions/:session/timeline/messages/:message/files/:index", "session", ({ params }) => timelineFile(params.session!, params.message!, params.index!)),
     route(
       "GET",
@@ -2163,16 +2232,26 @@ export function startCentral(options: CentralOptions): Central {
     return raw
   }
 
-  /** A spoke's refusal of a revert while the session runs, as 409 busy; anything else unchanged. */
-  function busyRefusal(cause: unknown): unknown {
-    return cause instanceof SpokeError && cause.message === REVERT_BUSY ? new HttpError(409, REVERT_BUSY, "busy") : cause
+  /**
+   * A spoke's refusal of a fork or revert op: code "busy" → 409 busy, "not_found" → 404 (failure() maps both). Older
+   * spokes send no code: their busy texts (the spoke's REVERT_BUSY, OpenCode's "Session is busy: …") and
+   * NOT_A_USER_MESSAGE are recognised instead; anything else unchanged (502).
+   */
+  function forkRevertRefusal(cause: unknown, busy = REVERT_BUSY): unknown {
+    if (!(cause instanceof SpokeError) || cause.code !== undefined) return cause
+    if (cause.message === REVERT_BUSY || /Session is busy/i.test(cause.message)) return new HttpError(409, busy, "busy")
+    if (cause.message === NOT_A_USER_MESSAGE) return new HttpError(404, NOT_A_USER_MESSAGE, "not_found")
+    return cause
+  }
+  const refused = (busy?: string) => (cause: unknown) => {
+    throw forkRevertRefusal(cause, busy)
   }
 
   /** POST …/fork {messageID}: a new session with the conversation before that user message (201). */
   async function forkSession(request: Request, sessionID: string, userID: string): Promise<Response> {
     const messageID = messageIDInput((await body(request)).messageID)
     const connID = featureOwner(sessionID, "fork")
-    const result = await spokes.request(connID, { op: "fork", sessionID, messageID })
+    const result = await spokes.request(connID, { op: "fork", sessionID, messageID }).catch(refused())
     await store.audit({ actor: userID, action: "session.fork", target: sessionID, detail: `${messageID} -> ${result.sessionID}` })
     return Response.json(result, { status: 201, headers: NO_STORE })
   }
@@ -2185,9 +2264,7 @@ export function startCentral(options: CentralOptions): Central {
     const files = input.files !== false
     const connID = featureOwner(sessionID, "revert")
     if (registry.running(sessionID)) throw new HttpError(409, REVERT_BUSY, "busy")
-    const result = await spokes.request(connID, { op: "revert", sessionID, messageID, files }).catch((cause) => {
-      throw busyRefusal(cause)
-    })
+    const result = await spokes.request(connID, { op: "revert", sessionID, messageID, files }).catch(refused())
     await store.audit({ actor: userID, action: "session.revert", target: sessionID, detail: files ? messageID : `${messageID} (messages only)` })
     return Response.json(result, { headers: NO_STORE })
   }
@@ -2195,13 +2272,18 @@ export function startCentral(options: CentralOptions): Central {
   /** POST …/revert/restore (undo) or …/revert/commit (make permanent): 204. */
   async function revertEnd(sessionID: string, userID: string, op: "revertRestore" | "revertCommit"): Promise<Response> {
     const connID = featureOwner(sessionID, "revert")
-    await spokes.request(connID, { op, sessionID }).catch((cause) => {
-      throw busyRefusal(cause)
-    })
+    if (registry.running(sessionID)) throw new HttpError(409, REVERT_END_BUSY, "busy")
+    await spokes.request(connID, { op, sessionID }).catch(refused(REVERT_END_BUSY))
     await store.audit({ actor: userID, action: op === "revertRestore" ? "session.revert.restore" : "session.revert.commit", target: sessionID })
     return new Response(null, { status: 204 })
   }
 
+  /** (REC-01) A hub event for the session's active recordings (its owner's only); never fails the route. */
+  function recordingTap(sessionID: string, kind: "interrupt" | "utterance.received" | "conversation", fields: Record<string, unknown>): void {
+    const tenant = registry.sessionTenant(sessionID)
+    if (tenant !== undefined) recordingService.hub(tenant, sessionID, kind, fields)
+  }
+
   /** Conversation mode: steer the utterance into the session (allowed while it is busy) and return at once. */
   async function utterance(request: Request, sessionID: string): Promise<Response> {
     const raw = (await body(request)).text
@@ -2211,6 +2293,7 @@ export function startCentral(options: CentralOptions): Central {
     const connID = ownerOf(sessionID, "steer")
     await humanTurn(sessionID)
     const { inboxID } = await spokes.request(connID, { op: "steer", sessionID, text })
+    recordingTap(sessionID, "utterance.received", { inboxID, text })
     registry.trackUtterance(sessionID, inboxID)
     return Response.json({ inboxID }, { status: 202 })
   }
@@ -2268,9 +2351,13 @@ export function startCentral(options: CentralOptions): Central {
     if (typeof on !== "boolean") return error(400, "Expected {on: boolean}")
     // Turning off always clears the hub's state, so a later reconnect does not switch it back on.
     if (!on) registry.setConversation(sessionID, false)
+    // (REC-01) Off ends the session's recordings (with a grace for the console's last batches); best effort.
+    const tenant = registry.sessionTenant(sessionID)
+    if (!on && tenant !== undefined) await recordingService.conversationChanged(tenant, sessionID, false).catch((cause) => console.error(`[hub] recording end failed: ${(cause as Error).message}`))
     const connID = ownerOf(sessionID)
     const { agent } = await spokes.request(connID, { op: "conversation", sessionID, on })
     if (on) registry.setConversation(sessionID, true, connID)
+    if (on && tenant !== undefined) recordingTap(sessionID, "conversation", { on: true })
     return Response.json({ on, agent })
   }
 
@@ -2360,7 +2447,7 @@ export function startCentral(options: CentralOptions): Central {
     return answered.outcome === "done" ? new Response(null, { status: 204 }) : error(409, PERMISSION_GONE, "gone")
   }
 
-  async function transcribe(request: Request, speech: Speech): Promise<Response> {
+  async function transcribe(request: Request, speech: Speech, userID: string, deviceID: string): Promise<Response> {
     const format = audioFormat(request.headers.get("content-type"))
     if (!format) return error(415, `Unsupported audio type: ${request.headers.get("content-type")}`)
     if (Number(request.headers.get("content-length") ?? 0) > config.maxAudioBytes) {
@@ -2368,7 +2455,13 @@ export function startCentral(options: CentralOptions): Central {
     }
     const audio = await boundedBytes(request, config.maxAudioBytes, "Recording too large")
     if (audio.length === 0) return error(400, "Empty recording")
-    return Response.json({ text: await speech.transcribe(audio, format) })
+    // (REC-01) With x-hub-recording + x-hub-segment: the segment is kept for the recording (no second upload).
+    const tap = await recordingService.transcribeTap(userID, deviceID, request.headers, audio, format).catch(() => undefined)
+    const started = performance.now()
+    const text = await speech.transcribe(audio, format)
+    if (!tap) return Response.json({ text })
+    const result = await tap.finish(text, Math.round(performance.now() - started)).catch(() => "failed" as const)
+    return Response.json({ text }, { headers: { [RECORDING_AUDIO_RESULT_HEADER]: result } })
   }
 
   /**
@@ -2524,6 +2617,8 @@ export function startCentral(options: CentralOptions): Central {
     for (const listener of [...listeners]) listener.end(SSE_RETRY_MS)
     drainSignal.abort()
     await connections
+    // (REC-01) The buffered hub events of recordings are written before the pod goes.
+    await recordingService.flush().catch((cause) => console.error(`[hub] recording hub events not written: ${(cause as Error).message}`))
   }
 
   /** Compressed copies of hashed assets, made once per file and encoding (they never change). */
@@ -2556,6 +2651,7 @@ export function startCentral(options: CentralOptions): Central {
       headers.set("service-worker-allowed", "/")
     } else if (type.startsWith("text/html")) {
       headers.set("cache-control", "no-cache")
+      headers.set(cspHeader(config.csp ?? "enforce"), CONSOLE_CSP)
     } else if (HASHED_ASSET.test(name)) {
       headers.set("cache-control", IMMUTABLE)
       if (COMPRESSIBLE.has(path.extname(name).toLowerCase()) && bytes.length >= MIN_COMPRESS_BYTES) {
@@ -2593,6 +2689,7 @@ export function startCentral(options: CentralOptions): Central {
     concierge: conciergeService,
     agentEventWriters,
     intentRetention,
+    recordings: recordingService,
     teams: { store: teamStore, seats: teamSeats, staffing: teamStaffing, intake: teamIntake },
     routes: [...routes.map(({ method, path, access }) => ({ method, path, access })), ...agent.routes.map(({ method, path }) => ({ method, path, access: "agent" as const }))],
     drain(drainOptions: DrainOptions = {}) {
@@ -2608,6 +2705,7 @@ export function startCentral(options: CentralOptions): Central {
       conciergeParts.tiers.stop?.()
       webhooks.stop()
       artifactMaintenance?.stop()
+      await recordingService.stop()
       profileApplier?.stop()
       agentEventWriters.stop()
       tokenPush.stop()
@@ -2642,11 +2740,15 @@ function decisionAnswer(input: Record<string, unknown>): { option?: string; text
   return { ...(typeof input.option === "string" ? { option: input.option } : {}), ...(typeof input.text === "string" ? { text: input.text } : {}), ...(input.via !== undefined ? { via: input.via as AnswerVia } : {}) }
 }
 
-/** Console envelope for a Decision failure: gone → 409 (the web app's toast), the rest by code. */
+/**
+ * Console envelope for a Decision failure: gone → 409 (the web app's toast), the rest by the agent API's code
+ * table (a revert-staged `conflict` 409, a `busy` 503 with retryAfter), never a bare 500 for a known code.
+ */
 function decisionFailure(cause: unknown): Response {
   if (!(cause instanceof AgentError)) throw cause
-  const status: Partial<Record<string, number>> = { gone: 409, not_found: 404, forbidden: 403, invalid: 400, rate_limited: 429, paused: 423, offline: 503, unsupported: 422 }
-  return Response.json({ error: cause.message, code: cause.code, ...(cause.options.hint ? { hint: cause.options.hint } : {}) }, { status: status[cause.code] ?? 500 })
+  const status = cause.code === "gone" ? 409 : AGENT_ERROR_STATUS[cause.code] ?? 500
+  const extra = cause.options.extra && typeof cause.options.extra.retryAfter === "number" ? { retryAfter: cause.options.extra.retryAfter } : {}
+  return Response.json({ error: cause.message, code: cause.code, ...(cause.options.hint ? { hint: cause.options.hint } : {}), ...extra }, { status })
 }
 
 /** Deep-link scheme of the native apps: `hubapp://link?hub=<public URL>&code=<link code>`. */
@@ -2790,6 +2892,9 @@ function failure(cause: unknown): Response {
   if (cause instanceof ValidationError) return error(400, cause.message)
   if (cause instanceof SyntaxError) return error(400, "Invalid JSON")
   if (cause instanceof SpeechError) return error(502, cause.message)
+  // A spoke's coded refusal (Res.code): busy → 409, not found → 404; anything else from a spoke is a bad gateway.
+  if (cause instanceof SpokeError && cause.code === "busy") return error(409, cause.message, "busy")
+  if (cause instanceof SpokeError && cause.code === "not_found") return error(404, cause.message, "not_found")
   if (cause instanceof SpokeError) return error(502, cause.message)
   if (cause instanceof RequestTooLargeError) return error(413, cause.message)
   if (cause instanceof OidcError) return authPage(cause.status, "Sign-in failed", cause.message)

package/src/central/profiles/content.ts

@@ -100,6 +100,22 @@ export function credentialFinding(text: string): string | undefined {
   return undefined
 }
 
+/**
+ * (REC-01) Replaces every literal credential in a text with `[redacted: <kind>]` (the CREDENTIALS table, applied
+ * globally) and lists the kinds removed, each once, in table order. Voice recordings scrub every text field with it.
+ */
+export function redactCredentials(text: string): { text: string; kinds: string[] } {
+  const kinds: string[] = []
+  let out = text
+  for (const [kind, pattern] of CREDENTIALS) {
+    const global = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`)
+    const next = out.replace(global, `[redacted: ${kind}]`)
+    if (next !== out && !kinds.includes(kind)) kinds.push(kind)
+    out = next
+  }
+  return { text: out, kinds }
+}
+
 /** Fields that would run code or install things on a machine: refused as unsupported. */
 const HOOK_FIELDS = new Set(["hooks", "hook", "setup", "install", "postinstall", "preinstall", "dependencies", "devdependencies", "requirements", "scripts"])
 const CONTENT_FIELDS = new Set(["instructions", "model", "skills", "commands"])

package/src/central/recording/clock.ts

@@ -0,0 +1,76 @@
+// REC-01 clock alignment of console events to hub time (contract: Clocks and alignment).
+// Each `clock.sync {t0, t1, hubAt}` sample gives offset = hubAt − (t0 + t1) / 2 and rtt = t1 − t0. A console event
+// at page time t gets ts = t + offset of the lowest-rtt sample within ±5 min (else the lowest-rtt sample overall):
+// piecewise, so page clock pauses (sleep) and drift are absorbed. Without samples, anchor.epoch − anchor.perf.
+import type { RecordingAnchor } from "../../protocol"
+
+export interface ClockSample {
+  readonly t0: number
+  readonly t1: number
+  readonly hubAt: number
+}
+
+export interface ClockSummary {
+  /** The best sample's offset (hub epoch ms − page ms), or the anchor's. */
+  readonly offsetMs: number
+  /** Half the worst rtt among the samples used (null: no sample, the anchor's wall clock). */
+  readonly errorMs: number | null
+  readonly samples: number
+}
+
+export interface ClockAlignment {
+  /** Aligned hub-epoch ms of a console event's page time. */
+  ts(t: number): number
+  /** For the manifest, after the events were aligned. */
+  readonly summary: ClockSummary
+}
+
+export const CLOCK_WINDOW_MS = 5 * 60_000
+
+interface Prepared {
+  readonly mid: number
+  readonly rtt: number
+  readonly offset: number
+}
+
+const round = (ms: number) => Math.round(ms * 10) / 10
+
+export function clockAlignment(samples: readonly ClockSample[], anchor: RecordingAnchor | undefined): ClockAlignment {
+  const prepared: Prepared[] = samples
+    .filter((s) => Number.isFinite(s.t0) && Number.isFinite(s.t1) && Number.isFinite(s.hubAt) && s.t1 >= s.t0)
+    .map((s) => ({ mid: (s.t0 + s.t1) / 2, rtt: s.t1 - s.t0, offset: s.hubAt - (s.t0 + s.t1) / 2 }))
+    .sort((a, b) => a.mid - b.mid)
+  const fallback = anchor ? anchor.epoch - anchor.perf : 0
+  if (!prepared.length) return { ts: (t) => round(t + fallback), summary: { offsetMs: fallback, errorMs: null, samples: 0 } }
+  const best = prepared.reduce((a, b) => (b.rtt < a.rtt ? b : a))
+  const used = new Set<Prepared>()
+  /** The first sample whose mid is ≥ value. */
+  const lowerBound = (value: number) => {
+    let lo = 0
+    let hi = prepared.length
+    while (lo < hi) {
+      const m = (lo + hi) >> 1
+      if (prepared[m]!.mid < value) lo = m + 1
+      else hi = m
+    }
+    return lo
+  }
+  const choose = (t: number): Prepared => {
+    let chosen: Prepared | undefined
+    for (let i = lowerBound(t - CLOCK_WINDOW_MS); i < prepared.length && prepared[i]!.mid <= t + CLOCK_WINDOW_MS; i++) {
+      if (!chosen || prepared[i]!.rtt < chosen.rtt) chosen = prepared[i]
+    }
+    return chosen ?? best
+  }
+  return {
+    ts: (t) => {
+      const sample = choose(t)
+      used.add(sample)
+      return round(t + sample.offset)
+    },
+    get summary() {
+      const worst = used.size ? Math.max(...[...used].map((s) => s.rtt)) : best.rtt
+      return { offsetMs: round(best.offset), errorMs: round(worst / 2), samples: prepared.length }
+    },
+  }
+}

package/src/central/recording/concierge-taps.ts

@@ -0,0 +1,104 @@
+// REC-01 Concierge taps (contract: Event schema → Hub): `concierge.tool` for every agent-route call of the user's
+// recorded Concierge session (method, route pattern, target, status, ms: never a request body, never a response),
+// and `wake.arrived` when the notifier's send to the Concierge succeeded (the rendered batch: hub-written IDs,
+// enums and counts only). Both are best effort and never change what the route or the send answers.
+import { AGENT_ERROR_STATUS, AgentError } from "../agent/errors"
+import type { AgentContext, AgentRoute } from "../agent/routes"
+
+export interface ConciergeCallFields {
+  readonly verb?: string
+  readonly method: string
+  readonly route: string
+  readonly target?: string
+  readonly status: number
+  readonly ms: number
+}
+
+export interface ConciergeCallRecorder {
+  /** A session actor's agent call (the recorder keeps it only for a recorded Concierge session). */
+  call(userID: string, sessionID: string, fields: ConciergeCallFields): void
+}
+
+/** The hub verb a route maps to: its last literal path segment (board, decisions, proposals, approve, …). */
+export function conciergeKind(path: string): string | undefined {
+  const literal = path.split("/").filter((s) => s && !s.startsWith(":"))
+  const last = literal.at(-1)
+  return last && last !== "agent" && last !== "api" ? last : undefined
+}
+
+const TARGET_PARAMS = ["addr", "id", "form", "staffing"] as const
+
+/** Wraps every route: session-actor calls are reported to the recorder after they answer (or throw). */
+export function recordConciergeCalls(routes: readonly AgentRoute[], recorder: ConciergeCallRecorder, now: () => number = Date.now): AgentRoute[] {
+  return routes.map((route) => ({
+    ...route,
+    handle: async (context: AgentContext) => {
+      if (context.actor.kind !== "session") return route.handle(context)
+      const started = now()
+      let status = 500
+      try {
+        const response = await route.handle(context)
+        status = response.status
+        return response
+      } catch (cause) {
+        status = cause instanceof AgentError ? (AGENT_ERROR_STATUS[cause.code] ?? 500) : 500
+        throw cause
+      } finally {
+        try {
+          const target = TARGET_PARAMS.map((p) => context.params[p]).find((v) => typeof v === "string" && v.length > 0)
+          const verb = conciergeKind(route.path)
+          recorder.call(context.user.id, (context.actor as { sessionID: string }).sessionID, {
+            ...(verb ? { verb } : {}),
+            method: route.method,
+            route: route.path,
+            ...(target ? { target: target.slice(0, 300) } : {}),
+            status,
+            ms: now() - started,
+          })
+        } catch {
+          // best effort
+        }
+      }
+    },
+  }))
+}
+
+export interface ConciergeBatchFacts {
+  readonly id: string
+  readonly kind: string
+  readonly budget?: string
+  readonly lines: number
+}
+
+export type ConciergeSend = (userID: string, text: string, options: { readonly wake: boolean; readonly urgent?: boolean; readonly batch?: ConciergeBatchFacts }) => Promise<{ readonly messageID: string; readonly woke?: boolean }>
+
+export interface WakeRecorder {
+  /** The user's current Concierge session (the send's recipient). */
+  current(userID: string): Promise<string | undefined>
+  wake(userID: string, sessionID: string, fields: Record<string, unknown>): void
+}
+
+/** The batch facts from the rendered text when the sender did not pass them ("Concierge update b7 …"). */
+function factsOf(text: string): ConciergeBatchFacts {
+  const head = text.split("\n", 1)[0] ?? ""
+  const id = /\bb(\d+)\b/.exec(head)?.[0] ?? "b?"
+  const kind = head.startsWith("Concierge digest") ? "digest" : head.includes("quiet hours ended") ? "release" : head.includes("changes were missed") ? "snapshot" : "update"
+  return { id, kind, lines: Math.max(0, text.split("\n").length - 2) }
+}
+
+/** Wraps the Concierge ports' send: a successful send is recorded as wake.arrived (a refused one is not). */
+export function wrapConciergeSend(send: ConciergeSend, recorder: WakeRecorder): ConciergeSend {
+  return async (userID, text, options) => {
+    const result = await send(userID, text, options)
+    try {
+      const sessionID = await recorder.current(userID)
+      if (sessionID !== undefined) {
+        const facts = options.batch ?? factsOf(text)
+        recorder.wake(userID, sessionID, { batchID: facts.id, batchKind: facts.kind, ...(facts.budget !== undefined ? { budget: facts.budget } : {}), wake: options.wake, lines: facts.lines, text })
+      }
+    } catch {
+      // best effort: the send succeeded either way
+    }
+    return result
+  }
+}