@huynle/hub 0.8.2 → 0.8.3

package/src/central/concierge/board-render.ts

@@ -19,7 +19,11 @@
 // Lines and the total are cut on code point boundaries, and a cut inside a frame still closes it ("…»").
 // The total is at most CONCIERGE_BOARD_LIMITS.renderedChars: overflow drops session lines from the lowest priority
 // (the end of watchlist order) up, then Decision lines from the oldest, and says how many lines were dropped.
+// (V-01b verify) IDs are rendered only when they match their kind's pattern (ses_[A-Za-z0-9]+, dec_[A-Za-z0-9]+,
+// blocker IDs): a session or Decision with any other ID loses its line, other bad IDs leave their list. Lone
+// surrogates are removed from all of the text.
 import { CONCIERGE_BOARD_LIMITS, INTENT_MAX, type ConciergeBoard, type ConciergeBoardDecision, type ConciergeBoardSection, type ConciergeBoardSession } from "../../../packages/protocol/src/concierge"
+import { isHubSessionID } from "../../../packages/protocol/src/harness-events"
 import { sanitizeLabel } from "../agent/envelope"
 
 const MIN = 60_000
@@ -44,11 +48,24 @@ export interface RenderOptions {
  */
 const HIDDEN = /[\u00ad\u115f\u1160\u180e\u3164\uffa0\u{e0000}-\u{e007f}]/gu
 
-/** Board text: hidden characters dropped, then sanitised (sanitizeLabel), one line, at most `max` code points. */
+/** (V-01b verify) Lone surrogates (paired ones are one code point under the u flag): a strict provider rejects them. */
+const LONE_SURROGATE = /[\ud800-\udfff]/gu
+
+/** Board text: hidden characters and lone surrogates dropped, then sanitised (sanitizeLabel), one line, at most `max` code points. */
 export function boardText(text: string, max: number): string {
-  return sanitizeLabel(text.replace(HIDDEN, ""), max)
+  return sanitizeLabel(text.replace(HIDDEN, "").replace(LONE_SURROGATE, ""), max)
 }
 
+/**
+ * (V-01b verify) Hub and harness IDs by kind (like the notifier's): an ID that does not match its kind's pattern is
+ * never rendered (its line, list entry or blocker is dropped), so no ID can carry a line break or text of its own.
+ */
+const DECISION_ID = /^dec_[A-Za-z0-9]{1,64}$/
+/** Harness blocker IDs (OpenCode per_…, Codex per_<connection>_n…): the board builder's own pattern (board.ts). */
+const BLOCKER_ID = /^[A-Za-z0-9_-]{1,64}$/
+const isDecisionID = (id: unknown): id is string => typeof id === "string" && DECISION_ID.test(id)
+const isBlockerID = (id: unknown): id is string => typeof id === "string" && BLOCKER_ID.test(id)
+
 /** Untrusted text: board text, guillemets neutralised, cut to `max` characters (code points), framed in «…». */
 export function frame(text: string, max: number): string {
   const chars = Array.from(boardText(text, Number.MAX_SAFE_INTEGER).replace(/«/g, "‹").replace(/»/g, "›"))
@@ -118,10 +135,11 @@ function sessionLine(s: ConciergeBoardSession, at: number): string {
   if (!s.blockers.reported) parts.push("blockers not reported")
   else if (s.blockers.count > 0) {
     // (CON-13) Each pending permission with the hub's inGrant (never the model's call), each form by its ID.
-    const pending = (s.blockers.pending ?? []).map((b) => (b.kind === "permission" ? `permission ${b.id} ${sanitizeLabel(b.action, 40)}: inGrant=${b.inGrant ? "yes" : "no"} auto=${b.auto ? "yes" : "no"}` : `form ${b.id}`))
+    const pending = (s.blockers.pending ?? []).filter((b) => isBlockerID(b.id)).map((b) => (b.kind === "permission" ? `permission ${b.id} ${sanitizeLabel(b.action, 40)}: inGrant=${b.inGrant ? "yes" : "no"} auto=${b.auto ? "yes" : "no"}` : `form ${b.id}`))
     parts.push(`blockers ${s.blockers.count}${s.blockers.kinds.length ? `: ${s.blockers.kinds.map((k) => sanitizeLabel(k, 40)).join(", ")}` : ""}${pending.length ? ` (${pending.join("; ")})` : ""}`)
   }
-  if (s.decisions.length) parts.push(`decisions ${s.decisions.join(", ")}`)
+  const decisions = s.decisions.filter(isDecisionID)
+  if (decisions.length) parts.push(`decisions ${decisions.join(", ")}`)
   if (s.lastResult) parts.push(`last ${s.lastResult.outcome} ${span(at - s.lastResult.at)} ago`)
   if (s.intent) parts.push(`intent (${s.intent.source}) ${frame(s.intent.text, INTENT_MAX)}`)
   // (CON-11) "no intent": the title shows only because no intent is set (one the user cleared reads the same).
@@ -131,7 +149,8 @@ function sessionLine(s: ConciergeBoardSession, at: number): string {
 }
 
 function decisionLine(d: ConciergeBoardDecision, at: number): string {
-  const parts = [`${d.id} from ${frame(d.from, LABEL_CHARS)}${d.about.length ? ` about ${d.about.join(", ")}` : ""}`, `urgency ${d.urgency}`, `tier ${d.tier}`, `asked ${span(at - d.at)} ago`]
+  const about = d.about.filter(isHubSessionID)
+  const parts = [`${d.id} from ${frame(d.from, LABEL_CHARS)}${about.length ? ` about ${about.join(", ")}` : ""}`, `urgency ${d.urgency}`, `tier ${d.tier}`, `asked ${span(at - d.at)} ago`]
   if (d.deadline !== undefined) parts.push(d.deadline >= at ? `deadline in ${span(d.deadline - at)}` : `deadline passed ${span(at - d.deadline)} ago`)
   if (d.armed) parts.push("armed")
   return cutLine(`- ${parts.join(" · ")}`)
@@ -152,20 +171,24 @@ export function renderBoard(board: ConciergeBoard, options: RenderOptions = {}):
   const { counts } = board
   if (board.sessions.status !== "ok") sessionsHead = `Sessions: ${unavailable(board.sessions)}`
   else {
-    const shown = board.sessions.items.length
+    const items = board.sessions.items.filter((s) => isHubSessionID(s.sessionID))
+    const shown = items.length
     const total = Math.max(counts.watched, shown)
     sessionsHead = `Sessions (${total} watched${total > shown ? `, ${shown} shown` : ""}):${shown === 0 ? " none" : ""}`
-    sessionLines = board.sessions.items.map((s) => sessionLine(s, board.at))
+    sessionLines = items.map((s) => sessionLine(s, board.at))
     if (total > shown) sessionTail.push(`(${total - shown} more watched sessions not shown)`)
   }
 
   let decisionsHead: string
   let decisionLines: string[] = []
   if (board.decisions.status !== "ok") decisionsHead = `Open decisions: ${unavailable(board.decisions)}`
-  else if (board.decisions.items.length === 0) decisionsHead = "Open decisions: none"
   else {
-    decisionsHead = `Open decisions (${Math.max(counts.openDecisions, board.decisions.items.length)}):`
-    decisionLines = board.decisions.items.map((d) => decisionLine(d, board.at))
+    const items = board.decisions.items.filter((d) => isDecisionID(d.id))
+    if (items.length === 0) decisionsHead = "Open decisions: none"
+    else {
+      decisionsHead = `Open decisions (${Math.max(counts.openDecisions, items.length)}):`
+      decisionLines = items.map((d) => decisionLine(d, board.at))
+    }
   }
 
   const machines =
@@ -186,5 +209,5 @@ export function renderBoard(board: ConciergeBoard, options: RenderOptions = {}):
     dropped++
     text = compose(dropped)
   }
-  return cutUnits(text, max)
+  return cutUnits(text, max).replace(LONE_SURROGATE, "")
 }

package/src/central/concierge/index.ts

@@ -23,7 +23,7 @@ export interface ConciergePorts {
    * Sends a message to the user's current Concierge session as app:concierge (Delivery.send; the inbound rule admits
    * it). Throws not_found when there is no current session.
    */
-  readonly send: (userID: string, text: string, options: { readonly wake: boolean; readonly urgent?: boolean }) => Promise<{ readonly messageID: string; readonly woke?: boolean }>
+  readonly send: (userID: string, text: string, options: { readonly wake: boolean; readonly urgent?: boolean; readonly batch?: { readonly id: string; readonly kind: string; readonly budget?: string; readonly lines: number } }) => Promise<{ readonly messageID: string; readonly woke?: boolean }>
   readonly entitlements: ConciergeEntitlements
   /** Every user of the hub (leader loops). */
   readonly users: () => Promise<Iterable<string>>

package/src/central/concierge/notifier.ts

@@ -937,7 +937,8 @@ export class ConciergeNotifierImpl implements ConciergeNotifier {
     try {
       if (!this.leading()) return
       // Queued, never steered: no `urgent`.
-      result = await this.within(this.ports.send(userID, text, { wake: batch.wake }), this.limits.sendTimeoutMs)
+      // (REC-01) The batch's facts ride along for a recording of the Concierge (wake.arrived): IDs, enums, counts.
+      result = await this.within(this.ports.send(userID, text, { wake: batch.wake, batch: { id: `b${batch.seq}`, kind: batch.kind, budget: batch.budget, lines: batch.lines.length } }), this.limits.sendTimeoutMs)
     } catch (cause) {
       failure = cause instanceof AgentError && REFUSED.has(cause.code) ? "refused" : "uncertain"
       this.log(`[hub] concierge notifier: ${batch.id} attempt ${batch.attempts} ${failure}: ${(cause as Error).message}`)

package/src/central/config.ts

@@ -9,6 +9,7 @@ import { isLoopbackHost } from "../loopback"
 import { formatPattern, parsePattern } from "./agent/policy"
 import { APP_DIR, configBase, legacyPaths, migrateFirst, migrateStateDir, resolveHubStateDir, stateLegacyPaths } from "../migrate"
 import { updateSpeech, type StoredSpeech } from "./speech/settings"
+import { cspMode, type CspMode } from "./csp"
 
 export const GOOGLE_ISSUER = "https://accounts.google.com"
 
@@ -57,6 +58,8 @@ export interface CentralConfig {
   readonly turnTimeoutMs: number
   /** VAPID subject (mailto: or https: URL) sent to push services. */
   readonly vapidSubject: string
+  /** The console's Content-Security-Policy: enforced, or (HUB_CSP=report-only) only reported (./csp.ts). */
+  readonly csp?: CspMode
   /** Speech settings from hub.json (below the phone's saved settings, above the env). */
   readonly speech?: StoredSpeech
   readonly auth: AuthConfig
@@ -486,6 +489,7 @@ export function centralConfig(rawEnv: Env = process.env, home: string = homedir(
     turnTimeoutMs: int(env.HUB_TURN_TIMEOUT_MS, 600_000),
     // Push services want a contact: an https URL or mailto. The public URL works for hosted hubs.
     vapidSubject: env.HUB_VAPID_SUBJECT || (publicURL.startsWith("https://") ? publicURL : "mailto:hub@localhost"),
+    csp: cspMode(env.HUB_CSP),
     ...(file.speech ? { speech: file.speech } : {}),
     auth,
     agentsNever: [...(file.agents?.never ?? [])],

package/src/central/csp.ts

@@ -0,0 +1,55 @@
+// The console's Content-Security-Policy (CSP-01), sent with the console HTML (src/central/http.ts staticFile; the
+// mock hub test/web-mock-hub.ts sends the same). Nothing inline, no eval, every source the hub's own origin:
+//   - scripts and styles come only from the built bundle (web/dist: hashed assets, /theme-boot.js); the console has
+//     no inline <script>, <style> or style="…" (Solid's style objects set CSSOM properties, which CSP allows), and the
+//     <style> that 3d-force-graph would inject is stripped at build time (web/vite.config.ts, stripStyleInject);
+//   - images may be data: (attachments in a transcript) or blob: (pasted images, artifact previews);
+//   - media may be blob: (Voice's whole-clip and MediaSource playback, the screen-off silence loop);
+//   - connect-src 'self' covers fetch, the SSE stream and same-origin WebSockets (CSP3: 'self' matches ws/wss);
+//   - frames only from this origin: the isolated artifact host (/artifact-host/v1/…, docs/artifact-host.md), which
+//     sends its own sandboxing policy; nothing may frame the console (frame-ancestors 'none');
+//   - the Silero VAD worker is a same-origin module script; its .wasm compiles in the worker, under the worker's own
+//     (absent) policy, so script-src needs no 'wasm-unsafe-eval';
+//   - forms submit only here (the console's forms are handled in script; OIDC sign-in is a navigation, not a form).
+// HUB_CSP=report-only sends the same policy as Content-Security-Policy-Report-Only (violations are only logged in
+// the browser's console): an escape hatch for a deployment that hits a violation, not a way to turn it off.
+export type CspMode = "enforce" | "report-only"
+
+const DIRECTIVES: ReadonlyArray<readonly [string, string]> = [
+  ["default-src", "'self'"],
+  ["script-src", "'self'"],
+  ["style-src", "'self'"],
+  ["img-src", "'self' data: blob:"],
+  ["media-src", "'self' blob:"],
+  ["font-src", "'self'"],
+  ["connect-src", "'self'"],
+  ["worker-src", "'self'"],
+  ["manifest-src", "'self'"],
+  ["frame-src", "'self'"],
+  ["frame-ancestors", "'none'"],
+  ["base-uri", "'none'"],
+  ["form-action", "'self'"],
+  ["object-src", "'none'"],
+]
+
+export const CONSOLE_CSP = DIRECTIVES.map(([name, sources]) => `${name} ${sources}`).join("; ")
+
+/** HUB_CSP: unset or "enforce" → enforce; "report-only" → report only. Anything else is a configuration error. */
+export function cspMode(value: string | undefined): CspMode {
+  const mode = value?.trim().toLowerCase() || "enforce"
+  if (mode === "enforce" || mode === "report-only") return mode
+  throw new Error(`HUB_CSP must be "enforce" or "report-only", got ${JSON.stringify(value)}`)
+}
+
+/** The header that carries the console policy in this mode. */
+export const cspHeader = (mode: CspMode): string => (mode === "report-only" ? "content-security-policy-report-only" : "content-security-policy")
+
+/** A policy as directive → sources (tests, the e2e checks). */
+export function parseCsp(policy: string): Record<string, string[]> {
+  const out: Record<string, string[]> = {}
+  for (const part of policy.split(";")) {
+    const [name, ...sources] = part.trim().split(/\s+/)
+    if (name) out[name.toLowerCase()] = sources
+  }
+  return out
+}

package/src/central/http.ts

@@ -8,7 +8,7 @@ import { diskAssets, type WebAssets } from "./assets"
 import path from "node:path"
 import { promisify } from "node:util"
 import { brotliCompress, constants as zlib, gzip } from "node:zlib"
-import { formAnswerProblem, NOT_A_USER_MESSAGE, REVERT_BUSY, REVERT_END_BUSY, PROMPT_IMAGE_MIMES, WORKSPACE_LIMITS, promptImagesProblem, redactEmbeddedMedia, type AvailableModel, type CoreOp, type EnrollStart, type FormAnswer, type ModelSelection, type PermissionDecision, type PromptImage } from "../protocol"
+import { formAnswerProblem, NOT_A_USER_MESSAGE, RECORDING_AUDIO_RESULT_HEADER, REVERT_BUSY, REVERT_END_BUSY, PROMPT_IMAGE_MIMES, WORKSPACE_LIMITS, promptImagesProblem, redactEmbeddedMedia, type AvailableModel, type CoreOp, type EnrollStart, type FormAnswer, type ModelSelection, type PermissionDecision, type PromptImage } from "../protocol"
 import { isLoopbackAddress, isLoopbackHost, isLoopbackURL, loopbackOrigins } from "../loopback"
 import { speakable } from "../speakable"
 import { Auth, RateLimitError, ValidationError } from "./auth"
@@ -71,9 +71,14 @@ import { CheckpointStore, journalCursors } from "./workspaces/checkpoints"
 import { coordinatorActor, SupervisorCoordinator } from "./workspaces/coordinator"
 import { artifactJournalEvent } from "./artifacts/events"
 import { ArtifactMaintenance } from "./artifacts/maintenance"
+import { MemoryBlobStore } from "./backend/memory-blobs"
+import { RecordingService } from "./recording"
+import { recordingRoutes } from "./recording/routes"
+import { wrapConciergeSend } from "./recording/concierge-taps"
 import { ARTIFACT_UPLOAD_LIMITS } from "./artifacts/routes"
 import { ArtifactStore } from "./artifacts/store"
 import { artifactHost, isArtifactHostPath } from "./artifacts/host"
+import { CONSOLE_CSP, cspHeader } from "./csp"
 import { ArtifactHostCaps } from "./artifacts/host-caps"
 import { artifactWorkspacesFromState } from "./artifacts/workspaces"
 import { teamDeniedEvent, TeamPolicy } from "./teams/policy"
@@ -196,6 +201,8 @@ export interface Central {
   readonly agentEventWriters: EventWriters
   /** (CON-02) Session intent retention (its leader runs it every 6 h; tests run a pass with runOnce). */
   readonly intentRetention: IntentRetention
+  /** (REC-01) Voice & Concierge recordings (developer): the owner-only store, taps, export and retention. */
+  readonly recordings: RecordingService
   /** The JSON API's route table (method, path, access), for audits and tests. */
   readonly routes: readonly RouteInfo[]
   /** Teams (HWA-33..37): definitions, seats (the delivery policy's) and staffing; HWA-37 routes reuse these. */
@@ -829,6 +836,8 @@ export function startCentral(options: CentralOptions): Central {
   const feed = new MessageFeed()
   // Cluster mode: messages stored on any pod reach this pod's listeners (ask waiters, agent watches).
   if (config.cluster) feed.attach({ bus: backends.bus, podID: config.cluster.podID }).catch((cause) => console.error(`[hub] message feed did not attach: ${(cause as Error).message}`))
+  /** (REC-01) The recording service (set below, once its ports exist); the Decision hook reads it late. */
+  let recordings: RecordingService | undefined
   /** (CON-06) The Concierge tiers (set below, once the Concierge modules exist): proposals' act, via, disarm. */
   let conciergeTierHooks: ConciergeTiers | undefined
   // Decisions (design §12.1): asks to @me; deadlines run over every user's Decisions (survive restarts).
@@ -842,6 +851,8 @@ export function startCentral(options: CentralOptions): Central {
     changed: (userID, decision) => {
       broadcast({ type: "decision", decision }, { tenant: userID })
       conciergeTierHooks?.decisionChanged?.(userID, decision)
+      // (REC-01) decision.opened / decision.answered of a recorded session (best effort).
+      recordings?.decisionChanged(userID, decision)
     },
     // Escalations' Decisions reply to the permission as the user; grant requests' create the grant as the user;
     // (CON-06) Concierge proposals run their verb as the user (all set up below).
@@ -1082,6 +1093,34 @@ export function startCentral(options: CentralOptions): Central {
   // Every stored agent message also goes to the user's console streams (live transcript rows).
   feed.subscribe((userID, message) => broadcast({ type: "message", message }, { tenant: userID }), { origin: true })
   const audit = new AgentAudit({ state: backends.state, now, admin: store, recorded: (userID, entry) => broadcast({ type: "agent", entry }, { tenant: userID }), concierge: (userID, sessionID) => isConciergeSession(conciergeTimedIdentity, userID, sessionID) })
+  // (REC-01) Voice & Concierge recordings (docs/voice-recording.md): records in the StateStore, bytes in the BlobStore
+  // under the tenant rec~<userID> (never the artifact tenant: artifact recovery would delete them); the retention sweep
+  // runs on the voice-recordings leader. SSE `recording` messages go to the user's own devices only.
+  const recordingService = new RecordingService({
+    state: backends.state,
+    blobs: backends.blobs ?? new MemoryBlobStore({ now }),
+    bus: backends.bus,
+    now,
+    ...(config.cluster ? { podID: config.cluster.podID } : {}),
+    version: options.version ?? "0.0.0",
+    owns: (userID, sessionID) => registry.owns(userID, sessionID),
+    sessionTitle: (sessionID) => registry.session(sessionID)?.title,
+    conversation: (sessionID) => registry.conversation(sessionID),
+    isConcierge: (userID, sessionID) => isConciergeSession(conciergeTimedIdentity, userID, sessionID),
+    speech: (userID) => {
+      const view = speechSettings.view(speechScope(userID)) as unknown as { stt?: Record<string, unknown>; tts?: Record<string, unknown> }
+      const pick = (o: Record<string, unknown> | undefined, keys: readonly string[]) => (o ? Object.fromEntries(keys.filter((k) => typeof o[k] === "string").map((k) => [k, (o[k] as string).slice(0, 120)])) : undefined)
+      return { ...(view.stt ? { stt: pick(view.stt, ["provider", "model"]) } : {}), ...(view.tts ? { tts: pick(view.tts, ["provider", "model", "voice"]) } : {}) }
+    },
+    notify: (userID, message, exceptDevice) => toUser(userID, message, exceptDevice),
+    audit: (entry) => store.audit(entry),
+    users: allUsers,
+    log: (message) => console.error(message),
+  })
+  recordings = recordingService
+  registry.recordingTap = recordingService.registryTap
+  registry.onSessionDeleted((sessionID, tenant) => void recordingService.sessionDeleted(tenant, sessionID).catch((cause) => console.error(`[hub] recording session end failed: ${(cause as Error).message}`)))
+  void leader("voice-recordings", { onElected: () => recordingService.retention.start(), onDeposed: () => recordingService.retention.stop() }).start()
   const grants = new Grants({ state: backends.state, counters: backends.counters, directory, store, admin: store, now, concierge: async (owner) => (await conciergeIdentity.current(owner)).hiddenSessionIDs })
   const acting = new ActingSwitch({ store, never: config.agentsNever, audit })
   /** An agent as envelopes name it (a session by its directory name). */
@@ -1276,12 +1315,13 @@ export function startCentral(options: CentralOptions): Central {
       const { sessionID } = await conciergeIdentity.current(userID)
       return sessionID !== undefined ? conciergeContext.beforeWake(userID, sessionID) : false
     },
-    send: async (userID, text, sendOptions) => {
+    // (REC-01) A successful send is recorded as wake.arrived in a recording of the Concierge session.
+    send: wrapConciergeSend(async (userID, text, sendOptions) => {
       const { sessionID } = await conciergeIdentity.current(userID)
       if (sessionID === undefined) throw new AgentError("not_found", "The Concierge is not running")
       const sent = await delivery.send(userID, conciergeActor(userID), sessionID, "msg", text, { wake: sendOptions.wake, ...(sendOptions.urgent ? { urgent: true } : {}) })
       return { messageID: sent.message.id, ...(sent.woke !== undefined ? { woke: sent.woke } : {}) }
-    },
+    }, { current: async (userID) => (recordingService.mayRecord(userID) ? (await conciergeIdentity.current(userID)).sessionID : undefined), wake: (userID, sessionID, fields) => recordingService.wake(userID, sessionID, fields) }),
     entitlements: C1_ENTITLEMENTS,
     users: allUsers,
     // CON-05 the notifier's journal (cursor), ledger store, watchlist view, board revision and the concierge lease.
@@ -1391,7 +1431,7 @@ export function startCentral(options: CentralOptions): Central {
     onDeposed: () => (conciergeSupervisor.stop(), conciergeParts.notifier.stop()),
   })
   void conciergeLeader.start()
-  const agentDeps = { intents, teamDiscovery, draining: drainSignal.signal, store, sessionTokens, directory, registry, spokes, delivery, decisions, feed, heartbeatMs, now, audit, grants, grantRequests, acting, actions, escalate, launches, webhooks, agentEvents, eventCursorKeys: tokenKeys, maxPromptChars: MAX_PROMPT_CHARS, profiles, workspaces, workspaceCheckpoints, teamIntake, graph: { teams: { teams: teamStore, seats: teamSeats! } }, teams: { teams: teamStore, seats: teamSeats!, staffing: teamStaffing }, artifacts: { ...(artifacts && backends.blobs ? { artifacts, blobs: backends.blobs } : {}), state: backends.state, now }, artifactHost: { caps: artifactHostCaps, ...(artifacts ? { artifacts } : {}) }, concierge: { state: backends.state, activity: conciergeActivity, results: conciergeResults, identity: conciergeTimedIdentity, protects: conciergeProtects(conciergeTimedIdentity), service: conciergeService, models: machineModels({ serviceFor: (machineID) => registry.serviceFor(machineID), reportedSessions: (connID) => registry.reportedSessions(connID), request: (connID, req) => spokes.request(connID, req) }), routes: () => conciergeParts.tiers.routes(), armed: conciergeArmed, timeZone: conciergeBoardDeps.timeZone, coverage: conciergeCoverage } }
+  const agentDeps = { recording: { call: (userID: string, sessionID: string, fields: Parameters<RecordingService["conciergeCall"]>[2]) => recordingService.conciergeCall(userID, sessionID, fields) }, intents, teamDiscovery, draining: drainSignal.signal, store, sessionTokens, directory, registry, spokes, delivery, decisions, feed, heartbeatMs, now, audit, grants, grantRequests, acting, actions, escalate, launches, webhooks, agentEvents, eventCursorKeys: tokenKeys, maxPromptChars: MAX_PROMPT_CHARS, profiles, workspaces, workspaceCheckpoints, teamIntake, graph: { teams: { teams: teamStore, seats: teamSeats! } }, teams: { teams: teamStore, seats: teamSeats!, staffing: teamStaffing }, artifacts: { ...(artifacts && backends.blobs ? { artifacts, blobs: backends.blobs } : {}), state: backends.state, now }, artifactHost: { caps: artifactHostCaps, ...(artifacts ? { artifacts } : {}) }, concierge: { state: backends.state, activity: conciergeActivity, results: conciergeResults, identity: conciergeTimedIdentity, protects: conciergeProtects(conciergeTimedIdentity), service: conciergeService, models: machineModels({ serviceFor: (machineID) => registry.serviceFor(machineID), reportedSessions: (connID) => registry.reportedSessions(connID), request: (connID, req) => spokes.request(connID, req) }), routes: () => conciergeParts.tiers.routes(), armed: conciergeArmed, timeZone: conciergeBoardDeps.timeZone, coverage: conciergeCoverage } }
   const resolveActor = createResolver({
     cookieName: COOKIE,
     findDevice: (token) => deviceOfToken(token),
@@ -1640,15 +1680,19 @@ export function startCentral(options: CentralOptions): Central {
       await store.removeDevice(device.id)
       return new Response(null, { status: 204, headers: { "set-cookie": cookie("", 0) } })
     }),
-    route("POST", "/api/transcribe", "user", ({ request, user }) => transcribe(request, speechFor(user.id))),
-    route("POST", "/api/speak", "user", async ({ request, user }) => {
+    route("POST", "/api/transcribe", "user", ({ request, user, device }) => transcribe(request, speechFor(user.id), user.id, device.id)),
+    route("POST", "/api/speak", "user", async ({ request, user, device }) => {
       const text = speakable(String((await body(request)).text ?? ""), config.maxSpeechChars)
       if (!text) return error(400, "Nothing to speak")
       const speech = speechFor(user.id)
+      // (REC-01) x-hub-recording (+ x-hub-tts-ref): tts.synth timing; best effort, the audio is never stored.
+      const tap = await recordingService.speakTap(user.id, device.id, request.headers, text.length).catch(() => undefined)
       // Passed through as the provider sends it, so the phone can start playing before synthesis ends.
       const audio = speech.speakStream ? await speech.speakStream(text, request.signal) : await speech.speak(text)
-      return new Response(audio, { headers: { "content-type": "audio/mpeg" } })
+      return new Response(tap ? tap.wrap(audio) : audio, { headers: { "content-type": "audio/mpeg" } })
     }),
+    // (REC-01) Recording routes: console only ("user": the user's cookie or device token), see docs/voice-recording.md.
+    ...recordingRoutes(recordingService, { version: options.version ?? "0.0.0", now, audit: (entry) => store.audit(entry) }).map((r) => route(r.method, r.path, "user", (context) => r.handle(context))),
     route("GET", "/api/push/key", "user", async () => Response.json({ publicKey: await push.publicKey() })),
     route("POST", "/api/push/subscribe", "user", async ({ request, device }) => {
       const input = await body(request)
@@ -1751,6 +1795,7 @@ export function startCentral(options: CentralOptions): Central {
       async ({ params }) => {
         await spokes.request(ownerOf(params.session!, "interrupt"), { op: "interrupt", sessionID: params.session! })
         registry.cancelTurns(params.session!)
+        recordingTap(params.session!, "interrupt", {})
         return new Response(null, { status: 204 })
       },
     ),
@@ -1761,6 +1806,15 @@ export function startCentral(options: CentralOptions): Central {
       return Response.json(stopped.result, { headers: NO_STORE })
     }),
     route("POST", "/api/sessions/:session/rename", "session", ({ request, params }) => rename(request, params.session!)),
+    // The hub forgets the error first; every process reporting the session that can (feature "dismissError")
+    // forgets it too, best effort: an older or offline one may seed it again, which the board ignores (StatusBoard).
+    route("POST", "/api/sessions/:session/error/dismiss", "session", async ({ params }) => {
+      const sessionID = params.session!
+      registry.dismissError(sessionID)
+      const targets = registry.sessionTargets(sessionID).filter((c) => registry.supports(c, "dismissError"))
+      await Promise.allSettled(targets.map((connID) => spokes.request(connID, { op: "dismissError", sessionID })))
+      return new Response(null, { status: 204 })
+    }),
     // Fork and revert (feature "fork"/"revert"; console only, audited): see docs/session-view.md.
     route("POST", "/api/sessions/:session/fork", "session", ({ request, params, user }) => forkSession(request, params.session!, user.id)),
     route("GET", "/api/sessions/:session/revert/preview", "session", async ({ params, url }) => {
@@ -2224,6 +2278,12 @@ export function startCentral(options: CentralOptions): Central {
     return new Response(null, { status: 204 })
   }
 
+  /** (REC-01) A hub event for the session's active recordings (its owner's only); never fails the route. */
+  function recordingTap(sessionID: string, kind: "interrupt" | "utterance.received" | "conversation", fields: Record<string, unknown>): void {
+    const tenant = registry.sessionTenant(sessionID)
+    if (tenant !== undefined) recordingService.hub(tenant, sessionID, kind, fields)
+  }
+
   /** Conversation mode: steer the utterance into the session (allowed while it is busy) and return at once. */
   async function utterance(request: Request, sessionID: string): Promise<Response> {
     const raw = (await body(request)).text
@@ -2233,6 +2293,7 @@ export function startCentral(options: CentralOptions): Central {
     const connID = ownerOf(sessionID, "steer")
     await humanTurn(sessionID)
     const { inboxID } = await spokes.request(connID, { op: "steer", sessionID, text })
+    recordingTap(sessionID, "utterance.received", { inboxID, text })
     registry.trackUtterance(sessionID, inboxID)
     return Response.json({ inboxID }, { status: 202 })
   }
@@ -2290,9 +2351,13 @@ export function startCentral(options: CentralOptions): Central {
     if (typeof on !== "boolean") return error(400, "Expected {on: boolean}")
     // Turning off always clears the hub's state, so a later reconnect does not switch it back on.
     if (!on) registry.setConversation(sessionID, false)
+    // (REC-01) Off ends the session's recordings (with a grace for the console's last batches); best effort.
+    const tenant = registry.sessionTenant(sessionID)
+    if (!on && tenant !== undefined) await recordingService.conversationChanged(tenant, sessionID, false).catch((cause) => console.error(`[hub] recording end failed: ${(cause as Error).message}`))
     const connID = ownerOf(sessionID)
     const { agent } = await spokes.request(connID, { op: "conversation", sessionID, on })
     if (on) registry.setConversation(sessionID, true, connID)
+    if (on && tenant !== undefined) recordingTap(sessionID, "conversation", { on: true })
     return Response.json({ on, agent })
   }
 
@@ -2382,7 +2447,7 @@ export function startCentral(options: CentralOptions): Central {
     return answered.outcome === "done" ? new Response(null, { status: 204 }) : error(409, PERMISSION_GONE, "gone")
   }
 
-  async function transcribe(request: Request, speech: Speech): Promise<Response> {
+  async function transcribe(request: Request, speech: Speech, userID: string, deviceID: string): Promise<Response> {
     const format = audioFormat(request.headers.get("content-type"))
     if (!format) return error(415, `Unsupported audio type: ${request.headers.get("content-type")}`)
     if (Number(request.headers.get("content-length") ?? 0) > config.maxAudioBytes) {
@@ -2390,7 +2455,13 @@ export function startCentral(options: CentralOptions): Central {
     }
     const audio = await boundedBytes(request, config.maxAudioBytes, "Recording too large")
     if (audio.length === 0) return error(400, "Empty recording")
-    return Response.json({ text: await speech.transcribe(audio, format) })
+    // (REC-01) With x-hub-recording + x-hub-segment: the segment is kept for the recording (no second upload).
+    const tap = await recordingService.transcribeTap(userID, deviceID, request.headers, audio, format).catch(() => undefined)
+    const started = performance.now()
+    const text = await speech.transcribe(audio, format)
+    if (!tap) return Response.json({ text })
+    const result = await tap.finish(text, Math.round(performance.now() - started)).catch(() => "failed" as const)
+    return Response.json({ text }, { headers: { [RECORDING_AUDIO_RESULT_HEADER]: result } })
   }
 
   /**
@@ -2546,6 +2617,8 @@ export function startCentral(options: CentralOptions): Central {
     for (const listener of [...listeners]) listener.end(SSE_RETRY_MS)
     drainSignal.abort()
     await connections
+    // (REC-01) The buffered hub events of recordings are written before the pod goes.
+    await recordingService.flush().catch((cause) => console.error(`[hub] recording hub events not written: ${(cause as Error).message}`))
   }
 
   /** Compressed copies of hashed assets, made once per file and encoding (they never change). */
@@ -2578,6 +2651,7 @@ export function startCentral(options: CentralOptions): Central {
       headers.set("service-worker-allowed", "/")
     } else if (type.startsWith("text/html")) {
       headers.set("cache-control", "no-cache")
+      headers.set(cspHeader(config.csp ?? "enforce"), CONSOLE_CSP)
     } else if (HASHED_ASSET.test(name)) {
       headers.set("cache-control", IMMUTABLE)
       if (COMPRESSIBLE.has(path.extname(name).toLowerCase()) && bytes.length >= MIN_COMPRESS_BYTES) {
@@ -2615,6 +2689,7 @@ export function startCentral(options: CentralOptions): Central {
     concierge: conciergeService,
     agentEventWriters,
     intentRetention,
+    recordings: recordingService,
     teams: { store: teamStore, seats: teamSeats, staffing: teamStaffing, intake: teamIntake },
     routes: [...routes.map(({ method, path, access }) => ({ method, path, access })), ...agent.routes.map(({ method, path }) => ({ method, path, access: "agent" as const }))],
     drain(drainOptions: DrainOptions = {}) {
@@ -2630,6 +2705,7 @@ export function startCentral(options: CentralOptions): Central {
       conciergeParts.tiers.stop?.()
       webhooks.stop()
       artifactMaintenance?.stop()
+      await recordingService.stop()
       profileApplier?.stop()
       agentEventWriters.stop()
       tokenPush.stop()

package/src/central/profiles/content.ts

@@ -100,6 +100,22 @@ export function credentialFinding(text: string): string | undefined {
   return undefined
 }
 
+/**
+ * (REC-01) Replaces every literal credential in a text with `[redacted: <kind>]` (the CREDENTIALS table, applied
+ * globally) and lists the kinds removed, each once, in table order. Voice recordings scrub every text field with it.
+ */
+export function redactCredentials(text: string): { text: string; kinds: string[] } {
+  const kinds: string[] = []
+  let out = text
+  for (const [kind, pattern] of CREDENTIALS) {
+    const global = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`)
+    const next = out.replace(global, `[redacted: ${kind}]`)
+    if (next !== out && !kinds.includes(kind)) kinds.push(kind)
+    out = next
+  }
+  return { text: out, kinds }
+}
+
 /** Fields that would run code or install things on a machine: refused as unsupported. */
 const HOOK_FIELDS = new Set(["hooks", "hook", "setup", "install", "postinstall", "preinstall", "dependencies", "devdependencies", "requirements", "scripts"])
 const CONTENT_FIELDS = new Set(["instructions", "model", "skills", "commands"])

package/src/central/recording/clock.ts

@@ -0,0 +1,76 @@
+// REC-01 clock alignment of console events to hub time (contract: Clocks and alignment).
+// Each `clock.sync {t0, t1, hubAt}` sample gives offset = hubAt − (t0 + t1) / 2 and rtt = t1 − t0. A console event
+// at page time t gets ts = t + offset of the lowest-rtt sample within ±5 min (else the lowest-rtt sample overall):
+// piecewise, so page clock pauses (sleep) and drift are absorbed. Without samples, anchor.epoch − anchor.perf.
+import type { RecordingAnchor } from "../../protocol"
+
+export interface ClockSample {
+  readonly t0: number
+  readonly t1: number
+  readonly hubAt: number
+}
+
+export interface ClockSummary {
+  /** The best sample's offset (hub epoch ms − page ms), or the anchor's. */
+  readonly offsetMs: number
+  /** Half the worst rtt among the samples used (null: no sample, the anchor's wall clock). */
+  readonly errorMs: number | null
+  readonly samples: number
+}
+
+export interface ClockAlignment {
+  /** Aligned hub-epoch ms of a console event's page time. */
+  ts(t: number): number
+  /** For the manifest, after the events were aligned. */
+  readonly summary: ClockSummary
+}
+
+export const CLOCK_WINDOW_MS = 5 * 60_000
+
+interface Prepared {
+  readonly mid: number
+  readonly rtt: number
+  readonly offset: number
+}
+
+const round = (ms: number) => Math.round(ms * 10) / 10
+
+export function clockAlignment(samples: readonly ClockSample[], anchor: RecordingAnchor | undefined): ClockAlignment {
+  const prepared: Prepared[] = samples
+    .filter((s) => Number.isFinite(s.t0) && Number.isFinite(s.t1) && Number.isFinite(s.hubAt) && s.t1 >= s.t0)
+    .map((s) => ({ mid: (s.t0 + s.t1) / 2, rtt: s.t1 - s.t0, offset: s.hubAt - (s.t0 + s.t1) / 2 }))
+    .sort((a, b) => a.mid - b.mid)
+  const fallback = anchor ? anchor.epoch - anchor.perf : 0
+  if (!prepared.length) return { ts: (t) => round(t + fallback), summary: { offsetMs: fallback, errorMs: null, samples: 0 } }
+  const best = prepared.reduce((a, b) => (b.rtt < a.rtt ? b : a))
+  const used = new Set<Prepared>()
+  /** The first sample whose mid is ≥ value. */
+  const lowerBound = (value: number) => {
+    let lo = 0
+    let hi = prepared.length
+    while (lo < hi) {
+      const m = (lo + hi) >> 1
+      if (prepared[m]!.mid < value) lo = m + 1
+      else hi = m
+    }
+    return lo
+  }
+  const choose = (t: number): Prepared => {
+    let chosen: Prepared | undefined
+    for (let i = lowerBound(t - CLOCK_WINDOW_MS); i < prepared.length && prepared[i]!.mid <= t + CLOCK_WINDOW_MS; i++) {
+      if (!chosen || prepared[i]!.rtt < chosen.rtt) chosen = prepared[i]
+    }
+    return chosen ?? best
+  }
+  return {
+    ts: (t) => {
+      const sample = choose(t)
+      used.add(sample)
+      return round(t + sample.offset)
+    },
+    get summary() {
+      const worst = used.size ? Math.max(...[...used].map((s) => s.rtt)) : best.rtt
+      return { offsetMs: round(best.offset), errorMs: round(worst / 2), samples: prepared.length }
+    },
+  }
+}