@huynle/hub 0.8.7 → 0.9.0

package/packages/cli/dist/hub-cli.js

@@ -7,7 +7,7 @@ import { createInterface } from "readline";
 // packages/cli/package.json
 var package_default = {
   name: "@huynle/hub-cli",
-  version: "0.8.7",
+  version: "0.9.0",
   private: true,
   description: "The hub CLI (`hub` / `hubctl`) for agents and scripts (internal; bundled into @huynle/hub, not published on its own).",
   license: "MIT",
@@ -710,7 +710,11 @@ var decisionFields = (options) => {
 var whyField = (options) => options.why !== undefined ? { why: options.why } : {};
 var signalOf = (options) => options.signal ? { signal: options.signal } : {};
 var idempotent = (options) => ({ ...signalOf(options), ...options.idempotencyKey ? { headers: { "idempotency-key": options.idempotencyKey } } : {} });
-var sendFields = (options) => ({ ...options.wake !== undefined ? { wake: options.wake } : {}, ...options.urgent !== undefined ? { urgent: options.urgent } : {} });
+var sendFields = (options) => ({
+  ...options.wake !== undefined ? { wake: options.wake } : {},
+  ...options.urgent !== undefined ? { urgent: options.urgent } : {},
+  ...options.notAfter !== undefined ? { notAfter: options.notAfter } : {}
+});
 var roleTarget = (options) => ({ ...options.session ? { session: options.session } : {}, ...options.project !== undefined ? { project: options.project } : {} });
 
 class HubClient {
@@ -916,7 +920,7 @@ class HubClient {
     return this.call("POST", `${AGENT}/roles/release`, { body: { role: bareRole(role), ...roleTarget(options) }, ...signalOf(options) });
   }
   msg(to, text, options = {}) {
-    return this.call("POST", `${AGENT}/msg`, { body: { to, text, ...sendFields(options), ...options.all ? { all: true } : {} }, ...signalOf(options) });
+    return this.call("POST", `${AGENT}/msg`, { body: { to, text, ...sendFields(options), ...options.all ? { all: true } : {} }, ...idempotent(options) });
   }
   async ask(to, text, options = {}) {
     if (options.all && options.wait !== undefined)
@@ -933,7 +937,7 @@ class HubClient {
       ...options.wait !== undefined ? { wait: first } : {},
       ...decisionFields(options)
     };
-    const asked = await this.call("POST", `${AGENT}/ask`, { body, ...signalOf(options) });
+    const asked = await this.call("POST", `${AGENT}/ask`, { body, ...idempotent(options) });
     if ("sent" in asked)
       return asked;
     let current = asked;
@@ -1110,6 +1114,7 @@ var EXIT_OF = {
   offline: EXIT.unavailable,
   busy: EXIT.unavailable,
   gone: EXIT.gone,
+  expired: EXIT.gone,
   unauthorized: EXIT.unauthorized,
   token_expired: EXIT.unauthorized
 };
@@ -3551,6 +3556,113 @@ function sessionContextProblem(v) {
   return;
 }
 
+// packages/protocol/src/media.ts
+var MEDIA_LIMITS = {
+  maxBytes: 8 * 1024 * 1024,
+  maxPixels: 40000000,
+  maxSide: 16384,
+  chunkBytes: 512 * 1024,
+  perRow: 8
+};
+var MEDIA_PATH_MAX = 4096;
+var MEDIA_REF_MAX = 2 + Math.ceil(MEDIA_PATH_MAX * 4 / 3) + 4;
+var FILE_REF = /^f(0|[1-9]\d{0,2})$/;
+var TOOL_REF = /^t(0|[1-9]\d{0,3})\.(0|[1-9]\d{0,2})$/;
+var PATH_REF = /^p:([A-Za-z0-9_-]+)$/;
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64url(text) {
+  if (text.length % 4 === 1)
+    return;
+  try {
+    const binary = atob(text.replace(/-/g, "+").replace(/_/g, "/"));
+    return Uint8Array.from(binary, (c) => c.charCodeAt(0));
+  } catch {
+    return;
+  }
+}
+function mediaPathRef(path) {
+  return `p:${base64url(new TextEncoder().encode(path))}`;
+}
+function parseMediaRef(ref) {
+  if (typeof ref !== "string" || ref.length > MEDIA_REF_MAX)
+    return;
+  const file = FILE_REF.exec(ref);
+  if (file)
+    return { kind: "file", index: Number(file[1]) };
+  const tool = TOOL_REF.exec(ref);
+  if (tool)
+    return { kind: "tool", part: Number(tool[1]), item: Number(tool[2]) };
+  const path = PATH_REF.exec(ref);
+  if (!path)
+    return;
+  const bytes = fromBase64url(path[1]);
+  if (!bytes || bytes.length === 0 || bytes.length > MEDIA_PATH_MAX)
+    return;
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return;
+  }
+  if (text.includes("\x00") || mediaPathRef(text) !== ref)
+    return;
+  return { kind: "path", path: text };
+}
+var isMediaOffset = (offset) => Number.isInteger(offset) && offset >= 0 && offset <= MEDIA_LIMITS.maxBytes;
+
+// packages/protocol/src/preview-bundle.ts
+var PREVIEW_BUNDLE_FEATURE = "previewBundle";
+var PREVIEW_BUNDLE_LIMITS = {
+  files: 200,
+  fileBytes: 5 * 1024 * 1024,
+  totalBytes: 20 * 1024 * 1024,
+  chunkBytes: 512 * 1024,
+  inlineBytes: 384 * 1024,
+  bundlePathMax: 200,
+  pathMax: 4096,
+  refMax: 300,
+  skipped: 200
+};
+var PREVIEW_MEDIA_TYPES = {
+  html: "text/html",
+  htm: "text/html",
+  css: "text/css",
+  js: "text/javascript",
+  mjs: "text/javascript",
+  json: "application/json",
+  txt: "text/plain",
+  csv: "text/csv",
+  md: "text/markdown",
+  pdf: "application/pdf",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml"
+};
+var MEDIA_TYPES = new Set(Object.values(PREVIEW_MEDIA_TYPES));
+var HEX64 = /^[0-9a-f]{64}$/;
+var int2 = (v, min, max) => Number.isSafeInteger(v) && v >= min && v <= max;
+var isPreviewPath = (v) => typeof v === "string" && v.length > 0 && v.length <= PREVIEW_BUNDLE_LIMITS.pathMax && !/[\u0000\r\n]/.test(v);
+function isPreviewBundleRequest(v) {
+  if (typeof v.sessionID !== "string" || !v.sessionID)
+    return false;
+  if (typeof v.messageID !== "string" || !v.messageID || v.messageID.length > 300)
+    return false;
+  if (!isPreviewPath(v.path))
+    return false;
+  const chunk = [v.bundle, v.file, v.offset].filter((x) => x !== undefined).length;
+  if (chunk === 0)
+    return true;
+  return chunk === 3 && typeof v.bundle === "string" && HEX64.test(v.bundle) && int2(v.file, 0, PREVIEW_BUNDLE_LIMITS.files - 1) && int2(v.offset, 0, PREVIEW_BUNDLE_LIMITS.fileBytes - 1);
+}
+
 // packages/protocol/src/harness-events.ts
 var HARNESS_EVENTS = [
   "session.created",
@@ -3936,6 +4048,60 @@ var ARTIFACT_LIMITS = {
   aiJobsPerArtifact: 2,
   aiInstructionChars: 8000
 };
+// packages/protocol/src/media-allowlist.ts
+var PUBLIC_SUFFIXES = new Set([
+  ...["co", "org", "ac", "gov", "net", "me", "ltd", "plc", "sch", "nhs"].map((s) => `${s}.uk`),
+  ...["com", "net", "org", "edu", "gov", "id", "asn"].map((s) => `${s}.au`),
+  ...["co", "ne", "or", "ac", "go", "gr", "ed", "ad", "lg"].map((s) => `${s}.jp`),
+  ...["co", "org", "net", "ac", "govt", "school", "geek", "gen", "kiwi", "maori"].map((s) => `${s}.nz`),
+  ...["com", "net", "org", "gov", "edu"].map((s) => `${s}.br`),
+  ...["com", "net", "org", "gov", "edu", "ac"].map((s) => `${s}.cn`),
+  ...["com", "net", "org", "gob", "edu"].map((s) => `${s}.mx`),
+  ...["co", "net", "org", "firm", "gen", "ind", "ac", "edu", "gov", "res"].map((s) => `${s}.in`),
+  ...["co", "org", "net", "ac", "gov", "web"].map((s) => `${s}.za`),
+  ...["com", "net", "org", "gov", "edu"].map((s) => `${s}.tr`),
+  ...["com", "net", "org", "gov", "edu"].map((s) => `${s}.sg`),
+  ...["com", "net", "org", "gov", "edu"].map((s) => `${s}.hk`),
+  ...["co", "or", "ne", "go", "ac", "re"].map((s) => `${s}.kr`),
+  ...["com", "net", "org", "gov", "edu"].map((s) => `${s}.tw`),
+  ...["com", "net", "org", "gov", "edu"].map((s) => `${s}.ar`),
+  ...["co", "or", "ac", "go"].map((s) => `${s}.id`),
+  ...["co", "or", "ac", "go"].map((s) => `${s}.th`),
+  ...["com", "net", "org", "gov", "edu"].map((s) => `${s}.my`),
+  ...["com", "net", "org", "gov", "edu"].map((s) => `${s}.ph`),
+  ...["com", "net", "org", "gov", "edu"].map((s) => `${s}.pk`),
+  ...["com", "net", "org", "gov", "edu"].map((s) => `${s}.ua`),
+  ...["com", "net", "org", "gov", "edu"].map((s) => `${s}.pl`),
+  ...["co", "or", "ac"].map((s) => `${s}.at`),
+  ...["co", "org", "ac"].map((s) => `${s}.il`),
+  "com.es",
+  "org.es",
+  "co.it",
+  "com.ru",
+  "co.ca",
+  "eu.org",
+  "github.io",
+  "githubpreview.dev",
+  "gitlab.io",
+  "pages.dev",
+  "workers.dev",
+  "netlify.app",
+  "vercel.app",
+  "herokuapp.com",
+  "appspot.com",
+  "blogspot.com",
+  "cloudfront.net",
+  "azurewebsites.net",
+  "web.app",
+  "firebaseapp.com",
+  "s3.amazonaws.com",
+  "ngrok.io",
+  "ngrok-free.app",
+  "glitch.me",
+  "repl.co",
+  "fly.dev",
+  "onrender.com"
+]);
 // packages/protocol/src/graph.ts
 var GRAPH_LIMITS = {
   nodes: 2000,
@@ -4054,7 +4220,7 @@ var IMPLIED_OPENCODE_FEATURES = [
   "expose",
   "create"
 ];
-var OPTIONAL_SPOKE_FEATURES = [...IMPLIED_OPENCODE_FEATURES, "autoName", "sessionTokens", "deliver", "hubPrompt", "permissionMessage", "actTokens", "launch", "fork", "revert", "dismissError"];
+var OPTIONAL_SPOKE_FEATURES = [...IMPLIED_OPENCODE_FEATURES, "autoName", "sessionTokens", "deliver", "hubPrompt", "permissionMessage", "actTokens", "launch", "fork", "revert", "dismissError", "timelineMedia", PREVIEW_BUNDLE_FEATURE, "voiceFront"];
 var CORE_OPS = ["turn", "steer", "interrupt", "stop", "permission", "form"];
 var KNOWN_SPOKE_FEATURES = [...CORE_OPS, ...OPTIONAL_SPOKE_FEATURES, "turnEvents", PROFILE_APPLY_FEATURE, SESSION_CONTEXT_FEATURE];
 var SPOKE_FEATURES = [...OPTIONAL_SPOKE_FEATURES, PROFILE_APPLY_FEATURE, SESSION_CONTEXT_FEATURE];
@@ -4072,6 +4238,8 @@ function featureForOp(op) {
     case "revertRestore":
     case "revertCommit":
       return "revert";
+    case "removeFront":
+      return "voiceFront";
     default:
       return op;
   }
@@ -4252,11 +4420,16 @@ function isServerRequest(v) {
       return nonEmpty(v.sessionID) && promptBody(v);
     case "timelineFile":
       return nonEmpty(v.sessionID) && nonEmpty(v.messageID) && v.messageID.length <= 300 && Number.isInteger(v.index) && Number(v.index) >= 0 && Number(v.index) < 1000;
+    case "timelineMedia":
+      return nonEmpty(v.sessionID) && nonEmpty(v.messageID) && v.messageID.length <= 300 && str2(v.ref) && parseMediaRef(v.ref) !== undefined && (v.offset === undefined || isMediaOffset(v.offset));
+    case "previewBundle":
+      return isPreviewBundleRequest(v);
     case "diff":
       return nonEmpty(v.sessionID) && nonEmpty(v.file) && v.file.length <= 4096;
     case "rename":
       return nonEmpty(v.sessionID) && str2(v.title) && v.title.length <= 1000;
     case "conversation":
+      return nonEmpty(v.sessionID) && typeof v.on === "boolean" && (v.frontID === undefined || nonEmpty(v.frontID) && v.frontID.length <= 300);
     case "expose":
       return nonEmpty(v.sessionID) && typeof v.on === "boolean";
     case "create":
@@ -4279,6 +4452,7 @@ function isServerRequest(v) {
     case "revertRestore":
     case "revertCommit":
     case "dismissError":
+    case "removeFront":
       return nonEmpty(v.sessionID);
     default:
       return false;
@@ -5739,6 +5913,14 @@ function durationArg(value, flag) {
     throw new UsageError(`${flag} takes seconds or a duration like 30s, 5m, 2h, 1d (got "${value}")`);
   return Number(match[1]) * UNIT_S[match[2]];
 }
+var ISO_DATE_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?(?:Z|[+-]\d{2}:?\d{2})?$/i;
+function notAfterArg(value, what) {
+  const text = value.trim();
+  const ms = /^\d+$/.test(text) ? Number(text) : ISO_DATE_TIME.test(text) ? Date.parse(text) : Number.NaN;
+  if (!Number.isSafeInteger(ms))
+    throw new UsageError(`${what} takes epoch milliseconds or an ISO 8601 date-time like 2027-01-15T12:00:00Z (got "${value}")`);
+  return ms;
+}
 var iso = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, "Z");
 function askOutcome(asked, waited) {
   const { message, answer } = asked;
@@ -5911,7 +6093,8 @@ var LAUNCH_FLAGS = {
   prompt: "string",
   end: "string",
   timeout: "string",
-  cleanup: "string"
+  cleanup: "string",
+  "not-after": "string"
 };
 var choices = (options) => options.length === 2 ? options.join(" or ") : `${options.slice(0, -1).join(", ")} or ${options.at(-1)}`;
 function oneOf3(flags, flag, options) {
@@ -5970,10 +6153,12 @@ async function launchSpecArg(flags, context) {
   const runtime = kind === undefined ? undefined : { kind, ...profile !== undefined ? { profile } : {} };
   const placement = defined({ labels: nodeLabels, machine, mode: flags.prefer === true ? "prefer" : undefined });
   const end = defined({ when, timeout: str(flags, "timeout"), cleanup });
+  const notAfterText = str(flags, "not-after");
+  const notAfter = notAfterText === undefined ? undefined : notAfterArg(notAfterText, "--not-after");
   return {
     ...defined({ key: str(flags, "key"), name, roles, harness: str(flags, "harness"), agent: str(flags, "agent"), model: str(flags, "model") }),
     workspace,
-    ...defined({ runtime, placement, prompt, labels, end })
+    ...defined({ runtime, placement, prompt, labels, end, notAfter })
   };
 }
 var at2 = (name) => `@${name.replace(/^@+/, "")}`;
@@ -6432,6 +6617,23 @@ function dueOf(args) {
     throw new ToolArgError(`"due" must be an ISO date/time or epoch milliseconds`);
   return ms;
 }
+function notAfterOf(args) {
+  const value = args.notAfter;
+  if (value === undefined || value === null || value === "")
+    return;
+  if (typeof value === "number" && Number.isSafeInteger(value))
+    return value;
+  if (typeof value === "string") {
+    try {
+      return notAfterArg(value, `"notAfter"`);
+    } catch (cause) {
+      if (cause instanceof UsageError)
+        throw new ToolArgError(cause.message);
+      throw cause;
+    }
+  }
+  throw new ToolArgError(`"notAfter" must be epoch milliseconds or an ISO 8601 date-time like 2027-01-15T12:00:00Z`);
+}
 var line4 = (i) => `${i.id}  ${i.status}${i.progress ? `/${i.progress}` : ""}  ${i.priority}  r${i.revision}  ${sanitizeText(i.title).replace(/\s+/g, " ")}`;
 function intakeText(i) {
   const from = i.source.kind === "user" ? "the user" : i.source.kind === "app" ? `app ${i.source.tokenID}` : `session ${i.source.sessionID}`;
@@ -6441,6 +6643,7 @@ function intakeText(i) {
     `status: ${i.status}${i.progress ? ` (${i.progress})` : ""}  priority: ${i.priority}  from: ${from}`,
     ...i.assignmentID ? [`assignment: ${i.assignmentID} in workspace ${i.workspaceID ?? "?"}${i.sessionID ? `, delivered to ${i.sessionID}` : ""}`] : [],
     ...i.due !== undefined ? [`due: ${new Date(i.due).toISOString()}`] : [],
+    ...i.notAfter !== undefined ? [`not after: ${new Date(i.notAfter).toISOString()}`] : [],
     ...i.labels?.length ? [`labels: ${i.labels.join(", ")}`] : [],
     ...i.criteria?.length ? ["done means:", ...i.criteria.map((c) => `- ${sanitizeText(c)}`)] : [],
     ...i.ref ? [`ref: ${sanitizeText(i.ref)}`] : [],
@@ -6452,7 +6655,7 @@ function intakeText(i) {
 var teamIntakeTools = [
   {
     name: "team_submit",
-    description: "Give work to a team: its entry role (e.g. the project manager) receives the task with the team's context and owns it as an assignment in the team's workspace; while the role is vacant it waits queued. Pass `key` to make retries idempotent. App tokens need scope teams:submit; sessions submit under the team's communication policy.",
+    description: "Give work to a team: its entry role (e.g. the project manager) receives the task with the team's context and owns it as an assignment in the team's workspace; while the role is vacant it waits queued (with `notAfter`, only until then: still queued at that time, it is cancelled with reason not_after instead of delivered late). Pass `key` to make retries idempotent. App tokens need scope teams:submit; sessions submit under the team's communication policy.",
     properties: {
       team: TEAM,
       title: { ...STRING3, description: "One line, at most 120 characters." },
@@ -6460,6 +6663,10 @@ var teamIntakeTools = [
       priority: { type: "string", enum: PRIORITIES, description: "Default normal." },
       labels: { type: "array", items: STRING3, description: "Slugs (lowercase letters, digits, dashes)." },
       due: { ...STRING3, description: "When it is due: an ISO date/time." },
+      notAfter: {
+        type: ["number", "string"],
+        description: "Never deliver after this time: epoch milliseconds or an ISO 8601 date-time (at most 30 days ahead). Already passed: nothing is submitted (expired). Still queued then: cancelled (reason not_after)."
+      },
       criteria: { type: "array", items: STRING3, description: "What done means (at most 8 lines)." },
       ref: { ...STRING3, description: "An external reference, e.g. a Brain task ID." },
       key: { ...STRING3, description: "Idempotency-Key: the same key and body return the original submission." }
@@ -6472,10 +6679,11 @@ var teamIntakeTools = [
       const labels = strings2(args, "labels");
       const criteria = strings2(args, "criteria");
       const due = dueOf(args);
+      const notAfter = notAfterOf(args);
       const brief = optional4(args, "brief");
       const ref = optional4(args, "ref");
       const key = optional4(args, "key");
-      const { intake, created } = await hub.teams.submit(need3(args, "team"), { title: need3(args, "title"), ...brief ? { brief } : {}, ...priority ? { priority } : {}, ...labels ? { labels } : {}, ...due !== undefined ? { due } : {}, ...criteria ? { criteria } : {}, ...ref ? { ref } : {} }, { signal, ...key ? { idempotencyKey: key } : {} });
+      const { intake, created } = await hub.teams.submit(need3(args, "team"), { title: need3(args, "title"), ...brief ? { brief } : {}, ...priority ? { priority } : {}, ...labels ? { labels } : {}, ...due !== undefined ? { due } : {}, ...notAfter !== undefined ? { notAfter } : {}, ...criteria ? { criteria } : {}, ...ref ? { ref } : {} }, { signal, ...key ? { idempotencyKey: key } : {} });
       return `${created ? "Submitted" : "Already submitted (same key)"}: ${intake.id} is ${intake.status}${intake.status === "queued" ? " (waiting for the entry role)" : ""}
 ${intakeText(intake)}`;
     }
@@ -6641,7 +6849,7 @@ var revision = (args) => {
     throw new ArgError(`"expectedRevision" is required: the team's revision you read (team_show)`);
   return value;
 };
-var int2 = (args, key, min, max) => {
+var int3 = (args, key, min, max) => {
   const value = args[key];
   if (value === undefined || value === null)
     return;
@@ -6748,7 +6956,7 @@ var teamTools = [
       const tags = strings3(args, "tags");
       const project = optional5(args, "project");
       const metadata = record(args, "metadata");
-      const limit = int2(args, "limit", 1, 200);
+      const limit = int3(args, "limit", 1, 200);
       const cursor = optional5(args, "cursor");
       if (args.paused !== undefined && typeof args.paused !== "boolean")
         throw new ArgError(`"paused" must be true or false`);
@@ -6815,8 +7023,8 @@ var teamTools = [
     required: ["team"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const from = int2(args, "from", 1, 1e9);
-      const to = args.to === undefined || args.to === null || args.to === "draft" ? "draft" : int2(args, "to", 1, 1e9);
+      const from = int3(args, "from", 1, 1e9);
+      const to = args.to === undefined || args.to === null || args.to === "draft" ? "draft" : int3(args, "to", 1, 1e9);
       const { from: a, to: b, diff } = await hub.teams.diff(need4(args, "team"), { signal, ...from !== undefined ? { from } : {}, to });
       const part = (label, d) => ["added", "removed", "changed"].flatMap((k) => d[k]?.length ? [`${label} ${k}: ${d[k].join(", ")}`] : []);
       const lines = [
@@ -7387,10 +7595,28 @@ var optionalExpires = (args) => {
   }
   throw new ArgError3(`"expires" must be seconds or a duration like 30s, 5m, 2h, 1d`);
 };
+var optionalNotAfter = (args) => {
+  const value = args.notAfter;
+  if (value === undefined || value === null)
+    return;
+  if (typeof value === "number" && Number.isSafeInteger(value))
+    return value;
+  if (typeof value === "string") {
+    try {
+      return notAfterArg(value, '"notAfter"');
+    } catch (cause) {
+      if (cause instanceof UsageError)
+        throw new ArgError3(cause.message);
+      throw cause;
+    }
+  }
+  throw new ArgError3(`"notAfter" must be epoch milliseconds or an ISO 8601 date-time like 2027-01-15T12:00:00Z`);
+};
 var sendOptions = (args) => {
   const wake = optionalBool(args, "wake");
   const urgent = optionalBool(args, "urgent");
-  return { ...wake !== undefined ? { wake } : {}, ...urgent !== undefined ? { urgent } : {} };
+  const notAfter = optionalNotAfter(args);
+  return { ...wake !== undefined ? { wake } : {}, ...urgent !== undefined ? { urgent } : {}, ...notAfter !== undefined ? { notAfter } : {} };
 };
 var whyOption = (args) => {
   const why = optional7(args, "why");
@@ -7464,7 +7690,8 @@ function launchSpec(args) {
       placement: definedFields({ labels: nodeLabels, machine, mode: prefer ? "prefer" : undefined }),
       prompt: optional7(args, "prompt"),
       labels: optionalLabels(args, "labels"),
-      end: definedFields({ when: optionalEnum(args, "end", LAUNCH_END_WHEN), timeout: optional7(args, "timeout"), cleanup: optionalEnum(args, "cleanup", CLEANUP_POLICIES) })
+      end: definedFields({ when: optionalEnum(args, "end", LAUNCH_END_WHEN), timeout: optional7(args, "timeout"), cleanup: optionalEnum(args, "cleanup", CLEANUP_POLICIES) }),
+      notAfter: optionalNotAfter(args)
     })
   };
 }
@@ -7514,6 +7741,7 @@ var STRING6 = { type: "string" };
 var SEND = {
   wake: { type: "boolean", description: "false: admit the message without starting a turn." },
   urgent: { type: "boolean", description: "Steer into the recipient's running turn." },
+  notAfter: { type: ["number", "string"], description: "Never deliver after this time: epoch milliseconds or an ISO 8601 date-time (at most 30 days ahead). Already passed: nothing is sent (expired)." },
   all: { type: "boolean", description: "Send to every session the address names (each holder of a role)." }
 };
 var TO = { type: "string", description: "The recipient: @name, @@role, @@role#team (a role of one of your teams), @name.project, ses_…, or @me (the user)." };
@@ -7671,7 +7899,7 @@ var webhookText = (w) => `${w.id}${w.label ? `  ${w.label}` : ""}  ${w.url}  ${w
 var webhookTools = [
   {
     name: "webhook_create",
-    description: "Create a durable signed webhook for canonical compact events. The signing secret is returned only here. Needs events:subscribe plus every selected family's scope.",
+    description: `Create a durable signed webhook for canonical compact events (e.g. launch.*, session.*, message.changed, team.intake). The signing secret is returned only here. Needs events:subscribe plus every selected family's scope; events ["team.intake"] alone needs only teams:submit (an app gets only its own submissions).`,
     properties: { url: STRING6, events: { type: "array", items: STRING6 }, label: STRING6 },
     required: ["url"],
     readOnly: false,
@@ -8188,13 +8416,13 @@ var TOOLS = [
   {
     name: "msg",
     description: "Tell a session something (fire and forget). Sent as this server's credential, not as an OpenCode session.",
-    properties: { to: TO, text: { ...STRING6, description: "The message." }, ...SEND },
+    properties: { to: TO, text: { ...STRING6, description: "The message." }, ...SEND, idempotencyKey: IDEMPOTENCY3 },
     required: ["to", "text"],
     readOnly: false,
     run: async (hub, args, signal) => {
       const to = need7(args, "to");
       const text = need7(args, "text");
-      const options = { ...sendOptions(args), signal };
+      const options = { ...sendOptions(args), ...idemOption(args), signal };
       if (optionalBool(args, "all"))
         return sentAllText(await hub.msg(to, text, { ...options, all: true }));
       return sentText(await hub.msg(to, text, options));
@@ -8208,7 +8436,8 @@ var TOOLS = [
       text: { ...STRING6, description: "The question." },
       wait: { type: "number", minimum: 0, maximum: WAIT_POLL_MAX_S, description: `Seconds to wait for the answer (0–${WAIT_POLL_MAX_S}).` },
       expires: { type: ["number", "string"], description: "When the ask expires: seconds, or 30s, 5m, 2h, 1d (1 minute to 7 days; default 24 h)." },
-      ...SEND
+      ...SEND,
+      idempotencyKey: IDEMPOTENCY3
     },
     required: ["to", "text"],
     readOnly: false,
@@ -8217,7 +8446,7 @@ var TOOLS = [
       const text = need7(args, "text");
       const wait = optionalWait(args);
       const expires = optionalExpires(args);
-      const options = { ...sendOptions(args), ...expires !== undefined ? { expires } : {}, signal };
+      const options = { ...sendOptions(args), ...expires !== undefined ? { expires } : {}, ...idemOption(args), signal };
       if (optionalBool(args, "all")) {
         if (wait !== undefined)
           throw new ArgError3(`"wait" cannot be combined with "all"`);
@@ -8381,7 +8610,7 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
   },
   {
     name: "launch",
-    description: "Start a new session on a node (a hub node with the repo under its workspace roots). The same key again answers the same launch. Needs an app token with scope sessions:launch and a grant with verb launch covering the repo.",
+    description: "Start a new session on a node (a hub node with the repo under its workspace roots). The same key again answers the same launch. With notAfter, a launch still waiting for a machine at that time is never started (it ends expired). Needs an app token with scope sessions:launch and a grant with verb launch covering the repo.",
     properties: {
       repo: { ...STRING6, description: "Absolute path of the repository on the node (or where a clone goes)." },
       mode: { type: "string", enum: [...WORKSPACE_MODES], description: "worktree (default: <repo>/.worktrees/<branch>, needs branch), checkout, or clone (needs remote)." },
@@ -8403,7 +8632,8 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
       prompt: { ...STRING6, description: "The session's first prompt." },
       end: { type: "string", enum: [...LAUNCH_END_WHEN], description: "When it ends: idle (default; idle with nothing open for 30 s), asked (with a question open: needs_user), never." },
       timeout: { ...STRING6, description: "Longest run, e.g. 4h or 90m." },
-      cleanup: { type: "string", enum: [...CLEANUP_POLICIES], description: "keep (default) or remove the workspace when it ends." }
+      cleanup: { type: "string", enum: [...CLEANUP_POLICIES], description: "keep (default) or remove the workspace when it ends." },
+      notAfter: { type: ["number", "string"], description: "Do not start after this time: epoch milliseconds or an ISO 8601 date-time (at most 30 days ahead). Still waiting for a machine then, the launch ends expired; once placed it runs (timeout bounds it). Already passed: nothing is launched (expired)." }
     },
     required: ["repo"],
     readOnly: false,
@@ -8945,7 +9175,7 @@ import { arch as osArch, platform as osPlatform } from "node:os";
 // packages/node/package.json
 var package_default2 = {
   name: "@huynle/hub-node",
-  version: "0.8.7",
+  version: "0.9.0",
   private: true,
   description: "`hub node`: the per-machine daemon that prepares, collects and cleans up launch workspaces (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -10037,7 +10267,7 @@ import path14 from "node:path";
 // packages/runtime-openshell/package.json
 var package_default3 = {
   name: "@huynle/hub-runtime-openshell",
-  version: "0.8.7",
+  version: "0.9.0",
   private: true,
   description: "The `openshell` runtime of `hub node`: launches in NVIDIA OpenShell sandboxes, driven through the openshell CLI (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -13721,7 +13951,7 @@ import path23 from "node:path";
 // packages/claude-code/package.json
 var package_default4 = {
   name: "@huynle/hub-claude-code",
-  version: "0.8.7",
+  version: "0.9.0",
   private: true,
   description: "The Claude Code hooks spoke: per-user daemon, hook bridge, plugin dir, `hub claude` wrapper and daemon-backed MCP server (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -14010,7 +14240,7 @@ import path26 from "node:path";
 // packages/preset/package.json
 var package_default5 = {
   name: "@huynle/hub-preset",
-  version: "0.8.7",
+  version: "0.9.0",
   private: true,
   description: "The preset spoke: drives a harness without a spoke of its own through a terminal pane (tmux), described by a data-only preset; official presets in presets/ (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -14535,7 +14765,7 @@ import { openSync as openSync6, closeSync as closeSync6, readFileSync as readFil
 // packages/codex/package.json
 var package_default6 = {
   name: "@huynle/hub-codex",
-  version: "0.8.7",
+  version: "0.9.0",
   private: true,
   description: "The Codex app-server spoke: attaches to Codex's app-server (its own over stdio, and the shared daemon's socket when present), and the `hub codex` wrapper (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -25130,10 +25360,13 @@ Identity
   hub role release <role[.project]> [--session <addr>]
 
 Messaging (text "-" reads it from stdin)
-  hub msg <addr> "text" [--all] [--no-wake] [--urgent]   tell: fire and forget
-  hub ask <addr> "text" [--wait [secs]] [--expires 2h] [--all] [--no-wake] [--urgent]
+  hub msg <addr> "text" [--all] [--no-wake] [--urgent] [--not-after <ms|ISO time>] [--key K]
+                                      tell: fire and forget; --not-after: never delivered after that time
+  hub ask <addr> "text" [--wait [secs]] [--expires 2h] [--not-after <ms|ISO time>] [--all] [--no-wake] [--urgent] [--key K]
                                       tracked until answered, declined or expired; --wait alone waits until
-                                      it expires; exit 0 answered, 1 declined or no answer yet, 8 expired
+                                      it expires; exit 0 answered, 1 declined or no answer yet, 8 expired;
+                                      --key (Idempotency-Key): a retry with the same key and text answers
+                                      the first send again and sends nothing (24 h, per credential)
   hub reply <msgID> "text" [--no-wake]   goes to the real sender
   hub decline <msgID> --why "reason"
   hub ask @me "question" [--option id=label[:safe]]... [--recommend id [--why "…"]] [--urgency low|normal|high]
@@ -25168,9 +25401,10 @@ Launching (users; agents and app tokens with sessions:launch under a grant with
          [--name <@name>] [--role R]... [--harness H] [--agent A] [--model provider/model]
          [--runtime host|openshell [--profile P]] [--machine M] [--node-label k=v]... [--prefer]
          [--label k=v]... [--prompt "text" | --prompt -] [--end idle|asked|never] [--timeout 4h]
-         [--cleanup keep|remove] [--key K]
+         [--cleanup keep|remove] [--key K] [--not-after <ms|ISO time>]
                                       start a session; the same --key again answers the same launch;
-                                      --label tags it for apps, --node-label picks nodes (--prefer: not required)
+                                      --label tags it for apps, --node-label picks nodes (--prefer: not required);
+                                      --not-after: still waiting for a machine then, it never starts (expired)
   hub launches list [--state S[,S]] [--label k=v]...   your launches (agents: the ones they started)
   hub launches show <launchID> · hub launches stop <launchID>   (stop: exit 8 when it already ended)
 
@@ -25299,7 +25533,16 @@ var whyOf = (flags) => {
   const why = str(flags, "why");
   return why !== undefined ? { why } : {};
 };
-var sendFlags = (flags) => ({ ...flags["no-wake"] === true ? { wake: false } : {}, ...flags.urgent === true ? { urgent: true } : {} });
+var sendFlags = (flags) => {
+  const notAfter = str(flags, "not-after");
+  const key = str(flags, "key");
+  return {
+    ...flags["no-wake"] === true ? { wake: false } : {},
+    ...flags.urgent === true ? { urgent: true } : {},
+    ...notAfter === undefined ? {} : { notAfter: notAfterArg(notAfter, "--not-after") },
+    ...key !== undefined ? { idempotencyKey: key } : {}
+  };
+};
 var nodeIo = (io) => ({
   env: io.env,
   home: io.home,
@@ -25421,7 +25664,7 @@ var COMMANDS = {
   },
   msg: {
     args: ["<addr>", "<text>"],
-    flags: { all: "bool", "no-wake": "bool", urgent: "bool" },
+    flags: { all: "bool", "no-wake": "bool", urgent: "bool", "not-after": "string", key: "string" },
     async handle(context) {
       const { flags, args } = context.parsed;
       const text = await textArg(args[1], context.io.stdin);
@@ -25433,7 +25676,7 @@ var COMMANDS = {
   },
   ask: {
     args: ["<addr>", "<text>"],
-    flags: { all: "bool", "no-wake": "bool", urgent: "bool", expires: "string", wait: "optional", ...DECISION_FLAGS },
+    flags: { all: "bool", "no-wake": "bool", urgent: "bool", "not-after": "string", key: "string", expires: "string", wait: "optional", ...DECISION_FLAGS },
     async handle(context) {
       const { flags, args } = context.parsed;
       const decision = decisionOptions(flags, args[0]);

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huynle/hub-cli",
-  "version": "0.8.7",
+  "version": "0.9.0",
   "private": true,
   "description": "The hub CLI (`hub` / `hubctl`) for agents and scripts (internal; bundled into @huynle/hub, not published on its own).",
   "license": "MIT",