@monster-orange/den 0.4.24 → 0.4.26

package/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to Den are documented here. Each release lists the
 config and manifest changes a distribution must make to move to it under
 **Migrations**.
 
+## [0.4.26] - 2026-11-10
+
+### Security
+
+- **A secret saved to 1Password is never on a command line.** `op`
+  wrote the value as an argument (`field[password]=<value>`), which any
+  process on the machine can read while `op` runs. Saving the admin
+  password (and every other 1Password write) now reads the item as JSON,
+  changes the one field and passes it on `op`'s stdin (`op item edit`, or
+  `op item create -` for a new item). The item's other fields are kept.
+  Nothing to change in config. A sweep of Den's other commands found no
+  other secret in argv: sudo and Doppler already read theirs on stdin,
+  and agent keys go in the environment.
+
+## [0.4.25] - 2026-11-10
+
+### Added
+
+- **Agents can use Hub (HUB-1.5).** With `hub.url` and `hub.token` (a
+  secret ref in this install's own store) set, every agent Den launches
+  gets Hub's MCP server, so it can search Hub and publish docs and mocks
+  there. Hub knows the team from the install's token and the project from
+  the workspace's repos. The token stays in the agent's own 0600 MCP
+  file. Agents use Hub's tools without asking (`hub.allow_tools`, default
+  on; off, they ask like any tool). Settings › Agents › Hub and `doctor`
+  say whether Hub is connected, and to which team. Nothing changes
+  without `hub.url`. See docs/distributions.md, "Hub".
+
+### Fixed
+
+- **Rotation wording.** Add override with no target says "Pick an
+  agent", not "Pick a agent". An install select's inherit option is short
+  ("inherit (auto)"), with where it comes from in the tag beside it, and
+  a select never cuts its words at 375 px.
+- **doctor, an older session host.** A host from an earlier version, with
+  no service host behind it, is ℹ "older host (pid N)", not ⚠ "unknown":
+  it picks up this version the next time it exits, and nothing needs
+  doing.
+
 ## [0.4.24] - 2026-11-10
 
 ### Fixed

package/docs/distributions.md

@@ -911,6 +911,53 @@ later plugins.
   one line per network. Stacks that are down, and projects with no routes
   file there, are left alone. (0.3.0-dev.40.)
 
+## Hub
+
+With `hub.url` set, every agent Den launches gets Hub's tools (HUB-1.5):
+it can search Hub and publish docs and mocks there. Without `hub.url`,
+nothing changes and nothing about Hub shows.
+
+```yaml
+# config/local/user.yml (or the org config; user.yml wins)
+hub:
+  url: https://hub.example.com
+  token: { vault: Private, item: Acme Hub, field: token }
+  # or the name of a secrets.refs entry: token: hub_install
+  allow_tools: true # the default: agents use Hub's tools without asking
+```
+
+- `hub.url` must be https. Plain http works only to this machine
+  (`localhost`, `*.localhost`).
+- `hub.token` is this install's Hub token (`hubi_…`, one per install,
+  made in Hub), as a ref in this install's own secrets store
+  (`secrets.provider`). Den never assumes a vault, item or field for it.
+- Each agent's MCP config gets a server named `hub`: Streamable HTTP at
+  `<hub.url>/mcp`, with `Authorization: Bearer <token>` and four plain
+  headers naming the caller: `X-Den-Agent` (its name), `X-Den-Session`
+  (a new opaque id per launch), `X-Den-Workspace` and `X-Den-Repos` (the
+  workspace's repos, `owner/repo`, comma-separated). Hub sets the team
+  from the token and the project from the repos.
+- Its prompt gets one line: "You can search Hub and publish docs and
+  mocks there with the hub\_\* tools; your team and project are set from
+  this Den install."
+- The token is only in the agent's own MCP file (mode 0600). It is never
+  in a command line, a record, a log, a page or an API answer.
+- `hub.allow_tools` (default `true`): agents use Hub's tools without
+  asking (Den allows `mcp__hub` for every agent it launches). The token
+  limits writes to this install's team, and Hub keeps every version. Set
+  it to `false` and Hub's tools ask before they run, like any tool. An
+  explicit deny in the install's own Claude Code permissions still wins.
+  Settings › Agents › Hub has the checkbox (it saves to
+  `config/local/user.yml`).
+- A Hub that is down, or a token that can't be read, never stops an
+  agent: it starts without Hub.
+
+Settings › Agents › Hub shows the URL, connected or not, the team and
+this install's label (from Hub's whoami tool), or why it can't connect.
+`GET /api/hub` answers the same. `<cli> doctor` has a Hub row: ✓ when
+connected, ⚠ with the reason when not. A Hub that is down never fails
+doctor.
+
 ## doctor
 
 `<cli> doctor` lists every strategy kind in the registry (secrets, tls,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monster-orange/den",
-  "version": "0.4.24",
+  "version": "0.4.26",
   "description": "Den: a local multi-repo dev orchestrator, HTTPS edge and E2E harness",
   "type": "module",
   "bin": {

package/src/shared/agents/den-claude.ts

@@ -50,6 +50,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { MCP_ACTIONS, configuredRuntimeBin } from "../den-config.js";
 import { rolePrompt } from "./personas.js";
+import { HUB_PROMPT_LINE } from "../hub.js";
 import { GUARDRAILS_DIR, guardrailHooks, hookCommands } from "./guardrails.js";
 import { DEFAULT_ROTATE } from "./rotation.js";
 import { idsInNames } from "./handback.js";
@@ -374,7 +375,17 @@ function common(input: LaunchInput): {
       )
     : null;
   const den = input.denToolsAllowed ? denToolRules(input.mcp.name) : null;
-  const allow = [...allowRules(input.allow ?? []), ...(den?.allow ?? [])];
+  // HUB-1.5: Hub's tools without asking, when hub.allow_tools is on (the
+  // default). Claude Code checks deny before allow: an install's deny wins.
+  const hubAllow =
+    input.mcp.hub?.allowTools === true
+      ? [`mcp__${input.mcp.hub.name}`, `mcp__${input.mcp.hub.name}__*`]
+      : [];
+  const allow = [
+    ...allowRules(input.allow ?? []),
+    ...(den?.allow ?? []),
+    ...hubAllow,
+  ];
   const ask = den?.ask ?? [];
   const settings =
     input.stateDir || hooks || allow.length ? settingsPath(input) : null;
@@ -393,7 +404,7 @@ function common(input: LaunchInput): {
         input.agentId,
         input.workspace.name,
         input.mcp.name,
-      ),
+      ) + (input.mcp.hub ? `\n\n${HUB_PROMPT_LINE}` : ""),
     ],
     files: {
       [file]: mcpConfigJson(input.mcp),

package/src/shared/agents/runtime.ts

@@ -60,6 +60,19 @@ export interface AgentMcp {
   env: Record<string, string>;
   /** The workspace it is pinned to. */
   scope: string;
+  /**
+   * HUB-1.5: Den Hub's MCP server (Streamable HTTP), when hub.url is set:
+   * its base URL and the headers (the bearer token among them). The
+   * headers go only into the agent's own 0600 MCP file, never into argv,
+   * a record, a log or a page.
+   */
+  hub?: {
+    name: string;
+    url: string;
+    headers: Record<string, string>;
+    /** hub.allow_tools: its tools run without asking (default on). */
+    allowTools?: boolean;
+  };
 }
 
 export interface LaunchInput {
@@ -322,8 +335,8 @@ export function whichBin(
 }
 
 /**
- * A standard MCP config (`mcpServers`, the shape most MCP clients read)
- * with Den's server as the only entry.
+ * A standard MCP config (`mcpServers`, the shape most MCP clients read):
+ * Den's server, and Den Hub's when it is set (HUB-1.5).
  */
 export function mcpConfigJson(mcp: AgentMcp): string {
   const [command, ...args] = mcp.command;
@@ -336,6 +349,15 @@ export function mcpConfigJson(mcp: AgentMcp): string {
             args,
             ...(Object.keys(mcp.env).length ? { env: mcp.env } : {}),
           },
+          ...(mcp.hub && mcp.hub.name !== mcp.name
+            ? {
+                [mcp.hub.name]: {
+                  type: "http",
+                  url: `${mcp.hub.url}/mcp`,
+                  headers: mcp.hub.headers,
+                },
+              }
+            : {}),
         },
       },
       null,

package/src/shared/hub.ts

@@ -0,0 +1,345 @@
+/**
+ * HUB-1.5: Den Hub for every agent Den launches.
+ *
+ *   hub:
+ *     url: https://hub.example.com       # the Hub's base URL
+ *     token: { item: …, field: … }        # a secret ref (or the name of a
+ *                                         # secrets.refs entry), resolved
+ *                                         # from this install's own store
+ *
+ * Read from the org config, then config/local/user.yml (user wins). SEC-0:
+ * the token is the install's, from the install's secrets backend; Den
+ * never assumes a vault, item or field of its own. With no hub.url,
+ * nothing changes and nothing is shown.
+ *
+ * Every agent gets Hub's MCP server (Streamable HTTP at `<url>/mcp`, with
+ * `Authorization: Bearer <token>`) and plain headers naming who calls:
+ * X-Den-Agent, X-Den-Session, X-Den-Workspace, X-Den-Repos. Hub picks the
+ * team (from the token) and the project (from the repos, then the
+ * workspace's name, then the team's default). The token is never logged,
+ * never in a page or an API answer: only in the agent's own 0600 MCP file.
+ */
+import { readDenConfig, readUserConfig, type DenConfig } from "./den-config.js";
+import {
+  getSecretsProvider,
+  namedSecretRef,
+  readSecretsConfig,
+  type SecretRef,
+  type SecretsConfig,
+  type SecretsProvider,
+} from "./secrets/index.js";
+
+/** The server's name in an agent's MCP config. */
+export const HUB_SERVER = "hub";
+
+/** The line every agent's prompt gets when Hub is set (generic). */
+export const HUB_PROMPT_LINE =
+  "You can search Hub and publish docs and mocks there with the hub_* tools; your team and project are set from this Den install.";
+
+export interface HubConfig {
+  /** The base URL, no trailing slash. */
+  url: string;
+  /** The token's ref in this install's store, or null when none is set. */
+  tokenRef: SecretRef | null;
+  /** Where the ref came from, for messages (never the value). */
+  tokenFrom: string;
+  /**
+   * hub.allow_tools (default true): agents use Hub's tools without asking.
+   * Off, they ask like any tool. An install's own deny rule still wins.
+   */
+  allowTools: boolean;
+}
+
+type RawHub =
+  | { url?: unknown; token?: unknown; allow_tools?: unknown }
+  | undefined;
+
+function rawHub(den: unknown, user: unknown): RawHub {
+  const d = (den as { hub?: RawHub } | null)?.hub ?? {};
+  const u = (user as { hub?: RawHub } | null)?.hub ?? {};
+  return { ...d, ...u };
+}
+
+/** A URL Den will send a token to: https, or http to this machine. */
+export function hubUrlProblem(url: string): string | null {
+  let u: URL;
+  try {
+    u = new URL(url);
+  } catch {
+    return `hub.url is not a URL: ${url}`;
+  }
+  const local =
+    ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname) ||
+    u.hostname.endsWith(".localhost");
+  if (u.protocol !== "https:" && !(u.protocol === "http:" && local))
+    return `hub.url must be https (http only to this machine): ${url}`;
+  return null;
+}
+
+/**
+ * hub.* (org config, then user.yml), or null without hub.url. A bad value
+ * throws naming its key.
+ */
+export function readHubConfig(
+  den: DenConfig | Record<string, unknown> = readDenConfig(),
+  user: Record<string, unknown> = readUserConfig() as Record<string, unknown>,
+  secrets: () => SecretsConfig = readSecretsConfig,
+): HubConfig | null {
+  const h = rawHub(den, user);
+  if (h?.url === undefined || h.url === null || h.url === "") return null;
+  if (typeof h.url !== "string") throw new Error("hub.url must be a string");
+  const url = h.url.trim().replace(/\/+$/, "");
+  const bad = hubUrlProblem(url);
+  if (bad) throw new Error(bad);
+  const t = h.token;
+  let tokenRef: SecretRef | null = null;
+  let tokenFrom = "hub.token";
+  if (typeof t === "string" && t.trim()) {
+    // The name of a secrets.refs entry.
+    tokenFrom = `secrets.refs.${t.trim()}`;
+    tokenRef = namedSecretRef(t.trim(), secrets());
+  } else if (t && typeof t === "object") {
+    const r = t as Record<string, unknown>;
+    const s = (v: unknown) => (typeof v === "string" ? v.trim() : "");
+    const ref: SecretRef = {
+      vault: s(r.vault),
+      item: s(r.item),
+      field: s(r.field) || s(r.key),
+    };
+    if (s(r.key)) ref.key = s(r.key);
+    tokenRef = ref.item || ref.key || ref.field ? ref : null;
+  } else if (t !== undefined && t !== null)
+    throw new Error(
+      "hub.token must be a secret ref ({ item, field } or { key }) or the name of a secrets.refs entry",
+    );
+  const at = h.allow_tools;
+  if (at !== undefined && at !== null && typeof at !== "boolean")
+    throw new Error("hub.allow_tools must be true or false");
+  return { url, tokenRef, tokenFrom, allowTools: at !== false };
+}
+
+/**
+ * Apply a POSTed `hub_allow_tools` to user.yml's hub block (in place): a
+ * boolean sets hub.allow_tools, null clears it (back to the default, on).
+ */
+export function patchHubAllowTools(
+  user: Record<string, unknown>,
+  v: unknown,
+): { ok: true } | { ok: false; error: string } {
+  if (v !== null && typeof v !== "boolean")
+    return { ok: false, error: "hub_allow_tools must be true, false or null" };
+  const hub = { ...((user.hub as Record<string, unknown> | undefined) ?? {}) };
+  if (v === null) delete hub.allow_tools;
+  else hub.allow_tools = v;
+  if (Object.keys(hub).length) user.hub = hub;
+  else delete user.hub;
+  return { ok: true };
+}
+
+/** The token from this install's store, or null (none set, or unreadable). */
+export async function readHubToken(
+  cfg: HubConfig,
+  provider: () => SecretsProvider = getSecretsProvider,
+): Promise<string | null> {
+  if (!cfg.tokenRef) return null;
+  try {
+    const v = await provider().tryGet(cfg.tokenRef);
+    return v && v.trim() ? v.trim() : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Who calls, as Hub reads it: plain names, never a secret. */
+export interface HubCaller {
+  agent: string;
+  session: string;
+  workspace: string;
+  repos: string[];
+}
+
+/** A header value: one line, printable, bounded. */
+const headerSafe = (v: string) => v.replace(/[^\x20-\x7e]/g, "?").slice(0, 512);
+
+export function hubHeaders(
+  token: string,
+  who: HubCaller,
+): Record<string, string> {
+  return {
+    Authorization: `Bearer ${token}`,
+    "X-Den-Agent": headerSafe(who.agent),
+    "X-Den-Session": headerSafe(who.session),
+    "X-Den-Workspace": headerSafe(who.workspace),
+    "X-Den-Repos": headerSafe(who.repos.join(",")),
+  };
+}
+
+/** owner/repo from a catalog entry: its gh slug, else its git remote. */
+export function ownerRepo(
+  entry: { gh?: string; remote?: string } | undefined,
+): string | null {
+  if (entry?.gh && /^[^/\s]+\/[^/\s]+$/.test(entry.gh)) return entry.gh;
+  const r = entry?.remote?.trim();
+  if (!r) return null;
+  const m = /[:/]([^/:\s]+)\/([^/\s]+?)(?:\.git)?\/?$/.exec(r);
+  return m ? `${m[1]}/${m[2]}` : null;
+}
+
+export interface HubWhoami {
+  team?: string;
+  label?: string;
+}
+
+export type HubStatus =
+  | { configured: false }
+  | {
+      configured: true;
+      url: string;
+      connected: boolean;
+      /** hub.allow_tools: agents use Hub's tools without asking. */
+      allowTools?: boolean;
+      team?: string;
+      label?: string;
+      /** Why it isn't connected, in words (never the token). */
+      problem?: string;
+    };
+
+/** The first object in a tool result: structured content, else JSON text. */
+function resultObject(r: unknown): Record<string, unknown> | null {
+  const o = r as {
+    structuredContent?: unknown;
+    content?: { type?: string; text?: string }[];
+  };
+  if (o?.structuredContent && typeof o.structuredContent === "object")
+    return o.structuredContent as Record<string, unknown>;
+  for (const c of o?.content ?? [])
+    if (c?.type === "text" && c.text)
+      try {
+        const v = JSON.parse(c.text) as unknown;
+        if (v && typeof v === "object") return v as Record<string, unknown>;
+      } catch {
+        /* not JSON */
+      }
+  return null;
+}
+
+/**
+ * Ask Hub who this install is: its whoami tool (the first tool whose name
+ * ends in "whoami"), over Streamable HTTP with the token. Bounded by
+ * `timeoutMs`; a failure is said in words, without the token.
+ */
+export async function hubWhoami(
+  url: string,
+  token: string,
+  opts: { timeoutMs?: number; fetch?: typeof fetch } = {},
+): Promise<HubWhoami> {
+  // Loaded here: only Settings › Hub and doctor ask Hub anything.
+  const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
+  const { StreamableHTTPClientTransport } =
+    await import("@modelcontextprotocol/sdk/client/streamableHttp.js");
+  const transport = new StreamableHTTPClientTransport(new URL(`${url}/mcp`), {
+    requestInit: { headers: { Authorization: `Bearer ${token}` } },
+    ...(opts.fetch ? { fetch: opts.fetch } : {}),
+  });
+  const client = new Client({ name: "den", version: "1" });
+  const timeout = opts.timeoutMs ?? 5000;
+  let timer: NodeJS.Timeout | undefined;
+  const bounded = <T>(p: Promise<T>) =>
+    Promise.race([
+      p,
+      new Promise<never>((_r, rej) => {
+        timer = setTimeout(
+          () => rej(new Error(`Hub did not answer in ${timeout} ms`)),
+          timeout,
+        );
+      }),
+    ]).finally(() => clearTimeout(timer));
+  try {
+    await bounded(client.connect(transport));
+    const tools = await bounded(client.listTools());
+    const who = tools.tools.find((t) => /whoami$/.test(t.name));
+    if (!who) return {};
+    const r = resultObject(
+      await bounded(client.callTool({ name: who.name, arguments: {} })),
+    );
+    const str = (v: unknown) => (typeof v === "string" && v ? v : undefined);
+    return {
+      ...(str(r?.team ?? (r?.team_name as unknown))
+        ? { team: str(r?.team ?? r?.team_name)! }
+        : {}),
+      ...(str(r?.label ?? r?.install ?? r?.install_label)
+        ? { label: str(r?.label ?? r?.install ?? r?.install_label)! }
+        : {}),
+    };
+  } finally {
+    await client.close().catch(() => undefined);
+  }
+}
+
+/** A message that is safe to show: the token, if it slipped in, cut out. */
+export function scrubToken(msg: string, token: string | null): string {
+  return token ? msg.split(token).join("[token]") : msg;
+}
+
+/** Settings › Hub and doctor: set, connected, and to whom. */
+export async function hubStatus(
+  deps: {
+    config?: () => HubConfig | null;
+    token?: (c: HubConfig) => Promise<string | null>;
+    whoami?: (url: string, token: string) => Promise<HubWhoami>;
+  } = {},
+): Promise<HubStatus> {
+  let cfg: HubConfig | null;
+  try {
+    cfg = (deps.config ?? (() => readHubConfig()))();
+  } catch (e) {
+    return {
+      configured: true,
+      url: "",
+      connected: false,
+      problem: (e as Error).message,
+    };
+  }
+  if (!cfg) return { configured: false };
+  if (!cfg.tokenRef)
+    return {
+      configured: true,
+      url: cfg.url,
+      allowTools: cfg.allowTools,
+      connected: false,
+      problem:
+        cfg.tokenFrom === "hub.token"
+          ? "no hub.token: set it to the install token's secret ref (Hub › Settings › Den installs makes one)"
+          : `hub.token names ${cfg.tokenFrom}, which is not set for this install's secrets backend`,
+    };
+  const token = await (deps.token ?? ((c) => readHubToken(c)))(cfg);
+  if (!token)
+    return {
+      configured: true,
+      url: cfg.url,
+      allowTools: cfg.allowTools,
+      connected: false,
+      problem: `${cfg.tokenFrom} could not be read from this install's secrets store`,
+    };
+  try {
+    const who = await (deps.whoami ?? ((u, t) => hubWhoami(u, t)))(
+      cfg.url,
+      token,
+    );
+    return {
+      configured: true,
+      url: cfg.url,
+      allowTools: cfg.allowTools,
+      connected: true,
+      ...who,
+    };
+  } catch (e) {
+    return {
+      configured: true,
+      url: cfg.url,
+      allowTools: cfg.allowTools,
+      connected: false,
+      problem: scrubToken(`Hub did not answer: ${(e as Error).message}`, token),
+    };
+  }
+}

package/src/shared/secrets/onepassword.ts

@@ -2,7 +2,7 @@
  * 1Password strategy — reads/writes item fields with the `op` CLI.
  * Selected with `secrets.provider: 1password`.
  */
-import { execFile } from "child_process";
+import { execFile, spawn } from "child_process";
 import { promisify } from "util";
 import type { PreflightResult, SecretRef, SecretsProvider } from "./types.js";
 import {
@@ -128,30 +128,108 @@ export class OnePasswordProvider implements SecretsProvider {
     }
   }
 
-  /** Overwrite the field; an item that isn't there yet is created (a Password item). */
+  /**
+   * Run `op` with `input` on its stdin. A secret goes this way, never in
+   * argv: any process on the machine can read another's command line.
+   */
+  private async runWithInput(args: string[], input: string): Promise<string> {
+    const { token: _t, ...opts } = await this.opOptions();
+    return new Promise((resolve, reject) => {
+      const child = spawn("op", args, {
+        env: opts.env,
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+      let stdout = "";
+      let stderr = "";
+      let killed = false;
+      const timer = setTimeout(() => {
+        killed = true;
+        child.kill("SIGTERM");
+      }, opts.timeout);
+      child.stdout.on("data", (d) => (stdout += String(d)));
+      child.stderr.on("data", (d) => (stderr += String(d)));
+      child.on("error", (e) => {
+        clearTimeout(timer);
+        reject(e);
+      });
+      child.on("close", (code) => {
+        clearTimeout(timer);
+        if (code === 0) resolve(stdout);
+        else
+          reject(
+            Object.assign(new Error(stderr.trim() || `op exited ${code}`), {
+              stderr,
+              killed,
+              code,
+            }),
+          );
+      });
+      child.stdin.on("error", () => undefined);
+      child.stdin.end(input);
+    });
+  }
+
+  /**
+   * Overwrite the field; an item that isn't there yet is created (a
+   * Password item). The value only ever travels on op's stdin, as the
+   * item's JSON (op item edit / op item create -), never in argv.
+   */
   async set(ref: SecretRef, value: string): Promise<void> {
     const vault = ref.vault ? ["--vault", ref.vault] : [];
-    const field = `${ref.field}[password]=${value}`;
+    type Field = {
+      id?: string;
+      label?: string;
+      type?: string;
+      purpose?: string;
+      value?: string;
+    };
+    let item: { id?: string; fields?: Field[] } | null = null;
+    let readErr: unknown = null;
     try {
-      await this.run(["item", "edit", ref.item, ...vault, field], true);
-    } catch (err) {
-      try {
+      item = JSON.parse(
         await this.run(
-          [
-            "item",
-            "create",
-            "--category",
-            "password",
-            "--title",
-            ref.item,
-            ...vault,
-            field,
-          ],
+          ["item", "get", ref.item, ...vault, "--format", "json", "--reveal"],
           true,
-        );
-      } catch {
-        throw err;
-      }
+        ),
+      ) as { id?: string; fields?: Field[] };
+    } catch (err) {
+      readErr = err;
+    }
+    if (item) {
+      const fields = item.fields ?? [];
+      const f = fields.find((x) => x.label === ref.field || x.id === ref.field);
+      if (f) {
+        f.value = value;
+        f.type = "CONCEALED";
+      } else fields.push({ label: ref.field, type: "CONCEALED", value });
+      item.fields = fields;
+      await this.runWithInput(
+        ["item", "edit", item.id || ref.item, ...vault],
+        JSON.stringify(item),
+      );
+      return;
+    }
+    const field: Field =
+      ref.field === "password"
+        ? {
+            id: "password",
+            type: "CONCEALED",
+            purpose: "PASSWORD",
+            label: "password",
+            value,
+          }
+        : { label: ref.field, type: "CONCEALED", value };
+    try {
+      await this.runWithInput(
+        ["item", "create", ...vault, "-"],
+        JSON.stringify({
+          title: ref.item,
+          category: "PASSWORD",
+          fields: [field],
+        }),
+      );
+    } catch {
+      throw readErr;
     }
   }
 

package/src/ui/cli/agent-ops.ts

@@ -256,6 +256,18 @@ export interface AgentsDeps extends SessionsDeps {
   userConfigFile?: () => string;
   /** D28: workspace `ws`'s services and their folders (the service scope). */
   workspaceServices?: (ws: string) => { address: string; path: string }[];
+  /**
+   * HUB-1.5: Den Hub's URL and this install's token (from its own store),
+   * or null when hub.url isn't set or the token can't be read (default:
+   * hub.* and the install's secrets backend).
+   */
+  hub?: () => Promise<{
+    url: string;
+    token: string;
+    allowTools?: boolean;
+  } | null>;
+  /** HUB-1.5: workspace `ws`'s repos as owner/repo (X-Den-Repos). */
+  workspaceRepos?: (ws: string) => string[];
 }
 
 export interface AgentsResolved extends Resolved {
@@ -272,6 +284,12 @@ export interface AgentsResolved extends Resolved {
   saveRuntimeBin: NonNullable<AgentsDeps["saveRuntimeBin"]>;
   userConfigFile: () => string;
   workspaceServices: (ws: string) => { address: string; path: string }[];
+  hub: () => Promise<{
+    url: string;
+    token: string;
+    allowTools?: boolean;
+  } | null>;
+  workspaceRepos: (ws: string) => string[];
 }
 
 /** The early-exit watch: at most this long, polling the host. */
@@ -327,6 +345,7 @@ let servicesFn: ((ws: string) => { address: string; path: string }[]) | null =
   null;
 let foldersFn: ((ws: string) => { under: string[]; exact?: string[] }) | null =
   null;
+let reposFn: ((ws: string) => string[]) | null = null;
 /** The workspaces config, for start and resume (loaded on first use). */
 export async function loadAgentWorkspaces(d: AgentsDeps): Promise<void> {
   await loadWorkspaces(d);
@@ -353,6 +372,50 @@ export async function loadAgentWorkspaces(d: AgentsDeps): Promise<void> {
       .listWorkspaceServices(cfg, readCatalog(), name)
       .map((r) => ({ address: r.address, path: r.repoPath }));
   };
+  const { ownerRepo } = await import("../../shared/hub.js");
+  reposFn = (name) => {
+    const cfg = ws.readWorkspacesFile().workspaces[name];
+    if (!cfg) return [];
+    const cat = readCatalog();
+    const out: string[] = [];
+    for (const r of ws.listWorkspaceServices(cfg, cat, name)) {
+      const slug = ownerRepo(cat[r.repoName]);
+      if (slug && !out.includes(slug)) out.push(slug);
+    }
+    return out;
+  };
+}
+
+/**
+ * HUB-1.5: Den Hub's MCP server for this agent, when hub.url is set and
+ * its token is readable: who calls (its name, a session id, the workspace
+ * and its repos), as headers. Hub sets the team and project from them.
+ */
+export async function agentHub(
+  d: AgentsResolved,
+  ws: string,
+  name: string,
+): Promise<AgentMcp["hub"] | undefined> {
+  const h = await d.hub().catch(() => null);
+  if (!h) return undefined;
+  const { HUB_SERVER, hubHeaders } = await import("../../shared/hub.js");
+  let repos: string[] = [];
+  try {
+    repos = d.workspaceRepos(ws);
+  } catch {
+    repos = [];
+  }
+  return {
+    name: HUB_SERVER,
+    url: h.url,
+    allowTools: h.allowTools !== false,
+    headers: hubHeaders(h.token, {
+      agent: name,
+      session: crypto.randomUUID(),
+      workspace: ws,
+      repos,
+    }),
+  };
 }
 
 /** The distribution's bin shim (as `mcp connect` registers), else Den's CLI. */
@@ -407,9 +470,29 @@ export function resolveAgentsDeps(d: AgentsDeps): AgentsResolved {
     userConfigFile: d.userConfigFile ?? userConfigPath,
     workspaceServices:
       d.workspaceServices ?? ((ws) => (servicesFn ? servicesFn(ws) : [])),
+    hub: d.hub ?? defaultHub,
+    workspaceRepos: d.workspaceRepos ?? ((ws) => (reposFn ? reposFn(ws) : [])),
   });
 }
 
+/** HUB-1.5: hub.* and the token from this install's store; null without. */
+async function defaultHub(): Promise<{
+  url: string;
+  token: string;
+  allowTools: boolean;
+} | null> {
+  const { readHubConfig, readHubToken } = await import("../../shared/hub.js");
+  let cfg;
+  try {
+    cfg = readHubConfig();
+  } catch {
+    return null; // a bad hub.* is doctor's and Settings' to say
+  }
+  if (!cfg) return null;
+  const token = await readHubToken(cfg);
+  return token ? { url: cfg.url, token, allowTools: cfg.allowTools } : null;
+}
+
 /**
  * ON-6: the server agent's scope is no workspace, but its agent is a
  * normal one: it "exists", and its folder is an empty one under the state
@@ -1799,11 +1882,29 @@ export async function startAgent(
     id,
     displayName: given ?? prev?.displayName ?? persona.displayName,
   });
-  const input = {
-    ...launchInput(d, cfg, persona, ws, id, model, det.path, undefined, {
+  const base = launchInput(
+    d,
+    cfg,
+    persona,
+    ws,
+    id,
+    model,
+    det.path,
+    undefined,
+    {
       ...(ch.permission ? { permission: ch.permission } : {}),
       ...(rt.permissions ? { allow } : {}),
-    }),
+    },
+  );
+  // HUB-1.5: Den Hub's MCP server, when hub.url is set.
+  const hub = await agentHub(
+    d,
+    ws,
+    given ?? prev?.displayName ?? persona.displayName ?? id,
+  );
+  const input = {
+    ...base,
+    ...(hub ? { mcp: { ...base.mcp, hub } } : {}),
     sessionLabel: peerName,
     ...(more.firstPrompt ? { firstPrompt: more.firstPrompt } : {}),
     // 0.4.18: Start agent here: in a folder of the workspace's.
@@ -2342,8 +2443,10 @@ export async function resumeAgent(
     // Resume in the cwd the agent had, wherever the workspace points now.
     // D24 (and D25: a rename since) the name peers see it by.
     const peerName = peerSessionName(d.cli, rec.workspace, rec);
+    const hub = await agentHub(d, rec.workspace, rec.displayName ?? rec.id);
     const at = {
       ...input,
+      ...(hub ? { mcp: { ...input.mcp, hub } } : {}),
       sessionLabel: peerName,
       worktree: rec.cwd,
       ...(rec.resumeToken ? { resumeToken: rec.resumeToken } : {}),

package/src/ui/cli/doctor-command.ts

@@ -473,6 +473,33 @@ export function whereCheck(r: WhereRow): OnboardCheck {
   };
 }
 
+/**
+ * HUB-1.5: doctor's Hub row, or none when hub.url isn't set. Never the
+ * token: hubStatus doesn't have it to give.
+ */
+export function hubLines(
+  st: import("../../shared/hub.js").HubStatus,
+  title: string,
+): { lines: string[]; problem: boolean; check?: OnboardCheck } {
+  if (!st.configured) return { lines: [], problem: false };
+  const who = [st.team && `team ${st.team}`, st.label && `install ${st.label}`]
+    .filter(Boolean)
+    .join(", ");
+  const detail = st.connected
+    ? `${st.url}: connected${who ? ` (${who})` : ""}`
+    : `${st.url || "hub.url"}: not connected: ${st.problem ?? "no answer"}`;
+  return {
+    lines: [
+      "",
+      `${title} doctor: Hub`,
+      "",
+      `  hub  ${st.connected ? "✓" : "⚠"}  ${detail}`,
+    ],
+    problem: false, // a Hub that is down never fails doctor: agents still run
+    check: { id: "hub", status: st.connected ? "ok" : "warn", detail },
+  };
+}
+
 export async function cmdDoctor(args: string[]): Promise<number> {
   const probe = args.includes("--probe");
   const json = args.includes("--json");
@@ -504,6 +531,11 @@ export async function cmdDoctor(args: string[]): Promise<number> {
     r.checks.push(
       ...(await whereRows(await defaultWhereDeps())).map(whereCheck),
     );
+    {
+      const { hubStatus } = await import("../../shared/hub.js");
+      const h = hubLines(await hubStatus(), readBrand().name);
+      if (h.check) r.checks.push(h.check);
+    }
     printJson(r);
     return r.ok ? 0 : 1;
   }
@@ -522,6 +554,12 @@ export async function cmdDoctor(args: string[]): Promise<number> {
     readBrand().name,
   ))
     console.log(l);
+  {
+    // HUB-1.5: only when hub.url is set.
+    const { hubStatus } = await import("../../shared/hub.js");
+    for (const l of hubLines(await hubStatus(), readBrand().name).lines)
+      console.log(l);
+  }
   for (const l of pollingLines(eventsFile(), readBrand().name)) console.log(l);
   const cli = product().cli;
   if (!probe) {

package/src/ui/cli/doctor-where.ts

@@ -115,11 +115,12 @@ export async function whereRows(d: WhereDeps): Promise<WhereRow[]> {
         }
       : host && !host.launchd
         ? {
-            // An older host and no service host behind it: what it lacks.
+            // An older host and no service host behind it: from an earlier
+            // version, so it can't say where it runs. Nothing is wrong.
             what: "session host",
-            session: `unknown (older host${host.pid ? `, pid ${host.pid}` : ""})`,
-            status: "warn",
-            detail: `${older} can't say where it runs, so whether its terminals and agents stop at logout is unknown. It is replaced the next time it exits. ${switchNow}`,
+            session: `older host${host.pid ? ` (pid ${host.pid})` : ""}`,
+            status: "info",
+            detail: `${older} is serving, from before this version, so it can't say whether its terminals and agents stop at logout. It picks up this version the next time it exits. Nothing to do. ${switchNow}`,
           }
         : host
           ? sessionRow("session host", host.launchd, d.cli, loginChosen)

package/src/ui/server/agent-routes.ts

@@ -173,6 +173,8 @@ export interface AgentRouteDeps {
   instruction?: { quietMs?: number; maxMs?: number };
   /** AG-18: how "after this turn" polls (tests: shorter). */
   personaWait?: { pollMs?: number; maxMs?: number };
+  /** HUB-1.5: GET /api/hub's answer (tests: a fake Hub). */
+  hubStatus?: () => Promise<import("../../shared/hub.js").HubStatus>;
 }
 
 const AGENTS_PATH =
@@ -426,6 +428,15 @@ export async function handleAgentRoutes(
     pathname === "/api/agents/resume-interrupted";
   if (pathname === "/api/agents/rotation")
     return rotationRoute(req, res, webDeps(deps.agents));
+  // HUB-1.5: Settings › Hub. Never the token: hubStatus doesn't return it.
+  if (pathname === "/api/hub") {
+    const method = req.method ?? "GET";
+    if (method !== "GET" && method !== "HEAD")
+      return methodNotAllowed(res, "GET");
+    const { hubStatus } = await import("../../shared/hub.js");
+    sendJson(res, await (deps.hubStatus ?? (() => hubStatus()))());
+    return true;
+  }
   if (
     pathname !== "/api/personas" &&
     pathname !== "/api/agents/runtimes" &&

package/src/ui/server/index.ts

@@ -283,6 +283,7 @@ import {
 } from "../../shared/cli-command.js";
 import { graphPrefs, patchStoredGraph } from "./graph-prefs.js";
 import { agentsLayout, patchAgentsLayout } from "./agents-layout-pref.js";
+import { patchHubAllowTools } from "../../shared/hub.js";
 import { editorOpen, patchEditorOpen } from "./editor-open-pref.js";
 import { graphPageHtml } from "./graph-page.js";
 import { mergeShellPrefs, shellPrefs, storedShell } from "./shell-prefs.js";
@@ -5017,6 +5018,8 @@ async function handleRequest(
   //     pane opens (AG-4b, editor-open-pref.ts); null clears it (none)
   //   language: the UI's language, en | ja | es (ui-language.ts); null or
   //     "en" clears it (English is the default)
+  //   hub_allow_tools: true | false, hub.allow_tools (HUB-1.5: agents use
+  //     Hub's tools without asking); null clears it (on)
   // It writes config/local/user.yml only. `distribution` is read-only: what
   // the org config (tracked) sets, for the Settings page's Distribution rows.
   // Every key POST accepts has a row in the Settings page's registry
@@ -5091,8 +5094,18 @@ async function handleRequest(
           machine_name?: unknown;
           agents_layout?: unknown;
           editor_open?: unknown;
+          hub_allow_tools?: unknown;
         };
         const user = readUserConfig();
+        // HUB-1.5: hub.allow_tools, Hub's tools without asking (Settings ›
+        // Agents › Hub); null clears it (the default, on).
+        if (body.hub_allow_tools !== undefined) {
+          const h = patchHubAllowTools(
+            user as Record<string, unknown>,
+            body.hub_allow_tools,
+          );
+          if (!h.ok) return send400(res, h.error);
+        }
         // AG-4b: the Agents tab's layout, a view preference only.
         if (body.agents_layout !== undefined) {
           const l = patchAgentsLayout(user, body.agents_layout);

package/src/ui/server/public/i18n/es.js

@@ -748,6 +748,7 @@
     "ver.usedLatest": "{n} ahora sigue la versión más reciente",
     "set.agents.personas": "Personas",
     "set.agents.rotation": "Rotación",
+    "set.agents.hub": "Hub",
     // The Agents tab (AG-4a-term, agents-page.js).
     "n.agents": "Agentes",
     "kind.agent": "Agente",

package/src/ui/server/public/i18n/ja.js

@@ -730,6 +730,7 @@
     "ver.usedLatest": "{n} は最新バージョンに追従します",
     "set.agents.personas": "ペルソナ",
     "set.agents.rotation": "交代",
+    "set.agents.hub": "Hub",
     // The Agents tab (AG-4a-term, agents-page.js).
     "n.agents": "エージェント",
     "kind.agent": "エージェント",

package/src/ui/server/public/settings-registry.js

@@ -912,6 +912,20 @@ export const DEN_SETTINGS = [
     read: () => null,
   },
 
+  {
+    id: "agents.hub",
+    category: "agents",
+    label: "Hub",
+    description:
+      "Every agent gets Hub's tools: search Hub, publish docs and mocks there. Its team and project come from this install's token and the workspace's repos. Set hub.url and hub.token (a secret ref in this install's store) in config/local/user.yml.",
+    keywords: ["hub", "den hub", "mcp", "team", "token", "docs", "mocks"],
+    scope: "user",
+    control: { type: "custom", render: renderHub },
+    keys: ["hub_allow_tools"],
+    read: () => null,
+    write: (v, ctx) => ctx.post({ hub_allow_tools: v }),
+  },
+
   {
     id: "agents.personas",
     category: "agents",
@@ -1276,6 +1290,9 @@ function renderRuntimes(host, ctx) {
   void load();
 }
 
+/** "an agent", "a persona": the article for a lowercase noun. */
+export const withArticle = (w) => `${/^[aeiou]/.test(w) ? "an" : "a"} ${w}`;
+
 const ROT_SCOPES = [
   ["agent", "Agent", "agent id"],
   ["persona-workspace", "Persona in a workspace", "persona@workspace"],
@@ -1376,7 +1393,7 @@ export function rotationHtml(b) {
   const field = (k, control) =>
     `<div class="rot-f" data-rot-key="${k}"><label for="rot-${k}">${escR(ROT_KEYS.find((x) => x[0] === k)[1])}</label>${control}<span class="set-tag" data-rot-src>${escR(inst[k] !== undefined ? "this install" : inherited(k))}</span></div>`;
   const sel = (k, opts) =>
-    `<select id="rot-${k}" data-focus-key="rot-${k}"><option value=""${inst[k] === undefined ? " selected" : ""}>inherit (${escR(inherited(k))})</option>` +
+    `<select id="rot-${k}" data-focus-key="rot-${k}"><option value=""${inst[k] === undefined ? " selected" : ""}>inherit (${escR(rotVal(b.org?.[k] !== undefined ? b.org[k] : b.defaults?.[k]))})</option>` +
     opts
       .map(
         ([v, l]) =>
@@ -1442,6 +1459,68 @@ export function rotationHtml(b) {
   );
 }
 
+/** HUB-1.5: Settings › Agents › Den Hub (b: GET /api/hub). */
+export function hubHtml(b) {
+  if (!b || !b.configured) return "";
+  const rows = [
+    ["URL", `<span class="den-mono">${escR(b.url || "not set")}</span>`],
+    [
+      "Status",
+      b.connected
+        ? `<span class="set-tag ok" data-hub-state="connected">Connected</span>`
+        : `<span class="set-tag warn" data-hub-state="down">Not connected</span>`,
+    ],
+    ...(b.team ? [["Team", escR(b.team)]] : []),
+    ...(b.label ? [["This install", escR(b.label)]] : []),
+  ];
+  const tools =
+    `<label class="hub-tools"><input type="checkbox" id="hub-allow-tools"${b.allowTools !== false ? " checked" : ""}> Agents use Hub's tools without asking</label>` +
+    `<p class="set-note" data-hub-tools-note>${
+      b.allowTools !== false
+        ? "Agents can publish and comment in Hub without asking; writes are versioned and stay in this install's team."
+        : "Agents ask before each Hub tool runs."
+    }</p>`;
+  return (
+    `<dl class="hub-st" data-hub>` +
+    rows.map(([k, v]) => `<dt>${escR(k)}</dt><dd>${v}</dd>`).join("") +
+    `</dl>` +
+    tools +
+    (!b.connected && b.problem
+      ? `<p class="set-note" data-hub-problem>${escR(b.problem)}</p>`
+      : "")
+  );
+}
+
+/** HUB-1.5: the Den Hub row; with no hub.url, the row isn't shown at all. */
+function renderHub(host, ctx) {
+  const row = host.closest(".set-row");
+  if (row) row.hidden = true;
+  // Under an invalid config /api/hub answers 422: ask nothing, show nothing.
+  if (ctx.shell?.configInvalid?.() === true) return Promise.resolve();
+  return ctx.shell
+    .api("GET", "/api/hub")
+    .then((b) => {
+      const html = hubHtml(b);
+      host.innerHTML = html;
+      if (row) row.hidden = !html;
+      const box = host.querySelector("#hub-allow-tools");
+      if (box)
+        box.addEventListener("change", () => {
+          box.disabled = true;
+          ctx.shell
+            .api("POST", "/api/settings", { hub_allow_tools: box.checked })
+            .then(() => renderHub(host, ctx))
+            .catch(() => {
+              box.checked = !box.checked;
+              box.disabled = false;
+            });
+        });
+    })
+    .catch(() => {
+      host.innerHTML = "";
+    });
+}
+
 /** The Rotation row: this install's values, the overrides, + Add override. */
 function renderRotation(host, ctx) {
   const err = () => host.querySelector(".rt-err");
@@ -1562,7 +1641,7 @@ function renderRotation(host, ctx) {
         message:
           scope === "persona-workspace"
             ? "Pick a persona and a workspace."
-            : `Pick a ${(ROT_SCOPES.find((x) => x[0] === scope) || [scope, scope])[1].toLowerCase()}.`,
+            : `Pick ${withArticle((ROT_SCOPES.find((x) => x[0] === scope) || [scope, scope])[1].toLowerCase())}.`,
       });
       return;
     }

package/src/ui/server/public/settings.html

@@ -451,9 +451,34 @@
         min-width: 0;
         max-width: 100%;
       }
+      /* A select never cuts its own words: it wraps to its own line. */
+      .rot-f select {
+        min-width: min(100%, max-content);
+      }
       .rot-add {
         margin-top: 10px;
       }
+      /* HUB-1.5: Settings › Agents › Hub. */
+      .hub-st {
+        display: grid;
+        grid-template-columns: max-content 1fr;
+        gap: 4px 12px;
+        margin: 0;
+      }
+      .hub-st dt {
+        color: var(--muted);
+      }
+      .hub-st dd {
+        margin: 0;
+        min-width: 0;
+        overflow-wrap: anywhere;
+      }
+      .hub-tools {
+        display: flex;
+        gap: 8px;
+        align-items: center;
+        margin-top: 10px;
+      }
       /* D30: the add form: each control with its label, wrapping. */
       .rot-pick {
         display: inline-flex;

package/src/ui/server/public/shell.js

@@ -856,6 +856,7 @@
     "ver.usedLatest": "{n} now tracks the latest version",
     "set.agents.personas": "Personas",
     "set.agents.rotation": "Rotation",
+    "set.agents.hub": "Hub",
     // The Agents tab (AG-4a-term, agents-page.js).
     "n.agents": "Agents",
     "kind.agent": "Agent",

package/src/ui/server/route-classes.ts

@@ -388,6 +388,10 @@ export const ROUTES: readonly RouteEntry[] = [
     "/api/agents/rotation",
     "D28: rotation settings, the overrides and an agent's effective values",
   ),
+  R(
+    "/api/hub",
+    "HUB-1.5: Den Hub: its URL, connected or not, the team and the install's label (never the token)",
+  ),
   M(
     ["PUT"],
     "/api/agents/rotation",