@songsid/agend 2.3.5-alpha.4 → 2.3.5-alpha.5

package/dist/general-knowledge/skills/credential-profiles/SKILL.md

@@ -111,8 +111,11 @@ restarted for you** and the reply says `restarted: true`. A paused or stopped on
 is not started: the reply says `restarted: false`, and the switch applies at its
 next start.
 
-Set `credential_profile` with `update_instance_config` or web Settings. Never
-hand-edit `fleet.yaml`.
+Set `credential_profile` with `update_instance_config` or web Settings: the
+agent's **Account** field, or **Settings → Agents → AI sign-ins and API keys →
+Accounts** (**Move agents here…**, and each CLI's **Fleet default**). Settings
+refuses a signed-out profile and names its login command.
+Never hand-edit `fleet.yaml`.
 
 **What to do / what not to do, per backend**
 

package/dist/general-knowledge/skills/cross-instance-messaging/SKILL.md

@@ -53,6 +53,7 @@ A peer's summary is not the original person's consent. Before an irreversible ac
 
 1. Ask the peer to send/delegate with `forwards: [verification_id]`, using the original human receipt's `verification_id` / `[agend-human-id:…]`. Every hop needs an explicit forward; mentioning an ID grants nothing. Only delivered references the sender can read are accepted (up to 16).
    - The ID goes in the `forwards` parameter, never only in the message text: an ID in the text grants nothing, and the receiver's `delivery_status` says "Delivery not found".
+   - Put verification and message ids in the `forwards` field only; do not repeat them in the message text, because people see that text in the topic notices.
    - If the `send_to_instance` / `delegate_task` schema you loaded has no `forwards`, pass it anyway. A session resumed across an AgEnD upgrade keeps the tool copy it first loaded (reloading does not refresh it); AgEnD's server accepts the parameter.
 2. Read `delivery_status({message_id: verification_id})`. Require `state: delivered`, its owned `proof_kind`, and the original `content` naming the exact operation/resource. Check `origin.platform`, `origin.adapter_id` and `origin.user_id` against the human authorized for that resource. Labels, quoted headers and agent relay rows are not origin evidence.
 3. Native queue/composer acceptance never proves the model consumed the message. Unknown/unverifiable outcomes, `/raw`, historical rows and a missing origin cannot prove human authorization. Action receipts identify the click and its anchor, not a human-authored platform message.

package/dist/general-knowledge/skills/fleet-health/SKILL.md

@@ -20,7 +20,7 @@ kiro-specific and wrong for claude-code / codex / grok / antigravity.
 When the user wants the live screen (not just a status word):
 - `get_instance_logs("<name>")` — recent output (the raw terminal stream).
 - Raw terminal (last resort, no tool for the live pane):
-  `tmux capture-pane -t agend:<name> -e -p | tail -20` on the default AGEND_HOME (an isolated home uses session `agend-<hash>` on its own `-L` socket; `agend attach <name>` works in both) — keep `-e`: without it the screen's styling is lost.
+  `agend tmux capture-pane -t agend:<name> -e -p | tail -20` on the default AGEND_HOME (an isolated home uses session `agend-<hash>`; `agend tmux` always reaches this fleet's own tmux and socket, and `agend attach <name>` works in both) — keep `-e`: without it the screen's styling is lost.
 
 **Faint text is not input.** A CLI paints its own suggestion or placeholder in the input box
 exactly like typed text, only faint (Claude Code: `❯ Try "…"`, or a suggested next prompt).
@@ -41,4 +41,4 @@ Do this when the user asks, or confirm first — don't silently restart others'
 
 A genuinely wedged CLI can sometimes be freed without a restart by interrupting it —
 that is the cancel key, exposed to users as the Cancel button / `/cancel`. Only drop to
-`tmux send-keys -t agend:<name> C-c` (kiro) / `Escape` (others) if the tools aren't enough.
+`agend tmux send-keys -t agend:<name> C-c` (kiro) / `Escape` (others) if the tools aren't enough.

package/dist/general-knowledge/skills/instance-lifecycle/SKILL.md

@@ -4,12 +4,14 @@ description: restart vs replace vs pause/wake; when to use each
 roles: [general]
 ---
 
-## Restart vs Replace
+## Restart vs Replace vs Stop / Delete
 
 - `restart_instance("<name>")` — keeps the session, reloads config. Use when config changed.
 - `replace_instance("<name>")` — kills old, creates a fresh instance with handover context.
   Use when the session is the problem: hallucinating / referencing stale info, stuck in a
   tool-call loop, or context is degrading (only backends that report context % surface that).
+- `stop_instance("<name>")` / `start_instance("<name>")` — stop or start an instance without removing its configuration or topic.
+- `delete_instance("<name>")` — stop and remove the instance, its schedules and team memberships, and its own chat topic (by default; pass `delete_topic: false` to keep the topic). On Discord the topic is a channel, so its history goes too. The General topic and a topic another agent uses are never deleted. The result's `topic_deleted` is the platform's answer; when it is false, `topic_reason` says why (for example, the Telegram bot lacks the Manage Topics admin right) — the agent is deleted either way.
 
 ## Pause / Wake (resource management)
 

package/dist/general-knowledge/skills/kiro-engine-migration/SKILL.md

@@ -10,6 +10,24 @@ roles: [general]
   instances as configured, so AgEnD stopped them and will not retry.
 - Or the user asks about kiro's engine change: Classic/legacy UI being deprecated, kiro-cli 3.0, or V3.
 
+## Kiro CLI 3.0: current refusal and migration instructions
+
+Kiro CLI 3.0 removed Classic. AgEnD refuses a Classic launch on major 3 or later before launching it or changing
+its saved conversation. Needs you names the Agent and explains how to continue. If a retirement/V2-V3 choice appears
+in an already running pane, AgEnD blocks messages and leaves the choice to the owner; never answer it for them.
+An explicitly pinned TUI/V2 launch remains allowed: it is not a Classic launch.
+
+For Classic today, ask the host owner to use a compatible Kiro CLI 2.x. The existing admin-confirmed Classic→TUI
+migration below requires **2.34+ within 2.x**, not 3.x. Do not remove the migration version fence or edit `kiro_ui` to
+bypass it. Keep the original pin, history and receipts; never resume a frozen Classic copy after work continued on V2.
+
+The guided **admin-confirmed migration on 2.x followed by a safe upgrade to 3.0 (plan C, #3047)** is coming separately.
+It is not implemented by this refusal/Needs-you change. Do not promise an automatic conversion or an upgrade date.
+
+繁體中文：Kiro CLI 3.0 已移除 Classic。請由主機管理者改用相容的 2.x；這個拒絕啟動的保護不會更動已存對話。
+既有管理員確認的 Classic→TUI 遷移只接受 2.34 以上的 **2.x**。先在 2.x 經管理員確認遷移、再安全升級到 3.0
+的引導流程（計畫 C，#3047）會另外提供，並未包含在這次保護裡。不要直接改 `kiro_ui` 或刪除版本檢查來繞過。
+
 ## What is true
 
 - **Each kiro instance's conversation lives in its engine's own store:**
@@ -56,11 +74,30 @@ The user has already been shown the plain notice in this topic. When they ask, e
 - Never run `kiro-cli` yourself, and never delete or edit anything under `~/.kiro` or kiro's data directory.
 - Never reply to the `[system:kiro-incompat]` notice itself. It is information, not a request.
 
+## Preparing for Kiro CLI 3.x
+
+1. Call `kiro_engine_status` with no name filter. Its `kiro3_readiness` summary counts **all** Kiro Agents and
+   Classic rooms, including General; filtering to one Agent still keeps that whole-fleet count. A Classic Agent
+   is not ready for Kiro 3.x. This readiness describes the removal of Classic, not a promise that every 3.x
+   release supports every session or tool.
+2. Keep a compatible Kiro **2.x** installed. For each Classic fleet Agent, ask the owner to confirm the existing
+   `migrate_kiro_instance` move described below. Do not change `kiro_ui` by hand. Wait for the same conversation
+   and model to pass both verification starts; failure stops the Agent for inspection. The migration itself is
+   unchanged and is not available on 3.x.
+3. A **ClassicBot room** cannot use `migrate_kiro_instance`: its owner must change the room to another backend
+   in Classic settings, or continue using Kiro 2.x. Such rooms count as still Classic until their effective Kiro
+   configuration no longer selects Classic. Do not present a fleet-Agent migration tool as room recovery.
+4. Check `kiro_engine_status` again: every remaining Kiro Agent must use TUI (or already use V3), and the
+   `still_classic` count must be zero before recommending an upgrade. General is subject to the same check.
+5. The owner then upgrades Kiro themselves. AgEnD neither installs the CLI nor answers a V2/V3 menu. If a menu
+   or an unverified resume blocks startup, inspect Needs-you; do not clear the pin or start a fresh conversation
+   to make the check pass. The version-specific exact-resume evidence is documented separately from readiness.
+
 ## Moving an instance from classic to the TUI engine (#2598)
 
 kiro-cli 3.0 drops the classic engine (`kiro_ui: legacy`), so classic instances are being moved to the TUI engine,
-**one batch at a time and only with the user's OK for that batch**. The move is `migrate_kiro_instance` (a
-coordinator-level tool; you do not have it). It carries the conversation: the instance's classic conversation is
+**one batch at a time and only with the user's OK for that batch**. The move is `migrate_kiro_instance` (available
+in the `general`, `coordinator` and `full` tool sets). It carries the conversation: the instance's classic conversation is
 resumed once under the TUI and becomes its own. A fleet admin confirms each move in this General topic: a
 "Move it / Cancel" prompt. Explain it if asked; never press it on the user's behalf.
 
@@ -92,8 +129,8 @@ session identity after `/chat` or `/clear`.
   this instance's. When it can't be proven, or the check passes its 30 s / 2 GiB limit, the instance resumes the
   conversation on record and the Log tab says why.
 - **Two conversations after an interrupted carry (#2753).** When a stopped TUI instance has its original carried
-  conversation and a newer one with work, recovery holds instead of choosing. `reconcile_kiro_instance` (full and
-  coordinator tool sets) asks a fleet admin to confirm, in General, keeping the original and archiving the named
+  conversation and a newer one with work, recovery holds instead of choosing. `reconcile_kiro_instance` (general,
+  coordinator and full tool sets) asks a fleet admin to confirm, in General, keeping the original and archiving the named
   newer one intact. Offer it only after the user chose those exact ids; docs/kiro-reconciliation.md explains it.
 - **"Kiro's terminal is in use by another program" (#2682).** While a kiro pane runs `/editor`, `/transcript`, a
   `!` command or a focused `/kvim` panel (legacy: `/editor`, `/reply`, `!`), AgEnD holds deliveries. Tell the user

package/dist/general-knowledge/skills/session-management/SKILL.md

@@ -67,7 +67,7 @@ cur.execute("SELECT value FROM conversations_v2 WHERE conversation_id = ?", (tar
 open('<instance-workspace>/restore.json', 'w').write(cur.fetchone()[0])
 ```
 ```bash
-tmux send-keys -t agend:<instance> '/chat load restore.json' Enter
+agend tmux send-keys -t agend:<instance> '/chat load restore.json' Enter
 # Success: "✔ Imported chat session state", context % jumps up
 ```
 

package/dist/general-knowledge/skills/tui-effort/SKILL.md

@@ -34,10 +34,10 @@ agend reload
 
 ```bash
 INSTANCE='<instance-name>'
-tmux send-keys -t "agend:${INSTANCE}" -l '/effort max'
-tmux send-keys -t "agend:${INSTANCE}" Enter
+agend tmux send-keys -t "agend:${INSTANCE}" -l '/effort max'
+agend tmux send-keys -t "agend:${INSTANCE}" Enter
 sleep 1
-tmux capture-pane -t "agend:${INSTANCE}" -p | tail -5
+agend tmux capture-pane -t "agend:${INSTANCE}" -p | tail -5
 ```
 
 成功回應：
@@ -58,19 +58,19 @@ kiro_default · claude-sonnet-4.6 · Max · ◔ 10% · λ ...
 
 ```bash
 INSTANCE='<instance-name>'
-tmux send-keys -t "agend:${INSTANCE}" -l '/effort'
-tmux send-keys -t "agend:${INSTANCE}" Enter
+agend tmux send-keys -t "agend:${INSTANCE}" -l '/effort'
+agend tmux send-keys -t "agend:${INSTANCE}" Enter
 sleep 1
-tmux capture-pane -t "agend:${INSTANCE}" -p | tail -10
+agend tmux capture-pane -t "agend:${INSTANCE}" -p | tail -10
 ```
 
 如需 tmux 自動導航，每個按鍵**分開送**並加短暫間隔：
 
 ```bash
-tmux send-keys -t "agend:${INSTANCE}" Down; sleep 0.2
-tmux send-keys -t "agend:${INSTANCE}" Down; sleep 0.2
-tmux send-keys -t "agend:${INSTANCE}" Down; sleep 0.2
-tmux send-keys -t "agend:${INSTANCE}" Enter
+agend tmux send-keys -t "agend:${INSTANCE}" Down; sleep 0.2
+agend tmux send-keys -t "agend:${INSTANCE}" Down; sleep 0.2
+agend tmux send-keys -t "agend:${INSTANCE}" Down; sleep 0.2
+agend tmux send-keys -t "agend:${INSTANCE}" Enter
 ```
 
 **不要假設固定次數 = 固定 level。** 游標初始在 Low，每次 Down 移一格；支援 `xhigh` 的 model 會多一個選項，所需次數不同。自動化一律用 `/effort <level>`。

package/dist/general-knowledge/skills/web-dashboard/SKILL.md

@@ -79,7 +79,7 @@ lists every page (**Pages (N)**), shows a page at phone or tablet width, and goe
 - `/web revoke` (in chat) signs every browser out, withdraws an unused code and closes the public link.
 
 **`/view` without signing in.** `web.view_access`: `open` (default) or `session`. With `open`, anyone who can reach
-the local address sees every instance's live terminal and the roster (status, context %, model, effort, backend,
+the local address sees every instance's live terminal (for Claude Code with its earlier conversation, as below) and the roster (status, context %, model, effort, backend,
 tags, name, description, avatars, cards) and the usage meters — read only; editing says "Sign in to edit". Over a
 public link `/view` always needs sign-in.
 
@@ -101,7 +101,7 @@ They can chat there unless `web.guests.chat` is false, run only the commands the
 agent's channel (on the web: `/ctx`, `/steer`, `/btw`, `/cancel`; anything else is refused), open the usage panel, and the
 agent sees them as `via web (guest)`. A guest's app has no Fleet, Settings or Needs you. Each person is **Chat** (the
 default) or **Trusted** (#2855, `level: trusted` on the grant; Chat → Trusted waits for a fleet admin): a Trusted guest
-also gets a read-only **View** of those agents (no typing; 2 reads a second, 2 agents at once) and **search** of the chat
+also gets a read-only **View** of those agents (no typing; 2 reads a second, 2 agents at once; for Claude Code with its earlier conversation) and **search** of the chat
 messages it can already see (6 a minute, 20 results; no messages between agents, tasks or settings). To invite someone: turn it
 on, grant them their agents in Settings → Access & security → Guests, and press **Send sign-in code** (or tell them to
 send `/web`). The Guests section is not in Settings over the public link.
@@ -233,20 +233,31 @@ values reloaded after Save. Password fields keep the browser's behaviour.
 ## Fleet
 
 `/ui/fleet/<tab>`: **Tasks**, **Schedules**, **Teams**, **Org chart**, **Cache**, plus a **Docs** link
-(`/ui/fleet/config` leads to Settings → Agent defaults: each of its settings lives in Settings, #2347).
+(`/ui/fleet/config` leads to Settings → Shared agent settings: each of its settings lives in Settings, #2347).
 The sidebar's **Fleet** (zh "Fleet 概覽", at the top) and the phone's Fleet tab open the Fleet tab this device used last
 (`agend_last_fleet_tab`; the Org chart the first time). The sidebar has no separate Fleet (Details) or View row.
 - **Tasks** — the task board: Home lists **projects** (with % done) and what waits for the person (**Confirm** /
   **Send back** finished work, **Answer** a blocked card — #2756: only the cards the person handed out, as Needs you;
   an agent's card in review says "Waiting for <agent>"); **No project** holds `task`-tool tasks. A project is a board
-  of main tasks (M-n) by status — To do, In progress, Blocked, To confirm, Done — with drag to move, an assignee
-  filter and each main task's sub tasks (S-n). A card opens in a dialog: every field editable, its sub tasks, comments,
+  of main tasks (M-n) by status — To do, In progress, Blocked, To confirm, Done — with drag to move and each main
+  task's sub tasks (S-n). **Filter** (status, assignee or nobody, priority, size; each chip **is** / **is not**; a main
+  task stays when it or a sub task matches) and **Display** (board or **list**; the list grouped by status, assignee or
+  priority, ordered by board order, priority, last change, newest or title; **Sub tasks as rows of their own**;
+  finished cards last 7 days / all / hidden). The project and filters are in the address (`?tp=`, `?tf=`): a link opens
+  that filtered board; the choices are remembered per device (`agend_tasks_display`, `agend_tasks_filters`). A card opens in a dialog: every field editable, its sub tasks, comments,
   progress log, history. **Search cards** in the header. Only a signed-in person confirms the work they handed out
   (an instance's `done` on such a card is review); a card an agent handed out, that agent confirms (#2434). No
-  delete: cancel. Alt+arrows on a card's title move it (no drag needed; the card's Position row on a phone). A main
+  delete: cancel. Alt+arrows on a card's title move it (no drag needed; the card's Position row on a phone). A right
+  click on a card (tile, list row, waiting row; or the menu key / Shift+F10) opens its menu: Open, Confirm / Send
+  back / Answer when it waits for the person, Move to, Assignee, Priority, Copy link / number, Cancel (Shift+right
+  click keeps the browser's menu). An open card's arrows (or K / J) step to the previous / next card the page showed
+  (a sub task: its siblings). A main
   task's tile shows the sub task at work and who is on it; a card waiting for review that is not wrapped up says
   **To fill in** and Confirm asks first. A card's **Dispatched by** row: who handed it out (a blocked question goes
-  to them first). Read-only over the public link.
+  to them first). An agent with the task board off (Dashboard access) is greyed out as an assignee: the board hands
+  it no cards. **Insights** (beside the project's numbers): its cards counted per assignee / status / priority / size,
+  each row a bar split by status, priority or size, every card or main tasks only — what the board shows
+  (`agend_tasks_insights` keeps the choices). Read-only over the public link.
 - **Schedules** — every schedule (silent ones included): when it runs in words, "next …", the target. **New
   schedule** (Repeat with a cron expression, or Once at a date and time; message, target, label, timezone),
   **Edit** (with an **Enabled** box — that is how you pause one), **Delete**. There is no "run now", and silent can't
@@ -383,6 +394,11 @@ to that instance's Log).
 
 **Chat | View | Log | Details** switch at the top of an instance.
 - **View** — the live terminal (read only), the identity card, and **Edit profile** (or **Sign in to edit** when signed out).
+  Scrolling up (or **Earlier output**) shows what scrolled off: tmux's scrollback; for Claude Code, its earlier
+  conversation from its transcript, drawn in Claude's own terminal style above the live screen under **History above**
+  (long output folded, click to expand; older pages near the top; the latest ~1000 steps), tool results included.
+  Everyone who may open the View sees it — a signed-in admin, an anonymous reader under `view_access: open`, a Trusted
+  guest for its agents (the user's decision on #3069); the Log tab's switch plays no part.
 - **Log** — [the Log tab](#the-log-tab).
 - **Details** — Configuration (display name, description, directory, bound to, tags; "Read only — change it in
   Settings." with **Edit in Settings**), Runtime (backend, model, effort, cost, context, 5 h and 7 d rate), Recent
@@ -473,13 +489,13 @@ running; kiro shows fleet events only; other backends say they have no readable
 **Chat & connections → Retry now** retries a disconnected connection without a fleet restart; a running login is reused. Startup retries continue with a five-minute cap. Local admin only, unavailable over public links. It changes no token or binding; refresh to read the later result.
 
 Sections (`/settings/<section>`, #2347), in two groups. **You**: **Preferences**, **Look**. **Fleet**: **Agents**,
-**Agent defaults**, **Chat & connections**, **Web dashboard**, **Access & security**, **Advanced**. Old addresses (`device`,
+**Shared agent settings**, **Chat & connections**, **Web dashboard**, **Access & security**, **Advanced**. Old addresses (`device`,
 `appearance`, `general`, `bots`, `classic`, `web`) lead to the new sections. **Search settings** (top of the sections, **/**;
 also Ctrl K → Settings) finds a setting by name, `fleet.yaml` key or synonym in either language and goes to the field.
 Header: version, **Setup wizard**, **Help**.
 
 **How changes apply (#2347).** Every Fleet section's edits are unsaved until
-**Save**: a field edit (Agent defaults, Chat & connections, Web dashboard, Access & security) is unsaved at once (a straight bar on its left); a dialog's **Done**
+**Save**: a field edit (Shared agent settings, Chat & connections, Web dashboard, Access & security) is unsaved at once (a straight bar on its left); a dialog's **Done**
 adds its changes. The bar **N unsaved change(s)** shows the cost — **Immediately**, **Restart this Agent** or **Restart
 AgEnD** — then **Save** or **Discard**; an invalid field keeps Save waiting (**Fix 1 field(s) to save**). Over a public
 link an admin can change the fleet's settings too (not the dashboard's own web settings, Guests or Web authority).
@@ -497,7 +513,7 @@ link, an unverified browser or a change that needs the host CLI. After a failure
 |---|---|---|
 | Your name (**Save**, **Use web-user** / **Use <account>**) | the name agents see on your web messages | your profile |
 | Theme: System / Light / Dark | page theme | host prefs `theme` |
-| Language: English / 中文 | page language (not the bots' replies — that is Agent defaults → Language) | host prefs `lang` |
+| Language: English / 中文 | page language (not the bots' replies — that is Shared agent settings → Language) | host prefs `lang` |
 | Names: Nickname first / Real name first | sidebar names | host prefs `names.primary` |
 | Allow HTML previews | the preview opt-in | host prefs `preview.optIn` |
 | Chat tour (this device) | replays the chat tour | browser |
@@ -520,7 +536,7 @@ backend skipped at first setup shows in Needs you even before an agent uses it.
 **Agents** — **New agent**; per agent **Settings**, **Pause / Wake**, **Start / Stop** (direct), ⋯ **Delete agent**
 (staged; on Apply it waits for a fleet admin's confirmation in General, then the agent is stopped and removed, as
 `delete_instance` does — no restart). The agent dialog writes `instances.<name>.*` (an "Inherit" box removes the key, and the field then says what it inherits:
-"Inherited: 30 min · change in Agent defaults"; a value nobody set anywhere is marked "default"):
+"Inherited: 30 min · change in Shared agent settings"; a value nobody set anywhere is marked "default"):
 | Label | Key | Applies |
 |---|---|---|
 | Display name, Description | `display_name`, `description` | now |
@@ -531,7 +547,7 @@ backend skipped at first setup shows in Needs you even before an agent uses it.
 | Agent mode, Tool set | `agent_mode`, `tool_set` | agent |
 | Tool progress; Bot-to-bot messages in topics (full / summary / hidden); Log level | `tool_progress`, `cross_instance_visibility`, `log_level` | now |
 | Require a delivered reply | `reply_completion_guard` | now |
-| Daily tips (Topic / Off; always posted in General, never by DM) | `tips` | now |
+| Daily tips (an on / off switch; always posted in General, never by DM) | `tips` | now |
 | Lightweight mode, Fallback model | `lightweight`, `model_failover` | agent |
 | System prompt | `systemPrompt` | agent |
 | Tags | `tags` | now |
@@ -550,11 +566,11 @@ ClassicBot (in **Chat & connections**, `/settings/chat#classicbot`) — per room
 `channels.<key>.*`: Backend, Model, Auto-pause after, **Collaboration mode** (`collab`), **Web echo** (`web_echo`),
 Advanced **Context lines** (these restart the room's agent); Tool progress and Require a delivered reply (now).
 
-**Agent defaults** — **Project folders** (`project_roots`: where New agent may put an agent; empty = anywhere;
+**Shared agent settings** (two cards: *Shared agent settings*, which an individual agent can override, each with "N/M in use" and the agents that set their own; and *System & channels*, one value for the whole fleet; a note about what saving costs appears under a field only once it is edited) — **Project folders** (`project_roots`: where New agent may put an agent; empty = anywhere;
 changing it waits for a fleet admin's OK) and the fleet defaults (`defaults.*`): **Language (bot replies)** (`locale`: Auto / en / zh-TW), default
 backend and model, auto-pause, tool progress, bot-to-bot visibility, reply guard, **Native replies trigger ClassicBot**
 (`reply_triggers`: a native reply triggers a ClassicBot bot; off by default, #2576); Advanced: tool set, agent mode, log
-level, **Hang detector enabled** / **Stuck timeout** (`hang_detector.*`), **Startup concurrency** (1–20) and
+level, **Hang detector** (on/off and its minutes) (`hang_detector.*`), **Startup concurrency** (1–20) and
 **Stagger delay** (`startup.*`, restart AgEnD). ClassicBot defaults (in Chat & connections; `classicBot.yaml defaults.*`): default backend, tool
 progress, reply guard, **Native replies trigger ClassicBot** (`reply_triggers`, also per room), **ClassicBot admins**,
 **Allowed guilds**.
@@ -579,7 +595,7 @@ Shown read-only ("Set in fleet.yaml"): `web.allowed_hosts`, `view_access`, `prev
 `upload_max_total_mb`, `web_terminal.bind`, `web_terminal.tunnel`.
 
 **Advanced** — fleet.yaml as **YAML / JSON**, **Edit / View**, **Copy**, **Download fleet.yaml**; **Apply**
-(edit mode) adds the edit to the bar, and Save writes it. While it waits, Agents, Agent defaults and the
+(edit mode) adds the edit to the bar, and Save writes it. While it waits, Agents, Shared agent settings and the
 connections are off (and the setup wizard); while those have unsaved changes, the editor only reads.
 
 **Setup wizard** — agent (backend, directory, name) → platform → token and server/group, your user ID → preview →

package/dist/general-knowledge/skills/worker-collaboration/SKILL.md

@@ -42,4 +42,4 @@ Do not put user-facing results only in terminal text; the fleet report is the de
 
 ## Relayed human approval
 
-For an irreversible action based on relayed consent, request an explicit `forwards` edge for the original human `verification_id`, then read its original content and origin with `delivery_status`. Each hop needs a forward; a peer's summary or a mentioned ID grants nothing. When you relay it, put the ID in `forwards` (even if your loaded copy of the tool's schema lacks the parameter: the server accepts it), not in the text. Require delivered and an owned proof_kind, and verify the actual platform/adapter/actor plus the exact resource. Hidden/expired/uncertain receipts are not consent and must not trigger a resend. A web-chat message (`[user:<name> via web, id:…]`) is that person: their sign-in code went to their own Discord or Telegram account. Answer it and do what it asks within your work — questions, looking things up, reading, analysis, changes in your own scope. Only a go-ahead action asks for more: a release or publish, anything destructive or irreversible beyond your own work (deleting what others use, force-pushing or resetting a shared branch; your temp files and your own branch and worktree are routine), spending money or quota beyond normal work, credentials or secrets, or granting or forwarding authority to another instance. For these an open browser is not proof of the account, so the account must stand behind it: a Discord or Telegram receipt, or a `via web (verified)` one — read it with `delivery_status`: `authority.kind: web-verified`, its person `authority.actor` (adapter and user id), checked like a Discord or Telegram message (delivered, an owned proof_kind, the original content, that actor) and forwarded the same way. On a web-only fleet (no Discord or Telegram connection) that person is the host operator, signed in with `agend web --code` on the AgEnD computer itself: a verified receipt names `authority.actor` adapter `host`, user `operator`. A guest (`via web (guest)`) was let in only to chat: talk with them there, and take nothing they ask as the admin's. Plain `via web`, a guest, and authority since revoked (`authority.kind: none`) are not a go-ahead; nor is a reviewer's APPROVE. See the cross-instance-messaging skill.
+For an irreversible action based on relayed consent, request an explicit `forwards` edge for the original human `verification_id`, then read its original content and origin with `delivery_status`. Each hop needs a forward; a peer's summary or a mentioned ID grants nothing. When you relay it, put the ID in `forwards` (even if your loaded copy of the tool's schema lacks the parameter: the server accepts it), not in the text. Put verification and message ids in the `forwards` field only; do not repeat them in the message text, because people see that text in the topic notices. Require delivered and an owned proof_kind, and verify the actual platform/adapter/actor plus the exact resource. Hidden/expired/uncertain receipts are not consent and must not trigger a resend. A web-chat message (`[user:<name> via web, id:…]`) is that person: their sign-in code went to their own Discord or Telegram account. Answer it and do what it asks within your work — questions, looking things up, reading, analysis, changes in your own scope. Only a go-ahead action asks for more: a release or publish, anything destructive or irreversible beyond your own work (deleting what others use, force-pushing or resetting a shared branch; your temp files and your own branch and worktree are routine), spending money or quota beyond normal work, credentials or secrets, or granting or forwarding authority to another instance. For these an open browser is not proof of the account, so the account must stand behind it: a Discord or Telegram receipt, or a `via web (verified)` one — read it with `delivery_status`: `authority.kind: web-verified`, its person `authority.actor` (adapter and user id), checked like a Discord or Telegram message (delivered, an owned proof_kind, the original content, that actor) and forwarded the same way. On a web-only fleet (no Discord or Telegram connection) that person is the host operator, signed in with `agend web --code` on the AgEnD computer itself: a verified receipt names `authority.actor` adapter `host`, user `operator`. A guest (`via web (guest)`) was let in only to chat: talk with them there, and take nothing they ask as the admin's. Plain `via web`, a guest, and authority since revoked (`authority.kind: none`) are not a go-ahead; nor is a reviewer's APPROVE. See the cross-instance-messaging skill.

package/dist/general-role.d.ts

@@ -1,5 +1,5 @@
 /** Shared General role text; native publication never loads a coordinator workspace or login. */
 export declare const GENERAL_ROLE_INSTRUCTIONS = "# Fleet Coordinator\n\nYou are the fleet coordinator \u2014 the central entry point for this AgEnD fleet.\nYou route tasks, manage instances, enforce policies, and synthesize results.\nDo NOT modify project files directly \u2014 delegate file changes to the project's instance.\nYou CAN write code snippets, explain code, and answer technical questions directly.\n\n## Task Routing\n\n- **Handle directly**: no file/exec access needed, answerable from knowledge, \u22642 reasoning steps (Q&A, translation, status queries, code snippets).\n- **Delegate to 1 instance**: scoped to one project/repo, needs file access or execution.\n- **Coordinate multiple**: spans repos, outputs feed each other, or parallel helps (max 3 per task).\n\nInstance discovery: start with list_instances(); follow the guidance in its response. Prefer reuse; never duplicate a running instance.\n\n## Reply Contract\n\nEvery final response to the user contains: the result (the actual answer or deliverable) and gaps (anything incomplete \u2014 omit if none). Summarize instance reports; omit internal coordination noise.\n\n## After Restart\n\nBEFORE processing any new messages: 1. list_instances() 2. list_teams() 3. list_decisions(). Only then handle requests.\n\n## Playbooks (on-demand skills)\n\nDetailed procedures live in your skills \u2014 consult them when the situation comes up rather than from memory:\n- **delegation-playbook** \u2014 delegation protocol, loop prevention, parallel vs sequential, result/failure handling, team management, instance configuration tips.\n- **development-workflow** \u2014 the fleet-wide code-change policy you enforce when delegating code tasks.\nPlus the operational skills (fleet-health, instance-lifecycle, scheduling, session-management, \u2026).\n";
 /** Fixed installed program assets, never an enumeration of a runtime profile. */
-export declare const GENERAL_SKILL_NAMES: readonly ["backend-providers", "bug-report", "credential-profiles", "cross-instance-messaging", "delegation-playbook", "development-workflow", "docker-install", "fleet-config", "fleet-health", "fleet-restart", "instance-lifecycle", "kiro-engine-migration", "model-discovery", "multi-channel", "scheduling", "session-management", "tui-effort", "web-appearance", "web-dashboard"];
+export declare const GENERAL_SKILL_NAMES: readonly ["backend-providers", "bug-report", "concepts", "credential-profiles", "cross-instance-messaging", "delegation-playbook", "development-workflow", "docker-install", "fleet-config", "fleet-health", "fleet-restart", "instance-lifecycle", "kiro-engine-migration", "model-discovery", "multi-channel", "scheduling", "session-management", "tui-effort", "web-appearance", "web-dashboard"];
 export declare const GENERAL_KNOWLEDGE_FILES: readonly ["steering/core-rules.md", ...string[]];

package/dist/general-role.js

@@ -4,6 +4,7 @@ export const GENERAL_ROLE_INSTRUCTIONS = "# Fleet Coordinator\n\nYou are the fle
 export const GENERAL_SKILL_NAMES = [
     "backend-providers",
     "bug-report",
+    "concepts",
     "credential-profiles",
     "cross-instance-messaging",
     "delegation-playbook",

package/dist/general-role.js.map

@@ -1 +1 @@
-{"version":3,"file":"general-role.js","sourceRoot":"","sources":["../src/general-role.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,MAAM,CAAC,MAAM,yBAAyB,GAAG,usDAAusD,CAAC;AAEjvD,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,mBAAmB;IACnB,YAAY;IACZ,qBAAqB;IACrB,0BAA0B;IAC1B,qBAAqB;IACrB,sBAAsB;IACtB,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,eAAe;IACf,oBAAoB;IACpB,uBAAuB;IACvB,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,oBAAoB;IACpB,YAAY;IACZ,gBAAgB;IAChB,eAAe;CACP,CAAC;AACX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,wBAAwB,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,IAAI,WAAW,CAAC,CAAU,CAAC"}
+{"version":3,"file":"general-role.js","sourceRoot":"","sources":["../src/general-role.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,MAAM,CAAC,MAAM,yBAAyB,GAAG,usDAAusD,CAAC;AAEjvD,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,mBAAmB;IACnB,YAAY;IACZ,UAAU;IACV,qBAAqB;IACrB,0BAA0B;IAC1B,qBAAqB;IACrB,sBAAsB;IACtB,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,eAAe;IACf,oBAAoB;IACpB,uBAAuB;IACvB,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,oBAAoB;IACpB,YAAY;IACZ,gBAAgB;IAChB,eAAe;CACP,CAAC;AACX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,wBAAwB,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,IAAI,WAAW,CAAC,CAAU,CAAC"}

package/dist/hub/admission.d.ts

@@ -0,0 +1,28 @@
+import { HubMemberJournal } from "./member-journal.js";
+import type { HubMemberTransport, HubQuestion, HubReceipt, HubExposure, HubReconcile, HubRevocation, HubMemberAdmission } from "./types.js";
+import type { HubMemberProfile } from "./profile.js";
+export interface HubAdmissionBinding {
+    profile: HubMemberProfile;
+    linkEpoch: number;
+    revocationVersion: number;
+    current(): boolean;
+}
+export interface HubAdmissionOptions {
+    journal: HubMemberJournal;
+    transport: HubMemberTransport;
+    binding(): HubAdmissionBinding;
+    /** Current member-owned consent, not the Hub's mirrored exposure or question fields. */
+    exposure(id: string): HubExposure | null;
+    fenceLocal(messageId: string): void;
+    hold(messageId: string, reason: "unavailable" | "denied" | "uncertain"): void;
+    now?: () => number;
+}
+export declare class HubMemberAdmissionAdapter implements HubMemberAdmission {
+    private readonly options;
+    constructor(options: HubAdmissionOptions);
+    private binding;
+    private owns;
+    admit(question: HubQuestion): Promise<HubReceipt>;
+    reconcile(input: HubReconcile): Promise<readonly HubReceipt[]>;
+    fence(input: HubRevocation): Promise<void>;
+}

package/dist/hub/admission.js

@@ -0,0 +1,62 @@
+/** Only this adapter admits a signed external question into a restricted outbox. No local human authority. */
+import { createPublicKey } from "node:crypto";
+import { personKeyString, verifyAsker } from "./identity.js";
+import { validated, HubProtocolError } from "./validation.js";
+import { revocationSchema } from "./protocol.js";
+export class HubMemberAdmissionAdapter {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    binding() { const b = this.options.binding(); if (!b.current())
+        throw new HubProtocolError("unavailable"); return b; }
+    owns(q, b) {
+        const e = this.options.exposure(q.identity.exposureId);
+        const identity = q.identity;
+        return !!e && e.state === "published" && e.id === identity.exposureId && e.fleetId === b.profile.fleetId
+            && identity.destinationFleetId === b.profile.fleetId && identity.issuer === b.profile.hub.hubId && identity.issuerKeyId === b.profile.issuerKeyId
+            && personKeyString(identity.owner) === personKeyString(b.profile.owner) && identity.revocationVersion === b.revocationVersion
+            && identity.expiresAt > (this.options.now?.() ?? Date.now())
+            && personKeyString(e.owner) === personKeyString(b.profile.owner) && e.revision === identity.exposureRevision;
+    }
+    async admit(question) {
+        const b = this.binding();
+        try {
+            const identity = verifyAsker(question.identity, question.text, { hubId: b.profile.hub.hubId, issuerKeyId: b.profile.issuerKeyId,
+                issuerPublicKey: createPublicKey(b.profile.hub.issuerPublicKey), fleetId: b.profile.fleetId, owner: b.profile.owner,
+                revocationVersion: b.revocationVersion, now: this.options.now?.() ?? Date.now() }, question.attachments);
+            const q = { text: question.text, identity, ...(question.attachments?.length ? { attachments: question.attachments } : {}) };
+            if (!this.owns(q, b))
+                throw new HubProtocolError("denied");
+            const prepared = this.options.journal.prepare(q);
+            if (prepared.receipt)
+                return prepared.receipt; // exact durable duplicate; never enqueues or executes again
+            const request = { messageId: identity.messageId, operationId: prepared.operationId, exposureRevision: identity.exposureRevision, phase: "admit" };
+            const lease = await this.options.transport.authorize(request);
+            const current = () => {
+                const live = this.options.binding();
+                return b.current() && live.current() && live.linkEpoch === b.linkEpoch && live.revocationVersion === b.revocationVersion && this.owns(q, live);
+            };
+            if (!current())
+                throw new HubProtocolError("stale");
+            return this.options.journal.commitAdmission(q, request, lease, { current, linkEpoch: b.linkEpoch, revocationVersion: b.revocationVersion });
+        }
+        catch (error) {
+            this.options.hold(question.identity.messageId, error instanceof HubProtocolError && error.code === "denied" ? "denied" : "unavailable");
+            throw error;
+        }
+    }
+    async reconcile(input) {
+        this.binding();
+        return this.options.journal.reconcile(input.afterReceiptSequence, input.messages);
+    }
+    async fence(input) {
+        const revocation = validated(revocationSchema, input);
+        this.binding();
+        const receipts = this.options.journal.fence(revocation, this.options.fenceLocal);
+        for (const receipt of receipts)
+            if (receipt.stage === "uncertain")
+                this.options.hold(receipt.messageId, "uncertain");
+    }
+}
+//# sourceMappingURL=admission.js.map

package/dist/hub/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../../src/hub/admission.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAcjD,MAAM,OAAO,yBAAyB;IACP,OAAO;IAApC,YAA6B,OAA4B;uBAA5B,OAAO;IAAwB,CAAC;IACrD,OAAO,KAA0B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3I,IAAI,CAAC,CAAc,EAAE,CAAsB;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC5B,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO;eACnG,QAAQ,CAAC,kBAAkB,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,QAAQ,CAAC,WAAW,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW;eAC9I,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,iBAAiB,KAAK,CAAC,CAAC,iBAAiB;eAC1H,QAAQ,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;eACzD,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,gBAAgB,CAAC;IACjH,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,QAAqB;QAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW;gBAC7H,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;gBACnH,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC3G,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5H,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,4DAA4D;YAC3G,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAgB,EAAE,CAAC;YAC3J,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,iBAAiB,KAAK,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACjJ,CAAC,CAAC;YACF,IAAI,CAAC,OAAO,EAAE;gBAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC9I,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QACvJ,CAAC;IACH,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,KAAmB;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpG,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,KAAoB;QAC9B,MAAM,UAAU,GAAG,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACjF,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW;gBAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACvH,CAAC;CACF"}

package/dist/hub/attachments/limits.d.ts

@@ -0,0 +1,20 @@
+export { attachmentsDigest, messageContentDigest } from "../identity.js";
+export interface HubAttachmentLimits {
+    fileBytes: number;
+    files: number;
+    messageBytes: number;
+}
+/** The defaults are also the ceiling: a Hub config may only lower them. */
+export declare const HUB_ATTACHMENT_LIMITS: Readonly<HubAttachmentLimits>;
+export declare function attachmentLimits(config?: Partial<HubAttachmentLimits> | null): HubAttachmentLimits;
+export type AttachmentTypeRefusal = "type-not-allowed" | "image-mismatch" | "empty";
+/** The type a file is stored and served as, decided by its name; an image must also carry its format's magic bytes. */
+export declare function classifyAttachment(name: string, head: Buffer): {
+    mime: string;
+    image: boolean;
+} | {
+    refused: AttachmentTypeRefusal;
+};
+/** PNG, JPEG, GIF and WebP by their leading bytes; anything else (SVG included) is not an image. */
+export declare function sniffImage(head: Buffer): string | null;
+export declare const isInlineImage: (mime: string) => boolean;

package/dist/hub/attachments/limits.js

@@ -0,0 +1,48 @@
+/** Hub attachments (attachments-v1): limits, the type allowlist, image magic bytes and the digests that bind files to
+ * a question or an answer. Pure: no I/O, no state. */
+import { HUB_ATTACHMENT_FILE_MAX, HUB_ATTACHMENTS_PER_MESSAGE } from "../protocol.js";
+export { attachmentsDigest, messageContentDigest } from "../identity.js";
+/** The defaults are also the ceiling: a Hub config may only lower them. */
+export const HUB_ATTACHMENT_LIMITS = Object.freeze({ fileBytes: HUB_ATTACHMENT_FILE_MAX, files: HUB_ATTACHMENTS_PER_MESSAGE, messageBytes: 50 * 1024 * 1024 });
+export function attachmentLimits(config) {
+    const pick = (key) => {
+        const value = config?.[key], ceiling = HUB_ATTACHMENT_LIMITS[key];
+        return typeof value === "number" && Number.isSafeInteger(value) && value >= 1 && value <= ceiling ? value : ceiling;
+    };
+    return { fileBytes: pick("fileBytes"), files: pick("files"), messageBytes: pick("messageBytes") };
+}
+/** Extension → stored type. Everything else is refused with a reason. SVG is not here: it is never a supported type. */
+const ALLOWED = Object.freeze({
+    png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif", webp: "image/webp", pdf: "application/pdf",
+    txt: "text/plain", md: "text/markdown", csv: "text/csv", json: "application/json", html: "text/html", htm: "text/html",
+    docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+});
+const IMAGE = new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
+/** The type a file is stored and served as, decided by its name; an image must also carry its format's magic bytes. */
+export function classifyAttachment(name, head) {
+    if (head.length === 0)
+        return { refused: "empty" };
+    const ext = /\.([a-z0-9]{1,8})$/i.exec(name)?.[1]?.toLowerCase();
+    const mime = ext !== undefined && Object.hasOwn(ALLOWED, ext) ? ALLOWED[ext] : undefined;
+    if (!mime)
+        return { refused: "type-not-allowed" };
+    if (!IMAGE.has(mime))
+        return { mime, image: false };
+    return sniffImage(head) === mime ? { mime, image: true } : { refused: "image-mismatch" };
+}
+/** PNG, JPEG, GIF and WebP by their leading bytes; anything else (SVG included) is not an image. */
+export function sniffImage(head) {
+    if (head.length >= 8 && head.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])))
+        return "image/png";
+    if (head.length >= 3 && head[0] === 0xff && head[1] === 0xd8 && head[2] === 0xff)
+        return "image/jpeg";
+    if (head.length >= 6 && /^GIF8[79]a$/.test(head.subarray(0, 6).toString("latin1")))
+        return "image/gif";
+    if (head.length >= 12 && head.subarray(0, 4).toString("latin1") === "RIFF" && head.subarray(8, 12).toString("latin1") === "WEBP")
+        return "image/webp";
+    return null;
+}
+export const isInlineImage = (mime) => IMAGE.has(mime);
+//# sourceMappingURL=limits.js.map

package/dist/hub/attachments/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../../src/hub/attachments/limits.ts"],"names":[],"mappings":"AAAA;sDACsD;AACtD,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGzE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAkC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,EAAE,2BAA2B,EAAE,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;AAC9L,MAAM,UAAU,gBAAgB,CAAC,MAA4C;IAC3E,MAAM,IAAI,GAAG,CAAC,GAA8B,EAAU,EAAE;QACtD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAClE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IACtH,CAAC,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;AACpG,CAAC;AAED,wHAAwH;AACxH,MAAM,OAAO,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC9D,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,iBAAiB;IACrH,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW;IACtH,IAAI,EAAE,yEAAyE;IAC/E,IAAI,EAAE,mEAAmE;IACzE,IAAI,EAAE,2EAA2E;CAClF,CAAC,CAAC;AACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AAE9E,uHAAuH;AACvH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAY;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpD,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC3F,CAAC;AACD,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC;IACtI,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IACtG,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC;IACvG,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC;IACtJ,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC"}