@staix/agent-hub 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the previous repository, archived on 2026-09-30 when this repository's history was rewritten; the one exception is the open smoke-check issue, formerly #12, which moved here as #1. Numbers in newer entries refer to this repository.
 
+## 0.11.0
+
+- Task operations settle model-written arguments before anything reaches the board: an `owner` or `peer` that is not a peer id, or a task id that is not a whole number, is refused with a clear message instead of leaving an ownerless task behind after a database error; `null` and an empty owner mean no owner (#70).
+- Review outcomes are credited to the work they judged in more cases: task paths are stored in one spelling (`./src/a.ts` and `src/a.ts` are one file for blame, and `.` blames nobody), and handing a task to the owner it already has keeps an earlier catch; ownership events now record the owner in the task history (#67).
+- After a crash, `pi.auto_start` brings Pi back on its recorded headless session, with or without `recovery.auto_resume_after_crash`, and on a fresh session (on the recorded backend and model) if that resume fails; before, a fresh Pi started and the recorded session could not be resumed while it ran (#66).
+- Tests cover a refused `hub_send` from the local worker and from Pi, a Pi resumed after `kill -9` on the session file the dead run recorded, and the crash report for Codex and Claude (#68).
+- Model-written text on an ordinary task is screened before it leaves the hub: a done summary, a review note, an unmet item or a budget handoff that matches a PII pattern is not saved to claude-mem, and every peer (the local worker included) gets a stub naming `ahub task show <id>`; the board keeps the text, and `ahub ask` shows such a note only on campus (#69).
+- With `local.bash_network` on, the local worker's commands can read Python's own CA bundle (`certifi/cacert.pem`, also vendored by pip), so `pip install` and `requests` work over HTTPS; every other `.pem` stays denied (#64).
+- Each command the local worker runs gets a temp dir of its own (`TMPDIR`), removed when it ends, a timeout or kill included; under deny-default the shared temp dirs (the user's and `/private/tmp`) are closed, so a command can no longer read what other tools left there (#63).
+- Under deny-default, Apple's `/usr/bin` shims (python3 among them) work with a full Xcode selected: the sandbox opens the app's whole `Contents`, since its tools load `SharedFrameworks`; 0.10.0 opened only `Contents/Developer`, so they worked with the Command Line Tools only.
+- With `local.bash_network: true` the local worker's and Pi's commands reach the network only through the hub's egress proxy: HTTPS to the hosts in `local.network_allow` (machine-local; by default the npm, PyPI, crates.io and Go module registries and GitHub), with names that resolve to internal addresses refused and each policy refusal logged by method and host; direct egress and loopback to claude-mem or the Codex app-server are denied. `"direct"` keeps the open network for one release (#65).
+
 ## 0.10.0
 
 - Review checklists and review outcomes: review requests ask the reviewer to map signatures and call sites to the plan, read the check result and list unmet items (`hub_review {unmet}`); the hub records approved, caught, contradicted and escalated reviews per implementer, reviewer and class, shown by `ahub task show` and `ahub route explain`, and `review.adaptive` (off by default) orders reviewers by that record, after idle before busy and ahead of quota. A record counts tasks, a catch belongs to the owner whose work was caught, and only a failure on the same file or symbol contradicts an approval (#35).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.10.0, control protocol 10. Durable delivery records distinguish queued
+Status: 0.11.0, control protocol 10. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -28,7 +28,7 @@ cd <your project> && ahub init && ahub up && ahub tail
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.10.0 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.11.0 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.10.0 and control protocol 10. Live verification
+This guide describes ahub 0.11.0 and control protocol 10. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Install and start
@@ -27,7 +27,7 @@ what the hub runs, which files it sends as credentials, where task text goes,
 or how far the local worker's sandbox reaches (`kimi_cmd`, `codex_bin`,
 `pi.cmd`, `checks`, `mlx.bin`, `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`,
 `omniroute.access_hosts`, the `omniroute` key files, `memory.worker_url`,
-`local.read_allow`, `local.bash_network`, `local.sandbox`) are machine-local:
+`local.read_allow`, `local.bash_network`, `local.network_allow`, `local.sandbox`) are machine-local:
 they apply only from a file git confirms nobody committed. Put them in
 `.agenthub/config.local.json` (`ahub init` adds it to `.gitignore`), which is
 read after `config.json`; outside a git repository they keep their defaults, and
@@ -35,9 +35,26 @@ an empty value always means the default.
 
 The local worker's commands run under a sandbox that starts from deny default
 (0.10): they may run and read the system, toolchain and project directories and
-the selected Xcode or Command Line Tools dir (`xcode-select -p`), write the
-project and temp, and nothing else. With `local.bash_network` on they may also
-read the public CA bundles, which the `*.pem` key deny would otherwise hide.
+the selected Xcode or Command Line Tools dir (`xcode-select -p`; for an Xcode
+app, its whole `Contents`, whose `SharedFrameworks` its tools load), write the
+project and a temp dir of their own (`TMPDIR`, made for each command and
+removed when it ends; one left by a hub crash, named `ahub-cmd-*`, goes with
+the OS temp cleanup), and nothing else; the shared temp dirs are closed.
+
+Network is off unless `local.bash_network` says otherwise. With `true` it goes
+only through the hub's egress proxy on a loopback port (0.11): commands get
+`HTTPS_PROXY` and the other proxy variables, the proxy opens HTTPS (`CONNECT`,
+port 443 unless an entry names one) to the hosts in `local.network_allow`, and
+the profile denies every other connection, direct egress and other loopback
+ports (claude-mem's, the Codex app-server's) included. A listed name also
+covers its subdomains; a name that resolves to a loopback or private address is
+refused, and so is plain HTTP. Each such refusal is a `network: refused` line
+in `hub.log`, by method and host. The default list holds the npm, PyPI, crates.io and Go module
+registries and GitHub's code hosts; set `local.network_allow` in
+`config.local.json` to replace it. `"direct"` keeps the open network of 0.10 and
+earlier for one release. With network on, commands may also read the public CA
+bundles and Python's `certifi/cacert.pem`, which the `*.pem` key deny would
+otherwise hide.
 `"local": { "sandbox": "allow-default" }` in `config.local.json` brings back the
 profile of 0.9 and earlier for one release, should a toolchain need a path the
 new one lacks; please report it. Newly closed outside home: `/Applications`
@@ -425,8 +442,8 @@ source and carries every recovery fix released up to it. Protocol 8 and older
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.10.0 ahub upgrade --to 0.10.0 --dry-run
-bunx --package @staix/agent-hub@0.10.0 ahub upgrade --to 0.10.0 --yes
+bunx --package @staix/agent-hub@0.11.0 ahub upgrade --to 0.11.0 --dry-run
+bunx --package @staix/agent-hub@0.11.0 ahub upgrade --to 0.11.0 --yes
 ```
 
 | Running now | Coordinator to use |
@@ -449,26 +466,28 @@ no blocker, and `--yes` stops at staging ("target protocol requires a newer
 coordinator") with an operation left to clear by `ahub recovery abort <id>`. An
 older 0.7.x CLI may lack recovery fixes released after it. The
 [smoke ledger](smoke.md) records dry-runs from real 0.6.4 and 0.7.5 hubs (issue
-#75), an applied upgrade with the 0.7.0 coordinator, and one from a running
-0.8.1 hub with tasks and a budget pause with the 0.9.0 coordinator.
+#75) and these applied upgrades: one with the 0.7.0 coordinator, one with the
+0.9.0 coordinator from a running 0.8.1 hub with tasks and a budget pause, and
+one with the 0.10.0 coordinator from a 0.9.0 hub with one completion check
+running and one queued.
 
 The coordinator verifies and retains the exact target package, preserves its
 own source, and promotes the global CLI only after restored projects pass
 readback.
 
-Once the installed CLI is 0.10.0, review the current project or all registered
+Once the installed CLI is 0.11.0, review the current project or all registered
 projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.10.0 --dry-run
+ahub upgrade --to 0.11.0 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.10.0 --yes
+ahub upgrade --to 0.11.0 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>
@@ -499,6 +518,15 @@ in `config.local.json` restores the old profile for one release. Off unless set:
 before 0.10.0 keeps no session record, so a crash of one is not reported as such
 by the next start.
 
+0.11.0 changes what `local.bash_network: true` means: the local worker's and
+Pi's commands reach the network only through the hub's egress proxy, to the
+hosts in `local.network_allow` (package registries and GitHub's code hosts by
+default). `local.network_allow` is machine-local and replaces the default list:
+a project that needs another host sets it in `config.local.json` with the
+defaults it still needs. `"direct"` keeps the open network of 0.10.0 for one
+release. Each command gets a temp dir of its own, and under deny-default the
+shared temp dirs are closed.
+
 The 0.7.0 transition stages the verified package and runs a retained
 coordinator from the source tree. It accepts a verified protocol-9 source and
 moves to a protocol-10 target. The source journal, queued envelopes, tasks,
@@ -537,9 +565,13 @@ crash of one is not reported this way.
   hub starts them again: Kimi loads its recorded session (ACP `session/load`), Pi
   resumes its session file, and the local worker starts without its history, on
   its recorded route (or pinned model). Off by default: the report then says
-  what to start. A Pi that ran in a terminal (`--mode tui`) is never started by
-  the hub; the report gives the command. With `pi.auto_start` and no resume,
-  Pi starts on a fresh session as usual.
+  what to start. With `pi.auto_start` on, Pi comes back on its recorded
+  headless session whether or not auto-resume is on (it runs on-prem, so this
+  spends no cloud quota), and on a fresh session if that fails, keeping the
+  recorded backend and model; the report says which. Malformed records in
+  `sessions.json` are skipped. A Pi that ran in a terminal (`--mode tui`) is never started on its
+  recorded session by the hub; the report gives the command, and with
+  `pi.auto_start` a fresh headless Pi starts instead.
 - Codex's app-server died with the hub; run `ahub codex` again. Claude Code's
   plugin reconnects by itself while that session is open.
 

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.10.0
+bun add -g github:STAIxBWLB/agent-hub#v0.11.0
 ahub setup
 ```
 

package/docs/security.md

@@ -7,14 +7,15 @@ agent-hub connects agents that can each run commands. This page says what the hu
 - **Other agents' text is untrusted.** Every message that crosses from one peer to another is framed as untrusted input (a channel tag with `meta.source` for Claude, a fixed header line plus a standing instruction for the others). A message body cannot forge the hub's own headers: such lines are quoted (`sanitize`). Replies inherit a hop count capped at 3, so agents cannot ping-pong forever; neither a digest nor a steer can reset it.
 - **The control link is loopback plus a secret.** The daemon and the Codex proxy bind 127.0.0.1 only. The control WebSocket requires a per-run token (`.agenthub/state/control-token`, mode 600), and both servers refuse any request that carries an `Origin` header: any web page can open a WebSocket to localhost, and browsers always send `Origin`. External clients cannot claim the console user's id or a hub-managed peer's id.
 - **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after `approvals.timeout_s` (default 120 s) of silence; the macOS notification for a waiting request carries the peer and the tool name only. The one exception is the hub's own tools (`hub_send` and the task tools, matched by exact name): Kimi's requests for them are approved once without a prompt and logged by name, the same trust Codex gets through `approval_mode` in the hub's config. They touch no file and run no process, and every call passes the hub's own checks. The match relies on the agent putting the tool name in the request's `title`, as Kimi does; an ACP agent that titles calls with model-written text must not be configured as `kimi_cmd`. A payload longer than the console shows is marked as cut and never offers a session-wide grant. `--unattended` turns prompts off, says so loudly, and is never the default.
-- **A committed config cannot choose launch commands, credential files, data endpoints or a wider sandbox.** The machine-local fields (`kimi_cmd`, `codex_bin`, `pi.cmd`, `checks`, `mlx.bin`, `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`, `omniroute.access_hosts`, the `omniroute` key files, `memory.worker_url`, `local.read_allow`, `local.bash_network`) apply only from a config file git confirms nobody committed: `.agenthub/config.json` or `.agenthub/config.local.json`, matched by file identity so no other spelling the file system accepts slips past, and `.agenthub` itself not a committed symlink or submodule. Without a repository, or when git fails, they keep their defaults; an empty value always means the default. "Untracked" is answered by the repository that contains the project: a checkout copied or extracted into an unrelated repository, or into an ignored directory of one, is trusted like your own files. So a cloned repository cannot choose a launch command, a completion check, a gateway to send a key file to, a memory endpoint, or a wider sandbox. A command in `checks` runs as you, outside the local worker's sandbox, like a git hook. Nothing in `routing.toml` or in task text is ever run. `routing.toml` and the other shared fields still come from the checkout, and they matter: `routing.toml` picks the models the local worker and the hub's inference use at your gateway and can turn the PII constraint off, and roles and budget shape who does what. Review them in a repository you do not trust.
+- **A committed config cannot choose launch commands, credential files, data endpoints or a wider sandbox.** The machine-local fields (`kimi_cmd`, `codex_bin`, `pi.cmd`, `checks`, `mlx.bin`, `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`, `omniroute.access_hosts`, the `omniroute` key files, `memory.worker_url`, `local.read_allow`, `local.bash_network`, `local.network_allow`) apply only from a config file git confirms nobody committed: `.agenthub/config.json` or `.agenthub/config.local.json`, matched by file identity so no other spelling the file system accepts slips past, and `.agenthub` itself not a committed symlink or submodule. Without a repository, or when git fails, they keep their defaults; an empty value always means the default. "Untracked" is answered by the repository that contains the project: a checkout copied or extracted into an unrelated repository, or into an ignored directory of one, is trusted like your own files. So a cloned repository cannot choose a launch command, a completion check, a gateway to send a key file to, a memory endpoint, or a wider sandbox. A command in `checks` runs as you, outside the local worker's sandbox, like a git hook. Nothing in `routing.toml` or in task text is ever run. `routing.toml` and the other shared fields still come from the checkout, and they matter: `routing.toml` picks the models the local worker and the hub's inference use at your gateway and can turn the PII constraint off, and roles and budget shape who does what. Review them in a repository you do not trust.
 - **Telemetry holds no bodies.** `.agenthub/state/events.jsonl` (issue #40) records envelope ids, routing and sizes, task ids and states, overlapping paths and token counts. It never records a message body, a task title or detail, and marks private (PII) envelopes and tasks as such. It stays on the machine; `ahub export` only prints it.
 - **Snapshots stay in your repository.** Per-turn snapshots (issue #33) are git objects in the project's own object store, written through a temporary index; nothing is referenced, pushed or copied elsewhere, and `git gc` prunes them. They hold what the work tree held, including untracked files that are not ignored, so keep secrets in ignored files. They carry the repository's own permissions, and nothing caps their disk use but `git gc`. A turn of a peer holding an open PII task is not snapshotted; a PII file left in the project is snapshotted by later turns like any other file. `ahub undo` restores only files whose current content is exactly what the turn left.
 - **The edit hook reads, never decides.** `ahub check-path --hook` (issue #32) reads hub.db and returns context for Claude and a line for you; it sets no permission decision, so your permission rules stay in charge. It names other owners' task ids, titles and states, which then reach Claude's model; PII tasks are left out.
 - **The session record holds identities only.** `.agenthub/state/sessions.json` (issue #37, mode 600) keeps each attached peer's recovery metadata: launch options, session and thread ids, Pi's session file path. No message or task text; loss notices name deliveries by id, sender and public task title.
-- **The local worker is boxed in.** Paths are resolved through symlinks and must stay inside the project; a secrets denylist (`.env*`, keys, credential files, the hub's own state) applies to its file tools, its git arguments and its memory capture alike; `.git` and `.agenthub` are not writable. Writes, edits, shell commands and mutating git wait for approval, and the approver sees what will be written or run, with control characters escaped. Everything it executes runs under the macOS sandbox, attended or not. Since 0.10 the profile starts from deny default (issue #39): commands run and read only the system, toolchain and project directories (and the project's git dir, the selected developer dir and temp; with network on, the public CA bundles); no writes outside the project, its git dir and temp; no `.git/hooks` or `.git/config` writes; no network, loopback included, unless `local.bash_network`. `local.sandbox: "allow-default"`, machine-local, brings back the profile of 0.9 and earlier for one release. The user's temp dir is still readable in both: a command can read another tool's leftovers there. Without the sandbox there is no `bash` tool.
+- **The local worker is boxed in.** Paths are resolved through symlinks and must stay inside the project; a secrets denylist (`.env*`, keys, credential files, the hub's own state) applies to its file tools, its git arguments and its memory capture alike; `.git` and `.agenthub` are not writable. Writes, edits, shell commands and mutating git wait for approval, and the approver sees what will be written or run, with control characters escaped. Everything it executes runs under the macOS sandbox, attended or not. Since 0.10 the profile starts from deny default (issue #39): commands run and read only the system, toolchain and project directories (and the project's git dir and the selected developer dir; with network on, the public CA bundles); no writes outside the project, its git dir and a temp dir of its own (`TMPDIR`, made for each command and removed when it ends; issue #63); no `.git/hooks` or `.git/config` writes; no network, loopback included, unless `local.bash_network`; with it, only through the hub's egress proxy to the hosts in `local.network_allow` (issue #65), which refuses names that resolve to internal addresses, so claude-mem and the Codex app-server stay out of reach (`"direct"` opens everything, for one release). The allowlist is a deny-default guarantee: under allow-default, DNS and the system's network daemons stay reachable around the proxy. One channel stays open under deny-default too: `trustd`, which TLS clients need, can fetch a certificate's AIA or OCSP URL on a command's behalf, outside the proxy. `local.sandbox: "allow-default"`, machine-local, brings back the profile of 0.9 and earlier for one release. Under deny-default the shared temp dirs (the user's and `/private/tmp`) are closed; allow-default still reads them. Without the sandbox there is no `bash` tool.
 - **Capabilities are enforced, not suggested.** `capabilities` (issue #39) is checked by the daemon where task operations and messages arrive, so a peer cannot get round it by phrasing. A peer can never answer a permission request: the control link takes `permit` from the console role only, and a message that quotes a permit command is just text. Both bind the hub's own tool paths: a vendor agent with its own shell in the project (Codex, Claude, Kimi) can read `.agenthub/state/control-token` and connect as the console, which only the local worker's and Pi's sandbox prevents.
 - **PII has an enforced path.** A task matching `signals.pii_patterns` goes to `local` or to nobody; its text is absent from other peers' envelopes, the console stream, the log and the board listing; the console user reviews it; `local` answers such a turn to the console only, keeps it out of its history, refuses it when the only gateway is off campus, and may not save notes or spin off tasks during it. Nothing about it is sent to claude-mem, whose observer is a cloud model.
+- **Free text is screened too.** On an ordinary task, a done summary (with its check output: a match withholds the whole note), a review note, an unmet item or a budget handoff that matches a PII pattern (issue #69) is not saved to claude-mem, and every peer, `local` included, gets a stub naming `ahub task show <id>`; the board keeps the text, `hub.log` notes the withholding by task id only, and `ahub ask` shows such a note only when its model is reached on campus. `hub_remember` refuses a match; what a vendor agent writes to its own memory is not screened.
 - **Secrets stay where they are read.** The gateway key and Cloudflare Access values are read inside the gateway client and go only into request headers: never into logs, errors, envelopes, tool output, memory, or the generated Switchyard config (the key travels by environment variable name). Subscription logins of Claude, Codex and Kimi are never proxied or pooled.
 - **The hub's own model calls are fenced.** Digest condensation and task triage read agent-written text as data; their output is capped text framed as untrusted, or a value checked against a closed list. It is never used as a route, a peer id, a tool call or an instruction.
 

package/docs/smoke.md

@@ -937,3 +937,30 @@ configured or running, and no peer was attached at the upgrade.
 - For about two minutes after the publish step logged `+ @staix/agent-hub@0.9.0`,
   `npm view` still showed `latest: 0.8.1`; the registry caught up without any
   action.
+
+## 0.9.0 to 0.10.0 attended upgrade (2026-10-01)
+
+A scratch project (a git work tree initialized by the 0.9.0 `ahub init`) ran a
+0.9.0 hub with tasks on its board and a completion check for the review class, set in
+`.agenthub/config.local.json` (`"review": "sleep 40"`, timeout 120 s). No peer
+was attached. Times are UTC.
+
+- At 05:54:46 the console marked task #1 done, which started its 40 s check.
+  `bunx --package @staix/agent-hub@0.10.0 ahub upgrade --to 0.10.0 --yes` right
+  after, about 90 s after the publish, failed with "registry metadata
+  unavailable for @staix/agent-hub@0.10.0" and scheduled nothing; the 0.9.0 hub
+  kept running. This is the registry lag from the 0.9.0 entry, met here as an
+  error instead of a stale `npm view`.
+- At 05:55:03 the console marked task #3 done, which queued its check behind
+  #1's (checks run one at a time), and `--yes` was applied in the same second.
+  Its plan listed one project, source 0.9.0, no blockers. The source did not
+  commit while a check was running or queued: #1's passed at 05:55:26 and #3's
+  at 05:56:07, the source committed and stopped at 05:56:07.1, and the 0.10.0
+  hub was up at 05:56:07.7. The operation, global install included, completed
+  at 05:56:15.
+- After release the hub ran 0.10.0 under a new instance id. All three tasks
+  were on the board with their full history (#1 and #3 approved by their
+  checks, #2 still proposed), and no history entry recorded an interrupted
+  check.
+- The coordinator promoted the global CLI to 0.10.0, and `ahub setup --yes`
+  installed the 0.10.0 plugin.

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1037,6 +1037,15 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
   `min_reviews` by held, others keep their place, and the implementer is never
   a candidate. The record is applied after quota, so the order is idle before
   busy, then the record, then quota.
+- Task paths are stored in one spelling (issue #67): no leading `./`, no repeated
+  or trailing `/`, the root as `.`; older rows are compared in that spelling.
+  Blame needs the same path, so a directory never blames the files under it,
+  though two tasks that both claim the same directory still blame each other: a
+  path does not say whether it is a directory. Existing rows are never
+  rewritten.
+  Ownership events (`assigned`, `escalated`, `reassigned`, `unassigned`) record
+  the owner they leave, so a reassignment to the same owner does not end the
+  window in which a catch counts; rows written before keep the old rule.
 
 ## Amendment: recovery after an unplanned stop (issue #37)
 
@@ -1051,6 +1060,12 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
   journal rows stay in `needs_review`, shown by `ahub queue list`), and the first
   attach rewrites the record with only the attached peers. A Pi in TUI mode is
   reported with its command, not resumed: the CLI runs its terminal.
+- `pi.auto_start` (issue #66) counts as consent to start Pi after a crash too:
+  crash recovery, not the plain auto-start, starts it, on the recorded headless
+  session first and with a `fresh` start (one that does not inherit the failed
+  launch's pending session, keeps the recorded backend and model) if that fails
+  or nothing headless was recorded. If crash recovery itself fails, the plain
+  auto-start runs after all.
 - Resume goes through the same start path as `ahub kimi` / `ahub pi` / `ahub
   local`: Kimi with `sessionId` (ACP `session/load`, refused when the agent does
   not offer `loadSession`), Pi with its session file, the local worker afresh.
@@ -1070,16 +1085,19 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
   (`/usr`, `/bin`, `/sbin`, `/System`, `/Library`, `/opt`, `/private/etc`, the
   dyld and timezone databases), the toolchain directories in home, `read_allow`,
   the project, its external git dirs, the selected developer dir (`xcode-select
-  -p`) and temp; writes as before; a short list of mach services (directory
+  -p`) and a temp dir made for each command (issue #63; the shared user temp
+  dir and `/private/tmp` are not open); writes to the project, its git dirs and
+  that temp dir; a short list of mach services (directory
   lookups, logging, notifications), plus name resolution and TLS trust when
   network is on, the trust being the public CA bundles allowed by exact path
-  after the denies (the `*.pem` key deny matches them); no brokers that act
+  after the denies (the `*.pem` key deny matches them), and any path ending in
+  `/certifi/cacert.pem` (Python's own bundle, issue #64); no brokers that act
   outside the sandbox (LaunchServices, SecurityServer). The denies at the end (credential
   stores, the denylist, `.agenthub`, git hooks and config) are shared by both
   bases.
 - The issue's allowlist proxy for `local.bash_network` is not built here: with
-  the flag on, network is allowed as in 0.9 and earlier. It is left for a
-  follow-up issue.
+  the flag on, network is allowed as in 0.9 and earlier. Issue #65 builds it
+  (amendment below).
 - `local.sandbox` ("deny-default" | "allow-default") is machine-local, since
   "allow-default" widens the sandbox.
 - Capabilities: `propose`, `assign` (a proposal naming another peer as owner),
@@ -1092,3 +1110,20 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
   `important` is checked where messages are admitted, the others in the task
   operations, so in-process tools (the local worker, Pi) are covered too.
 
+## Amendment: egress proxy for the local worker (issue #65)
+
+- With `local.bash_network: true` the daemon runs an HTTP `CONNECT` proxy on a
+  loopback port for the hub run (`src/local/proxy.ts`, built-ins only). The
+  profile allows outbound network only to that port, looks up TLS trust but no
+  DNS (the proxy resolves), and commands get the proxy variables.
+- The proxy opens a tunnel only to a host in `local.network_allow`
+  (machine-local): a name also covers its subdomains, an address only itself,
+  port 443 unless an entry names one (`host:port`). A name that resolves to a
+  loopback, private, link-local or carrier-grade NAT address is refused; an
+  address is reached only when listed. Plain HTTP is refused. No TLS
+  interception. Each refusal is logged with the host only.
+- Decisions recorded in the issue: the default list holds the npm, Yarn, PyPI,
+  crates.io and Go module registries and GitHub's code hosts, so a project that
+  already had network on keeps installing packages; `"direct"` keeps the open
+  network of 0.10 and earlier for one release.
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15727,7 +15727,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.10.0",
+  version: "0.11.0",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/adapters/local-worker.ts

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { renderDigest, replyAudience, replyParent, STANDING_INSTRUCTION, USER, type Envelope, type EnvelopeOpts, type PeerId } from "../hub/envelope.ts";
 import { TASK_TOOL_NAMES, TASK_TOOLS } from "../hub/hub-tools.ts";
 import { BasePeer } from "../hub/peers.ts";
-import { profile } from "../local/sandbox.ts";
+import { profile, proxyEnv, type SandboxNetwork } from "../local/sandbox.ts";
 import { runTool, TOOL_SCHEMAS, touchedPaths, type ToolContext } from "../local/tools.ts";
 import type { Capture } from "../memory/capture.ts";
 import type { ChatMessage, ChatResult, OmniRoute } from "../omniroute/client.ts";
@@ -17,7 +17,7 @@ export interface LocalOptions {
   route?: string;
   /** Model id sent straight to OmniRoute when the sidecar is absent, unhealthy or fails a call. */
   fixedModel: string;
-  tools: { deny: string[]; permit: ToolContext["permit"]; bashNetwork?: boolean; readAllow?: string[]; sandbox?: "deny-default" | "allow-default" };
+  tools: { deny: string[]; permit: ToolContext["permit"]; bashNetwork?: SandboxNetwork; readAllow?: string[]; sandbox?: "deny-default" | "allow-default" };
   capture?: Capture;
   /** Runs a hub task tool (hub_task_*, hub_review, hub_remember) as this peer. Absent = the tools are not offered. */
   taskTool?: (name: string, args: Record<string, unknown>, turn: { pii: boolean }) => Promise<string>;
@@ -165,6 +165,7 @@ export class LocalPeer extends BasePeer {
       deny: this.opts.tools.deny,
       permit: this.opts.tools.permit,
       sandboxProfile: this.sandboxProfile,
+      sandboxEnv: proxyEnv(this.opts.tools.bashNetwork ?? false),
       send: (text, to) => {
         const refused = this.onMessage?.(text, policy?.pii ? reply : { inReplyTo: replyParent(envs), to: to?.length ? to : replyAudience(envs) });
         if (typeof refused === "string") return `not sent: ${refused}`;

package/src/hub/ask.ts

@@ -85,14 +85,19 @@ export async function gather(question: string, d: AskDeps): Promise<{ evidence:
 
   // Matching tasks first, then the most recently touched; PII rows keep their place with a stub, so counts stay right.
   const tasks = d.board.list().sort((a, b) => hit(b.title) - hit(a.title) || b.updated - a.updated).slice(0, MAX_TASKS);
-  const anyPii = tasks.some((t) => d.isPii(t));
+  // An ordinary task's last note is model-written (a summary, a review note): one that matches a PII pattern is shown
+  // only on campus, like a PII task (#69).
+  const notePii = (t: (typeof tasks)[number]) => !d.isPii(t) && !!t.history.at(-1)?.note && (d.isPiiText?.(t.history.at(-1)!.note!) ?? false);
+  const anyPii = tasks.some((t) => d.isPii(t) || notePii(t));
   const showPii = anyPii ? await onCampus() : false;
   let piiShown = false;
   const taskRows: Evidence[] = tasks.map((t) => {
     const secret = d.isPii(t);
     if (secret && showPii) piiShown = true;
     const last = t.history.at(-1);
-    const text = secret && !showPii ? "[pii] (its text is shown only when the model is reached on campus)" : `${t.title}${last ? ` | last: ${last.event} by ${last.by}${last.note ? ` (${last.note})` : ""}` : ""}`;
+    if (notePii(t) && showPii) piiShown = true;
+    const note = last?.note && notePii(t) && !showPii ? "its note is shown only when the model is reached on campus" : last?.note;
+    const text = secret && !showPii ? "[pii] (its text is shown only when the model is reached on campus)" : `${t.title}${last ? ` | last: ${last.event} by ${last.by}${note ? ` (${note})` : ""}` : ""}`;
     return { id: `task #${t.id}`, kind: "task", text: `[${t.class}] ${t.state}, owner ${t.owner ?? "none"}, reviewer ${t.reviewer ?? "none"}: ${text}`.slice(0, ITEM_CHARS) };
   });
 

package/src/hub/board.ts

@@ -22,6 +22,8 @@ export interface HistoryEntry {
   by: PeerId;
   event: string; // proposed | assigned | accepted | declined | done | approved | changes_requested | escalated | reassigned
   note?: string;
+  /** The owner an event that set it left the task with (#67); absent in rows written before 0.11. */
+  owner?: PeerId | null;
 }
 export interface Task {
   id: number;
@@ -122,7 +124,7 @@ export class Board {
       throw new Error(`task #${id} is ${task.state}: cannot move to ${patch.state}`);
     }
     const next = { ...task, ...patch, refs: { ...task.refs, ...patch.refs } };
-    const history = [...task.history, { at: Date.now(), by, event, ...(note ? { note } : {}) }];
+    const history = [...task.history, { at: Date.now(), by, event, ...(note ? { note } : {}), ...("owner" in patch ? { owner: next.owner } : {}) }];
     this.db
       .query("UPDATE tasks SET state = ?, owner = ?, reviewer = ?, refs = ?, plan = ?, rejections = ?, history = ?, updated = ? WHERE id = ?")
       .run(next.state, next.owner, next.reviewer, JSON.stringify(next.refs), JSON.stringify(next.plan ?? {}), next.rejections, JSON.stringify(history), Date.now(), id);

package/src/hub/config-trust.ts

@@ -24,6 +24,7 @@ export const MACHINE_LOCAL = [
   "memory.worker_url",
   "local.read_allow",
   "local.bash_network",
+  "local.network_allow", // the hosts the egress proxy opens (#65)
   "local.sandbox", // "allow-default" widens what the worker's commands may do
 ] as const;
 

package/src/hub/crash.ts

@@ -31,7 +31,9 @@ export function readSessions(stateDir: string): SessionsFile | undefined {
   if (!existsSync(fileOf(stateDir))) return undefined;
   try {
     const s = JSON.parse(readFileSync(fileOf(stateDir), "utf8")) as SessionsFile;
-    return Array.isArray(s.peers) ? s : undefined;
+    if (!Array.isArray(s.peers)) return undefined;
+    // A record without a peer id or metadata says nothing to resume, and reading it would stop recovery for the rest.
+    return { ...s, peers: s.peers.filter((p) => !!p && typeof p.peer === "string" && !!p.meta && typeof p.meta === "object") };
   } catch {
     return undefined; // cut short by the crash: nothing to resume from
   }
@@ -51,7 +53,7 @@ const str = (v: unknown) => (typeof v === "string" && v ? v : undefined);
  * What can come back after a crash. `resume` holds the start arguments for peers the hub launches itself (Kimi through
  * ACP `session/load`, Pi through its session file, the local worker afresh); the others say what the user has to do.
  */
-export function crashPlan(records: SessionRecord[]): { peer: string; resume?: Record<string, string>; how: string }[] {
+export function crashPlan(records: SessionRecord[]): { peer: string; resume?: Record<string, string>; how: string; fresh?: Record<string, string>; tui?: true }[] {
   return records.map(({ peer, meta }) => {
     const launch = (meta.launch && typeof meta.launch === "object" ? meta.launch : {}) as Record<string, unknown>;
     const model = str(launch.model);
@@ -66,13 +68,16 @@ export function crashPlan(records: SessionRecord[]): { peer: string; resume?: Re
         return { peer, resume: { sessionId, ...(model ? { model } : {}) }, how: `kimi: session ${sessionId} can be loaded again (ACP session/load)` };
       }
       case "pi": {
+        // `fresh`: what a new headless session keeps of the recorded one (pi.auto_start's fallback, #66).
+        const fresh: Record<string, string> = {};
+        for (const k of ["backend", "model"] as const) if (str(launch[k])) fresh[k] = str(launch[k])!;
         const sessionFile = str(meta.sessionFile) ?? str(launch.sessionFile);
-        if (!sessionFile) return { peer, how: "pi: no session file was recorded; start it again with ahub pi" };
+        if (!sessionFile) return { peer, fresh, how: "pi: no session file was recorded; start it again with ahub pi" };
         // A terminal Pi is run by the CLI that launched it, not by the hub: nothing here could start it again.
-        if (str(launch.mode) === "tui") return { peer, how: `pi: it ran in a terminal; start it again with ahub pi --mode tui --session-file ${sessionFile}` };
+        if (str(launch.mode) === "tui") return { peer, fresh, tui: true, how: `pi: it ran in a terminal; start it again with ahub pi --mode tui --session-file ${sessionFile}` };
         const args: Record<string, string> = { sessionFile };
         for (const k of ["mode", "backend", "model"] as const) if (str(launch[k])) args[k] = str(launch[k])!;
-        return { peer, resume: args, how: `pi: its session file can be resumed (${sessionFile})` };
+        return { peer, fresh, resume: args, how: `pi: its session file can be resumed (${sessionFile})` };
       }
       case "local": {
         // `model` is also recorded as the route's fallback, and a model given at start pins it: pass one or the other.

package/src/hub/daemon.ts

@@ -14,7 +14,8 @@ import { PiPeer } from "../adapters/pi.ts";
 import { startModelRelay, type ModelRelay } from "../models/relay.ts";
 import type { MlxOptions } from "../models/mlx.ts";
 import { PiToolReceipts } from "../pi/tool-receipts.ts";
-import { profile } from "../local/sandbox.ts";
+import { profile, proxyEnv, type SandboxNetwork } from "../local/sandbox.ts";
+import { DEFAULT_NETWORK_ALLOW, startEgressProxy, type EgressProxy } from "../local/proxy.ts";
 import { runTool, TOOL_SCHEMAS, type ToolContext } from "../local/tools.ts";
 import { LocalPeer } from "../adapters/local-worker.ts";
 import { Capture, skipTools } from "../memory/capture.ts";
@@ -63,7 +64,8 @@ export interface HubConfig {
   pi: { enabled: boolean; auto_start: boolean; cmd: string[]; backend: "auto" | "dgx" | "mlx"; dgx_coding: string; dgx_fast: string; max_steps: number };
   mlx: Pick<MlxOptions, "provider" | "host" | "runtimeDir" | "modelPath" | "port" | "model" | "sourceModel" | "contextWindow" | "maxInputTokens" | "maxTokens" | "maxConcurrency">;
   /** `sandbox`: "deny-default" (issue #39), or "allow-default", the profile of 0.9 and earlier, kept for one release. */
-  local: { deny: string[]; bash_network: boolean; max_steps: number; read_allow: string[]; sandbox: "deny-default" | "allow-default" };
+  /** `bash_network`: true is network through the egress proxy to `network_allow` (#65); "direct" is everything, for one release. */
+  local: { deny: string[]; bash_network: boolean | "direct"; network_allow: string[]; max_steps: number; read_allow: string[]; sandbox: "deny-default" | "allow-default" };
   /** Pending permission requests: how long they wait, and whether the desktop is told (issue #5). */
   approvals: { timeout_s: number; notify: boolean };
   /** An owner offline this long loses its open tasks back to routing; 0 turns it off (issue #6). */
@@ -97,7 +99,7 @@ export const DEFAULT_CONFIG: HubConfig = {
   omniroute: DEFAULT_OMNIROUTE,
   pi: { enabled: false, auto_start: false, cmd: ["pi"], backend: "auto", dgx_coding: "coding", dgx_fast: "fast", max_steps: 30 },
   mlx: { provider: "ollama", model: "agenthub-fast-mlx:4b-8k", sourceModel: "qwen3.5:4b-mlx", contextWindow: 8192, maxInputTokens: 6000, maxTokens: 2048, maxConcurrency: 1 },
-  local: { deny: [], bash_network: false, max_steps: 30, read_allow: [], sandbox: "deny-default" },
+  local: { deny: [], bash_network: false, network_allow: DEFAULT_NETWORK_ALLOW, max_steps: 30, read_allow: [], sandbox: "deny-default" },
   // Off here, so tests and a hub without a config file stay silent; a project's config defaults it on for macOS.
   approvals: { timeout_s: 120, notify: false },
   tasks: { release_after_min: 30 },
@@ -301,6 +303,7 @@ export async function startDaemon(opts: DaemonOptions) {
   // a record left now would make the next ordinary start look like one.
   if (recoveryOperation || restartFilePresent) try { removeSessions(opts.stateDir); } catch { /* nothing to remove */ }
   const autoResume = config.recovery.auto_resume_after_crash === true; // a string "false" is not a yes
+  const piAutoStart = config.pi.enabled && config.pi.auto_start;
   const startedAt = Date.now();
   /** What crash recovery did or asks the user to do, for `ahub status`. */
   const crashReport: string[] = [];
@@ -334,6 +337,16 @@ export async function startDaemon(opts: DaemonOptions) {
     return [k, fallback];
   })) as unknown as LimitsConfig;
   const limiter = new Limiter(limits);
+  // The local worker's and Pi's commands reach the network only through this proxy (issue #65); "direct" keeps the
+  // open network of 0.10 and earlier for one release, anything else means none.
+  let egress: EgressProxy | undefined;
+  if (config.local.bash_network === true) {
+    const allow = Array.isArray(config.local.network_allow) ? config.local.network_allow.filter((h): h is string => typeof h === "string") : DEFAULT_NETWORK_ALLOW;
+    egress = await startEgressProxy({ allow, log });
+    startupCleanup.push(() => void egress?.close());
+    log(`network: egress proxy on 127.0.0.1:${egress.port}, ${allow.length} allowed host(s) (local.network_allow)`);
+  }
+  const sandboxNetwork: SandboxNetwork = config.local.bash_network === "direct" ? true : egress ? { proxyPort: egress.port } : false;
   const admit = (env: Envelope, parent?: string): string | undefined => {
     // [FYI] is recorded and costs nobody a turn: nothing to limit.
     if (env.from === USER || env.from === HUB || env.from === DIGEST || env.priority === "fyi") return undefined;
@@ -601,6 +614,13 @@ export async function startDaemon(opts: DaemonOptions) {
       taskOpsInFlight--;
     }
   };
+  /** A model-written peer argument: a peer id, or nothing for absent, null or "". Anything else is refused. */
+  const peerArg = (v: unknown, name: string): PeerId | undefined => {
+    if (v == null || v === "") return undefined;
+    const id = typeof v === "string" ? v.trim().toLowerCase() : undefined; // peer ids are lowercase; "Codex" means codex
+    if (!id || !PEER_ID.test(id)) throw new Error(`${name} must be a peer id, not ${JSON.stringify(v).slice(0, 60)}`);
+    return id;
+  };
   async function taskOpBody(by: PeerId, op: string, a: Record<string, any>, inProcess = false, piiTurn = false): Promise<string> {
     // Inside a PII turn the worker's words may carry the PII whatever they are attached to: a note would go to
     // claude-mem (a cloud observer) and a new task could be routed to a cloud peer without matching any pattern.
@@ -621,9 +641,11 @@ export async function startDaemon(opts: DaemonOptions) {
       log(`capabilities: ${by} may not ${what} (${op})`);
       throw new Error(`${by} may not ${what} (no "${cap}" in capabilities.${by} in .agenthub/config.json)`);
     };
+    // Tool callers are models (#70): `owner` is a peer id or nothing, settled before anything reaches the board.
     if (op === "hub_task_propose") {
+      a = { ...a, owner: peerArg(a.owner, "owner") };
       need("propose", "propose tasks");
-      if (typeof a.owner === "string" && a.owner && a.owner !== by) need("assign", "hand tasks to other peers");
+      if (a.owner && a.owner !== by) need("assign", "hand tasks to other peers");
     }
     if (op === "hub_remember") need("remember", "save notes to shared memory");
     switch (op) {
@@ -661,8 +683,11 @@ export async function startDaemon(opts: DaemonOptions) {
     switch (op) {
       case "task_show":
         return JSON.stringify(board.get(Number(a.id)) ? { ...board.get(Number(a.id)), reviews: board.reviews({ task: Number(a.id) }) } : `no task #${a.id}`, null, 2);
-      case "task_assign":
-        return line(await tasks.assignTo(a.id, String(a.peer)));
+      case "task_assign": {
+        const peer = peerArg(a.peer, "peer");
+        if (!peer) throw new Error("peer is required");
+        return line(await tasks.assignTo(a.id, peer));
+      }
       case "task_escalate":
         return line(await tasks.escalate(USER, a.id));
       case "route_explain":
@@ -908,13 +933,26 @@ export async function startDaemon(opts: DaemonOptions) {
     const report = (line: string) => (crashReport.push(line), notify(`crash recovery: ${line}`));
     const lostCount = [...lost.values()].reduce((n, l) => n + l.length, 0);
     report(`the previous hub run stopped without shutting down${lostCount ? `; ${lostCount} deliveries it had in flight are in needs_review (ahub queue list)` : ""}`);
+    const start = (peer: string, args: Parameters<typeof startPeer>[1]) => startPeer(peer, args).catch((e: Error) => ({ ok: false, error: e.message }));
     for (const step of crashPlan(prev.peers)) {
+      // `pi.auto_start` already asks for Pi (#66): its recorded headless session comes back, auto-resume or not, and a
+      // fresh one starts when that fails or there is nothing headless to resume. Pi runs on-prem: no cloud quota.
+      if (step.peer === "pi" && piAutoStart) {
+        if (step.resume) {
+          const r = await start("pi", step.resume as Parameters<typeof startPeer>[1]);
+          if (r.ok) { report(`pi resumed (pi.auto_start): ${step.how}`); continue; }
+          report(`pi not resumed (${String(r.error)}); ${step.how}`);
+        } else report(step.how);
+        const fresh = await start("pi", { ...(step.fresh as Parameters<typeof startPeer>[1]), fresh: true });
+        const back = step.tui ? `; to go back to the recorded session, run ahub kill, start the hub without pi.auto_start, then the command above` : "";
+        report(fresh.ok ? `pi.auto_start started a fresh session${back}` : `pi.auto_start could not start Pi either (${String(fresh.error)})`);
+        continue;
+      }
       if (!step.resume || !autoResume) {
-        const fresh = step.peer === "pi" && config.pi.enabled && config.pi.auto_start ? "; pi.auto_start starts a fresh session" : "";
-        report(`${step.how}${step.resume ? " (recovery.auto_resume_after_crash is off)" : ""}${fresh}`);
+        report(`${step.how}${step.resume ? " (recovery.auto_resume_after_crash is off)" : ""}`);
         continue;
       }
-      const r = await startPeer(step.peer, step.resume as Parameters<typeof startPeer>[1]).catch((e: Error) => ({ ok: false, error: e.message }));
+      const r = await start(step.peer, step.resume as Parameters<typeof startPeer>[1]);
       report(r.ok ? `${step.peer} resumed: ${step.how}` : `${step.peer} not resumed (${String(r.error)}); ${step.how}`);
     }
     writeStatus();
@@ -1038,7 +1076,7 @@ export async function startDaemon(opts: DaemonOptions) {
 
   // One start per peer at a time: a second `ahub codex` must not tear down an adapter that is still coming up.
   const starting = new Map<string, Promise<Record<string, unknown>>>();
-  function startPeer(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string }): Promise<Record<string, unknown>> {
+  function startPeer(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; fresh?: boolean }): Promise<Record<string, unknown>> {
     if (stopping) return Promise.resolve({ ok: false, error: "hub is stopping" });
     if (peer === "pi" && starting.has(peer)) return Promise.resolve({ ok: false, error: "Pi start is in progress; inspect status before retrying" });
     const running = starting.get(peer) ?? startPeerOnce(peer, args).finally(() => starting.delete(peer));
@@ -1062,7 +1100,7 @@ export async function startDaemon(opts: DaemonOptions) {
     };
   }
 
-  async function startPeerOnce(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string }): Promise<Record<string, unknown>> {
+  async function startPeerOnce(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; fresh?: boolean }): Promise<Record<string, unknown>> {
     let unmute: (() => void) | undefined;
     try {
       return await startPeerBody(peer, args, (p) => { unmute = muteState(p); });
@@ -1071,7 +1109,7 @@ export async function startDaemon(opts: DaemonOptions) {
     }
   }
 
-  async function startPeerBody(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string }, mute: (p: PeerAdapter) => void): Promise<Record<string, unknown>> {
+  async function startPeerBody(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; fresh?: boolean }, mute: (p: PeerAdapter) => void): Promise<Record<string, unknown>> {
     if (peer === "pi") {
       if (args.mode !== undefined && !["headless", "tui"].includes(args.mode)) return { ok: false, error: "invalid Pi mode" };
       if (args.backend !== undefined && !["auto", "dgx", "mlx"].includes(args.backend)) return { ok: false, error: "invalid Pi backend" };
@@ -1087,7 +1125,8 @@ export async function startDaemon(opts: DaemonOptions) {
       const unclaimed = existing.state === "offline" && !saved.sessionId && !saved.sessionFile;
       if (changesOwner && (existing.state === "busy" || (existing.state !== "offline" && !existing.recoveryReady))) return { ok: false, error: "Pi is busy; wait for agent_settled before changing mode/backend" };
       if (unclaimed) {
-        if (!args.sessionId && !args.sessionFile) args = { ...args, ...existing.pendingResume };
+        // `fresh` (crash recovery's fallback, #66): the pending session is the one that just failed to load.
+        if (!args.sessionId && !args.sessionFile && !args.fresh) args = { ...args, ...existing.pendingResume };
         // Revoke the previous launch bridge before issuing another launch. A late
         // process from the abandoned CLI cannot claim the replacement owner.
         // The replacement's start event is the only state change the console should see (issue #42).
@@ -1177,7 +1216,8 @@ export async function startDaemon(opts: DaemonOptions) {
       let piReply: Envelope | undefined;
       const ctx: ToolContext = {
         cwd: opts.cwd, deny: config.local.deny,
-        sandboxProfile: profile(opts.cwd, config.local.bash_network, config.local.read_allow, config.local.deny, config.local.sandbox === "allow-default" ? "allow" : "deny"),
+        sandboxProfile: profile(opts.cwd, sandboxNetwork, config.local.read_allow, config.local.deny, config.local.sandbox === "allow-default" ? "allow" : "deny"),
+        sandboxEnv: proxyEnv(sandboxNetwork),
         permit: (title) => onPermission({ peer: "pi", title, options: [{ optionId: "allow", name: "Allow", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] }).then((picked) => picked === "allow" && pi.acceptingTools && bus.peers.get("pi") === pi),
         send: (text, to) => {
           if (to?.some((id) => !bus.peers.has(id) && id !== USER)) return "error: unknown peer";
@@ -1268,7 +1308,7 @@ export async function startDaemon(opts: DaemonOptions) {
         omni,
         ...(sidecar && route ? { sidecar, route } : {}),
         fixedModel: args.model ?? routing.local.fixed_model,
-        tools: { deny: config.local.deny, bashNetwork: config.local.bash_network, readAllow: config.local.read_allow, sandbox: config.local.sandbox, permit },
+        tools: { deny: config.local.deny, bashNetwork: sandboxNetwork, readAllow: config.local.read_allow, sandbox: config.local.sandbox, permit },
         ...(capture ? { capture } : {}),
         taskTool: (name, a, turn) => taskOp("local", name, a, true, turn.pii),
         turnPolicy: (envs) => tasks.turnPolicy(envs),
@@ -1733,6 +1773,7 @@ export async function startDaemon(opts: DaemonOptions) {
       // logged and shutdown finishes anyway, or the process ignores SIGTERM forever.
       for (const exit of exits) if (exit.status === "rejected") log(`peer stop failed during shutdown: ${(exit.reason as Error)?.message ?? exit.reason}`);
       await modelRelay?.close();
+      await egress?.close();
       await piReceipts?.close();
       budget.close();
       board.close();
@@ -1774,11 +1815,15 @@ export async function startDaemon(opts: DaemonOptions) {
   if (crashed) {
     // This run owns the record now, so its clean stop removes it even if no peer attaches to rewrite it.
     try { if (readSessions(opts.stateDir)?.instanceId === crashed.instanceId) writeSessions(opts.stateDir, { ...crashed, instanceId, at: Date.now() }); } catch (error) { log(`session record not adopted: ${(error as Error).message}`); }
-    void recoverAfterCrash(crashed).catch((error) => log(`crash recovery failed: ${(error as Error).message}`));
+    void recoverAfterCrash(crashed).catch((error) => {
+      log(`crash recovery failed: ${(error as Error).message}`);
+      // pi.auto_start still holds: a running Pi answers `already`, a starting one refuses the second start.
+      if (piAutoStart) void startPeer("pi", {}).catch((e) => log(`Pi auto-start failed: ${e.message}`));
+    });
   }
-  // Skipped only when crash recovery itself starts Pi again on its recorded session.
-  const piResumes = !!crashed && autoResume && crashPlan(crashed.peers).some((s) => s.peer === "pi" && s.resume);
-  if (config.pi.enabled && config.pi.auto_start && !recoveryActive() && !piResumes) void startPeer("pi", {}).catch((error) => log(`Pi auto-start failed: ${error.message}`));
+  // After a crash that recorded Pi, crash recovery starts it (#66): its recorded session first, a fresh one if that fails.
+  const piRecovered = !!crashed?.peers.some((p) => p.peer === "pi");
+  if (piAutoStart && !recoveryActive() && !piRecovered) void startPeer("pi", {}).catch((error) => log(`Pi auto-start failed: ${error.message}`));
   return { bus, token, port: server.port as number, stop, stopped: new Promise<void>((r) => (onStop = r)) };
   } finally {
     if (!ready) for (const cleanup of startupCleanup.reverse()) { try { cleanup(); } catch { /* preserve startup error */ } }

package/src/hub/tasks.ts

@@ -45,13 +45,18 @@ const OPEN: Task["state"][] = ["proposed", "in_progress", "changes_requested"];
 /** Board events that leave a task where its completion check found it; any other event means it moved on meanwhile. */
 const QUIET_EVENTS = new Set(["answer", "reviewer changed"]);
 
+/** A project path as one spelling (#67): no leading `./`, no repeated or trailing `/`; the root is `.`. */
+export const normPath = (p: string) => p.replace(/^(\.\/)+/, "").replace(/\/{2,}/g, "/").replace(/\/+$/, "") || ".";
+
 /** Same path, or one is a directory of the other; the project root (`.`) holds everything. */
 export const samePlace = (a: string, b: string) => {
-  const norm = (p: string) => p.replace(/^\.\//, "").replace(/\/+$/, "") || ".";
-  const [x, y] = [norm(a), norm(b)];
+  const [x, y] = [normPath(a), normPath(b)];
   return x === "." || y === "." || x === y || x.startsWith(`${y}/`) || y.startsWith(`${x}/`);
 };
 
+/** Events that hand a task to an owner (or take it away); newer history records that owner on them (#67). */
+const OWNERSHIP_EVENTS = new Set(["assigned", "escalated", "reassigned", "unassigned"]);
+
 /** One line of model-written text: whitespace (newlines included) collapses, so it can never start a forged log line. */
 const text = (v: unknown) => (typeof v === "string" && v.trim() ? v.replace(/\s+/g, " ").trim().slice(0, 300) : undefined);
 /** A list of short strings; a lone string counts as a list of one. */
@@ -61,7 +66,7 @@ const fields = (input: unknown) => (input && typeof input === "object" && !Array
 /** Tool callers are models: inputSchema is not enforced on the way in, so refs are normalized before they reach the board. */
 function cleanRefs(input: unknown): TaskRefs {
   const r = fields(input);
-  const paths = textList(r.paths);
+  const paths = [...new Set(textList(r.paths).map(normPath))];
   const out: TaskRefs = {};
   for (const k of ["repo", "branch", "commit"] as const) if (text(r[k])) out[k] = text(r[k])!;
   if (paths.length) out.paths = paths;
@@ -71,7 +76,7 @@ function cleanRefs(input: unknown): TaskRefs {
 /** The same for a plan (issue #31): only its four lists, each of short strings. */
 function cleanPlan(input: unknown): TaskPlan {
   const r = fields(input);
-  return Object.fromEntries(PLAN_KEYS.map((k) => [k, textList(r[k])] as const).filter(([, v]) => v.length));
+  return Object.fromEntries(PLAN_KEYS.map((k) => [k, k === "paths" ? [...new Set(textList(r[k]).map(normPath))] : textList(r[k])] as const).filter(([, v]) => v.length));
 }
 
 /** A plan as one line for other owners; the whole plan is on the board. */
@@ -147,7 +152,15 @@ export class Tasks {
 
   /** Who asked for changes on the current owner's work: requests made before the task changed hands were about someone else's. */
   private requestedChanges(task: Task): Set<PeerId> {
-    const since = task.history.findLastIndex((h) => ["assigned", "escalated", "reassigned", "unassigned"].includes(h.event));
+    // The window starts where the owner last changed. Newer entries carry the owner, so handing a task to the owner it
+    // already had (`ahub task assign <id> <owner>`) keeps the window; older ones do not, and any of them starts it.
+    let since = -1;
+    let owner: PeerId | null | undefined = null;
+    task.history.forEach((h, i) => {
+      if (!OWNERSHIP_EVENTS.has(h.event)) return;
+      if (h.owner === undefined || h.owner !== owner) since = i;
+      owner = h.owner;
+    });
     return new Set(task.history.slice(since + 1).filter((h) => h.event === "changes_requested").map((h) => h.by));
   }
 
@@ -171,8 +184,10 @@ export class Tasks {
       const approval = [...t.history].reverse().find((h) => h.event === "approved");
       if (!approval || now - approval.at > CONTRADICTION_WINDOW_MS || approval.by === USER) continue;
       const theirs = this.places(t);
-      // Blame needs the same file or symbol: a directory or `.` would contradict every approval under it.
-      const same = mine.paths.some((p) => theirs.paths.includes(p)) || mine.symbols.some((x) => theirs.symbols.includes(x));
+      // Blame needs the same file or symbol: a directory or `.` would contradict every approval under it. Older rows
+      // were stored as written, so both sides are compared in one spelling.
+      const file = (p: string) => normPath(p) !== "." && theirs.paths.some((q) => normPath(q) === normPath(p));
+      const same = mine.paths.some(file) || mine.symbols.some((x) => theirs.symbols.includes(x));
       if (!same || this.d.board.reviews({ task: t.id }).some((r) => r.kind === "contradicted")) continue;
       this.d.board.recordReview({ implementer: t.owner, reviewer: approval.by, class: t.class, kind: "contradicted", task: t.id });
     }
@@ -251,6 +266,18 @@ export class Tasks {
   /** Whether a model-written name may be shown to other peers and in the log: one matching a PII pattern may be PII. */
   nameable = (t: string): boolean => !this.isPii({ signals: detectSignals({ title: "", detail: t, refs: {} }, this.d.routing(), this.d.cwd) });
 
+  /**
+   * Model-written free text about an ordinary task (a done summary, a review note with its unmet items, a handoff)
+   * that matches a PII pattern stays on this machine (#69): every peer gets a stub, `local` too, which handles an
+   * ordinary task's turn like any other (gateway off campus allowed, memory capture on). The board keeps the text for
+   * `ahub task show`. A PII task's messages are private already.
+   */
+  private screen(task: Task, text: string, what: string, to: PeerId | null | undefined): string {
+    if (!text || this.isPii(task) || to === USER || this.nameable(text)) return text;
+    this.d.notify(`task #${task.id}: the ${what} was withheld from ${to ?? "a peer"} (it matches a PII pattern)`);
+    return `[${what} withheld: it matches a PII pattern; ahub task show ${task.id}]`;
+  }
+
   /** Where two tasks meet: shared paths, then shared symbols, leaving out any name that matches a PII pattern. */
   private where(hit: { paths: string[]; symbols: string[] }): string {
     const shown = [...hit.paths.filter(this.nameable), ...hit.symbols.filter(this.nameable).map((s) => `symbol ${s}`)];
@@ -368,7 +395,7 @@ export class Tasks {
   private async sendTask(task: Task, a: Assignment, context?: string, overlap = ""): Promise<void> {
     const pii = this.isPii(task);
     const brief = pii ? undefined : await this.d.briefs?.forTask(task.owner!, task).catch(() => undefined);
-    const rejected = task.history.filter((h) => h.event === "changes_requested").map((h) => `- ${h.by}: ${h.note ?? ""}`);
+    const rejected = task.history.filter((h) => h.event === "changes_requested").map((h) => `- ${h.by}: ${this.screen(task, h.note ?? "", "review note", a.owner)}`);
     const facts = [`class ${task.class}`, a.owner === PI ? `backend pi/${a.piBackend ?? "dgx"}` : "", task.refs.paths?.length ? `paths ${task.refs.paths.join(", ")}` : "", task.refs.branch ? `branch ${task.refs.branch}` : "", a.reviewer ? `reviewer ${a.reviewer}` : "no reviewer"].filter(Boolean).join("; ");
     const plan = planText(task.plan);
     const body = [
@@ -380,7 +407,7 @@ export class Tasks {
       rejected.length ? `Earlier review notes:\n${rejected.join("\n")}` : "",
       brief ?? "",
       // What the previous owner left behind. Peer-written free text: never attached to a PII task.
-      context && !pii ? `Handoff from the previous owner:\n${context.slice(0, 3000)}` : "",
+      context && !pii ? `Handoff from the previous owner:\n${this.screen(task, context, "handoff", a.owner).slice(0, 3000)}` : "",
       `Take it with hub_task_accept {id: ${task.id}, plan: {paths, symbols, signatures, insertion_points}} (what you will change, before you start${pii ? "" : "; owners of overlapping tasks see it"}) or pass with hub_task_decline. When finished: hub_task_done {id: ${task.id}, summary: what changed, why, and the check you ran with its result, refs}.`,
     ].filter(Boolean).join("\n\n");
     this.d.bus.publish(newEnvelope(HUB, body, { to: [task.owner!], kind: "task", priority: "important", refs: { ...task.refs, task: String(task.id) }, ...(pii ? { private: true } : {}) }));
@@ -431,8 +458,11 @@ export class Tasks {
   }
 
   private need(id: unknown, open = false): Task {
-    const task = this.d.board.get(Number(id));
-    if (!task) throw new Error(`no task #${id}`);
+    // Callers are models (#70): an id is a whole number or a digit string, never an array that Number() would accept.
+    const n = typeof id === "number" ? id : typeof id === "string" && /^\s*\d+\s*$/.test(id) ? Number(id) : NaN;
+    if (!Number.isInteger(n)) throw new Error(`id must be a task number, not ${(typeof id === "number" ? String(id) : JSON.stringify(id ?? null)).slice(0, 60)}`);
+    const task = this.d.board.get(n);
+    if (!task) throw new Error(`no task #${n}`);
     // Handing a task to someone else only makes sense while there is work left on it.
     if (open && !OPEN.includes(task.state)) throw new Error(`task #${task.id} is ${task.state}: it can no longer change hands`);
     return task;
@@ -590,7 +620,8 @@ export class Tasks {
       `- ${check ? `Check result: ${(check.note ?? "").split("\n")[0]}` : "No check ran for this class: run the affected tests yourself."}`,
       `- List what is unmet in hub_review's unmet, one item each.`,
     ].join("\n");
-    const body = `Review task #${task.id} [${task.class}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${last?.note ?? "(no summary)"}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet}.`;
+    const summary = last?.note ? this.screen(task, last.note, "summary", reviewer) : "(no summary)";
+    const body = `Review task #${task.id} [${task.class}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${summary}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet}.`;
     this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, task: String(task.id) }, ...(this.isPii(task) ? { private: true } : {}) }));
   }
 
@@ -613,7 +644,7 @@ export class Tasks {
         }
       }
       this.note(next, by, "decision", `Task #${next.id} approved by ${by}: ${next.title}\n${note ?? ""}`);
-      this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${note}` : ""}`, pii);
+      this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${this.screen(next, note, "review note", next.owner)}` : ""}`, pii);
       await this.releaseDependents(next);
       return next;
     }
@@ -625,11 +656,11 @@ export class Tasks {
       const moved = await this.escalate(HUB, rejected.id, `${rejected.rejections} consecutive changes_requested`);
       if (moved.owner !== rejected.owner) return moved;
       // Nobody to escalate to: the owner still has to hear the verdict and the note.
-      this.tell(moved, `Task #${moved.id}: ${by} requests changes again.${note ? ` ${note}` : ""} Nobody else can take it; fix it and call hub_task_done again.`, pii);
+      this.tell(moved, `Task #${moved.id}: ${by} requests changes again.${note ? ` ${this.screen(moved, note, "review note", moved.owner)}` : ""} Nobody else can take it; fix it and call hub_task_done again.`, pii);
       return moved;
     }
     const reopened = this.d.board.update(rejected.id, HUB, "reopened", { state: "in_progress" });
-    this.tell(reopened, `Task #${reopened.id}: ${by} requests changes.${note ? ` ${note}` : ""} Fix it and call hub_task_done again.`, pii);
+    this.tell(reopened, `Task #${reopened.id}: ${by} requests changes.${note ? ` ${this.screen(reopened, note, "review note", reopened.owner)}` : ""} Fix it and call hub_task_done again.`, pii);
     return reopened;
   }
 
@@ -719,6 +750,8 @@ export class Tasks {
   /** Auto notes: only transitions that carry content, never for PII. */
   private note(task: Task, by: PeerId, kind: string, text: string): void {
     if (this.isPii(task) || !this.d.memory) return;
+    // claude-mem's observer is a cloud model: model-written text that matches a PII pattern is not sent (#69).
+    if (!this.nameable(text)) return this.d.notify(`task #${task.id}: a ${kind} note was not saved to shared memory (it matches a PII pattern)`);
     void this.d.memory.save({ text, title: `agent-hub task #${task.id}: ${task.title}`.slice(0, 120), project: this.d.project, metadata: { peer: by, task: task.id, kind } });
   }
 

package/src/local/deny.ts

@@ -30,14 +30,14 @@ export const sbplString = (s: string) => `"${s.replace(/\\/g, "\\\\").replace(/"
  * Seatbelt regex filters equivalent to isDenied. Seatbelt sees absolute paths, so the `local.deny` substrings are
  * anchored under the project root: a bare "private/" would otherwise match /private/var/... and deny the whole temp tree.
  */
-export function denyRegexes(root: string, extra: string[] = []): string[] {
+export function denyRegexes(root: string, extra: string[] = [], withNames = true): string[] {
   const names = DENY_NAMES.map((re) => {
     const body = re.startsWith("^") ? re.slice(1) : `[^/]*${re}`;
     return `/${body}${body.endsWith("$") ? "" : "[^/]*$"}`;
   });
   return [
     ...DENY_SEGMENTS.map((s) => `/${sbplEscape(s)}(/|$)`),
-    ...names,
+    ...(withNames ? names : []),
     ...extra.filter(Boolean).map((e) => `^${sbplEscape(root)}/.*${sbplEscape(e)}`),
   ].map((re) => `(regex ${sbplString(re)})`);
 }

package/src/local/proxy.ts

@@ -0,0 +1,142 @@
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP, connect, createServer, type Server, type Socket } from "node:net";
+
+/**
+ * The only way out for the local worker's commands when `local.bash_network` is on (issue #65): an HTTP CONNECT proxy
+ * on loopback that opens tunnels to allowlisted hosts only. CONNECT only, so TLS stays end to end; plain HTTP is
+ * refused. A name that resolves to a loopback, private or link-local address is refused unless it is listed as an
+ * address: claude-mem and the Codex app-server listen on loopback without auth.
+ */
+
+/** What a project gets unless `local.network_allow` says otherwise: package registries and code hosts. */
+export const DEFAULT_NETWORK_ALLOW = [
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "github.com",
+  "codeload.github.com",
+  "objects.githubusercontent.com",
+  "raw.githubusercontent.com",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org",
+];
+
+export interface EgressProxy {
+  port: number;
+  url: string;
+  close(): Promise<void>;
+}
+
+/** `host` or `host:port`; a name also matches its subdomains, an address only itself. Port 443 unless named. */
+export function allowed(list: string[], host: string, port: number): boolean {
+  const h = host.toLowerCase().replace(/\.$/, "");
+  return list.some((raw) => {
+    const entry = raw.trim().toLowerCase();
+    const at = entry.lastIndexOf(":");
+    const [name, p] = at > 0 && !entry.includes("]") && /^\d+$/.test(entry.slice(at + 1)) ? [entry.slice(0, at), Number(entry.slice(at + 1))] : [entry, 443];
+    if (!name || p !== port) return false;
+    return h === name || (!isIP(name) && h.endsWith(`.${name}`));
+  });
+}
+
+// Parsed, not prefix-matched: an IPv4-mapped IPv6 address in any spelling (`::ffff:7f00:1`) checks as its IPv4 address.
+const INTERNAL = new BlockList();
+// IPv4 nets as leading octets: the package check refuses private address literals in published files.
+for (const [a, b, bits] of [[0, 0, 8], [10, 0, 8], [100, 64, 10], [127, 0, 8], [169, 254, 16], [172, 16, 12], [192, 168, 16], [198, 18, 15], [224, 0, 3]] as const) INTERNAL.addSubnet(`${a}.${b}.0.0`, bits, "ipv4");
+for (const [net, bits] of [["::", 96], ["fc00::", 7], ["fe80::", 10], ["fec0::", 10], ["ff00::", 8]] as const) INTERNAL.addSubnet(net, bits, "ipv6");
+
+/** Loopback, private, link-local, site-local, unspecified, carrier-grade NAT, benchmark, multicast or reserved. */
+export function isInternal(address: string): boolean {
+  const family = isIP(address);
+  return family !== 0 && INTERNAL.check(address, family === 6 ? "ipv6" : "ipv4");
+}
+
+const hostOf = (target: string) => {
+  try {
+    return ` ${new URL(target).host}`;
+  } catch {
+    return "";
+  }
+};
+
+export function startEgressProxy(opts: { allow: string[]; log: (line: string) => void }): Promise<EgressProxy> {
+  const sockets = new Set<Socket>();
+  // Half-open on both sides: a client that sends its request and shuts its write side still gets the answer.
+  const server: Server = createServer({ allowHalfOpen: true }, (client) => {
+    sockets.add(client);
+    client.on("close", () => sockets.delete(client));
+    client.on("error", () => client.destroy());
+    let head = Buffer.alloc(0);
+    const onData = (chunk: Buffer) => {
+      head = Buffer.concat([head, chunk]);
+      const end = head.indexOf("\r\n\r\n");
+      if (end < 0) {
+        if (head.length > 8192) refuse(client, 431, "request header too large");
+        return;
+      }
+      client.off("data", onData);
+      client.pause();
+      const rest = head.subarray(end + 4);
+      const [method = "", target = "", version = ""] = head.subarray(0, end).toString("latin1").split("\r\n")[0]!.split(" ");
+      // Answer in the version asked (macOS nc wants HTTP/1.0 back); curl and git take either.
+      void tunnel(client, method, target, rest, version === "HTTP/1.0" ? "HTTP/1.0" : "HTTP/1.1");
+    };
+    client.on("data", onData);
+  });
+
+  const refuse = (client: Socket, code: number, why: string, target = "") => {
+    if (target) opts.log(`network: refused ${target} (${why})`);
+    client.end(`HTTP/1.1 ${code} ${code === 403 ? "Forbidden" : "Bad Request"}\r\nContent-Type: text/plain\r\nConnection: close\r\n\r\nagent-hub: ${why}\n`);
+  };
+
+  const tunnel = async (client: Socket, method: string, target: string, rest: Buffer, http: string) => {
+    // The log gets a method and a host, never a path, a query or userinfo: those carry tokens.
+    if (method.toUpperCase() !== "CONNECT") return refuse(client, 403, "only CONNECT (https) goes through this proxy", `${/^[A-Za-z]{1,16}$/.test(method) ? method : "a request"}${hostOf(target)}`);
+    const m = /^(\[[^\]]+\]|[^:]+):(\d{1,5})$/.exec(target);
+    const host = m?.[1]!.replace(/^\[|\]$/g, "") ?? "";
+    if (!m || !(isIP(host) || /^[a-z0-9.-]+$/i.test(host))) return refuse(client, 400, "bad CONNECT target", "a CONNECT request");
+    const port = Number(m[2]);
+    if (!allowed(opts.allow, host, port)) return refuse(client, 403, `${host}:${port} is not in local.network_allow`, `${host}:${port}`);
+    let address = host;
+    if (!isIP(host)) {
+      try {
+        address = (await lookup(host)).address;
+      } catch {
+        return refuse(client, 403, `${host} does not resolve`, `${host}:${port}`);
+      }
+      // A listed name must not lead back into this machine or its network (DNS can say anything).
+      if (isInternal(address)) return refuse(client, 403, `${host} resolves to an internal address`, `${host}:${port}`);
+    }
+    const upstream = connect({ host: address, port, allowHalfOpen: true });
+    sockets.add(upstream);
+    upstream.on("close", () => sockets.delete(upstream));
+    upstream.once("connect", () => {
+      client.write(`${http} 200 Connection Established\r\n\r\n`);
+      if (rest.length) upstream.write(rest);
+      client.pipe(upstream);
+      upstream.pipe(client);
+      client.resume();
+    });
+    upstream.on("error", () => (client.writable && !client.destroyed ? refuse(client, 403, `${host}:${port} is unreachable`) : client.destroy()));
+    client.on("close", () => upstream.destroy());
+  };
+
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const port = (server.address() as { port: number }).port;
+      resolve({
+        port,
+        url: `http://127.0.0.1:${port}`,
+        close: () => new Promise((done) => {
+          for (const s of sockets) s.destroy();
+          server.close(() => done());
+        }),
+      });
+    });
+  });
+}

package/src/local/sandbox.ts

@@ -1,5 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { realPath } from "../hub/project.ts";
@@ -26,10 +26,16 @@ const HOME_READABLE = [".bun", ".cargo", ".rustup", ".local", ".npm", ".cache",
  */
 const CA_BUNDLES = ["/private/etc/ssl/cert.pem", "/opt/homebrew/etc/ca-certificates/cert.pem", "/opt/homebrew/etc/openssl@3/cert.pem", "/usr/local/etc/ca-certificates/cert.pem", "/usr/local/etc/openssl@3/cert.pem"];
 
-/** The selected Xcode or Command Line Tools dir: the `/usr/bin` shims (git, clang, make, python3) run what is in it. */
+/**
+ * The selected Xcode or Command Line Tools dir: the `/usr/bin` shims (git, clang, make, python3) run what is in it.
+ * Inside an app bundle that is the whole `Contents`: its tools load frameworks from `SharedFrameworks` next to it.
+ */
 function developerDir(): string | undefined {
   const out = spawnSync("xcode-select", ["-p"], { encoding: "utf8" });
-  return out.status === 0 && out.stdout.trim() ? out.stdout.trim() : undefined;
+  let dir = out.status === 0 ? out.stdout.trim() : "";
+  // Seatbelt matches real paths: an Xcode selected through a symlink (`Xcode.app` -> `Xcode-26.0.app`) needs its target.
+  try { dir = dir && realPath(dir); } catch { /* gone since it was selected: nothing the shims could run either */ }
+  return dir ? dir.replace(/(\.app\/Contents)\/Developer\/?$/, "$1") : undefined;
 }
 
 /** A submodule or worktree keeps its git dir outside the project; git needs it, minus the parts that execute or reconfigure. */
@@ -49,13 +55,21 @@ const SYSTEM_READABLE = ["/usr", "/bin", "/sbin", "/System", "/Library", "/opt",
  */
 const MACH_SERVICES = ["com.apple.system.opendirectoryd.libinfo", "com.apple.system.DirectoryService.libinfo_v1", "com.apple.system.logger", "com.apple.system.notification_center"];
 const NETWORK_MACH_SERVICES = ["com.apple.dnssd.service", "com.apple.trustd", "com.apple.trustd.agent", "com.apple.networkd"];
+/** Through the egress proxy (#65) the proxy resolves names: only TLS trust is looked up here, no DNS that could carry data. */
+const PROXY_MACH_SERVICES = ["com.apple.trustd", "com.apple.trustd.agent"];
+
+/**
+ * Network for the commands: none, direct (`local.bash_network: "direct"`, everything, kept for one release), or only
+ * the hub's egress proxy on a loopback port (#65), which opens allowlisted hosts.
+ */
+export type SandboxNetwork = boolean | { proxyPort: number };
 
 /**
  * `base` "deny" (issue #39) starts from `(deny default)` and allows only what commands need: running and reading the
  * system, toolchain and project directories, writing the project and temp. "allow" is the profile of 0.9 and earlier,
  * kept for one release behind `local.sandbox: "allow-default"`. The denies at the end apply to both.
  */
-export function profile(cwd: string, network: boolean, readAllow: string[] = [], deny: string[] = [], base: "deny" | "allow" = "deny"): string {
+export function profile(cwd: string, network: SandboxNetwork, readAllow: string[] = [], deny: string[] = [], base: "deny" | "allow" = "deny"): string {
   const home = homedir();
   const inHome = (p: string) => (p.startsWith("~/") ? join(home, p.slice(2)) : p);
   const root = realPath(cwd);
@@ -66,41 +80,46 @@ export function profile(cwd: string, network: boolean, readAllow: string[] = [],
   const readable = [root, ...HOME_READABLE.map((p) => join(home, p)), ...readAllow.map(inHome), ...gitDirs, ...(dev ? [dev] : [])];
   const subpaths = (paths: string[]) => paths.map((p) => `(subpath ${q(p)})`).join(" ");
   const globals = (names: string[]) => names.map((n) => `(global-name ${q(n)})`).join(" ");
+  const proxy = typeof network === "object" ? `(allow network-outbound (remote ip ${q(`localhost:${network.proxyPort}`)}))` : undefined;
   const start = base === "deny"
     ? [
         "(deny default)",
         "(allow process-fork)",
         // Runs from the system, toolchain and project directories only; a script runs through an allowed interpreter.
-        `(allow process-exec ${subpaths([...SYSTEM_READABLE, ...readable, tmp, "/private/tmp"])})`,
+        // The user's temp dir and /private/tmp are shared with every other process: each command gets its own (#63).
+        `(allow process-exec ${subpaths([...SYSTEM_READABLE, ...readable])})`,
         "(allow signal (target same-sandbox))",
         "(allow process-info* (target same-sandbox))",
         "(allow sysctl-read)",
-        `(allow mach-lookup ${globals([...MACH_SERVICES, ...(network ? NETWORK_MACH_SERVICES : [])])})`,
+        `(allow mach-lookup ${globals([...MACH_SERVICES, ...(proxy ? PROXY_MACH_SERVICES : network ? NETWORK_MACH_SERVICES : [])])})`,
         '(allow ipc-posix-shm-read-data ipc-posix-shm-read-metadata (ipc-posix-name "apple.shm.notification_center"))',
         "(allow file-read-metadata)",
-        `(allow file-read* (literal "/") ${subpaths([...SYSTEM_READABLE, tmp, "/private/tmp", "/dev"])} ${subpaths(readable)})`,
+        `(allow file-read* (literal "/") ${subpaths([...SYSTEM_READABLE, "/dev"])} ${subpaths(readable)})`,
         '(allow file-ioctl (regex #"^/dev/"))',
-        ...(network ? ["(allow network*)"] : []),
+        ...(proxy ? [proxy] : network ? ["(allow network*)"] : []),
       ]
     : [
         "(allow default)",
-        ...(network ? [] : ["(deny network*)"]),
+        ...(network === true ? [] : ["(deny network*)", ...(proxy ? [proxy] : [])]),
         // Home is default-deny for reads: whatever a command reads can end up in the model's answer, and that answer
         // is shared with agents that run on cloud subscriptions (~/.claude.json, app tokens, browser profiles ...).
         `(deny file-read* (subpath ${q(home)}))`,
         `(allow file-read-metadata (subpath ${q(home)}))`,
         `(allow file-read* ${subpaths(readable)})`,
       ];
+  const places = `${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")} ${denyRegexes(root, deny, false).join(" ")}`;
   return [
     "(version 1)",
     ...start,
     "(deny file-write*)",
-    `(allow file-write* (subpath ${q(root)}) (subpath ${q(tmp)}) (subpath "/private/tmp") (regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`,
+    `(allow file-write* (subpath ${q(root)}) ${base === "deny" ? "" : `(subpath ${q(tmp)}) (subpath "/private/tmp") `}(regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`,
     // Inside cwd: nothing that runs later outside the sandbox, nothing that reconfigures the hub.
     `(deny file-write* (subpath ${q(join(root, ".agenthub"))}) ${[join(root, ".git"), ...gitDirs].map((d) => `(subpath ${q(join(d, "hooks"))}) (literal ${q(join(d, "config"))})`).join(" ")})`,
     `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")})`,
     `(deny file-read* file-write* ${denyRegexes(root, deny).join(" ")})`,
-    ...(network ? [`(allow file-read* ${CA_BUNDLES.map((p) => `(literal ${q(p)})`).join(" ")})`] : []),
+    // Python's own CA bundle (certifi, which pip vendors too): pip, requests and httpx read it instead of the system's (#64).
+    // The last match wins: the denied places come again after it, so it overrides only the `.pem` name rule.
+    ...(network ? [`(allow file-read* ${CA_BUNDLES.map((p) => `(literal ${q(p)})`).join(" ")} (regex ${q("/certifi/cacert\\.pem$")}))`, `(deny file-read* file-write* ${places})`] : []),
   ].join("\n");
 }
 
@@ -110,12 +129,16 @@ export interface ExecResult {
 }
 
 /** Run argv under seatbelt with a scrubbed environment. Never runs unsandboxed: no sandbox, no exec. */
-export function sandboxedExec(argv: string[], opts: { cwd: string; profile: string; timeoutMs?: number }): Promise<ExecResult> {
+export function sandboxedExec(argv: string[], opts: { cwd: string; profile: string; timeoutMs?: number; env?: Record<string, string> }): Promise<ExecResult> {
   if (!sandboxAvailable()) return Promise.resolve({ code: null, output: "error: command execution needs macOS sandbox-exec and is disabled on this host" });
   return new Promise((resolve) => {
-    const env = { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: homedir(), LANG: process.env.LANG ?? "en_US.UTF-8", TERM: "dumb", TMPDIR: tmpdir() };
+    // A temp dir of its own (#63): the user's is shared with every other process, and what a command reads can reach
+    // an answer shown to cloud peers. Allowed after the profile's denies, and gone when the command ends.
+    const own = realPath(mkdtempSync(join(tmpdir(), "ahub-cmd-")));
+    const sandbox = `${opts.profile}\n(allow file-read* file-write* process-exec (subpath ${q(own)}))`;
+    const env = { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: homedir(), LANG: process.env.LANG ?? "en_US.UTF-8", TERM: "dumb", ...opts.env, TMPDIR: `${own}/` };
     // Own process group: a timeout has to take the grandchildren too, or they keep the pipes open and the project writable.
-    const child = spawn(SANDBOX_EXEC, ["-p", opts.profile, ...argv], { cwd: opts.cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
+    const child = spawn(SANDBOX_EXEC, ["-p", sandbox, ...argv], { cwd: opts.cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
     let output = "";
     const take = (d: Buffer) => {
       if (output.length < OUTPUT_CAP) output += d.toString();
@@ -129,18 +152,33 @@ export function sandboxedExec(argv: string[], opts: { cwd: string; profile: stri
         child.kill("SIGKILL");
       }
     };
+    // Best effort, never in the way of the result: a command can mark its files immutable (`chflags uchg`), and then
+    // the plain remove throws. What still fails is left to the OS temp cleanup.
+    const dropOwn = () => {
+      try { rmSync(own, { recursive: true, force: true }); } catch {
+        try { spawnSync("chflags", ["-R", "nouchg", own]); rmSync(own, { recursive: true, force: true }); } catch { /* left behind */ }
+      }
+    };
     const timer = setTimeout(killGroup, opts.timeoutMs ?? 120_000);
     let done = false;
     const finish = (code: number | null, signal: NodeJS.Signals | null) => {
       if (done) return;
       done = true;
       clearTimeout(timer);
+      dropOwn();
       const clipped = output.length >= OUTPUT_CAP ? `${output.slice(0, OUTPUT_CAP)}\n(output truncated)` : output;
       resolve({ code, output: signal ? `${clipped}\n(killed: ${signal}, timeout?)` : clipped });
     };
-    child.on("error", (e) => (done || ((done = true), resolve({ code: null, output: `error: ${e.message}` }))));
+    child.on("error", (e) => (done || ((done = true), dropOwn(), resolve({ code: null, output: `error: ${e.message}` }))));
     child.on("close", finish);
     // `close` waits for every holder of the pipes; after `exit` give stragglers a moment, then stop waiting and reap them.
     child.on("exit", (code, signal) => setTimeout(() => (killGroup(), finish(code, signal)), 500).unref());
   });
 }
+
+/** The environment that sends a command's HTTPS through the egress proxy (#65); empty without one. */
+export function proxyEnv(network: SandboxNetwork): Record<string, string> {
+  if (typeof network !== "object") return {};
+  const url = `http://127.0.0.1:${network.proxyPort}`;
+  return { HTTPS_PROXY: url, https_proxy: url, HTTP_PROXY: url, http_proxy: url, ALL_PROXY: url, all_proxy: url, NO_PROXY: "", no_proxy: "" };
+}

package/src/local/tools.ts

@@ -12,6 +12,8 @@ export interface ToolContext {
   deny: string[];
   /** Seatbelt profile for this project, built once per worker (`profile()` in sandbox.ts): it spawns git and must not run per tool call. */
   sandboxProfile: string;
+  /** Extra environment for sandboxed commands: the egress proxy's variables when network goes through it (#65). */
+  sandboxEnv?: Record<string, string>;
   /** Ask the console. Resolves false on deny or timeout. */
   permit: (title: string) => Promise<boolean>;
   /** Publish a message to other peers mid-turn. Returns a one-line receipt. */
@@ -136,7 +138,7 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         // The approver sees the whole command, not a prefix: what is hidden cannot be approved.
         if (command.length > 4000) return "error: command longer than 4000 characters; put it in a script file with write, then run that";
         if (!(await ctx.permit(`bash: ${command}`))) return "error: the user did not approve this command";
-        const res = await sandboxedExec(["/bin/bash", "-c", command], { cwd: ctx.cwd, profile: ctx.sandboxProfile, timeoutMs: (Number(a.timeout_s) || 120) * 1000 });
+        const res = await sandboxedExec(["/bin/bash", "-c", command], { cwd: ctx.cwd, profile: ctx.sandboxProfile, timeoutMs: (Number(a.timeout_s) || 120) * 1000, ...(ctx.sandboxEnv ? { env: ctx.sandboxEnv } : {}) });
         return `${res.output}\n(exit ${res.code})`;
       }
       case "git": {
@@ -147,7 +149,7 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         if (problem) return `error: git ${sub}: ${problem}`;
         if (GIT_WRITE.has(sub) && !(await ctx.permit(`git ${args.join(" ")}`))) return "error: the user did not approve this git command";
         // Sandboxed like bash: flags such as --output or an editor cannot write outside the project or reach the network.
-        const res = await sandboxedExec(["git", "--no-pager", ...args], { cwd: ctx.cwd, profile: ctx.sandboxProfile });
+        const res = await sandboxedExec(["git", "--no-pager", ...args], { cwd: ctx.cwd, profile: ctx.sandboxProfile, ...(ctx.sandboxEnv ? { env: ctx.sandboxEnv } : {}) });
         return `${res.output}\n(exit ${res.code})`;
       }
       case "hub_send":