@staix/agent-hub 0.10.0 → 0.12.0

package/src/hub/daemon.ts

@@ -14,7 +14,8 @@ import { PiPeer } from "../adapters/pi.ts";
 import { startModelRelay, type ModelRelay } from "../models/relay.ts";
 import type { MlxOptions } from "../models/mlx.ts";
 import { PiToolReceipts } from "../pi/tool-receipts.ts";
-import { profile } from "../local/sandbox.ts";
+import { profile, proxyEnv, type SandboxNetwork } from "../local/sandbox.ts";
+import { DEFAULT_NETWORK_ALLOW, startEgressProxy, type EgressProxy } from "../local/proxy.ts";
 import { runTool, TOOL_SCHEMAS, type ToolContext } from "../local/tools.ts";
 import { LocalPeer } from "../adapters/local-worker.ts";
 import { Capture, skipTools } from "../memory/capture.ts";
@@ -62,8 +63,8 @@ export interface HubConfig {
   omniroute: OmniRouteConfig;
   pi: { enabled: boolean; auto_start: boolean; cmd: string[]; backend: "auto" | "dgx" | "mlx"; dgx_coding: string; dgx_fast: string; max_steps: number };
   mlx: Pick<MlxOptions, "provider" | "host" | "runtimeDir" | "modelPath" | "port" | "model" | "sourceModel" | "contextWindow" | "maxInputTokens" | "maxTokens" | "maxConcurrency">;
-  /** `sandbox`: "deny-default" (issue #39), or "allow-default", the profile of 0.9 and earlier, kept for one release. */
-  local: { deny: string[]; bash_network: boolean; max_steps: number; read_allow: string[]; sandbox: "deny-default" | "allow-default" };
+  /** `bash_network`: true is network through the egress proxy to `network_allow` (#65); "direct" is everything, until 0.13.0 (#83). */
+  local: { deny: string[]; bash_network: boolean | "direct"; network_allow: string[]; max_steps: number; read_allow: string[] };
   /** Pending permission requests: how long they wait, and whether the desktop is told (issue #5). */
   approvals: { timeout_s: number; notify: boolean };
   /** An owner offline this long loses its open tasks back to routing; 0 turns it off (issue #6). */
@@ -82,6 +83,8 @@ export interface HubConfig {
   capabilities: Record<string, string[]>;
   /** Machine-local fields a config file set but git could not vouch for, and why (issue #17). */
   ignored?: string[];
+  /** Settings that were removed or are about to be (issue #83): what each does now, for `hub.log` and `ahub doctor`. */
+  retired?: string[];
 }
 export const DEFAULT_CONFIG: HubConfig = {
   watchdog_ms: DEFAULT_WATCHDOG_MS,
@@ -97,7 +100,7 @@ export const DEFAULT_CONFIG: HubConfig = {
   omniroute: DEFAULT_OMNIROUTE,
   pi: { enabled: false, auto_start: false, cmd: ["pi"], backend: "auto", dgx_coding: "coding", dgx_fast: "fast", max_steps: 30 },
   mlx: { provider: "ollama", model: "agenthub-fast-mlx:4b-8k", sourceModel: "qwen3.5:4b-mlx", contextWindow: 8192, maxInputTokens: 6000, maxTokens: 2048, maxConcurrency: 1 },
-  local: { deny: [], bash_network: false, max_steps: 30, read_allow: [], sandbox: "deny-default" },
+  local: { deny: [], bash_network: false, network_allow: DEFAULT_NETWORK_ALLOW, max_steps: 30, read_allow: [] },
   // Off here, so tests and a hub without a config file stay silent; a project's config defaults it on for macOS.
   approvals: { timeout_s: 120, notify: false },
   tasks: { release_after_min: 30 },
@@ -137,6 +140,16 @@ export function loadConfig(cwd: string): HubConfig {
   if (!files.length) return DEFAULT_CONFIG;
   const file = files.reduce((a, b) => ({ ...a, ...b, ...Object.fromEntries(CONFIG_BLOCKS.filter((k) => a[k] !== undefined && b[k] !== undefined).map((k) => [k, { ...a[k], ...b[k] }])) }));
   delete file.ignored; // the hub's own record, never a file's
+  delete file.retired;
+  // Escape hatches with a stated end (issue #83). A removed one is ignored, never an error: an old config.local.json
+  // must not stop a hub from starting.
+  const retired: string[] = [];
+  if (file.local?.sandbox !== undefined) {
+    if (file.local.sandbox === "allow-default") retired.push('local.sandbox "allow-default" was removed in 0.12.0: the deny-default sandbox applies (local.read_allow adds paths)');
+    file.local = { ...file.local };
+    delete file.local.sandbox;
+  }
+  if (file.local?.bash_network === "direct") retired.push('local.bash_network "direct" (the open network) goes in 0.13.0: set it to true and list the hosts in local.network_allow');
   if (file.mlx != null && (typeof file.mlx !== "object" || Array.isArray(file.mlx))) throw new Error("mlx configuration must be an object");
   if (file.mlx?.provider !== undefined && !["ollama", "legacy"].includes(file.mlx.provider)) throw new Error("mlx.provider must be ollama or legacy");
   if (file.mlx?.provider === undefined && (file.mlx?.modelPath || file.mlx?.runtimeDir || file.mlx?.bin || file.mlx?.port)) {
@@ -168,6 +181,7 @@ export function loadConfig(cwd: string): HubConfig {
     capabilities: { ...file.capabilities },
     mlx,
     ...(ignored.length ? { ignored } : {}),
+    ...(retired.length ? { retired } : {}),
   };
 }
 
@@ -301,6 +315,7 @@ export async function startDaemon(opts: DaemonOptions) {
   // a record left now would make the next ordinary start look like one.
   if (recoveryOperation || restartFilePresent) try { removeSessions(opts.stateDir); } catch { /* nothing to remove */ }
   const autoResume = config.recovery.auto_resume_after_crash === true; // a string "false" is not a yes
+  const piAutoStart = config.pi.enabled && config.pi.auto_start;
   const startedAt = Date.now();
   /** What crash recovery did or asks the user to do, for `ahub status`. */
   const crashReport: string[] = [];
@@ -334,6 +349,16 @@ export async function startDaemon(opts: DaemonOptions) {
     return [k, fallback];
   })) as unknown as LimitsConfig;
   const limiter = new Limiter(limits);
+  // The local worker's and Pi's commands reach the network only through this proxy (issue #65); "direct" keeps the
+  // open network of 0.10 and earlier until 0.13.0 (issue #83), anything else means none.
+  let egress: EgressProxy | undefined;
+  if (config.local.bash_network === true) {
+    const allow = Array.isArray(config.local.network_allow) ? config.local.network_allow.filter((h): h is string => typeof h === "string") : DEFAULT_NETWORK_ALLOW;
+    egress = await startEgressProxy({ allow, log });
+    startupCleanup.push(() => void egress?.close());
+    log(`network: egress proxy on 127.0.0.1:${egress.port}, ${allow.length} allowed host(s) (local.network_allow)`);
+  }
+  const sandboxNetwork: SandboxNetwork = config.local.bash_network === "direct" ? true : egress ? { proxyPort: egress.port } : false;
   const admit = (env: Envelope, parent?: string): string | undefined => {
     // [FYI] is recorded and costs nobody a turn: nothing to limit.
     if (env.from === USER || env.from === HUB || env.from === DIGEST || env.priority === "fyi") return undefined;
@@ -422,6 +447,7 @@ export async function startDaemon(opts: DaemonOptions) {
   if (strayChecks.length) log(`checks ignored for ${strayChecks.join(", ")}: not a task class with a command (classes: ${CLASSES.join(", ")})`);
   // Commands and the other machine-local fields came only from a file git vouched for (loadConfig, issue #17).
   for (const line of config.ignored ?? []) log(`${line}; only a config file nobody committed may set it`);
+  for (const line of config.retired ?? []) log(`config: ${line}`);
   const checksAllowed = Object.keys(checkCommands).length > 0;
   const checkTimeoutS = typeof config.checks.timeout_s === "number" && config.checks.timeout_s >= 1 ? Math.min(config.checks.timeout_s, 3600) : 600;
   const runningChecks = new Set<() => void>();
@@ -601,6 +627,13 @@ export async function startDaemon(opts: DaemonOptions) {
       taskOpsInFlight--;
     }
   };
+  /** A model-written peer argument: a peer id, or nothing for absent, null or "". Anything else is refused. */
+  const peerArg = (v: unknown, name: string): PeerId | undefined => {
+    if (v == null || v === "") return undefined;
+    const id = typeof v === "string" ? v.trim().toLowerCase() : undefined; // peer ids are lowercase; "Codex" means codex
+    if (!id || !PEER_ID.test(id)) throw new Error(`${name} must be a peer id, not ${JSON.stringify(v).slice(0, 60)}`);
+    return id;
+  };
   async function taskOpBody(by: PeerId, op: string, a: Record<string, any>, inProcess = false, piiTurn = false): Promise<string> {
     // Inside a PII turn the worker's words may carry the PII whatever they are attached to: a note would go to
     // claude-mem (a cloud observer) and a new task could be routed to a cloud peer without matching any pattern.
@@ -621,9 +654,11 @@ export async function startDaemon(opts: DaemonOptions) {
       log(`capabilities: ${by} may not ${what} (${op})`);
       throw new Error(`${by} may not ${what} (no "${cap}" in capabilities.${by} in .agenthub/config.json)`);
     };
+    // Tool callers are models (#70): `owner` is a peer id or nothing, settled before anything reaches the board.
     if (op === "hub_task_propose") {
+      a = { ...a, owner: peerArg(a.owner, "owner") };
       need("propose", "propose tasks");
-      if (typeof a.owner === "string" && a.owner && a.owner !== by) need("assign", "hand tasks to other peers");
+      if (a.owner && a.owner !== by) need("assign", "hand tasks to other peers");
     }
     if (op === "hub_remember") need("remember", "save notes to shared memory");
     switch (op) {
@@ -661,8 +696,11 @@ export async function startDaemon(opts: DaemonOptions) {
     switch (op) {
       case "task_show":
         return JSON.stringify(board.get(Number(a.id)) ? { ...board.get(Number(a.id)), reviews: board.reviews({ task: Number(a.id) }) } : `no task #${a.id}`, null, 2);
-      case "task_assign":
-        return line(await tasks.assignTo(a.id, String(a.peer)));
+      case "task_assign": {
+        const peer = peerArg(a.peer, "peer");
+        if (!peer) throw new Error("peer is required");
+        return line(await tasks.assignTo(a.id, peer));
+      }
       case "task_escalate":
         return line(await tasks.escalate(USER, a.id));
       case "route_explain":
@@ -908,13 +946,26 @@ export async function startDaemon(opts: DaemonOptions) {
     const report = (line: string) => (crashReport.push(line), notify(`crash recovery: ${line}`));
     const lostCount = [...lost.values()].reduce((n, l) => n + l.length, 0);
     report(`the previous hub run stopped without shutting down${lostCount ? `; ${lostCount} deliveries it had in flight are in needs_review (ahub queue list)` : ""}`);
+    const start = (peer: string, args: Parameters<typeof startPeer>[1]) => startPeer(peer, args).catch((e: Error) => ({ ok: false, error: e.message }));
     for (const step of crashPlan(prev.peers)) {
+      // `pi.auto_start` already asks for Pi (#66): its recorded headless session comes back, auto-resume or not, and a
+      // fresh one starts when that fails or there is nothing headless to resume. Pi runs on-prem: no cloud quota.
+      if (step.peer === "pi" && piAutoStart) {
+        if (step.resume) {
+          const r = await start("pi", step.resume as Parameters<typeof startPeer>[1]);
+          if (r.ok) { report(`pi resumed (pi.auto_start): ${step.how}`); continue; }
+          report(`pi not resumed (${String(r.error)}); ${step.how}`);
+        } else report(step.how);
+        const fresh = await start("pi", { ...(step.fresh as Parameters<typeof startPeer>[1]), fresh: true });
+        const back = step.tui ? `; to go back to the recorded session, run ahub kill, start the hub without pi.auto_start, then the command above` : "";
+        report(fresh.ok ? `pi.auto_start started a fresh session${back}` : `pi.auto_start could not start Pi either (${String(fresh.error)})`);
+        continue;
+      }
       if (!step.resume || !autoResume) {
-        const fresh = step.peer === "pi" && config.pi.enabled && config.pi.auto_start ? "; pi.auto_start starts a fresh session" : "";
-        report(`${step.how}${step.resume ? " (recovery.auto_resume_after_crash is off)" : ""}${fresh}`);
+        report(`${step.how}${step.resume ? " (recovery.auto_resume_after_crash is off)" : ""}`);
         continue;
       }
-      const r = await startPeer(step.peer, step.resume as Parameters<typeof startPeer>[1]).catch((e: Error) => ({ ok: false, error: e.message }));
+      const r = await start(step.peer, step.resume as Parameters<typeof startPeer>[1]);
       report(r.ok ? `${step.peer} resumed: ${step.how}` : `${step.peer} not resumed (${String(r.error)}); ${step.how}`);
     }
     writeStatus();
@@ -1038,7 +1089,7 @@ export async function startDaemon(opts: DaemonOptions) {
 
   // One start per peer at a time: a second `ahub codex` must not tear down an adapter that is still coming up.
   const starting = new Map<string, Promise<Record<string, unknown>>>();
-  function startPeer(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string }): Promise<Record<string, unknown>> {
+  function startPeer(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; fresh?: boolean }): Promise<Record<string, unknown>> {
     if (stopping) return Promise.resolve({ ok: false, error: "hub is stopping" });
     if (peer === "pi" && starting.has(peer)) return Promise.resolve({ ok: false, error: "Pi start is in progress; inspect status before retrying" });
     const running = starting.get(peer) ?? startPeerOnce(peer, args).finally(() => starting.delete(peer));
@@ -1062,7 +1113,7 @@ export async function startDaemon(opts: DaemonOptions) {
     };
   }
 
-  async function startPeerOnce(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string }): Promise<Record<string, unknown>> {
+  async function startPeerOnce(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; fresh?: boolean }): Promise<Record<string, unknown>> {
     let unmute: (() => void) | undefined;
     try {
       return await startPeerBody(peer, args, (p) => { unmute = muteState(p); });
@@ -1071,7 +1122,7 @@ export async function startDaemon(opts: DaemonOptions) {
     }
   }
 
-  async function startPeerBody(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string }, mute: (p: PeerAdapter) => void): Promise<Record<string, unknown>> {
+  async function startPeerBody(peer: string, args: { model?: string; route?: string; mode?: "headless" | "tui"; backend?: "auto" | "dgx" | "mlx"; sessionId?: string; sessionFile?: string; fresh?: boolean }, mute: (p: PeerAdapter) => void): Promise<Record<string, unknown>> {
     if (peer === "pi") {
       if (args.mode !== undefined && !["headless", "tui"].includes(args.mode)) return { ok: false, error: "invalid Pi mode" };
       if (args.backend !== undefined && !["auto", "dgx", "mlx"].includes(args.backend)) return { ok: false, error: "invalid Pi backend" };
@@ -1087,7 +1138,8 @@ export async function startDaemon(opts: DaemonOptions) {
       const unclaimed = existing.state === "offline" && !saved.sessionId && !saved.sessionFile;
       if (changesOwner && (existing.state === "busy" || (existing.state !== "offline" && !existing.recoveryReady))) return { ok: false, error: "Pi is busy; wait for agent_settled before changing mode/backend" };
       if (unclaimed) {
-        if (!args.sessionId && !args.sessionFile) args = { ...args, ...existing.pendingResume };
+        // `fresh` (crash recovery's fallback, #66): the pending session is the one that just failed to load.
+        if (!args.sessionId && !args.sessionFile && !args.fresh) args = { ...args, ...existing.pendingResume };
         // Revoke the previous launch bridge before issuing another launch. A late
         // process from the abandoned CLI cannot claim the replacement owner.
         // The replacement's start event is the only state change the console should see (issue #42).
@@ -1177,7 +1229,8 @@ export async function startDaemon(opts: DaemonOptions) {
       let piReply: Envelope | undefined;
       const ctx: ToolContext = {
         cwd: opts.cwd, deny: config.local.deny,
-        sandboxProfile: profile(opts.cwd, config.local.bash_network, config.local.read_allow, config.local.deny, config.local.sandbox === "allow-default" ? "allow" : "deny"),
+        sandboxProfile: profile(opts.cwd, sandboxNetwork, config.local.read_allow, config.local.deny),
+        sandboxEnv: proxyEnv(sandboxNetwork),
         permit: (title) => onPermission({ peer: "pi", title, options: [{ optionId: "allow", name: "Allow", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] }).then((picked) => picked === "allow" && pi.acceptingTools && bus.peers.get("pi") === pi),
         send: (text, to) => {
           if (to?.some((id) => !bus.peers.has(id) && id !== USER)) return "error: unknown peer";
@@ -1268,7 +1321,7 @@ export async function startDaemon(opts: DaemonOptions) {
         omni,
         ...(sidecar && route ? { sidecar, route } : {}),
         fixedModel: args.model ?? routing.local.fixed_model,
-        tools: { deny: config.local.deny, bashNetwork: config.local.bash_network, readAllow: config.local.read_allow, sandbox: config.local.sandbox, permit },
+        tools: { deny: config.local.deny, bashNetwork: sandboxNetwork, readAllow: config.local.read_allow, permit },
         ...(capture ? { capture } : {}),
         taskTool: (name, a, turn) => taskOp("local", name, a, true, turn.pii),
         turnPolicy: (envs) => tasks.turnPolicy(envs),
@@ -1733,6 +1786,7 @@ export async function startDaemon(opts: DaemonOptions) {
       // logged and shutdown finishes anyway, or the process ignores SIGTERM forever.
       for (const exit of exits) if (exit.status === "rejected") log(`peer stop failed during shutdown: ${(exit.reason as Error)?.message ?? exit.reason}`);
       await modelRelay?.close();
+      await egress?.close();
       await piReceipts?.close();
       budget.close();
       board.close();
@@ -1774,11 +1828,15 @@ export async function startDaemon(opts: DaemonOptions) {
   if (crashed) {
     // This run owns the record now, so its clean stop removes it even if no peer attaches to rewrite it.
     try { if (readSessions(opts.stateDir)?.instanceId === crashed.instanceId) writeSessions(opts.stateDir, { ...crashed, instanceId, at: Date.now() }); } catch (error) { log(`session record not adopted: ${(error as Error).message}`); }
-    void recoverAfterCrash(crashed).catch((error) => log(`crash recovery failed: ${(error as Error).message}`));
+    void recoverAfterCrash(crashed).catch((error) => {
+      log(`crash recovery failed: ${(error as Error).message}`);
+      // pi.auto_start still holds: a running Pi answers `already`, a starting one refuses the second start.
+      if (piAutoStart) void startPeer("pi", {}).catch((e) => log(`Pi auto-start failed: ${e.message}`));
+    });
   }
-  // Skipped only when crash recovery itself starts Pi again on its recorded session.
-  const piResumes = !!crashed && autoResume && crashPlan(crashed.peers).some((s) => s.peer === "pi" && s.resume);
-  if (config.pi.enabled && config.pi.auto_start && !recoveryActive() && !piResumes) void startPeer("pi", {}).catch((error) => log(`Pi auto-start failed: ${error.message}`));
+  // After a crash that recorded Pi, crash recovery starts it (#66): its recorded session first, a fresh one if that fails.
+  const piRecovered = !!crashed?.peers.some((p) => p.peer === "pi");
+  if (piAutoStart && !recoveryActive() && !piRecovered) void startPeer("pi", {}).catch((error) => log(`Pi auto-start failed: ${error.message}`));
   return { bus, token, port: server.port as number, stop, stopped: new Promise<void>((r) => (onStop = r)) };
   } finally {
     if (!ready) for (const cleanup of startupCleanup.reverse()) { try { cleanup(); } catch { /* preserve startup error */ } }

package/src/hub/tasks.ts

@@ -45,13 +45,18 @@ const OPEN: Task["state"][] = ["proposed", "in_progress", "changes_requested"];
 /** Board events that leave a task where its completion check found it; any other event means it moved on meanwhile. */
 const QUIET_EVENTS = new Set(["answer", "reviewer changed"]);
 
+/** A project path as one spelling (#67): no leading `./`, no repeated or trailing `/`; the root is `.`. */
+export const normPath = (p: string) => p.replace(/^(\.\/)+/, "").replace(/\/{2,}/g, "/").replace(/\/+$/, "") || ".";
+
 /** Same path, or one is a directory of the other; the project root (`.`) holds everything. */
 export const samePlace = (a: string, b: string) => {
-  const norm = (p: string) => p.replace(/^\.\//, "").replace(/\/+$/, "") || ".";
-  const [x, y] = [norm(a), norm(b)];
+  const [x, y] = [normPath(a), normPath(b)];
   return x === "." || y === "." || x === y || x.startsWith(`${y}/`) || y.startsWith(`${x}/`);
 };
 
+/** Events that hand a task to an owner (or take it away); newer history records that owner on them (#67). */
+const OWNERSHIP_EVENTS = new Set(["assigned", "escalated", "reassigned", "unassigned"]);
+
 /** One line of model-written text: whitespace (newlines included) collapses, so it can never start a forged log line. */
 const text = (v: unknown) => (typeof v === "string" && v.trim() ? v.replace(/\s+/g, " ").trim().slice(0, 300) : undefined);
 /** A list of short strings; a lone string counts as a list of one. */
@@ -61,7 +66,7 @@ const fields = (input: unknown) => (input && typeof input === "object" && !Array
 /** Tool callers are models: inputSchema is not enforced on the way in, so refs are normalized before they reach the board. */
 function cleanRefs(input: unknown): TaskRefs {
   const r = fields(input);
-  const paths = textList(r.paths);
+  const paths = [...new Set(textList(r.paths).map(normPath))];
   const out: TaskRefs = {};
   for (const k of ["repo", "branch", "commit"] as const) if (text(r[k])) out[k] = text(r[k])!;
   if (paths.length) out.paths = paths;
@@ -71,7 +76,7 @@ function cleanRefs(input: unknown): TaskRefs {
 /** The same for a plan (issue #31): only its four lists, each of short strings. */
 function cleanPlan(input: unknown): TaskPlan {
   const r = fields(input);
-  return Object.fromEntries(PLAN_KEYS.map((k) => [k, textList(r[k])] as const).filter(([, v]) => v.length));
+  return Object.fromEntries(PLAN_KEYS.map((k) => [k, k === "paths" ? [...new Set(textList(r[k]).map(normPath))] : textList(r[k])] as const).filter(([, v]) => v.length));
 }
 
 /** A plan as one line for other owners; the whole plan is on the board. */
@@ -147,7 +152,15 @@ export class Tasks {
 
   /** Who asked for changes on the current owner's work: requests made before the task changed hands were about someone else's. */
   private requestedChanges(task: Task): Set<PeerId> {
-    const since = task.history.findLastIndex((h) => ["assigned", "escalated", "reassigned", "unassigned"].includes(h.event));
+    // The window starts where the owner last changed. Newer entries carry the owner, so handing a task to the owner it
+    // already had (`ahub task assign <id> <owner>`) keeps the window; older ones do not, and any of them starts it.
+    let since = -1;
+    let owner: PeerId | null | undefined = null;
+    task.history.forEach((h, i) => {
+      if (!OWNERSHIP_EVENTS.has(h.event)) return;
+      if (h.owner === undefined || h.owner !== owner) since = i;
+      owner = h.owner;
+    });
     return new Set(task.history.slice(since + 1).filter((h) => h.event === "changes_requested").map((h) => h.by));
   }
 
@@ -171,8 +184,10 @@ export class Tasks {
       const approval = [...t.history].reverse().find((h) => h.event === "approved");
       if (!approval || now - approval.at > CONTRADICTION_WINDOW_MS || approval.by === USER) continue;
       const theirs = this.places(t);
-      // Blame needs the same file or symbol: a directory or `.` would contradict every approval under it.
-      const same = mine.paths.some((p) => theirs.paths.includes(p)) || mine.symbols.some((x) => theirs.symbols.includes(x));
+      // Blame needs the same file or symbol: a directory or `.` would contradict every approval under it. Older rows
+      // were stored as written, so both sides are compared in one spelling.
+      const file = (p: string) => normPath(p) !== "." && theirs.paths.some((q) => normPath(q) === normPath(p));
+      const same = mine.paths.some(file) || mine.symbols.some((x) => theirs.symbols.includes(x));
       if (!same || this.d.board.reviews({ task: t.id }).some((r) => r.kind === "contradicted")) continue;
       this.d.board.recordReview({ implementer: t.owner, reviewer: approval.by, class: t.class, kind: "contradicted", task: t.id });
     }
@@ -251,6 +266,18 @@ export class Tasks {
   /** Whether a model-written name may be shown to other peers and in the log: one matching a PII pattern may be PII. */
   nameable = (t: string): boolean => !this.isPii({ signals: detectSignals({ title: "", detail: t, refs: {} }, this.d.routing(), this.d.cwd) });
 
+  /**
+   * Model-written free text about an ordinary task (a done summary, a review note with its unmet items, a handoff)
+   * that matches a PII pattern stays on this machine (#69): every peer gets a stub, `local` too, which handles an
+   * ordinary task's turn like any other (gateway off campus allowed, memory capture on). The board keeps the text for
+   * `ahub task show`. A PII task's messages are private already.
+   */
+  private screen(task: Task, text: string, what: string, to: PeerId | null | undefined): string {
+    if (!text || this.isPii(task) || to === USER || this.nameable(text)) return text;
+    this.d.notify(`task #${task.id}: the ${what} was withheld from ${to ?? "a peer"} (it matches a PII pattern)`);
+    return `[${what} withheld: it matches a PII pattern; ahub task show ${task.id}]`;
+  }
+
   /** Where two tasks meet: shared paths, then shared symbols, leaving out any name that matches a PII pattern. */
   private where(hit: { paths: string[]; symbols: string[] }): string {
     const shown = [...hit.paths.filter(this.nameable), ...hit.symbols.filter(this.nameable).map((s) => `symbol ${s}`)];
@@ -368,7 +395,7 @@ export class Tasks {
   private async sendTask(task: Task, a: Assignment, context?: string, overlap = ""): Promise<void> {
     const pii = this.isPii(task);
     const brief = pii ? undefined : await this.d.briefs?.forTask(task.owner!, task).catch(() => undefined);
-    const rejected = task.history.filter((h) => h.event === "changes_requested").map((h) => `- ${h.by}: ${h.note ?? ""}`);
+    const rejected = task.history.filter((h) => h.event === "changes_requested").map((h) => `- ${h.by}: ${this.screen(task, h.note ?? "", "review note", a.owner)}`);
     const facts = [`class ${task.class}`, a.owner === PI ? `backend pi/${a.piBackend ?? "dgx"}` : "", task.refs.paths?.length ? `paths ${task.refs.paths.join(", ")}` : "", task.refs.branch ? `branch ${task.refs.branch}` : "", a.reviewer ? `reviewer ${a.reviewer}` : "no reviewer"].filter(Boolean).join("; ");
     const plan = planText(task.plan);
     const body = [
@@ -380,7 +407,7 @@ export class Tasks {
       rejected.length ? `Earlier review notes:\n${rejected.join("\n")}` : "",
       brief ?? "",
       // What the previous owner left behind. Peer-written free text: never attached to a PII task.
-      context && !pii ? `Handoff from the previous owner:\n${context.slice(0, 3000)}` : "",
+      context && !pii ? `Handoff from the previous owner:\n${this.screen(task, context, "handoff", a.owner).slice(0, 3000)}` : "",
       `Take it with hub_task_accept {id: ${task.id}, plan: {paths, symbols, signatures, insertion_points}} (what you will change, before you start${pii ? "" : "; owners of overlapping tasks see it"}) or pass with hub_task_decline. When finished: hub_task_done {id: ${task.id}, summary: what changed, why, and the check you ran with its result, refs}.`,
     ].filter(Boolean).join("\n\n");
     this.d.bus.publish(newEnvelope(HUB, body, { to: [task.owner!], kind: "task", priority: "important", refs: { ...task.refs, task: String(task.id) }, ...(pii ? { private: true } : {}) }));
@@ -431,8 +458,11 @@ export class Tasks {
   }
 
   private need(id: unknown, open = false): Task {
-    const task = this.d.board.get(Number(id));
-    if (!task) throw new Error(`no task #${id}`);
+    // Callers are models (#70): an id is a whole number or a digit string, never an array that Number() would accept.
+    const n = typeof id === "number" ? id : typeof id === "string" && /^\s*\d+\s*$/.test(id) ? Number(id) : NaN;
+    if (!Number.isInteger(n)) throw new Error(`id must be a task number, not ${(typeof id === "number" ? String(id) : JSON.stringify(id ?? null)).slice(0, 60)}`);
+    const task = this.d.board.get(n);
+    if (!task) throw new Error(`no task #${n}`);
     // Handing a task to someone else only makes sense while there is work left on it.
     if (open && !OPEN.includes(task.state)) throw new Error(`task #${task.id} is ${task.state}: it can no longer change hands`);
     return task;
@@ -590,7 +620,8 @@ export class Tasks {
       `- ${check ? `Check result: ${(check.note ?? "").split("\n")[0]}` : "No check ran for this class: run the affected tests yourself."}`,
       `- List what is unmet in hub_review's unmet, one item each.`,
     ].join("\n");
-    const body = `Review task #${task.id} [${task.class}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${last?.note ?? "(no summary)"}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet}.`;
+    const summary = last?.note ? this.screen(task, last.note, "summary", reviewer) : "(no summary)";
+    const body = `Review task #${task.id} [${task.class}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${summary}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet}.`;
     this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, task: String(task.id) }, ...(this.isPii(task) ? { private: true } : {}) }));
   }
 
@@ -613,7 +644,7 @@ export class Tasks {
         }
       }
       this.note(next, by, "decision", `Task #${next.id} approved by ${by}: ${next.title}\n${note ?? ""}`);
-      this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${note}` : ""}`, pii);
+      this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${this.screen(next, note, "review note", next.owner)}` : ""}`, pii);
       await this.releaseDependents(next);
       return next;
     }
@@ -625,11 +656,11 @@ export class Tasks {
       const moved = await this.escalate(HUB, rejected.id, `${rejected.rejections} consecutive changes_requested`);
       if (moved.owner !== rejected.owner) return moved;
       // Nobody to escalate to: the owner still has to hear the verdict and the note.
-      this.tell(moved, `Task #${moved.id}: ${by} requests changes again.${note ? ` ${note}` : ""} Nobody else can take it; fix it and call hub_task_done again.`, pii);
+      this.tell(moved, `Task #${moved.id}: ${by} requests changes again.${note ? ` ${this.screen(moved, note, "review note", moved.owner)}` : ""} Nobody else can take it; fix it and call hub_task_done again.`, pii);
       return moved;
     }
     const reopened = this.d.board.update(rejected.id, HUB, "reopened", { state: "in_progress" });
-    this.tell(reopened, `Task #${reopened.id}: ${by} requests changes.${note ? ` ${note}` : ""} Fix it and call hub_task_done again.`, pii);
+    this.tell(reopened, `Task #${reopened.id}: ${by} requests changes.${note ? ` ${this.screen(reopened, note, "review note", reopened.owner)}` : ""} Fix it and call hub_task_done again.`, pii);
     return reopened;
   }
 
@@ -719,6 +750,8 @@ export class Tasks {
   /** Auto notes: only transitions that carry content, never for PII. */
   private note(task: Task, by: PeerId, kind: string, text: string): void {
     if (this.isPii(task) || !this.d.memory) return;
+    // claude-mem's observer is a cloud model: model-written text that matches a PII pattern is not sent (#69).
+    if (!this.nameable(text)) return this.d.notify(`task #${task.id}: a ${kind} note was not saved to shared memory (it matches a PII pattern)`);
     void this.d.memory.save({ text, title: `agent-hub task #${task.id}: ${task.title}`.slice(0, 120), project: this.d.project, metadata: { peer: by, task: task.id, kind } });
   }
 

package/src/local/deny.ts

@@ -30,14 +30,14 @@ export const sbplString = (s: string) => `"${s.replace(/\\/g, "\\\\").replace(/"
  * Seatbelt regex filters equivalent to isDenied. Seatbelt sees absolute paths, so the `local.deny` substrings are
  * anchored under the project root: a bare "private/" would otherwise match /private/var/... and deny the whole temp tree.
  */
-export function denyRegexes(root: string, extra: string[] = []): string[] {
+export function denyRegexes(root: string, extra: string[] = [], withNames = true): string[] {
   const names = DENY_NAMES.map((re) => {
     const body = re.startsWith("^") ? re.slice(1) : `[^/]*${re}`;
     return `/${body}${body.endsWith("$") ? "" : "[^/]*$"}`;
   });
   return [
     ...DENY_SEGMENTS.map((s) => `/${sbplEscape(s)}(/|$)`),
-    ...names,
+    ...(withNames ? names : []),
     ...extra.filter(Boolean).map((e) => `^${sbplEscape(root)}/.*${sbplEscape(e)}`),
   ].map((re) => `(regex ${sbplString(re)})`);
 }

package/src/local/proxy.ts

@@ -0,0 +1,169 @@
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP, connect, createServer, type Server, type Socket } from "node:net";
+
+/**
+ * The only way out for the local worker's commands when `local.bash_network` is on (issue #65): an HTTP CONNECT proxy
+ * on loopback that opens tunnels to allowlisted hosts only. CONNECT only, so TLS stays end to end; plain HTTP is
+ * refused. A name that resolves to a loopback, private or link-local address is refused unless it is listed as an
+ * address: claude-mem and the Codex app-server listen on loopback without auth.
+ */
+
+/** What a project gets unless `local.network_allow` says otherwise: package registries and code hosts. */
+export const DEFAULT_NETWORK_ALLOW = [
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "github.com",
+  "codeload.github.com",
+  "objects.githubusercontent.com",
+  "raw.githubusercontent.com",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org",
+];
+
+export interface EgressProxy {
+  port: number;
+  url: string;
+  close(): Promise<void>;
+}
+
+/** `host` or `host:port`; a name also matches its subdomains, an address only itself. Port 443 unless named. */
+export function allowed(list: string[], host: string, port: number): boolean {
+  const h = host.toLowerCase().replace(/\.$/, "");
+  return list.some((raw) => {
+    const entry = raw.trim().toLowerCase();
+    const at = entry.lastIndexOf(":");
+    const [name, p] = at > 0 && !entry.includes("]") && /^\d+$/.test(entry.slice(at + 1)) ? [entry.slice(0, at), Number(entry.slice(at + 1))] : [entry, 443];
+    if (!name || p !== port) return false;
+    return h === name || (!isIP(name) && h.endsWith(`.${name}`));
+  });
+}
+
+// Parsed, not prefix-matched: an IPv4-mapped IPv6 address in any spelling (`::ffff:7f00:1`) checks as its IPv4 address.
+const INTERNAL = new BlockList();
+// IPv4 nets as leading octets: the package check refuses private address literals in published files.
+for (const [a, b, bits] of [[0, 0, 8], [10, 0, 8], [100, 64, 10], [127, 0, 8], [169, 254, 16], [172, 16, 12], [192, 168, 16], [198, 18, 15], [224, 0, 3]] as const) INTERNAL.addSubnet(`${a}.${b}.0.0`, bits, "ipv4");
+// RFC 8215's local-use NAT64 prefix puts the IPv4 address where the operator's prefix length says: refused outright.
+for (const [net, bits] of [["::", 96], ["fc00::", 7], ["fe80::", 10], ["fec0::", 10], ["ff00::", 8], ["64:ff9b:1::", 48]] as const) INTERNAL.addSubnet(net, bits, "ipv6");
+// The well-known NAT64 prefix (issue #82): with DNS64, a name whose only record is an internal IPv4 address comes back
+// as 64:ff9b::<that address>, and the NAT64 gateway carries the connection there. Its IPv4 address is what counts.
+const NAT64 = new BlockList();
+NAT64.addSubnet("64:ff9b::", 96, "ipv6");
+
+/** The IPv4 address in the last 32 bits of an IPv6 address, whatever its spelling. */
+function lastIPv4(v6: string): string {
+  const [head = "", tail] = new URL(`http://[${v6}]`).hostname.slice(1, -1).split("::");
+  const h = head ? head.split(":") : [];
+  const t = tail ? tail.split(":") : [];
+  const all = tail === undefined ? h : [...h, ...Array<string>(8 - h.length - t.length).fill("0"), ...t];
+  const [a = 0, b = 0] = all.slice(6).map((g) => parseInt(g, 16));
+  return `${a >> 8}.${a & 255}.${b >> 8}.${b & 255}`;
+}
+
+/** Loopback, private, link-local, site-local, unspecified, carrier-grade NAT, benchmark, multicast or reserved. */
+export function isInternal(address: string): boolean {
+  // Only a non-global address carries a zone (`fe80::1%en0`, `::1%lo0`), and BlockList cannot parse one: internal.
+  if (address.includes("%")) return true;
+  const family = isIP(address);
+  if (family === 6 && NAT64.check(address, "ipv6")) return isInternal(lastIPv4(address));
+  return family !== 0 && INTERNAL.check(address, family === 6 ? "ipv6" : "ipv4");
+}
+
+const hostOf = (target: string) => {
+  try {
+    return ` ${new URL(target).host}`;
+  } catch {
+    return "";
+  }
+};
+
+export function startEgressProxy(opts: { allow: string[]; log: (line: string) => void }): Promise<EgressProxy> {
+  const sockets = new Set<Socket>();
+  // Half-open on both sides: a client that sends its request and shuts its write side still gets the answer.
+  const server: Server = createServer({ allowHalfOpen: true }, (client) => {
+    sockets.add(client);
+    client.on("close", () => sockets.delete(client));
+    client.on("error", () => client.destroy());
+    let head = Buffer.alloc(0);
+    const onData = (chunk: Buffer) => {
+      head = Buffer.concat([head, chunk]);
+      const end = head.indexOf("\r\n\r\n");
+      if (end < 0) {
+        // Once: later chunks of the same request must not refuse (and log) again. Nothing of the header is logged.
+        if (head.length > 8192) client.off("data", onData), refuse(client, 431, "request header too large", "a request");
+        return;
+      }
+      client.off("data", onData);
+      client.pause();
+      const rest = head.subarray(end + 4);
+      const [method = "", target = "", version = ""] = head.subarray(0, end).toString("latin1").split("\r\n")[0]!.split(" ");
+      // Answer in the version asked (macOS nc wants HTTP/1.0 back); curl and git take either.
+      void tunnel(client, method, target, rest, version === "HTTP/1.0" ? "HTTP/1.0" : "HTTP/1.1");
+    };
+    client.on("data", onData);
+  });
+
+  const refuse = (client: Socket, code: number, why: string, target = "") => {
+    if (target) opts.log(`network: refused ${target} (${why})`);
+    client.end(`HTTP/1.1 ${code} ${code === 403 ? "Forbidden" : "Bad Request"}\r\nContent-Type: text/plain\r\nConnection: close\r\n\r\nagent-hub: ${why}\n`);
+  };
+
+  const tunnel = async (client: Socket, method: string, target: string, rest: Buffer, http: string) => {
+    // The log gets a method and a host, never a path, a query or userinfo: those carry tokens.
+    if (method.toUpperCase() !== "CONNECT") return refuse(client, 403, "only CONNECT (https) goes through this proxy", `${/^[A-Za-z]{1,16}$/.test(method) ? method : "a request"}${hostOf(target)}`);
+    const m = /^(\[[^\]]+\]|[^:]+):(\d{1,5})$/.exec(target);
+    const host = m?.[1]!.replace(/^\[|\]$/g, "") ?? "";
+    if (!m || !(isIP(host) || /^[a-z0-9.-]+$/i.test(host))) return refuse(client, 400, "bad CONNECT target", "a CONNECT request");
+    const port = Number(m[2]);
+    if (!allowed(opts.allow, host, port)) return refuse(client, 403, `${host}:${port} is not in local.network_allow`, `${host}:${port}`);
+    let address = host;
+    if (!isIP(host)) {
+      try {
+        address = (await lookup(host)).address;
+      } catch {
+        return refuse(client, 403, `${host} does not resolve`, `${host}:${port}`);
+      }
+      // A listed name must not lead back into this machine or its network (DNS can say anything).
+      if (isInternal(address)) return refuse(client, 403, `${host} resolves to an internal address`, `${host}:${port}`);
+    }
+    const upstream = connect({ host: address, port, allowHalfOpen: true });
+    sockets.add(upstream);
+    upstream.on("close", () => sockets.delete(upstream));
+    let open = false;
+    upstream.once("connect", () => {
+      open = true;
+      client.write(`${http} 200 Connection Established\r\n\r\n`);
+      if (rest.length) upstream.write(rest);
+      client.pipe(upstream);
+      upstream.pipe(client);
+      client.resume();
+    });
+    // Before the tunnel opens a failure is a refusal, logged with the error code only (never its text). After, the
+    // stream is the client's TLS: an HTTP answer would corrupt it, so the client is just closed.
+    upstream.on("error", (e: NodeJS.ErrnoException) => {
+      if (open || !client.writable || client.destroyed) return void client.destroy();
+      const code = /^E[A-Z]{2,20}$/.test(e.code ?? "") ? `, ${e.code}` : "";
+      refuse(client, 403, `${host}:${port} is unreachable${code}`, `${host}:${port}`);
+    });
+    client.on("close", () => upstream.destroy());
+  };
+
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const port = (server.address() as { port: number }).port;
+      resolve({
+        port,
+        url: `http://127.0.0.1:${port}`,
+        close: () => new Promise((done) => {
+          for (const s of sockets) s.destroy();
+          server.close(() => done());
+        }),
+      });
+    });
+  });
+}