@staix/agent-hub 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the previous repository, archived on 2026-09-30 when this repository's history was rewritten; the one exception is the open smoke-check issue, formerly #12, which moved here as #1. Numbers in newer entries refer to this repository.
 
+## 0.12.0
+
+- The egress proxy logs every refusal: an oversized request header and an unreachable listed host now leave a `network: refused` line too, the latter with its error code, never the error text; a failure after the tunnel opened closes the connection instead of writing an HTTP answer into it (#81).
+- Behind NAT64 with the well-known prefix `64:ff9b::/96`, the egress proxy judges an answer by the IPv4 address it carries, so a listed name that resolves to an internal IPv4 host through DNS64 is refused; the local-use prefix `64:ff9b:1::/48` is refused outright, and a scoped IPv6 address (`fe80::1%en0`) counts as internal. A network-specific NAT64 prefix is not recognised (#82).
+- `local.sandbox: "allow-default"` is removed: the local worker's and Pi's commands always run under the deny-default sandbox, and a project that still sets it starts normally with a note in `hub.log` and `ahub doctor` (paths a toolchain needs go in `local.read_allow`). `local.bash_network: "direct"` still works until 0.13.0, with the same note naming that release (#83).
+
 ## 0.11.0
 
 - Task operations settle model-written arguments before anything reaches the board: an `owner` or `peer` that is not a peer id, or a task id that is not a whole number, is refused with a clear message instead of leaving an ownerless task behind after a database error; `null` and an empty owner mean no owner (#70).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.11.0, control protocol 10. Durable delivery records distinguish queued
+Status: 0.12.0, control protocol 10. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -28,7 +28,7 @@ cd <your project> && ahub init && ahub up && ahub tail
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.11.0 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.12.0 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.11.0 and control protocol 10. Live verification
+This guide describes ahub 0.12.0 and control protocol 10. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Install and start
@@ -48,16 +48,23 @@ port 443 unless an entry names one) to the hosts in `local.network_allow`, and
 the profile denies every other connection, direct egress and other loopback
 ports (claude-mem's, the Codex app-server's) included. A listed name also
 covers its subdomains; a name that resolves to a loopback or private address is
-refused, and so is plain HTTP. Each such refusal is a `network: refused` line
-in `hub.log`, by method and host. The default list holds the npm, PyPI, crates.io and Go module
+refused, and so is plain HTTP. Behind NAT64 with the well-known prefix
+`64:ff9b::/96`, the IPv4 address inside the answer is what counts; the local-use
+prefix `64:ff9b:1::/48` is refused outright, so on a network whose DNS64 uses it
+an IPv4-only host such as github.com is refused too; use `"direct"` there (it is
+removed in 0.13.0). A network-specific NAT64 prefix is not recognised. Every
+refusal is a `network: refused` line in `hub.log`, by host where one is known
+(with the method for plain HTTP, and the error code when a listed host is
+unreachable), never a path, query or header. The default list holds the npm, PyPI, crates.io and Go module
 registries and GitHub's code hosts; set `local.network_allow` in
 `config.local.json` to replace it. `"direct"` keeps the open network of 0.10 and
-earlier for one release. With network on, commands may also read the public CA
+earlier until 0.13.0, which removes it; while it is set, `hub.log` and `ahub
+doctor` say so. With network on, commands may also read the public CA
 bundles and Python's `certifi/cacert.pem`, which the `*.pem` key deny would
 otherwise hide.
-`"local": { "sandbox": "allow-default" }` in `config.local.json` brings back the
-profile of 0.9 and earlier for one release, should a toolchain need a path the
-new one lacks; please report it. Newly closed outside home: `/Applications`
+The allow-default profile of 0.9 and earlier was removed in 0.12.0: a
+`local.sandbox` setting is ignored (`"allow-default"` with a note in `hub.log`
+and `ahub doctor`), and a toolchain the profile lacks goes in `local.read_allow`. Newly closed outside home: `/Applications`
 (an app's bundled CLI), `/nix`, `/Volumes` and `/Users/Shared`. A toolchain
 there, or elsewhere in your home (a CI tool cache, a version manager the profile
 does not list), needs its directory in `local.read_allow`, for example
@@ -442,8 +449,8 @@ source and carries every recovery fix released up to it. Protocol 8 and older
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.11.0 ahub upgrade --to 0.11.0 --dry-run
-bunx --package @staix/agent-hub@0.11.0 ahub upgrade --to 0.11.0 --yes
+bunx --package @staix/agent-hub@0.12.0 ahub upgrade --to 0.12.0 --dry-run
+bunx --package @staix/agent-hub@0.12.0 ahub upgrade --to 0.12.0 --yes
 ```
 
 | Running now | Coordinator to use |
@@ -466,28 +473,29 @@ no blocker, and `--yes` stops at staging ("target protocol requires a newer
 coordinator") with an operation left to clear by `ahub recovery abort <id>`. An
 older 0.7.x CLI may lack recovery fixes released after it. The
 [smoke ledger](smoke.md) records dry-runs from real 0.6.4 and 0.7.5 hubs (issue
-#75) and these applied upgrades: one with the 0.7.0 coordinator, one with the
-0.9.0 coordinator from a running 0.8.1 hub with tasks and a budget pause, and
-one with the 0.10.0 coordinator from a 0.9.0 hub with one completion check
-running and one queued.
+#75) and these applied upgrades: one with the 0.7.0 coordinator; one with the
+0.9.0 coordinator from a running 0.8.1 hub with tasks and a budget pause; one
+with the 0.10.0 coordinator from a 0.9.0 hub (one completion check running and
+one queued); and one with the 0.11.0 coordinator from a 0.10.0 hub with
+`local.bash_network` on.
 
 The coordinator verifies and retains the exact target package, preserves its
 own source, and promotes the global CLI only after restored projects pass
 readback.
 
-Once the installed CLI is 0.11.0, review the current project or all registered
+Once the installed CLI is 0.12.0, review the current project or all registered
 projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.11.0 --dry-run
+ahub upgrade --to 0.12.0 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.11.0 --yes
+ahub upgrade --to 0.12.0 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>
@@ -513,7 +521,7 @@ to 0 to opt out.
 0.10.0 changes every project's local worker: its commands run under the
 deny-default sandbox described above, and a toolchain outside the listed
 directories needs `local.read_allow`; `"local": { "sandbox": "allow-default" }`
-in `config.local.json` restores the old profile for one release. Off unless set:
+in `config.local.json` restored the old profile until 0.12.0. Off unless set:
 `review.adaptive`, `recovery.auto_resume_after_crash` and `capabilities`. A hub
 before 0.10.0 keeps no session record, so a crash of one is not reported as such
 by the next start.
@@ -523,10 +531,15 @@ Pi's commands reach the network only through the hub's egress proxy, to the
 hosts in `local.network_allow` (package registries and GitHub's code hosts by
 default). `local.network_allow` is machine-local and replaces the default list:
 a project that needs another host sets it in `config.local.json` with the
-defaults it still needs. `"direct"` keeps the open network of 0.10.0 for one
-release. Each command gets a temp dir of its own, and under deny-default the
+defaults it still needs. `"direct"` keeps the open network of 0.10.0 until
+0.13.0. Each command gets a temp dir of its own, and under deny-default the
 shared temp dirs are closed.
 
+0.12.0 removes `local.sandbox: "allow-default"`: a project that still sets it
+runs under the deny-default sandbox, and `hub.log` and `ahub doctor` say so.
+`local.bash_network: "direct"` still works until 0.13.0, and both name it while
+it is set.
+
 The 0.7.0 transition stages the verified package and runs a retained
 coordinator from the source tree. It accepts a verified protocol-9 source and
 moves to a protocol-10 target. The source journal, queued envelopes, tasks,

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.11.0
+bun add -g github:STAIxBWLB/agent-hub#v0.12.0
 ahub setup
 ```
 

package/docs/security.md

@@ -12,7 +12,7 @@ agent-hub connects agents that can each run commands. This page says what the hu
 - **Snapshots stay in your repository.** Per-turn snapshots (issue #33) are git objects in the project's own object store, written through a temporary index; nothing is referenced, pushed or copied elsewhere, and `git gc` prunes them. They hold what the work tree held, including untracked files that are not ignored, so keep secrets in ignored files. They carry the repository's own permissions, and nothing caps their disk use but `git gc`. A turn of a peer holding an open PII task is not snapshotted; a PII file left in the project is snapshotted by later turns like any other file. `ahub undo` restores only files whose current content is exactly what the turn left.
 - **The edit hook reads, never decides.** `ahub check-path --hook` (issue #32) reads hub.db and returns context for Claude and a line for you; it sets no permission decision, so your permission rules stay in charge. It names other owners' task ids, titles and states, which then reach Claude's model; PII tasks are left out.
 - **The session record holds identities only.** `.agenthub/state/sessions.json` (issue #37, mode 600) keeps each attached peer's recovery metadata: launch options, session and thread ids, Pi's session file path. No message or task text; loss notices name deliveries by id, sender and public task title.
-- **The local worker is boxed in.** Paths are resolved through symlinks and must stay inside the project; a secrets denylist (`.env*`, keys, credential files, the hub's own state) applies to its file tools, its git arguments and its memory capture alike; `.git` and `.agenthub` are not writable. Writes, edits, shell commands and mutating git wait for approval, and the approver sees what will be written or run, with control characters escaped. Everything it executes runs under the macOS sandbox, attended or not. Since 0.10 the profile starts from deny default (issue #39): commands run and read only the system, toolchain and project directories (and the project's git dir and the selected developer dir; with network on, the public CA bundles); no writes outside the project, its git dir and a temp dir of its own (`TMPDIR`, made for each command and removed when it ends; issue #63); no `.git/hooks` or `.git/config` writes; no network, loopback included, unless `local.bash_network`; with it, only through the hub's egress proxy to the hosts in `local.network_allow` (issue #65), which refuses names that resolve to internal addresses, so claude-mem and the Codex app-server stay out of reach (`"direct"` opens everything, for one release). The allowlist is a deny-default guarantee: under allow-default, DNS and the system's network daemons stay reachable around the proxy. One channel stays open under deny-default too: `trustd`, which TLS clients need, can fetch a certificate's AIA or OCSP URL on a command's behalf, outside the proxy. `local.sandbox: "allow-default"`, machine-local, brings back the profile of 0.9 and earlier for one release. Under deny-default the shared temp dirs (the user's and `/private/tmp`) are closed; allow-default still reads them. Without the sandbox there is no `bash` tool.
+- **The local worker is boxed in.** Paths are resolved through symlinks and must stay inside the project; a secrets denylist (`.env*`, keys, credential files, the hub's own state) applies to its file tools, its git arguments and its memory capture alike; `.git` and `.agenthub` are not writable. Writes, edits, shell commands and mutating git wait for approval, and the approver sees what will be written or run, with control characters escaped. Everything it executes runs under the macOS sandbox, attended or not. Since 0.10 the profile starts from deny default (issue #39): commands run and read only the system, toolchain and project directories (and the project's git dir and the selected developer dir; with network on, the public CA bundles); no writes outside the project, its git dir and a temp dir of its own (`TMPDIR`, made for each command and removed when it ends; issue #63); no `.git/hooks` or `.git/config` writes; no network, loopback included, unless `local.bash_network`; with it, only through the hub's egress proxy to the hosts in `local.network_allow` (issue #65), which refuses names that resolve to internal addresses (behind NAT64 with the well-known prefix, by the IPv4 address the answer carries; a network-specific prefix is not recognised), so claude-mem and the Codex app-server stay out of reach (`"direct"` opens everything, until 0.13.0). One channel stays open: `trustd`, which TLS clients need, can fetch a certificate's AIA or OCSP URL on a command's behalf, outside the proxy. The allow-default profile of 0.9 and earlier was removed in 0.12.0 (issue #83); a `local.sandbox` setting is ignored with a note. The shared temp dirs (the user's and `/private/tmp`) are closed. Without the sandbox there is no `bash` tool.
 - **Capabilities are enforced, not suggested.** `capabilities` (issue #39) is checked by the daemon where task operations and messages arrive, so a peer cannot get round it by phrasing. A peer can never answer a permission request: the control link takes `permit` from the console role only, and a message that quotes a permit command is just text. Both bind the hub's own tool paths: a vendor agent with its own shell in the project (Codex, Claude, Kimi) can read `.agenthub/state/control-token` and connect as the console, which only the local worker's and Pi's sandbox prevents.
 - **PII has an enforced path.** A task matching `signals.pii_patterns` goes to `local` or to nobody; its text is absent from other peers' envelopes, the console stream, the log and the board listing; the console user reviews it; `local` answers such a turn to the console only, keeps it out of its history, refuses it when the only gateway is off campus, and may not save notes or spin off tasks during it. Nothing about it is sent to claude-mem, whose observer is a cloud model.
 - **Free text is screened too.** On an ordinary task, a done summary (with its check output: a match withholds the whole note), a review note, an unmet item or a budget handoff that matches a PII pattern (issue #69) is not saved to claude-mem, and every peer, `local` included, gets a stub naming `ahub task show <id>`; the board keeps the text, `hub.log` notes the withholding by task id only, and `ahub ask` shows such a note only when its model is reached on campus. `hub_remember` refuses a match; what a vendor agent writes to its own memory is not screened.

package/docs/smoke.md

@@ -964,3 +964,30 @@ was attached. Times are UTC.
   check.
 - The coordinator promoted the global CLI to 0.10.0, and `ahub setup --yes`
   installed the 0.10.0 plugin.
+
+## 0.10.0 to 0.11.0 attended upgrade (2026-10-01)
+
+A scratch project (a git work tree initialized by the 0.10.0 `ahub init`) ran a
+0.10.0 hub with `"local": { "bash_network": true }` in
+`.agenthub/config.local.json`, two tasks (#1 with the path spelled `./a.txt`),
+and an open budget pause: a peer had attached once and gone offline, and `ahub
+budget set` fed it a 95% reading. No peer was attached at the upgrade. Times are
+UTC, from `hub.log` and the operation record.
+
+- 0.11.0 was published at 08:43:45 (the registry's `time` field); a
+  cache-busting registry read, observed at the console at 08:43:58, showed it
+  as `latest`. `bunx --package @staix/agent-hub@0.11.0 ahub
+  upgrade --to 0.11.0 --dry-run` then listed one project, source 0.10.0, protocol
+  10, no blockers.
+- `--yes` created the operation at 08:44:19.4. The source committed at 08:44:19.5
+  and stopped; the 0.11.0 hub started its egress proxy (13 allowed hosts) at
+  08:44:19.7, found the pause still open with its reset time, and was up at
+  08:44:19.7. The operation, global install and plugin install included,
+  completed at 08:44:27.7.
+- The tasks' refs and history and the pause row's columns, dumped with `sqlite3`
+  before and after (the latter once the 0.11.0 hub was up), were byte-identical: #1 still reads `./a.txt` (0.11.0 normalizes paths only on new
+  writes).
+- Through the proxy, `curl` reached registry.npmjs.org (200, observed at the
+  console: the proxy logs no successes) and was refused example.com, logged as `network: refused example.com:443 (example.com:443 is
+  not in local.network_allow)`.
+- After `ahub setup --yes`, `claude plugin list` showed the 0.11.0 plugin.

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1099,7 +1099,9 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
   the flag on, network is allowed as in 0.9 and earlier. Issue #65 builds it
   (amendment below).
 - `local.sandbox` ("deny-default" | "allow-default") is machine-local, since
-  "allow-default" widens the sandbox.
+  "allow-default" widens the sandbox. Removed in 0.12.0 (issue #83): the field is
+  ignored with a note in `hub.log` and `ahub doctor`, and is no longer
+  machine-local because nothing reads it.
 - Capabilities: `propose`, `assign` (a proposal naming another peer as owner),
   `remember`, `important`. A peer not listed in `capabilities` has all of them,
   which keeps today's behaviour, and a listed peer whose value is not a list has
@@ -1125,5 +1127,5 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
 - Decisions recorded in the issue: the default list holds the npm, Yarn, PyPI,
   crates.io and Go module registries and GitHub's code hosts, so a project that
   already had network on keeps installing packages; `"direct"` keeps the open
-  network of 0.10 and earlier for one release.
+  network of 0.10 and earlier until 0.13.0 (issue #83).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15727,7 +15727,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.11.0",
+  version: "0.12.0",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/adapters/local-worker.ts

@@ -17,7 +17,7 @@ export interface LocalOptions {
   route?: string;
   /** Model id sent straight to OmniRoute when the sidecar is absent, unhealthy or fails a call. */
   fixedModel: string;
-  tools: { deny: string[]; permit: ToolContext["permit"]; bashNetwork?: SandboxNetwork; readAllow?: string[]; sandbox?: "deny-default" | "allow-default" };
+  tools: { deny: string[]; permit: ToolContext["permit"]; bashNetwork?: SandboxNetwork; readAllow?: string[] };
   capture?: Capture;
   /** Runs a hub task tool (hub_task_*, hub_review, hub_remember) as this peer. Absent = the tools are not offered. */
   taskTool?: (name: string, args: Record<string, unknown>, turn: { pii: boolean }) => Promise<string>;
@@ -67,7 +67,7 @@ export class LocalPeer extends BasePeer {
     private readonly opts: LocalOptions,
   ) {
     super(id, opts.watchdogMs);
-    this.sandboxProfile = profile(opts.cwd, opts.tools.bashNetwork ?? false, opts.tools.readAllow, opts.tools.deny, opts.tools.sandbox === "allow-default" ? "allow" : "deny");
+    this.sandboxProfile = profile(opts.cwd, opts.tools.bashNetwork ?? false, opts.tools.readAllow, opts.tools.deny);
   }
 
   recoveryMetadata(): Record<string, unknown> {

package/src/cli/main.ts

@@ -892,6 +892,7 @@ const commands: Record<string, () => Promise<void> | void> = {
 
     const config = loadConfig(cwd);
     row(!config.ignored, "config", config.ignored ? `${config.ignored.join("; ")} (move them to .agenthub/config.local.json)` : "no machine-local field ignored");
+    for (const line of config.retired ?? []) row(false, "retired setting", line); // issue #83
     const omni = new OmniRoute(config.omniroute);
     const gateway = await omni.base();
     row(!!gateway, "omniroute", gateway ? `${new URL(gateway).host} healthy` : config.omniroute.urls.length || process.env.AGENTHUB_OMNIROUTE_URL ? "no candidate reachable (VPN off?); ahub local cannot run" : "not configured: set omniroute.urls in .agenthub/config.local.json (any OpenAI-compatible gateway); ahub local cannot run");

package/src/hub/config-trust.ts

@@ -25,7 +25,6 @@ export const MACHINE_LOCAL = [
   "local.read_allow",
   "local.bash_network",
   "local.network_allow", // the hosts the egress proxy opens (#65)
-  "local.sandbox", // "allow-default" widens what the worker's commands may do
 ] as const;
 
 /**

package/src/hub/daemon.ts

@@ -63,9 +63,8 @@ export interface HubConfig {
   omniroute: OmniRouteConfig;
   pi: { enabled: boolean; auto_start: boolean; cmd: string[]; backend: "auto" | "dgx" | "mlx"; dgx_coding: string; dgx_fast: string; max_steps: number };
   mlx: Pick<MlxOptions, "provider" | "host" | "runtimeDir" | "modelPath" | "port" | "model" | "sourceModel" | "contextWindow" | "maxInputTokens" | "maxTokens" | "maxConcurrency">;
-  /** `sandbox`: "deny-default" (issue #39), or "allow-default", the profile of 0.9 and earlier, kept for one release. */
-  /** `bash_network`: true is network through the egress proxy to `network_allow` (#65); "direct" is everything, for one release. */
-  local: { deny: string[]; bash_network: boolean | "direct"; network_allow: string[]; max_steps: number; read_allow: string[]; sandbox: "deny-default" | "allow-default" };
+  /** `bash_network`: true is network through the egress proxy to `network_allow` (#65); "direct" is everything, until 0.13.0 (#83). */
+  local: { deny: string[]; bash_network: boolean | "direct"; network_allow: string[]; max_steps: number; read_allow: string[] };
   /** Pending permission requests: how long they wait, and whether the desktop is told (issue #5). */
   approvals: { timeout_s: number; notify: boolean };
   /** An owner offline this long loses its open tasks back to routing; 0 turns it off (issue #6). */
@@ -84,6 +83,8 @@ export interface HubConfig {
   capabilities: Record<string, string[]>;
   /** Machine-local fields a config file set but git could not vouch for, and why (issue #17). */
   ignored?: string[];
+  /** Settings that were removed or are about to be (issue #83): what each does now, for `hub.log` and `ahub doctor`. */
+  retired?: string[];
 }
 export const DEFAULT_CONFIG: HubConfig = {
   watchdog_ms: DEFAULT_WATCHDOG_MS,
@@ -99,7 +100,7 @@ export const DEFAULT_CONFIG: HubConfig = {
   omniroute: DEFAULT_OMNIROUTE,
   pi: { enabled: false, auto_start: false, cmd: ["pi"], backend: "auto", dgx_coding: "coding", dgx_fast: "fast", max_steps: 30 },
   mlx: { provider: "ollama", model: "agenthub-fast-mlx:4b-8k", sourceModel: "qwen3.5:4b-mlx", contextWindow: 8192, maxInputTokens: 6000, maxTokens: 2048, maxConcurrency: 1 },
-  local: { deny: [], bash_network: false, network_allow: DEFAULT_NETWORK_ALLOW, max_steps: 30, read_allow: [], sandbox: "deny-default" },
+  local: { deny: [], bash_network: false, network_allow: DEFAULT_NETWORK_ALLOW, max_steps: 30, read_allow: [] },
   // Off here, so tests and a hub without a config file stay silent; a project's config defaults it on for macOS.
   approvals: { timeout_s: 120, notify: false },
   tasks: { release_after_min: 30 },
@@ -139,6 +140,16 @@ export function loadConfig(cwd: string): HubConfig {
   if (!files.length) return DEFAULT_CONFIG;
   const file = files.reduce((a, b) => ({ ...a, ...b, ...Object.fromEntries(CONFIG_BLOCKS.filter((k) => a[k] !== undefined && b[k] !== undefined).map((k) => [k, { ...a[k], ...b[k] }])) }));
   delete file.ignored; // the hub's own record, never a file's
+  delete file.retired;
+  // Escape hatches with a stated end (issue #83). A removed one is ignored, never an error: an old config.local.json
+  // must not stop a hub from starting.
+  const retired: string[] = [];
+  if (file.local?.sandbox !== undefined) {
+    if (file.local.sandbox === "allow-default") retired.push('local.sandbox "allow-default" was removed in 0.12.0: the deny-default sandbox applies (local.read_allow adds paths)');
+    file.local = { ...file.local };
+    delete file.local.sandbox;
+  }
+  if (file.local?.bash_network === "direct") retired.push('local.bash_network "direct" (the open network) goes in 0.13.0: set it to true and list the hosts in local.network_allow');
   if (file.mlx != null && (typeof file.mlx !== "object" || Array.isArray(file.mlx))) throw new Error("mlx configuration must be an object");
   if (file.mlx?.provider !== undefined && !["ollama", "legacy"].includes(file.mlx.provider)) throw new Error("mlx.provider must be ollama or legacy");
   if (file.mlx?.provider === undefined && (file.mlx?.modelPath || file.mlx?.runtimeDir || file.mlx?.bin || file.mlx?.port)) {
@@ -170,6 +181,7 @@ export function loadConfig(cwd: string): HubConfig {
     capabilities: { ...file.capabilities },
     mlx,
     ...(ignored.length ? { ignored } : {}),
+    ...(retired.length ? { retired } : {}),
   };
 }
 
@@ -338,7 +350,7 @@ export async function startDaemon(opts: DaemonOptions) {
   })) as unknown as LimitsConfig;
   const limiter = new Limiter(limits);
   // The local worker's and Pi's commands reach the network only through this proxy (issue #65); "direct" keeps the
-  // open network of 0.10 and earlier for one release, anything else means none.
+  // open network of 0.10 and earlier until 0.13.0 (issue #83), anything else means none.
   let egress: EgressProxy | undefined;
   if (config.local.bash_network === true) {
     const allow = Array.isArray(config.local.network_allow) ? config.local.network_allow.filter((h): h is string => typeof h === "string") : DEFAULT_NETWORK_ALLOW;
@@ -435,6 +447,7 @@ export async function startDaemon(opts: DaemonOptions) {
   if (strayChecks.length) log(`checks ignored for ${strayChecks.join(", ")}: not a task class with a command (classes: ${CLASSES.join(", ")})`);
   // Commands and the other machine-local fields came only from a file git vouched for (loadConfig, issue #17).
   for (const line of config.ignored ?? []) log(`${line}; only a config file nobody committed may set it`);
+  for (const line of config.retired ?? []) log(`config: ${line}`);
   const checksAllowed = Object.keys(checkCommands).length > 0;
   const checkTimeoutS = typeof config.checks.timeout_s === "number" && config.checks.timeout_s >= 1 ? Math.min(config.checks.timeout_s, 3600) : 600;
   const runningChecks = new Set<() => void>();
@@ -1216,7 +1229,7 @@ export async function startDaemon(opts: DaemonOptions) {
       let piReply: Envelope | undefined;
       const ctx: ToolContext = {
         cwd: opts.cwd, deny: config.local.deny,
-        sandboxProfile: profile(opts.cwd, sandboxNetwork, config.local.read_allow, config.local.deny, config.local.sandbox === "allow-default" ? "allow" : "deny"),
+        sandboxProfile: profile(opts.cwd, sandboxNetwork, config.local.read_allow, config.local.deny),
         sandboxEnv: proxyEnv(sandboxNetwork),
         permit: (title) => onPermission({ peer: "pi", title, options: [{ optionId: "allow", name: "Allow", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] }).then((picked) => picked === "allow" && pi.acceptingTools && bus.peers.get("pi") === pi),
         send: (text, to) => {
@@ -1308,7 +1321,7 @@ export async function startDaemon(opts: DaemonOptions) {
         omni,
         ...(sidecar && route ? { sidecar, route } : {}),
         fixedModel: args.model ?? routing.local.fixed_model,
-        tools: { deny: config.local.deny, bashNetwork: sandboxNetwork, readAllow: config.local.read_allow, sandbox: config.local.sandbox, permit },
+        tools: { deny: config.local.deny, bashNetwork: sandboxNetwork, readAllow: config.local.read_allow, permit },
         ...(capture ? { capture } : {}),
         taskTool: (name, a, turn) => taskOp("local", name, a, true, turn.pii),
         turnPolicy: (envs) => tasks.turnPolicy(envs),

package/src/local/proxy.ts

@@ -47,11 +47,29 @@ export function allowed(list: string[], host: string, port: number): boolean {
 const INTERNAL = new BlockList();
 // IPv4 nets as leading octets: the package check refuses private address literals in published files.
 for (const [a, b, bits] of [[0, 0, 8], [10, 0, 8], [100, 64, 10], [127, 0, 8], [169, 254, 16], [172, 16, 12], [192, 168, 16], [198, 18, 15], [224, 0, 3]] as const) INTERNAL.addSubnet(`${a}.${b}.0.0`, bits, "ipv4");
-for (const [net, bits] of [["::", 96], ["fc00::", 7], ["fe80::", 10], ["fec0::", 10], ["ff00::", 8]] as const) INTERNAL.addSubnet(net, bits, "ipv6");
+// RFC 8215's local-use NAT64 prefix puts the IPv4 address where the operator's prefix length says: refused outright.
+for (const [net, bits] of [["::", 96], ["fc00::", 7], ["fe80::", 10], ["fec0::", 10], ["ff00::", 8], ["64:ff9b:1::", 48]] as const) INTERNAL.addSubnet(net, bits, "ipv6");
+// The well-known NAT64 prefix (issue #82): with DNS64, a name whose only record is an internal IPv4 address comes back
+// as 64:ff9b::<that address>, and the NAT64 gateway carries the connection there. Its IPv4 address is what counts.
+const NAT64 = new BlockList();
+NAT64.addSubnet("64:ff9b::", 96, "ipv6");
+
+/** The IPv4 address in the last 32 bits of an IPv6 address, whatever its spelling. */
+function lastIPv4(v6: string): string {
+  const [head = "", tail] = new URL(`http://[${v6}]`).hostname.slice(1, -1).split("::");
+  const h = head ? head.split(":") : [];
+  const t = tail ? tail.split(":") : [];
+  const all = tail === undefined ? h : [...h, ...Array<string>(8 - h.length - t.length).fill("0"), ...t];
+  const [a = 0, b = 0] = all.slice(6).map((g) => parseInt(g, 16));
+  return `${a >> 8}.${a & 255}.${b >> 8}.${b & 255}`;
+}
 
 /** Loopback, private, link-local, site-local, unspecified, carrier-grade NAT, benchmark, multicast or reserved. */
 export function isInternal(address: string): boolean {
+  // Only a non-global address carries a zone (`fe80::1%en0`, `::1%lo0`), and BlockList cannot parse one: internal.
+  if (address.includes("%")) return true;
   const family = isIP(address);
+  if (family === 6 && NAT64.check(address, "ipv6")) return isInternal(lastIPv4(address));
   return family !== 0 && INTERNAL.check(address, family === 6 ? "ipv6" : "ipv4");
 }
 
@@ -75,7 +93,8 @@ export function startEgressProxy(opts: { allow: string[]; log: (line: string) =>
       head = Buffer.concat([head, chunk]);
       const end = head.indexOf("\r\n\r\n");
       if (end < 0) {
-        if (head.length > 8192) refuse(client, 431, "request header too large");
+        // Once: later chunks of the same request must not refuse (and log) again. Nothing of the header is logged.
+        if (head.length > 8192) client.off("data", onData), refuse(client, 431, "request header too large", "a request");
         return;
       }
       client.off("data", onData);
@@ -114,14 +133,22 @@ export function startEgressProxy(opts: { allow: string[]; log: (line: string) =>
     const upstream = connect({ host: address, port, allowHalfOpen: true });
     sockets.add(upstream);
     upstream.on("close", () => sockets.delete(upstream));
+    let open = false;
     upstream.once("connect", () => {
+      open = true;
       client.write(`${http} 200 Connection Established\r\n\r\n`);
       if (rest.length) upstream.write(rest);
       client.pipe(upstream);
       upstream.pipe(client);
       client.resume();
     });
-    upstream.on("error", () => (client.writable && !client.destroyed ? refuse(client, 403, `${host}:${port} is unreachable`) : client.destroy()));
+    // Before the tunnel opens a failure is a refusal, logged with the error code only (never its text). After, the
+    // stream is the client's TLS: an HTTP answer would corrupt it, so the client is just closed.
+    upstream.on("error", (e: NodeJS.ErrnoException) => {
+      if (open || !client.writable || client.destroyed) return void client.destroy();
+      const code = /^E[A-Z]{2,20}$/.test(e.code ?? "") ? `, ${e.code}` : "";
+      refuse(client, 403, `${host}:${port} is unreachable${code}`, `${host}:${port}`);
+    });
     client.on("close", () => upstream.destroy());
   };
 

package/src/local/sandbox.ts

@@ -59,21 +59,20 @@ const NETWORK_MACH_SERVICES = ["com.apple.dnssd.service", "com.apple.trustd", "c
 const PROXY_MACH_SERVICES = ["com.apple.trustd", "com.apple.trustd.agent"];
 
 /**
- * Network for the commands: none, direct (`local.bash_network: "direct"`, everything, kept for one release), or only
+ * Network for the commands: none, direct (`local.bash_network: "direct"`, everything, until 0.13.0), or only
  * the hub's egress proxy on a loopback port (#65), which opens allowlisted hosts.
  */
 export type SandboxNetwork = boolean | { proxyPort: number };
 
 /**
- * `base` "deny" (issue #39) starts from `(deny default)` and allows only what commands need: running and reading the
- * system, toolchain and project directories, writing the project and temp. "allow" is the profile of 0.9 and earlier,
- * kept for one release behind `local.sandbox: "allow-default"`. The denies at the end apply to both.
+ * Starts from `(deny default)` (issue #39) and allows only what commands need: running and reading the system,
+ * toolchain and project directories, writing the project and a temp dir of their own. The allow-default profile of
+ * 0.9 and earlier was removed in 0.12.0 (issue #83).
  */
-export function profile(cwd: string, network: SandboxNetwork, readAllow: string[] = [], deny: string[] = [], base: "deny" | "allow" = "deny"): string {
+export function profile(cwd: string, network: SandboxNetwork, readAllow: string[] = [], deny: string[] = []): string {
   const home = homedir();
   const inHome = (p: string) => (p.startsWith("~/") ? join(home, p.slice(2)) : p);
   const root = realPath(cwd);
-  const tmp = realPath(tmpdir());
   const gitDirs = externalGitDirs(root);
   const creds = [".ssh", ".aws", ".gnupg", ".config/gh", ".config/gcloud", ".kube", ".docker", ".netrc", ".npmrc", ".omniroute", ".claude", ".codex", ".kimi-code", "Library/Keychains"];
   const dev = developerDir();
@@ -81,38 +80,28 @@ export function profile(cwd: string, network: SandboxNetwork, readAllow: string[
   const subpaths = (paths: string[]) => paths.map((p) => `(subpath ${q(p)})`).join(" ");
   const globals = (names: string[]) => names.map((n) => `(global-name ${q(n)})`).join(" ");
   const proxy = typeof network === "object" ? `(allow network-outbound (remote ip ${q(`localhost:${network.proxyPort}`)}))` : undefined;
-  const start = base === "deny"
-    ? [
-        "(deny default)",
-        "(allow process-fork)",
-        // Runs from the system, toolchain and project directories only; a script runs through an allowed interpreter.
-        // The user's temp dir and /private/tmp are shared with every other process: each command gets its own (#63).
-        `(allow process-exec ${subpaths([...SYSTEM_READABLE, ...readable])})`,
-        "(allow signal (target same-sandbox))",
-        "(allow process-info* (target same-sandbox))",
-        "(allow sysctl-read)",
-        `(allow mach-lookup ${globals([...MACH_SERVICES, ...(proxy ? PROXY_MACH_SERVICES : network ? NETWORK_MACH_SERVICES : [])])})`,
-        '(allow ipc-posix-shm-read-data ipc-posix-shm-read-metadata (ipc-posix-name "apple.shm.notification_center"))',
-        "(allow file-read-metadata)",
-        `(allow file-read* (literal "/") ${subpaths([...SYSTEM_READABLE, "/dev"])} ${subpaths(readable)})`,
-        '(allow file-ioctl (regex #"^/dev/"))',
-        ...(proxy ? [proxy] : network ? ["(allow network*)"] : []),
-      ]
-    : [
-        "(allow default)",
-        ...(network === true ? [] : ["(deny network*)", ...(proxy ? [proxy] : [])]),
-        // Home is default-deny for reads: whatever a command reads can end up in the model's answer, and that answer
-        // is shared with agents that run on cloud subscriptions (~/.claude.json, app tokens, browser profiles ...).
-        `(deny file-read* (subpath ${q(home)}))`,
-        `(allow file-read-metadata (subpath ${q(home)}))`,
-        `(allow file-read* ${subpaths(readable)})`,
-      ];
+  const start = [
+    "(deny default)",
+    "(allow process-fork)",
+    // Runs from the system, toolchain and project directories only; a script runs through an allowed interpreter.
+    // The user's temp dir and /private/tmp are shared with every other process: each command gets its own (#63).
+    `(allow process-exec ${subpaths([...SYSTEM_READABLE, ...readable])})`,
+    "(allow signal (target same-sandbox))",
+    "(allow process-info* (target same-sandbox))",
+    "(allow sysctl-read)",
+    `(allow mach-lookup ${globals([...MACH_SERVICES, ...(proxy ? PROXY_MACH_SERVICES : network ? NETWORK_MACH_SERVICES : [])])})`,
+    '(allow ipc-posix-shm-read-data ipc-posix-shm-read-metadata (ipc-posix-name "apple.shm.notification_center"))',
+    "(allow file-read-metadata)",
+    `(allow file-read* (literal "/") ${subpaths([...SYSTEM_READABLE, "/dev"])} ${subpaths(readable)})`,
+    '(allow file-ioctl (regex #"^/dev/"))',
+    ...(proxy ? [proxy] : network ? ["(allow network*)"] : []),
+  ];
   const places = `${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")} ${denyRegexes(root, deny, false).join(" ")}`;
   return [
     "(version 1)",
     ...start,
     "(deny file-write*)",
-    `(allow file-write* (subpath ${q(root)}) ${base === "deny" ? "" : `(subpath ${q(tmp)}) (subpath "/private/tmp") `}(regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`,
+    `(allow file-write* (subpath ${q(root)}) (regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`,
     // Inside cwd: nothing that runs later outside the sandbox, nothing that reconfigures the hub.
     `(deny file-write* (subpath ${q(join(root, ".agenthub"))}) ${[join(root, ".git"), ...gitDirs].map((d) => `(subpath ${q(join(d, "hooks"))}) (literal ${q(join(d, "config"))})`).join(" ")})`,
     `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")})`,

package/templates/config.json

@@ -23,7 +23,7 @@
     "cf_client_id_file": "",
     "cf_client_secret_file": ""
   },
-  "local": { "deny": [], "bash_network": false, "max_steps": 30, "read_allow": [], "sandbox": "deny-default" },
+  "local": { "deny": [], "bash_network": false, "max_steps": 30, "read_allow": [] },
   "approvals": { "timeout_s": 120 },
   "tasks": { "release_after_min": 30 },
   "checks": { "timeout_s": 600 },