@staix/agent-hub 0.12.1 → 0.12.2

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the previous repository, archived on 2026-09-30 when this repository's history was rewritten; the one exception is the open smoke-check issue, formerly #12, which moved here as #1. Numbers in newer entries refer to this repository.
 
+## 0.12.2
+
+- An edit approved after another peer changed the file now applies its fragment replacement to current contents. It rechecks that the old fragment still matches exactly once and refuses a stale match. Both write and edit revalidate their paths after approval, so a path replaced with an escaping symlink during the wait is refused (#98).
+
 ## 0.12.1
 
 - Exhausted task deliveries escalate with the last error and notify the console. Three consecutive exhausted deliveries exclude a peer from routing until a delivery completes. A local worker validates its gateway, model inventory and a minimal availability call before attaching; doctor flags an unserved fixed model (#89).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.12.1, control protocol 11. Durable delivery records distinguish queued
+Status: 0.12.2, control protocol 11. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.12.1 and control protocol 11. Live verification
+This guide describes ahub 0.12.2 and control protocol 11. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Install and start
@@ -481,8 +481,8 @@ source and carries every recovery fix released up to it. Protocol 8 and older
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.12.1 ahub upgrade --to 0.12.1 --dry-run
-bunx --package @staix/agent-hub@0.12.1 ahub upgrade --to 0.12.1 --yes
+bunx --package @staix/agent-hub@0.12.2 ahub upgrade --to 0.12.2 --dry-run
+bunx --package @staix/agent-hub@0.12.2 ahub upgrade --to 0.12.2 --yes
 ```
 
 | Running now | Coordinator to use |
@@ -520,14 +520,14 @@ projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.12.1 --dry-run
+ahub upgrade --to 0.12.2 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.12.1 --yes
+ahub upgrade --to 0.12.2 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>

package/docs/smoke.md

@@ -2,6 +2,42 @@
 
 `scripts/check.sh` covers everything against fakes. The legs below need real accounts and an interactive terminal, so they are run by hand and recorded here.
 
+## Approval race live reproduction and candidate verification (#98)
+
+Measured on 2026-10-02 KST with installed 0.12.1 and the correction candidate,
+using real Kimi 2.1.1 and Pi 0.86.0 in disposable git projects:
+
+- Pi requested an edit of only `PI_MARKER`, and its allow-once approval waited.
+  Kimi changed the separate `KIMI_MARKER` line. Approving Pi restored the old
+  Kimi value (`pending`) while retaining `pi-live`. The hub emitted one concurrent
+  conflict event with both turn ids, so conflict detection worked while the tool
+  still overwrote unrelated current contents.
+- The candidate repeated the same real-agent interleaving and kept both
+  `kimi-live` and `pi-live`. One concurrent conflict was recorded, and Kimi's
+  reviewer role produced an actual `pi:accepted -> pi:done -> kimi:approved`
+  task history. This is the runtime fix included in 0.12.2.
+- Regression checks cover a fragment changed while approval waits and write/edit
+  paths changed into out-of-project symlinks during approval. Existing approval
+  denial and initial exact-match checks remain intact.
+- The same live acceptance session used real Codex 0.159.3 (reply `pong`, no hub
+  negative RPC ids leaked), the real local worker, and real Switchyard routes.
+  Controlled gateway 503s verified escalation, three-exhausted-delivery routing
+  exclusion, recovery after a completed delivery, and a post-write needs-review
+  hold with one notice and explicit resolution. Idle model/route replacements and
+  busy refusal were observed; doctor flagged an unserved fixed model.
+- Pi native session usage independently totalled 36,390 tokens, exactly matching
+  hub events. A candidate session's complete native and hub totals also matched
+  at 100,940 tokens. Real Kimi submitted a 1,430-character checkpoint summary and
+  handed open work to Pi after a controlled 95% reading.
+- The real Codex weekly reading was 2%, so natural near-limit pause remains
+  unverified (issue #1). The injected 95% empty-work check spent zero extra
+  checkpoint turns; it is separate evidence from the natural provider leg.
+
+The gateway outages, response barriers and manual quota readings were controlled
+fault inputs. Native/model replies were verified against files, task history,
+events and native session usage. Disposable test hubs were stopped and removed
+from the registry; credentials and raw conversations remain outside the ledger.
+
 ## Reliability and self-development run (#89-#95, 0.12.1)
 
 Measured on 2026-10-01 in an isolated worktree of this repository:

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1141,3 +1141,13 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
 - Pi assistant usage is forwarded through the authenticated bridge and recorded before settlement, without counting the same message both at `message_end` and `agent_end`.
 - An idle peer with no open owner/reviewer task and no queued or active delivery skips the quota checkpoint turn; the pause proceeds immediately and the log records the skip.
 - Control protocol 11 adds queue hold metadata; the current coordinator supports authenticated protocol 9, 10 and 11 recovery sources.
+
+
+## Approval-time file validation, 0.12.2 (#98)
+
+The hub-native write and edit tools validate paths before requesting approval and
+again after approval, at mutation time. Edit retains its early exact-fragment
+check, then reads current contents after approval and requires the old fragment
+to occur exactly once. The approved replacement applies to those current bytes,
+so another peer's unrelated edits made during the wait are retained. A changed
+fragment or an escaping path returns an error without a write.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15727,7 +15727,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.12.1",
+  version: "0.12.2",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/local/tools.ts

@@ -116,19 +116,25 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         return out.length > OUTPUT_CAP ? `${out.slice(0, OUTPUT_CAP)}\n(truncated: read again with offset/limit)` : out;
       }
       case "write": {
-        const file = guardPath(ctx, String(a.path), "write");
+        let file = guardPath(ctx, String(a.path), "write");
         const content = String(a.content ?? "");
         if (!(await ctx.permit(`write ${a.path} (${content.length} chars):\n${preview(content)}`))) return "error: the user did not approve this write";
+        file = guardPath(ctx, String(a.path), "write");
         mkdirSync(dirname(file), { recursive: true });
         writeFileSync(file, content);
         return `wrote ${a.path}`;
       }
       case "edit": {
-        const file = guardPath(ctx, String(a.path), "write");
-        const text = readFileSync(file, "utf8");
-        const count = text.split(String(a.old)).length - 1;
+        let file = guardPath(ctx, String(a.path), "write");
+        let text = readFileSync(file, "utf8");
+        let count = text.split(String(a.old)).length - 1;
         if (!a.old || count !== 1) return `error: \`old\` must match exactly once, it matched ${count} times`;
         if (!(await ctx.permit(`edit ${a.path}:\n- ${preview(String(a.old), 600)}\n+ ${preview(String(a.new ?? ""), 600)}`))) return "error: the user did not approve this edit";
+        // Approval can outlive another peer's edit or a path change. Apply only the approved fragment to current bytes.
+        file = guardPath(ctx, String(a.path), "write");
+        text = readFileSync(file, "utf8");
+        count = text.split(String(a.old)).length - 1;
+        if (count !== 1) return `error: file changed during approval; \`old\` must match exactly once, it matched ${count} times`;
         writeFileSync(file, text.replace(String(a.old), () => String(a.new ?? "")));
         return `edited ${a.path}`;
       }