@staix/agent-hub 0.12.16 → 0.12.17

package/docs/verification/2026-10-09-agent-shell-t0.md

@@ -0,0 +1,123 @@
+# Agent shell identity T0, issues #193 and #194
+
+## Evidence collected
+
+- Installed CLI reports `codex-cli 0.146.0` (`codex --version`, 2026-10-09). `codex app-server --help` supports configuration overrides and WebSocket listeners; its example names `shell_environment_policy.inherit=all`.
+- The [version-pinned native environment implementation](https://github.com/openai/codex/blob/rust-v0.146.0/codex-rs/protocol/src/shell_environment.rs) applies inheritance, default exclusions, custom exclusions, explicit values, and `include_only` in that order. It then injects `CODEX_THREAD_ID`. `AGENTHUB_PEER_ID` is an ordinary inherited variable and can be removed by filtering. The native thread marker is injected after filtering, which supplies a fallback without widening the user's environment policy.
+- The [version-pinned core wrapper](https://github.com/openai/codex/blob/rust-v0.146.0/codex-rs/core/src/exec_env.rs) explicitly documents thread-marker injection even with `include_only`.
+- The [current configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference) describes inheritance and filtering, and now describes a `filters` map alongside legacy `exclude` and `include_only`. Current documentation is not evidence that every new option exists in installed 0.146.0.
+- The hub's Codex adapter passes a child environment even without optional launch values. It now sets its own marker and removes stale vendor markers inherited from the caller. Recovery authority remains scrubbed by `childEnv`.
+
+## Native Codex observations (2026-10-09)
+
+- Real installed `codex exec --json --model gpt-5.5 --sandbox workspace-write`
+  completed a single fixed Python shell probe in an isolated git fixture.
+  With explicit `inherit=all`, the hub marker, native thread marker and harmless
+  canary were present; a Claude marker was absent. The disposable loopback
+  responder was reachable by the harness, while the native shell request failed
+  with `URLError`, errno 1. No sandbox or network exception was requested.
+- A second real run used `inherit=none`, an explicit PATH and
+  `include_only=["PATH"]`. The hub marker, native marker and canary still appeared
+  in the observed shell. This does not establish that filtering removed them;
+  the difference from the pinned environment construction is unresolved in this
+  installed host environment. The fallback is supported by source and marker
+  presence, without widening the caller's configured policy.
+- A real native MCP call under `workspace-write` completed `agent-hub.hub_status`
+  against the candidate bundle and an isolated conductor daemon. Native JSONL
+  recorded the MCP call completing, and the daemon independently recorded a
+  codex `conduct/status` event. Only this exact hub tool was approved through the
+  existing per-tool `approval_mode=approve` configuration; its daemon role check
+  still applied. This proves MCP access separately from the blocked shell path.
+- The first run with the user's configured `gpt-6.1-sol` failed before tools:
+  that slug was rejected by the installed ChatGPT-account endpoint. The probe's
+  explicit model selection did not change the user's configuration.
+
+## Native Claude observations (2026-10-09)
+
+- The final observer proof used source `20ad5e6`. Its read-only feed-off
+  continuation verified one completed native turn, 263,413 cached-inclusive
+  tokens, a matching opaque daemon Stop receipt, native idle and no pending
+  deliveries. The fresh feed-own run verified two actual owner completions and
+  independent file reviews, nine native finals matched by nine daemon Stops,
+  27 unique usage records and 1,888,242 tokens. Eight completed turns contained
+  supervision, totalling 1,292,922 tokens. The receipt matched the final native
+  message, session, launcher and instance; earlier incomplete captures below
+  were not retroactively marked complete.
+
+- In the original captures, Claude Code 2.1.295, Opus 5.5, ran the candidate MCP tools in real PTYs
+  after its five-hour quota reset. Both feed-off and feed-own fixtures started
+  local and headless Pi, proposed two tasks, reassigned Beta to Pi, held and
+  released both peers, and independently read the exact ALPHA/BETA files before
+  approving their tasks. The console independently audited four allow-once
+  answers in each fixture, covering the two writes and bounded file checks.
+- The real feed-off TUI displayed inbound review requests; the feed-own TUI
+  displayed actual supervision and review pushes. MCP success and channel
+  delivery were observed separately. A transient startup warning about the
+  server name did not prevent the later observed channel deliveries.
+- In the feed-own native TUI, the operator submitted the fixed Python probe
+  through `!`. Its actual command output was `AGENTHUB_PEER_ID=true`,
+  `CLAUDECODE=true`, `CLAUDE_CODE_SESSION_ID=true`, `CODEX_THREAD_ID=false`.
+  This is shell output captured before Claude's interpretation of it.
+- A subsequent feed-off run pinned to `da2ebbc` executed the same fixed probe
+  through the model's actual native Bash tool and separately through `!`.
+  Both actual command outputs showed the same three Claude/hub markers present
+  and `CODEX_THREAD_ID` absent. This closes the separate model-shell observation;
+  neither command printed environment values.
+- The original harness accepted hub idle too early and stopped both last
+  review turns before a native final answer. Native transcripts independently
+  show two completed turns in feed-off and five in feed-own, with the last
+  assistant message still `tool_use` in each case. The board approvals are real;
+  complete final-turn verification and production supervision accounting were
+  incomplete for those captures. The harness now requires the current daemon instance, its session,
+  the fixture-specific transcript, a final `end_turn` and `turn_duration` after
+  the last actual review. Missing measurements remain unknown.
+- The `da2ebbc` run verified the final native message UUID, message id,
+  `end_turn`, subsequent `turn_duration`, daemon instance, session and launcher.
+  Its complete transcript contains five completed turns and 21 unique usage
+  records, totalling 1,451,782 tokens including cached input. The daemon certified
+  only one native Stop, however. Its log refused the other completions as an
+  unavailable completed transcript message or completion predating the current
+  turn; the final refusal occurred before cleanup. A normal review receipt
+  remained queued. Actual task/file/final-answer evidence is valid, while full
+  runtime accounting and delivery settlement remain incomplete.
+- The `6034dd9` read-only continuation preserved both approved tasks and exact
+  files. It completed one native turn with four unique usage records and 261,483
+  cached-inclusive tokens, but the matching daemon Stop remained absent. After
+  a bounded retry, the Stop handler logged unavailable completion at
+  01:39:04.087 UTC; the native stop summary/duration appeared at 01:39:04.095 UTC.
+  With no overlapping operator prompt, this strongly supports a transcript
+  visibility barrier while the native hook waits. The strict harness timed out
+  incomplete and stopped its owned processes. The final message's thinking/text
+  rows carried identical usage counters in these observed transcripts; this
+  observation does not replace the final text/duration requirement.
+
+## Plain Claude and Kimi observations (2026-10-09)
+
+- Plain Claude 2.1.295, launched with the candidate MCP configuration but no
+  development-channel flag, completed one native `hub_status` call with an
+  independent daemon Claude status audit. Its only native tool calls were
+  ToolSearch and that status call. A unique operator push was bridge-accepted,
+  but no native pushed user row or response appeared in the observed
+  20.075-second window. This bounded negative observation is not a universal
+  claim about channel support. Actual channel-enabled review/supervision pushes
+  were observed separately in the conductor cases. The plain probe and cleanup
+  took 56.724 seconds and made no model file, shell, task or settings changes.
+- Real Kimi Code CLI 2.1.1 answered ACP `initialize` and created native session
+  `session_17eeb9dc-38d3-4685-b1aa-3db6a89b465c`. Its single prompt failed with
+  protocol error `-32000`, HTTP 403, for the managed account's weekly usage
+  limit before any requested tool event. No task-list/status result or ordinary
+  peer's conductor refusal was obtained. The owning CLI's safe provider list
+  showed only `managed:kimi-code`, type `kimi`, four models, OAuth, default
+  `kimi-code/k3`. No distinct configured provider was found. The reset time
+  remains unknown; no purchase, credential/configuration change or model retry
+  was attempted. Owned native processes and the fixture daemon were stopped.
+
+## Release disposition and remaining bounded live probe
+
+- On 2026-10-09 the user explicitly approved release 0.12.17 with only the Kimi native new-tool and ordinary-role refusal T0 evidence deferred. Kimi coverage remains unverified. This decision defers no other source/native gate and authorizes no purchase, credentials, provider/configuration change, account retry or authority relaxation.
+- Kimi ACP MCP: after native provider access is available under an authorized account, request the same read-only task list/status and ordinary-role refusal probes in isolated sessions. Verify actual native tool events/results and the daemon reply before marking this prerequisite verified. The existing quota failure proves neither new-tool access nor refusal behavior.
+
+## Verification limits
+
+- Codex shell and MCP probes used the root agent's serial resource slot. Claude `!`, model shell, enabled-channel pushes and the bounded plain-session comparison were observed in subsequent serial native cases. Kimi new-tool access remains unverified because its real account rejected the prompt before tools.
+- New unit and fake-adapter tests are prepared but have not been run by this worker. The root agent owns the final immutable-head checks.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
       "paths": [
         "package.json",
         "src/",
@@ -30,11 +30,12 @@
         ".github/workflows/check.yml",
         "scripts/ci-gates.mjs",
         "scripts/ci-reuse.mjs",
-        ".github/workflows/release.yml"
+        ".github/workflows/release.yml",
+        "scripts/smoke-conductor.ts"
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
       "paths": [
         "package.json",
         "src/",
@@ -42,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "20ad5e68fd1264fa43dd7426f60cb0c8211d6555",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -55,7 +56,7 @@
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "8b7d7254f1bb5602ec5d658e7814e236f8fb43e7",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -67,7 +68,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "20ad5e68fd1264fa43dd7426f60cb0c8211d6555",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -79,18 +80,19 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "20ad5e68fd1264fa43dd7426f60cb0c8211d6555",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
         "src/hub/limits.ts",
         "src/hub/delivery-journal.ts",
         "src/hub/inference.ts",
-        "src/hub/daemon.ts"
+        "src/hub/daemon.ts",
+        "src/hub/supervision.ts"
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "20ad5e68fd1264fa43dd7426f60cb0c8211d6555",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -107,11 +109,16 @@
         "src/cli/recovery-package.ts",
         "src/cli/facts-hook.ts",
         "src/pi/process-signature.ts",
-        "src/hub/context-window.ts"
+        "src/hub/context-window.ts",
+        "src/hub/conductor.ts",
+        "src/cli/console.ts",
+        "src/cli/console-state.ts",
+        "src/cli/identity.ts",
+        "src/cli/identity-audit.ts"
       ]
     },
     "docs/agent-notes/local-worker.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "8b7d7254f1bb5602ec5d658e7814e236f8fb43e7",
       "paths": [
         "src/adapters/local-worker.ts",
         "src/local/",
@@ -120,7 +127,7 @@
       ]
     },
     "docs/agent-notes/models.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "8b7d7254f1bb5602ec5d658e7814e236f8fb43e7",
       "paths": [
         "src/models/",
         "src/hub/inference.ts",
@@ -129,7 +136,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -138,11 +145,13 @@
         "src/hub/task-sweep.ts",
         "src/cli/launch.ts",
         "src/cli/main.ts",
-        "src/cli/preview.ts"
+        "src/cli/preview.ts",
+        "src/hub/conductor.ts",
+        "src/hub/supervision.ts"
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "2f6274d007d47aa3db0976c4989021520c03a3ef",
+      "verifiedAgainst": "2a274289e280252b264716da3a1112f67b0c278e",
       "paths": [
         "test/",
         "scripts/check.sh",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.16",
+  "version": "0.12.17",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.16",
+  "version": "0.12.17",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15291,8 +15291,8 @@ function projectContext(cwd, env = process.env) {
 function stateDirFor(cwd) {
   return projectContext(cwd).stateDir;
 }
-var PROTOCOL = 14;
-var RECOVERY_SOURCE_PROTOCOLS = [9, 10, 11, 12, 13, PROTOCOL];
+var PROTOCOL = 15;
+var RECOVERY_SOURCE_PROTOCOLS = [9, 10, 11, 12, 13, 14, PROTOCOL];
 function readControl(stateDir) {
   try {
     const status = JSON.parse(readFileSync2(join2(stateDir, "status.json"), "utf8"));
@@ -15403,7 +15403,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.12.16",
+  version: "0.12.17",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",
@@ -15503,7 +15503,18 @@ var TASK_TOOLS = [
   tool("hub_remember", "Save a decision, finding, contract or fail to the memory all agents share (claude-mem); the other agents also get it with their next message. A fail is an approach you tried that does not work, and why: the most useful note, it stops the others spending their quota on it. Do not retry what a fail note rules out without new evidence. Conclusions worth recalling, not chatter.", { text: str, title: str, kind: { type: "string", enum: [...NOTE_KINDS] }, task: id }, ["text"])
 ];
 var TASK_TOOL_NAMES = new Set(TASK_TOOLS.map((t) => t.name));
+var CONDUCTOR_TOOLS = [
+  tool("hub_status", "Inspect public team state, holds, quota windows, task counts and pending approval peer/tool/age. Only the configured conductor may use this tool.", {}),
+  tool("hub_task_show", "Read a task's public view and history. PII tasks remain stubs. Only the conductor may use this tool.", { id }, ["id"]),
+  tool("hub_task_assign", "Move a task to another peer, as the conductor. Requires assign capability when the conductor has an explicit capabilities list.", { id, peer: str }, ["id", "peer"]),
+  tool("hub_task_escalate", "Escalate a task through the normal task flow, as the conductor. Requires assign capability when explicitly listed.", { id }, ["id"]),
+  tool("hub_peer_start", "Start local, kimi or headless pi. Claude, Codex and Pi TUI requests return a command for the person to run, without launching a terminal.", { peer: { type: "string", enum: ["local", "kimi", "pi", "claude", "codex"] }, mode: { type: "string", enum: ["headless", "tui"] } }, ["peer"]),
+  tool("hub_peer_hold", "Hold a peer's deliveries as the conductor. This hold is separate from the person's hold and budget pauses.", { peer: str }, ["peer"]),
+  tool("hub_peer_release", "Release only the conductor hold you placed. Never lifts a person's hold or a budget pause.", { peer: str }, ["peer"])
+];
+var CONDUCTOR_TOOL_NAMES = new Set(CONDUCTOR_TOOLS.map((t) => t.name));
 var ROLE_TEXT = {
+  conductor: "conductor: plan and split work into tasks with owners, watch the team with hub_status, move stalled work, and ensure every task is reviewed (review it yourself only if you also hold reviewer). Report results and open decisions to the person. Do not implement tasks you handed out. Never ask a peer to answer an approval; ask the person for human-only actions. You may release only holds you placed, never human holds or budget pauses.",
   planner: "planner: break work into tasks with hub_task_propose (one outcome each, the right class, paths in refs, and after: [ids] for work that must wait for other tasks) instead of doing everything yourself.",
   implementer: "implementer: accept tasks assigned to you, do them, and finish with hub_task_done (summary: what changed, why, and the check you ran with its result; refs). Decline what you cannot do. Before starting work nobody assigned you, claim it with hub_task_propose naming yourself as owner, with the paths in refs. With a claim or an accept, give a plan: the files, symbols and signatures you will change and where new code goes.",
   verifier: "verifier: run the checks a task names and report what passed and what did not in hub_task_done.",
@@ -15690,7 +15701,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         inputSchema: { type: "object", properties: { delivery_id: { type: "string" }, delivery_generation: { type: "string" } }, required: ["delivery_id", "delivery_generation"], additionalProperties: false }
       }
     ],
-    ...TASK_TOOLS
+    ...TASK_TOOLS,
+    ...CONDUCTOR_TOOLS
   ]
 }));
 server.setRequestHandler(CallToolRequestSchema, async (req) => {
@@ -15720,7 +15732,7 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
     const sent = `sent to: ${res.targets.join(", ") || "(no other peers attached)"}`;
     return text(typeof res.notice === "string" ? `${sent}; ${res.notice}` : sent);
   }
-  if (TASK_TOOL_NAMES.has(name)) {
+  if (TASK_TOOL_NAMES.has(name) || CONDUCTOR_TOOL_NAMES.has(name)) {
     if (!hub)
       return text(offline());
     const res = await hub.request({ t: "task", op: name, args: args ?? {} });

package/src/adapters/acp.ts

@@ -2,7 +2,7 @@ import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
 import { createInterface } from "node:readline";
 import { renderDigest, replyAudience, replyParent, type Envelope, type PeerId } from "../hub/envelope.ts";
 import { BasePeer } from "../hub/peers.ts";
-import { childEnv, stopOwnedProcess, trackGroup } from "../hub/child-process.ts";
+import { peerChildEnv, stopOwnedProcess, trackGroup } from "../hub/child-process.ts";
 
 export interface PermissionOption {
   optionId: string;
@@ -135,7 +135,7 @@ export class AcpPeer extends BasePeer {
   async start(): Promise<void> {
     const [bin, ...args] = this.opts.cmd;
     // Its own process group, stopped as a whole (#115, as Codex's in #113): an agent CLI may be a launcher with a native child.
-    const proc = spawn(bin!, args, { cwd: this.opts.cwd, env: childEnv({ ...process.env, ...(this.opts.env ?? {}) }), stdio: ["pipe", "pipe", "pipe"], detached: true });
+    const proc = spawn(bin!, args, { cwd: this.opts.cwd, env: peerChildEnv(this.id, { ...process.env, ...(this.opts.env ?? {}) }), stdio: ["pipe", "pipe", "pipe"], detached: true });
     this.proc = proc;
     trackGroup(proc);
     proc.on("error", (e) => this.down(`spawn failed: ${e.message}`));

package/src/adapters/claude-channel.ts

@@ -8,7 +8,7 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { ControlClient, stateDirFor } from "../hub/control-client.ts";
 import { VERSION } from "../version.ts";
-import { DEFAULT_ROLES, roleContract, TASK_TOOL_NAMES, TASK_TOOLS } from "../hub/hub-tools.ts";
+import { CONDUCTOR_TOOLS, CONDUCTOR_TOOL_NAMES, DEFAULT_ROLES, roleContract, TASK_TOOL_NAMES, TASK_TOOLS } from "../hub/hub-tools.ts";
 import { frame, replyParent, sanitize, HUB_MESSAGE_INSTRUCTION, type Envelope } from "../hub/envelope.ts";
 
 // A native session is pinned at launch. Unlike a new CLI invocation after `cd`,
@@ -201,6 +201,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
           },
         ]),
     ...TASK_TOOLS,
+    ...CONDUCTOR_TOOLS,
   ],
 }));
 
@@ -225,7 +226,7 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
     const sent = `sent to: ${res.targets.join(", ") || "(no other peers attached)"}`;
     return text(typeof res.notice === "string" ? `${sent}; ${res.notice}` : sent);
   }
-  if (TASK_TOOL_NAMES.has(name)) {
+  if (TASK_TOOL_NAMES.has(name) || CONDUCTOR_TOOL_NAMES.has(name)) {
     if (!hub) return text(offline());
     const res = await hub.request({ t: "task", op: name, args: args ?? {} });
     return text(res.ok ? res.text : `error: ${res.error}`);

package/src/adapters/codex-appserver.ts

@@ -3,7 +3,7 @@ import type { Server, ServerWebSocket } from "bun";
 import { renderDigest, replyAudience, replyParent, type Envelope, type PeerId } from "../hub/envelope.ts";
 import { BasePeer } from "../hub/peers.ts";
 import { codexContext, type ContextReading } from "../hub/context-window.ts";
-import { childEnv, stopOwnedProcess, trackGroup } from "../hub/child-process.ts";
+import { peerChildEnv, stopOwnedProcess, trackGroup } from "../hub/child-process.ts";
 
 export interface CodexOptions {
   /** Port the TUI attaches to: `codex --enable tui_app_server --remote ws://127.0.0.1:<proxyPort>`. */
@@ -305,9 +305,10 @@ export class CodexPeer extends BasePeer {
       throw new Error(`port ${port} already answers /healthz: an app-server the hub does not own is running (orphan from a crashed hub?)`);
     }
     let gone = "";
+    const env = peerChildEnv("codex", { ...process.env, ...(this.opts.env ?? {}) });
     this.proc = spawn(this.opts.bin ?? "codex", ["app-server", "--listen", `ws://127.0.0.1:${port}`, ...(this.opts.extraArgs ?? [])], {
       cwd: this.opts.cwd,
-      env: childEnv({ ...process.env, ...(this.opts.env ?? {}) }),
+      env,
       stdio: ["ignore", "ignore", "pipe"],
       detached: true, // its own process group, stopped as a whole (#113): `codex` is a launcher with a native child
     });

package/src/adapters/local-worker.ts

@@ -4,7 +4,7 @@ import type { RouteLabelEvent, RouteTurnOutcome } from "../models/route/labels.t
 import type { ToolObservation } from "../models/route/signals.ts";
 import { randomUUID } from "node:crypto";
 import { renderDigest, replyAudience, replyParent, STANDING_INSTRUCTION, USER, type Envelope, type EnvelopeOpts, type PeerId } from "../hub/envelope.ts";
-import { TASK_TOOL_NAMES, TASK_TOOLS } from "../hub/hub-tools.ts";
+import { CONDUCTOR_TOOL_NAMES, CONDUCTOR_TOOLS, TASK_TOOL_NAMES, TASK_TOOLS } from "../hub/hub-tools.ts";
 import { BasePeer } from "../hub/peers.ts";
 import { profile, proxyEnv, type SandboxNetwork } from "../local/sandbox.ts";
 import { runTool, toolResultFailed, TOOL_SCHEMAS, touchedPaths, type ToolContext } from "../local/tools.ts";
@@ -98,7 +98,7 @@ export class LocalPeer extends BasePeer {
         await this.requireBudget(envs, "model_calls");
         if (generation !== this.turn) throw new Error("route belongs to an ended turn");
         if (signal.aborted) throw new Error("turn cancelled before model request");
-        const tools = judge ? undefined : [...TOOL_SCHEMAS, ...(this.opts.taskTool ? TASK_TOOLS.map(asFunction) : [])];
+        const tools = judge ? undefined : [...TOOL_SCHEMAS, ...(this.opts.taskTool ? [...TASK_TOOLS, ...CONDUCTOR_TOOLS].map(asFunction) : [])];
         const result = await this.opts.omni.chat({ model, messages, ...(tools ? { tools } : {}), ...(judge ? { max_tokens: maxTokens ?? 2048 } : {}) }, { signal, ...(pii ? { onCampusOnly: true } : {}) });
         this.recordUsage(result, model);
         if (generation !== this.turn) throw new Error("route belongs to an ended turn");
@@ -250,7 +250,7 @@ export class LocalPeer extends BasePeer {
             await this.requireBudget(envs, "tool_calls");
             if (turnSignal.aborted) throw new ExecutionBudgetStop(this.budgetStopReason || "turn cancelled before tool execution");
           } catch (error) { clearInterval(alive); throw error; }
-          const running = TASK_TOOL_NAMES.has(name) && this.opts.taskTool ? this.opts.taskTool(name, safeParse(call.function.arguments), { pii: !!policy?.pii }).catch((e: Error) => `error: ${e.message}`) : runTool(name, call.function.arguments, ctx);
+          const running = (TASK_TOOL_NAMES.has(name) || CONDUCTOR_TOOL_NAMES.has(name)) && this.opts.taskTool ? this.opts.taskTool(name, safeParse(call.function.arguments), { pii: !!policy?.pii }).catch((e: Error) => `error: ${e.message}`) : runTool(name, call.function.arguments, ctx);
           const output = await running.finally(() => clearInterval(alive));
           if (turn !== this.turn) return "";
           this.touch();
@@ -281,7 +281,7 @@ export class LocalPeer extends BasePeer {
         });
       },
       sandboxProfile: this.sandboxProfile,
-      sandboxEnv: proxyEnv(this.opts.tools.bashNetwork ?? false),
+      sandboxEnv: { ...proxyEnv(this.opts.tools.bashNetwork ?? false), AGENTHUB_PEER_ID: this.id },
       signal: turnSignal,
       send: (text, to) => {
         const refused = this.onMessage?.(text, pii ? reply : { inReplyTo: replyParent(envs), to: to?.length ? to : replyAudience(envs) });
@@ -334,7 +334,7 @@ export class LocalPeer extends BasePeer {
     // A task turn asks for its class's route; a route needs the sidecar, which exists only when the worker was started with one.
     const route = policy?.route ?? this.opts.route;
     const fixedModel = policy?.fixedModel ?? this.opts.fixedModel;
-    const tools = [...TOOL_SCHEMAS, ...(this.opts.taskTool ? TASK_TOOLS.map(asFunction) : [])];
+    const tools = [...TOOL_SCHEMAS, ...(this.opts.taskTool ? [...TASK_TOOLS, ...CONDUCTOR_TOOLS].map(asFunction) : [])];
     const signal = this.abort!.signal;
     const messages: ChatMessage[] = [{ role: "system", content: system(this.opts.cwd, this.opts.preamble) }, ...this.history, ...turnMsgs];
     const routed = await this.hubCall(route, messages, policy, signal);