@staix/agent-hub 0.12.24 → 0.12.25

package/src/adapters/pi.ts

@@ -28,6 +28,10 @@ export interface PiExit {
 export interface PiToolContext { userBash: boolean; isCurrent: () => boolean; onApproval: (provenance: ApprovalProvenance) => void; }
 export interface PiToolResult { text: string; exitCode: number | null; }
 class PiToolSettlementFailure extends Error {}
+class PiPromptNotStarted extends Error {
+  constructor(readonly promptId: string) { super("Pi native session changed before prompt insertion; reverify its retained terminal before retrying"); }
+}
+class PiPromptUncertain extends Error {}
 export interface PiOptions {
   cwd: string; stateDir: string; cmd?: string[]; mode: "headless" | "tui"; backend: "auto" | "dgx" | "mlx"; sessionFile?: string; sessionId?: string;
   model?: string;
@@ -101,6 +105,11 @@ export class PiPeer extends BasePeer {
   private stopping = true;
   private rosterDetached = false;
   private rosterEpoch = 0;
+  private rosterLifecycleRevision = 0;
+  private fencedPrompt = false;
+  private hubPromptId: string | undefined;
+  private hubPromptGeneration: number | undefined;
+  private pendingPromptId: string | undefined;
   /** A personal native turn observed on reattach has no hub reply audience. */
   private rosterUnownedRun = false;
   private exitReported = false;
@@ -319,6 +328,7 @@ export class PiPeer extends BasePeer {
     this.rosterDetached = false; this.rosterUnownedRun = false;
     this.requestedStopReason = undefined;
     this.approvalTurnAbort = false;
+    this.fencedPrompt = false; this.hubPromptId = undefined; this.hubPromptGeneration = undefined; this.pendingPromptId = undefined;
     this.exitReported = false; this.started = false; this.lastToolName = undefined; this.shutdownExit = undefined;
     this.approvalExpiries = 0; this.approvalAnswerEpoch = undefined; this.approvalStopReason = ""; this.approvalAbortSent = false;
     mkdirSync(this.opts.stateDir, { recursive: true });
@@ -347,7 +357,13 @@ export class PiPeer extends BasePeer {
       if (url.pathname === "/ack") {
         const pending = this.tuiCommands.get(String(body.id));
         if (!pending) return Response.json({ ok: false }, { status: 404 });
-        this.tuiCommands.delete(String(body.id)); body.ok ? pending.resolve(body.result) : pending.reject(new Error(String(body.error ?? "Pi TUI command failed")));
+        this.tuiCommands.delete(String(body.id));
+        const refusal = body.refusal;
+        const boundRefusal = this.fencedPrompt && this.verifiedOwner() && pending.command.type === "prompt" && pending.command.sessionId === this.sessionId
+          && refusal?.promptId === pending.command.id && refusal.sessionId === this.sessionId
+          && Number.isSafeInteger(refusal.generation) && refusal.generation >= Number(pending.command.generation);
+        body.ok ? pending.resolve(body.result) : pending.reject(boundRefusal && refusal.kind === "prompt_not_started" ? new PiPromptNotStarted(String(body.id))
+          : boundRefusal && refusal.kind === "prompt_uncertain" ? new PiPromptUncertain("Pi native prompt insertion is uncertain; inspect its retained terminal before retrying") : new Error(String(body.error ?? "Pi TUI command failed")));
         return Response.json({ ok: true });
       }
       if (url.pathname === "/tool") return this.handleToolRequest(body);
@@ -437,10 +453,14 @@ export class PiPeer extends BasePeer {
   async resumeFromRoster(): Promise<void> {
     if (!this.rosterDetached) return;
     if (this.opts.mode !== "tui" || this.stopping || !this.rosterDetached || !this.server || !this.verifiedOwner()) throw new Error("Pi roster return has no verified live TUI owner");
-    const epoch = this.rosterEpoch, session = this.sessionId, file = this.sessionFile;
+    if (!this.fencedPrompt) throw new Error("Pi roster return needs a fenced-prompt extension; restart the retained terminal with the current hub extension");
+    if (this.pendingPromptId) throw new Error("Pi prompt admission is still pending; wait before reverifying the retained terminal");
+    const epoch = this.rosterEpoch, lifecycle = this.rosterLifecycleRevision, session = this.sessionId, file = this.sessionFile;
     const snapshot = await this.sendTui({ type: "get_session_state" });
     if (epoch !== this.rosterEpoch || this.stopping || !this.verifiedOwner() || this.activeTools || snapshot?.sessionId !== session || snapshot?.sessionFile !== file || typeof snapshot?.idle !== "boolean") throw new Error("Pi roster return could not verify the current native session");
+    if (lifecycle !== this.rosterLifecycleRevision) throw new Error("Pi native activity changed during roster return; retry with a fresh session snapshot");
     this.rosterDetached = false;
+    this.hubPromptId = undefined; this.hubPromptGeneration = undefined;
     this.rosterUnownedRun = !snapshot.idle; this.agentRunning = !snapshot.idle;
     this.setState(snapshot.idle ? "idle" : "busy");
     if (!snapshot.idle) this.clearWatchdog();
@@ -534,6 +554,7 @@ export class PiPeer extends BasePeer {
     this.setState("busy"); this.activeEnvs = envs; this.currentReply = replyParent(envs); this.settledText = "";
     const rosterEpoch = this.rosterEpoch;
     let attempted = false;
+    let promptId: string | undefined;
     try {
       const requested = await this.opts.selectModel?.(envs);
       if (rosterEpoch !== this.rosterEpoch || !this.acceptingTools) throw new Error("Pi is off roster or stopped");
@@ -542,10 +563,32 @@ export class PiPeer extends BasePeer {
       this.noteActivity();
       attempted = true;
       if (deliveryId) this.activeDeliveryIds.add(deliveryId);
-      if (this.opts.mode === "tui") await this.sendTui({ type: "prompt", message: renderDigest(envs, true) });
+      if (this.opts.mode === "tui") { const pending = this.sendTui({ type: "prompt", message: renderDigest(envs, true) }); promptId = this.pendingPromptId; await pending; }
       else await this.sendRpc({ type: "prompt", message: renderDigest(envs, true) });
+      if (promptId !== undefined && promptId !== this.pendingPromptId) return;
+      if (this.fencedPrompt && this.rosterDetached) {
+        if (deliveryId && this.activeDeliveryIds.delete(deliveryId)) this.delivery({ id: deliveryId, state: "needs_review", reason: "Pi native activity changed before prompt acceptance was confirmed" });
+        this.setState("offline");
+        return;
+      }
       if (deliveryId && this.activeDeliveryIds.has(deliveryId)) this.delivery({ id: deliveryId, state: "accepted" });
     } catch (error) {
+      if (promptId !== undefined && promptId !== this.pendingPromptId) return;
+      if (error instanceof PiPromptUncertain) { this.pendingPromptId = undefined; await this.detachForRoster(); return; }
+      if (error instanceof PiPromptNotStarted && error.promptId === this.pendingPromptId) {
+        this.pendingPromptId = undefined;
+        if (deliveryId) this.activeDeliveryIds.delete(deliveryId);
+        if (deliveryId) this.delivery({ id: deliveryId, state: "failed_safe", reason: error.message });
+        else this.onFailed?.(envs);
+        await this.detachForRoster();
+        return;
+      }
+      if (this.fencedPrompt && this.pendingPromptId && this.rosterDetached) {
+        this.pendingPromptId = undefined;
+        if (deliveryId && this.activeDeliveryIds.delete(deliveryId)) this.delivery({ id: deliveryId, state: "needs_review", reason: "Pi prompt acknowledgement is uncertain after personal native activity" });
+        this.setState("offline");
+        return;
+      }
       if (rosterEpoch !== this.rosterEpoch) {
         if (!attempted && deliveryId) this.delivery({ id: deliveryId, state: "failed_safe", reason: "Pi withdrawn before native dispatch" });
         return;
@@ -563,11 +606,13 @@ export class PiPeer extends BasePeer {
         this.delivery({ id: deliveryId, state: "failed_safe", reason });
       }
       await this.terminateFailedTurn(error instanceof Error ? error : new Error(reason));
+    } finally {
+      if (promptId !== undefined && this.pendingPromptId === promptId) this.pendingPromptId = undefined;
     }
   }
 
   async steer(envs: Envelope[], deliveryId?: string): Promise<void> {
-    if (this.state !== "busy" || !this.acceptingTools || envs.some((e) => e.kind !== "chat" || e.private || e.priority !== "important")) {
+    if (this.state !== "busy" || !this.acceptingTools || (this.fencedPrompt && this.pendingPromptId && this.hubPromptGeneration === undefined) || envs.some((e) => e.kind !== "chat" || e.private || e.priority !== "important")) {
       const reason = `Pi workflow/private messages must queue${this.rosterDetached ? ": off roster" : this.rosterUnownedRun ? ": native turn pending" : ""}`;
       if (deliveryId) this.delivery({ id: deliveryId, state: "failed_safe", reason });
       throw new Error(reason);
@@ -597,14 +642,39 @@ export class PiPeer extends BasePeer {
   }
 
   private handleBridgeEvent(event: any): void {
+    if (this.fencedPrompt && this.opts.mode === "tui" && !this.rosterUnownedRun && ["agent_start", "agent_end", "agent_settled"].includes(event.type)
+      && typeof event.promptId === "string" && event.promptId !== this.hubPromptId) return;
+    if (this.fencedPrompt && this.opts.mode === "tui" && (this.activeEnvs.length > 0 || this.pendingPromptId || this.hubPromptId) && !this.rosterDetached && !this.rosterUnownedRun && !this.stopping && ["agent_start", "agent_end", "agent_settled"].includes(event.type)) {
+      const bound = this.verifiedOwner() && (event.sessionId === undefined || event.sessionId === this.sessionId);
+      if (!bound || !Number.isSafeInteger(event.generation) || event.generation < this.budgetGeneration) return;
+      const owned = this.hubPromptId !== undefined && event.promptId === this.hubPromptId;
+      if (event.type === "agent_start" && event.generation > this.budgetGeneration) {
+        if (owned) this.hubPromptGeneration = event.generation;
+        else {
+          if (this.pendingPromptId || this.activeEnvs.length) {
+            // Await the prompt's exact ACK before deciding whether its effect was absent or uncertain.
+            this.rosterDetached = true; this.rosterEpoch++; this.clearWatchdog();
+            this.activeEnvs = []; this.currentReply = undefined; this.settledText = ""; this.settledError = "";
+            this.abortTools();
+            if (!this.pendingPromptId) {
+              for (const id of this.activeDeliveryIds) this.delivery({ id, state: "needs_review", reason: "Pi personal native activity replaced the accepted hub turn" });
+              this.activeDeliveryIds.clear(); this.setState("offline");
+            }
+          } else { this.rosterUnownedRun = true; this.setState("busy"); this.clearWatchdog(); }
+        }
+      } else if (!this.rosterUnownedRun && (!owned || event.generation !== this.hubPromptGeneration)) return;
+    }
     if (this.rosterDetached || this.rosterUnownedRun) {
       // The shipped extension's legacy agent_start omits sessionId. Its authenticated bridge
       // and still-verified owner bind that event to this session; an explicit mismatch never does.
       const bound = !this.stopping && this.verifiedOwner() && (event.sessionId === undefined || event.sessionId === this.sessionId);
       if (bound && event.type === "agent_start" && Number.isSafeInteger(event.generation) && event.generation > this.budgetGeneration) {
+        this.rosterLifecycleRevision++;
         this.budgetGeneration = event.generation;
         this.noteActivity(); // personal native activity also revokes an earlier ID-only empty-resume proof
       }
+      // Snapshot ACKs and lifecycle events use separate requests, so their arrival order is not native state order.
+      if (bound && event.type === "agent_settled" && (event.generation === undefined || event.generation === this.budgetGeneration)) this.rosterLifecycleRevision++;
       if (!bound && event.type !== "session_shutdown") return;
     }
     if (this.rosterDetached && event.type !== "session_shutdown") return;
@@ -619,6 +689,7 @@ export class PiPeer extends BasePeer {
     if (event.type === "session_start") {
       if (!this.ownerClaimed) { this.ownerClaimed = true; this.ownerToken = String(event.ownerToken ?? ""); }
       this.approvalTurnAbort = event.approvalTurnAbort === true;
+      this.fencedPrompt ||= event.fencedPrompt === true;
       this.sessionId = String(event.sessionId ?? ""); this.sessionFile = String(event.sessionFile ?? "");
       this.ownerPid = Number.isInteger(event.pid) ? event.pid : undefined; this.ownerSignature = typeof event.signature === "string" ? event.signature : undefined;
       if ((this.opts.sessionId && this.sessionId !== this.opts.sessionId) || (this.opts.sessionFile && this.sessionFile !== this.opts.sessionFile)) { this.opts.log?.(`[${this.id}] Pi session identity mismatch`); return; }
@@ -699,6 +770,7 @@ export class PiPeer extends BasePeer {
       for (const id of this.activeDeliveryIds) this.delivery({ id, state: approvalStopReason ? "completed" : error || cancelled ? "needs_review" : "completed", ...(error || cancelled ? { reason: error || "Pi turn cancelled; partial effects are possible" } : {}) });
       this.activeDeliveryIds.clear();
       this.currentReply = undefined; this.activeEnvs = [];
+      this.hubPromptId = undefined; this.hubPromptGeneration = undefined;
       this.executionAbort?.abort(); this.executionAbort = undefined;
       this.approvalExpiries = 0; this.approvalAnswerEpoch = undefined; this.approvalStopReason = ""; this.approvalAbortSent = false;
       this.abortedToolIds.clear(); this.abortIdsOverflow = false;
@@ -717,7 +789,9 @@ export class PiPeer extends BasePeer {
   }
   private sendTui(command: Record<string, unknown>): Promise<any> {
     const id = `ahub-${++this.seq}`;
-    const wire = { id, ...command };
+    const fenced = this.fencedPrompt && command.type === "prompt";
+    if (fenced) { this.pendingPromptId = id; this.hubPromptId = id; this.hubPromptGeneration = undefined; }
+    const wire = { id, ...command, ...(fenced ? { sessionId: this.sessionId, generation: this.budgetGeneration } : {}) };
     return new Promise((resolvePromise, reject) => {
       const timer = setTimeout(() => {
         this.tuiCommands.delete(id);

package/src/hub/daemon.ts

@@ -419,6 +419,8 @@ interface Client {
   peer?: PeerId;
   tail?: () => void;
   watch?: () => void;
+  /** The one-launch Kimi TUI admission this socket attached under; its close clears only that admission. */
+  kimiAdmission?: string;
 }
 type Sock = ServerWebSocket<Client>;
 
@@ -655,7 +657,7 @@ export async function startDaemon(opts: DaemonOptions) {
         const peer = sock.data.peer ? bus.peers.get(sock.data.peer) : undefined;
         if (peer instanceof WsPeer) {
           peer.detach(sock);
-          if (sock.data.peer === "kimi" && peer.state === "offline" && !peer.claiming) clearKimiAdmission();
+          if (sock.data.peer === "kimi" && peer.state === "offline" && !peer.claiming && sock.data.kimiAdmission === kimiAdmissionId) clearKimiAdmission();
         }
       },
     },
@@ -3869,7 +3871,7 @@ export async function startDaemon(opts: DaemonOptions) {
         preparedSessionRoles.delete(c.peer); // an external transport has no receipt for this daemon's native preamble
         preparedSessionRoleIdentities.delete(c.peer);
         ws.claim(sock, msg.channel === false);
-        if (kimiPull) { clearTimeout(kimiAdmissionExpiry); kimiAdmissionExpiry = undefined; }
+        if (kimiPull) { clearTimeout(kimiAdmissionExpiry); kimiAdmissionExpiry = undefined; c.kimiAdmission = kimiAdmissionId; }
         if (c.peer === "claude") logPermissionStart(c.peer);
         writeStatus(); // the claim has to be visible before the preface, or a standing-by session takes the id back
         void ensurePreface(c.peer).finally(() => {
@@ -4154,7 +4156,9 @@ export async function startDaemon(opts: DaemonOptions) {
         if (c.role !== "console") return void reply({ ok: false, error: "watch is a person-only console command" });
         if (msg.peer !== "kimi" && msg.peer !== "qwen") return void reply({ ok: false, error: "watch supports headless kimi and qwen only" });
         const peer = msg.peer as "kimi" | "qwen";
-        if (peer === "kimi" && (kimiSessionMode ?? startMode("kimi")) === "tui") return void reply({ ok: false, error: "Kimi is in pull-only TUI mode; use its native terminal or start headless" });
+        // Judged by the live owner: a headless Kimi started by --mode headless is watchable under a TUI start mode.
+        const kimiOwner = bus.peers.get("kimi");
+        if (peer === "kimi" && !(kimiOwner instanceof AcpPeer) && (kimiOwner instanceof WsPeer || (kimiSessionMode ?? startMode("kimi")) === "tui")) return void reply({ ok: false, error: "Kimi is in pull-only TUI mode; use its native terminal or start headless" });
         if (!membershipAllowed(peer)) return void reply({ ok: false, error: `${peer} is off roster` });
         c.watch?.();
         c.watch = activityRings[peer].subscribe(item => {

package/src/hub/path-policy.ts

@@ -1,6 +1,7 @@
 import { lstatSync, opendirSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { realPath } from "./project.ts";
+import { foldSegment } from "./permission-mode.ts";
 /** Bounded project-relative exact paths/subtrees or *, ? and whole-segment ** globs. */
 export function policyPaths(raw: unknown, field: string): string[] {
   if (raw === undefined) return [];
@@ -15,16 +16,27 @@ export function policyRealPath(path: string): string {
   while (!existing(ancestor)) { const parent = dirname(ancestor); if (parent === ancestor) throw new Error("path cannot be resolved"); ancestor = parent; }
   return join(realPath(ancestor), relative(ancestor, path));
 }
-const beneath = (path: string, root: string) => { path = path.toLowerCase(); root = root.toLowerCase(); return path === root || path.startsWith(root.endsWith(sep) ? root : root + sep); };
+const within = (path: string, root: string) => path === root || path.startsWith(root.endsWith(sep) ? root : root + sep);
+// Either spelling protects, as for globs: lowercase as before, or folded like a case-insensitive disk opens names (NFD/NFC,
+// compatibility forms, long s, ignorable code points). Folding is not a function of the lowercase form for every name.
+const beneath = (path: string, root: string) => within(path.toLowerCase(), root.toLowerCase()) || within(foldSegment(path), foldSegment(root));
+const lowerBeneath = (path: string, root: string) => within(path.toLowerCase(), root.toLowerCase());
 export function policyTargets(cwd: string, paths: string[]): string[] {
   const root = realPath(cwd);
   return [...new Set(paths.flatMap(path => { const lexical = resolve(root, path); return [lexical, policyRealPath(lexical)]; }))];
 }
-/** Linear-space wildcard DP, avoiding regex backtracking on untrusted paths. */
+/**
+ * Either spelling protects: the lowercase comparison keeps `?` matching one code point whose fold expands (ß, fi), and
+ * the folded one catches NFD/NFC, compatibility and long-s aliases. Adding a match only ever adds protection.
+ */
 function segmentMatches(pattern: string, name: string): boolean {
-  const chars = [...name.toLowerCase()];
+  return wildcard(pattern.toLowerCase(), name.toLowerCase()) || wildcard(foldSegment(pattern), foldSegment(name));
+}
+/** Linear-space wildcard DP, avoiding regex backtracking on untrusted paths. */
+function wildcard(pattern: string, name: string): boolean {
+  const chars = [...name];
   let previous = new Array<boolean>(chars.length + 1).fill(false); previous[0] = true;
-  for (const char of pattern.toLowerCase()) {
+  for (const char of pattern) {
     const next = new Array<boolean>(chars.length + 1).fill(false);
     next[0] = char === "*" && previous[0]!;
     for (let i = 1; i <= chars.length; i++) next[i] = char === "*" ? previous[i]! || next[i - 1]! : previous[i - 1]! && (char === "?" || char === chars[i - 1]);
@@ -63,10 +75,17 @@ function globScope(root: string, lexical: string, actual: string, path: string,
   if (patternScope(pattern, start, relative(root, lexical), includeParents) || patternScope(pattern, start, relative(root, actual), includeParents)) return true;
   const visit = (dir: string, states: Set<number>, depth: number, ancestors: Set<string>): boolean => {
     const real = policyRealPath(dir);
-    if (states.has(pattern.length)) return beneath(lexical, real) || beneath(actual, real) || includeParents && (beneath(real, lexical) || beneath(real, actual));
+    if (states.has(pattern.length)) {
+      if (beneath(lexical, real) || beneath(actual, real) || includeParents && (beneath(real, lexical) || beneath(real, actual))) return true;
+      // An earlier `**` can still match deeper: an alias below this match (`ss/ß -> other` for `**/ß`) is searched too.
+      // A trailing `**` only re-matches everything below, so it never walks the subtree (as before, for paths outside it).
+      states = new Set([...states].filter(i => i !== pattern.length && !(i === pattern.length - 1 && pattern[i] === "**")));
+      if (!states.size) return false;
+    }
     if (patternScope(pattern, states, relative(real, actual), includeParents)) return true;
     if (!existing(dir)) return false;
-    if (!beneath(real, root)) throw new Error("policy glob discovery outside project");
+    // Unfolded: a sibling whose folded spelling looks like the project is outside it, and discovery there fails closed.
+    if (!lowerBeneath(real, root)) throw new Error("policy glob discovery outside project");
     const info = statSync(dir);
     if (!info.isDirectory()) return false;
     if (depth > 32 || ancestors.has(real) || budget.entries > 4096) throw new Error("policy glob discovery unavailable");

package/src/hub/tasks.ts

@@ -564,6 +564,10 @@ export class Tasks {
   private plannerPullRecord(task: Task): HistoryEntry["planning"] {
     return task.history.findLast(entry => entry.event === "backlog pulled" || entry.event === "backlog returned")?.planning;
   }
+  private hasPersonReservation(task: Task): boolean {
+    const reservation = task.history.findLast(entry => entry.event === "reserved" || entry.planning?.fields.includes("reserved") && !["backlog pulled", "backlog returned"].includes(entry.event)) ?? (task.history[0]?.event === "backlogged" ? task.history[0] : undefined);
+    return !!task.reserved && reservation?.by === USER;
+  }
   wip(peer: PeerId, except?: number): number {
     return this.d.board.plannerWip(peer, except);
   }
@@ -604,8 +608,7 @@ export class Tasks {
       }
       const assignment = this.plannerAssignment(task);
       if (!assignment.owner) throw new PreEffectToolRefusal("no peer has eligible planner WIP capacity");
-      const reservation = task.history.findLast(entry => entry.event === "reserved" || entry.planning?.fields.includes("reserved") && !["backlog pulled", "backlog returned"].includes(entry.event)) ?? (task.history[0]?.event === "backlogged" ? task.history[0] : undefined);
-      if (task.reserved && reservation?.by === USER && assignment.owner !== task.reserved) throw new PreEffectToolRefusal("a person's reservation is retained");
+      if (this.hasPersonReservation(task) && assignment.owner !== task.reserved) throw new PreEffectToolRefusal("a person's reservation is retained");
       return { task, owner: assignment.owner };
     };
     const initial = validate(), withheld = await this.withholds("note", input.reason, initial.task);
@@ -723,6 +726,7 @@ export class Tasks {
       if (task.state === "approved") throw new PreEffectToolRefusal("approved work is final");
       if (by !== USER && (task.state !== "backlog" || taskHasStarted(task) || task.pinned || Object.hasOwn(patch, "pinned"))) throw new PreEffectToolRefusal("planner changes only unpinned backlog work");
       if (by !== USER && patch.rank !== undefined && task.history.some(entry => entry.by === USER && entry.planning?.fields.includes("rank"))) throw new PreEffectToolRefusal("a person's backlog order is retained");
+      if (by !== USER && Object.hasOwn(patch, "reserved") && this.hasPersonReservation(task)) throw new PreEffectToolRefusal("a person's reservation is retained");
       if (Object.hasOwn(patch, "deps") || Object.hasOwn(patch, "reserved")) {
         if (task.state !== "backlog" || taskHasStarted(task) || task.owner) throw new PreEffectToolRefusal("dependency and reservation changes require unstarted backlog work");
         if (patch.reserved && !(SUPPORTED_PEERS as readonly string[]).includes(patch.reserved) && !this.d.bus.knownPeers().includes(patch.reserved) && !this.d.routing().classes[task.class]?.peers.includes(patch.reserved)) throw new PreEffectToolRefusal("reserved owner is not a supported or configured peer");
@@ -1611,7 +1615,11 @@ export class Tasks {
       if (next.phase && !this.isPii(task) && !this.nameable(JSON.stringify(next.phase))) throw new PreEffectToolRefusal("phase metadata matches a PII pattern; use private work");
       if (next.phase) validatePhaseLinks(task, next.phase, id => this.d.board.get(id), t => this.isPii(t));
     }
-    if (next.reviewedHead !== task.sdlc?.reviewedHead) this.mine(task, by, "reviewer", true);
+    // Recording a head is the reviewer's; a head dropped because the repo or PR changed is not a recording, and a
+    // head supplied with a new PR identity is one even when its value is unchanged (#382).
+    const suppliedHead = !!input && typeof input === "object" && (input as { reviewedHead?: unknown }).reviewedHead !== undefined;
+    const artifactChanged = next.repo !== task.sdlc?.repo || next.pr !== task.sdlc?.pr;
+    if (next.reviewedHead !== undefined && (next.reviewedHead !== task.sdlc?.reviewedHead || (suppliedHead && artifactChanged))) this.mine(task, by, "reviewer", true);
     return this.d.board.update(task.id, by, "lifecycle", { sdlc: next });
   }
 
@@ -1816,7 +1824,7 @@ export class Tasks {
     }
     if (task.state === "proposed" || task.state === "changes_requested") task = this.d.board.update(task.id, by, "accepted", { state: "in_progress" }, WITH_DONE); // done without a separate accept
     const command = this.d.runCheck ? this.d.check?.(task.class, task) : undefined;
-    if (!command) return this.complete(task, by, summary, refs, "", withheld);
+    if (!command) return this.complete(task, by, summary, refs, "", withheld, "review");
     // The tool call returns now; a check can outlast an agent's tool timeout. The result decides what comes next.
     this.checking.set(task.id, task.owner);
     const pending = this.d.board.update(task.id, by, "done (checking)", { refs: cleanRefs(refs) }, summary, { withheld: withheld || undefined });
@@ -1942,12 +1950,15 @@ export class Tasks {
     this.tell(task, `Task #${id}: its check failed.\n$ ${outcome}${result.tail ? `\n${result.tail}` : ""}\nFix it and call hub_task_done again.`, pii);
   }
 
-  private async complete(task: Task, by: PeerId, summary?: string, refs?: TaskRefs, checkOutput = "", withheld = false): Promise<Task> {
+  /** `gated`: the transition `done()` already gated with no await since, so it is not read back twice (#382). */
+  private async complete(task: Task, by: PeerId, summary?: string, refs?: TaskRefs, checkOutput = "", withheld = false, gated?: "review"): Promise<Task> {
     let reviewer = task.reviewer;
-    if (this.d.sdlc && this.d.sdlc.config().mode !== "off") {
+    if (this.d.sdlc && this.d.sdlc.config().mode !== "off" && gated !== (reviewer ? "review" : "approval")) {
       await this.lifecycleGate(task, reviewer ? "review" : "approval");
       task = this.need(task.id, false, true);
       this.mine(task, by, "owner", true);
+      // In every mode: another done may have landed during the readback.
+      if (task.state === "in_review" || task.state === "approved") throw new Error(`task #${task.id} is already ${task.state}`);
       reviewer = task.reviewer;
     }
     const next = this.d.board.update(task.id, by, "done", { state: reviewer ? "in_review" : "approved", ...(task.sdlc ? { sdlc: { ...task.sdlc, stage: lifecycleStage(this.d.sdlc?.config() ?? sdlcConfig(undefined), reviewer ? "review" : "merge") } } : {}), refs: cleanRefs(refs) }, checkOutput ? `${summary ?? ""}\n${checkOutput}`.trim() : summary, { withheld: withheld || undefined });

package/src/hub/text-projection.ts

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { closeSync, constants, fstatSync, mkdirSync, mkdtempSync, openSync, readSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { extname, isAbsolute, join, resolve } from "node:path";
+import { dirname, extname, isAbsolute, join, resolve } from "node:path";
 
 import { homedir, tmpdir } from "node:os";
 import { sbplString } from "../local/deny.ts";
@@ -8,6 +8,7 @@ import { spawnSync } from "node:child_process";
 import { realPath } from "./project.ts";
 import { profile, sandboxAvailable } from "../local/sandbox.ts";
 export type ProjectionConfig = Record<string, string[]>;
+const EMPTY_ROOT = "/var/empty";
 export const MAX_PROJECTION_INPUT = 16 * 1024 * 1024;
 const MAX_INPUT = MAX_PROJECTION_INPUT, MAX_TEXT = 256 * 1024;
 /** Only machine-local config chooses programs; no implicit shell or command-string parsing. */
@@ -23,14 +24,18 @@ export function projectionConfig(raw: unknown): ProjectionConfig {
 }
 export interface ProjectedText { inputHash: string; rawHash: string; rawBlob: string; configHash: string; text: string }
 const hash = (data: string | Buffer) => createHash("sha256").update(data).digest("hex");
-function commandFingerprint(cwd: string, argv: string[]): string {
-  const parts = [JSON.stringify(argv)];
+/** The program and script files an argv runs, resolved as the converter will see them. */
+function programFiles(cwd: string, argv: string[]): { index: number; file: string; size: number; mtimeMs: number; ctimeMs: number }[] {
+  const out: { index: number; file: string; size: number; mtimeMs: number; ctimeMs: number }[] = [];
   for (const [index, arg] of argv.entries()) {
-    if (index !== 0 && !/\.(?:sh|py|js|ts|rb)$/.test(arg)) continue;
+    if (index !== 0 && !/\.(?:sh|py|js|mjs|cjs|ts|rb|pl)$/.test(arg)) continue;
     const choices = isAbsolute(arg) ? [arg] : index === 0 && !arg.includes("/") ? (process.env.PATH ?? "/usr/bin:/bin").split(":").slice(0, 32).map(dir => join(dir, arg)) : [resolve(cwd, arg)];
-    for (const file of choices) try { const st = statSync(file); if (!st.isFile()) continue; parts.push(file, String(st.size), String(st.mtimeMs), String(st.ctimeMs)); break; } catch { /* another PATH entry */ }
+    for (const file of choices) try { const st = statSync(file); if (!st.isFile()) continue; out.push({ index, file, size: st.size, mtimeMs: st.mtimeMs, ctimeMs: st.ctimeMs }); break; } catch { /* another PATH entry */ }
   }
-  return hash(parts.join("\\n"));
+  return out;
+}
+function commandFingerprint(cwd: string, argv: string[]): string {
+  return hash([JSON.stringify(argv), ...programFiles(cwd, argv).flatMap(p => [p.file, String(p.size), String(p.mtimeMs), String(p.ctimeMs)])].join("\\n"));
 }
 function boundedCache(file: string): string {
   const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
@@ -47,8 +52,12 @@ function boundedCache(file: string): string {
 export class TextProjections {
   private readonly sandbox: string;
   private readonly warned = new Set<string>();
+  /** Inputs whose full-budget conversion failed: the same bytes under the same command are not converted again. */
+  private readonly failed = new Set<string>();
   constructor(private readonly options: { cwd: string; stateDir: string; config: ProjectionConfig; deny?: string[]; readAllow?: string[]; log?: (line: string) => void }) {
-    this.sandbox = Object.keys(options.config).length ? profile(options.cwd, false, options.readAllow, options.deny, ["."]) : "";
+    // Rooted at an empty system directory, not the project: the converter reads its snapshot and program files only.
+    // Only where conversion can run: /var/empty is a macOS directory, and a host without the sandbox never converts.
+    this.sandbox = Object.keys(options.config).length && sandboxAvailable() ? profile(EMPTY_ROOT, false, options.readAllow, options.deny, ["."]) : "";
   }
   private warn(ext: string): void {
     if (this.warned.has(ext)) return;
@@ -103,17 +112,33 @@ export class TextProjections {
           if (value.inputHash === inputHash && value.rawHash === rawHash && value.rawBlob === rawBlob && value.configHash === configHash && typeof value.text === "string" && Buffer.byteLength(value.text) <= MAX_TEXT) return value;
         }
       } catch { /* missing/invalid cache is not evidence */ }
+      if (this.failed.has(key)) throw new Error("conversion failed before");
       if (!sandboxAvailable()) throw new Error("sandbox unavailable");
       scratch = realPath(mkdtempSync(join(tmpdir(), "ahub-projection-input-"))); const snapshot = join(scratch, "input" + ext);
       writeFileSync(snapshot, bytes, { mode: 0o400 });
+      // A read_allow entry may enclose the project. Seatbelt lets a later rule win only for the operation it names, so the
+      // deny and the literal grants after it both name file-read-data. The converter runs in its scratch directory (getcwd
+      // needs that directory's data), with its program and script arguments resolved to absolute paths.
+      const root = realPath(this.options.cwd), projectDeny = "\n(deny file-read-data (subpath " + sbplString(root) + "))";
+      const resolved = programFiles(this.options.cwd, argv);
+      // A module loader lists the directories above its script: grant those listings (not their files) up to the root.
+      const listings = new Set<string>();
+      for (const program of resolved) for (let dir = dirname(realPath(program.file)); dir.startsWith(root + "/") || dir === root; dir = dirname(dir)) { listings.add(dir); if (dir === root) break; }
+      const programs = resolved.map(p => "\n(allow file-read* file-read-data process-exec (literal " + sbplString(realPath(p.file)) + "))").join("")
+        + [...listings].map(dir => "\n(allow file-read-data (literal " + sbplString(dir) + "))").join("")
+        + "\n(allow file-read* file-read-data (literal " + sbplString(scratch) + "))";
+      const absolute = new Map(resolved.map(p => [p.index, p.file]));
       const result = spawnSync(process.execPath, [join(import.meta.dir, "projection-exec.ts")], {
-        cwd: this.options.cwd, timeout: deadline === undefined ? 8000 : Math.ceil(Math.max(1, Math.min(8000, deadline - performance.now()))), maxBuffer: MAX_TEXT * 2, encoding: "utf8",
-        input: JSON.stringify({ cwd: this.options.cwd, sandbox: this.sandbox + "\n(allow file-read* (literal " + sbplString(snapshot) + "))", argv: argv.map(arg => arg === "{input}" ? snapshot : arg), ...(deadline === undefined ? {} : { timeoutMs: Math.max(1, Math.min(5000, deadline - performance.now() - 100)) }) }),
+        cwd: scratch, timeout: deadline === undefined ? 8000 : Math.ceil(Math.max(1, Math.min(8000, deadline - performance.now()))), maxBuffer: MAX_TEXT * 2, encoding: "utf8",
+        input: JSON.stringify({ cwd: scratch, sandbox: this.sandbox + projectDeny + "\n(allow file-read* file-read-data (literal " + sbplString(snapshot) + "))" + programs, argv: argv.map((arg, index) => arg === "{input}" ? snapshot : absolute.get(index) ?? arg), ...(deadline === undefined ? {} : { timeoutMs: Math.max(1, Math.min(5000, deadline - performance.now() - 100)) }) }),
         env: { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: homedir(), LANG: "en_US.UTF-8", TERM: "dumb" },
       });
-      if (result.error || result.status !== 0) throw new Error("conversion failed");
+      // ponytail: in-memory for this process, cleared at 1024 keys; persist it if restarts make retries costly.
+      const failure = () => { if (deadline === undefined) { if (this.failed.size >= 1024) this.failed.clear(); this.failed.add(key); } return new Error("conversion failed"); };
+      if (result.error) throw new Error("conversion helper failed"); // a spawn or helper failure may be transient: not remembered
+      if (result.status !== 0) throw failure();
       const converted = JSON.parse(result.stdout) as { ok?: boolean; text?: string };
-      if (converted.ok !== true || typeof converted.text !== "string" || Buffer.byteLength(converted.text) > MAX_TEXT || converted.text.includes("\0")) throw new Error("conversion failed");
+      if (converted.ok !== true || typeof converted.text !== "string" || Buffer.byteLength(converted.text) > MAX_TEXT || converted.text.includes("\0")) throw failure();
       verify?.();
       const value = { inputHash, rawHash, rawBlob, configHash, text: converted.text };
       mkdirSync(cacheDir, { recursive: true });

package/src/hub/tooling.ts

@@ -1,5 +1,5 @@
 import { spawn, type ChildProcess } from "node:child_process";
-import { accessSync, constants, readdirSync, readFileSync, statSync } from "node:fs";
+import { accessSync, closeSync, constants, fstatSync, openSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { delimiter, join, relative, resolve, isAbsolute } from "node:path";
 import { realPath } from "./project.ts";
@@ -32,8 +32,18 @@ const PROBE_MS = 2000, PROBE_BYTES = 4096;
 /** `env` supplies CLAUDE_CONFIG_DIR and CODEX_HOME, the runtimes' own config roots (the hub's environment by default). */
 export interface ToolingSources { home?: string; cwd?: string; path?: string; env?: Record<string, string | undefined> }
 
+/** A regular file of at most 1 MiB, opened without blocking: a FIFO or device under a project's `.claude/` reads as absent. */
+const text = (file: string): string | undefined => {
+  let fd: number | undefined;
+  try {
+    fd = openSync(file, constants.O_RDONLY | constants.O_NONBLOCK);
+    const st = fstatSync(fd);
+    if (!st.isFile() || st.size > 1024 * 1024) return undefined;
+    return readFileSync(fd, "utf8");
+  } catch { return undefined; } finally { if (fd !== undefined) closeSync(fd); }
+};
 const json = (file: string): Record<string, unknown> | undefined => {
-  try { const v = JSON.parse(readFileSync(file, "utf8")); return v && typeof v === "object" ? v as Record<string, unknown> : undefined; } catch { return undefined; }
+  try { const v = JSON.parse(text(file) ?? ""); return v && typeof v === "object" ? v as Record<string, unknown> : undefined; } catch { return undefined; }
 };
 /** A version string as data, never anything longer or stranger. */
 const version = (v: unknown): string | null => typeof v === "string" && /^[0-9A-Za-z.+_-]{1,40}$/.test(v) ? v : null;
@@ -58,12 +68,13 @@ function claudePlugins(root: string, cwd: string | undefined): Addon[] {
 }
 
 function codexPlugins(root: string): Addon[] {
-  let text: string;
-  try { text = readFileSync(join(root, "config.toml"), "utf8"); } catch { return []; }
-  const found = new Map<string, string>(); // plugin name -> marketplace
-  // `[plugins."name@market"]` with no `enabled = false` below it, and plugins whose hooks Codex was told to trust.
-  for (const m of text.matchAll(/^\[plugins\."([^"@]+)@([^"]+)"\]\s*\n((?:(?!\[)[^\n]*\n?)*)/gm)) if (!/^\s*enabled\s*=\s*false\b/m.test(m[3] ?? "")) found.set(m[1]!, m[2]!);
-  for (const m of text.matchAll(/^\[hooks\.state\."([^"@]+)@([^":]+):/gm)) found.set(m[1]!, m[2]!);
+  const config = text(join(root, "config.toml"));
+  if (config === undefined) return [];
+  const found = new Map<string, string>(), disabled = new Set<string>(); // plugin name -> marketplace
+  // `[plugins."name@market"]` with no `enabled = false` below it, and plugins whose hooks Codex was told to trust
+  // unless their plugin entry disables them: a trust entry outlives the plugin's own switch.
+  for (const m of config.matchAll(/^\[plugins\."([^"@]+)@([^"]+)"\]\s*\n((?:(?!\[)[^\n]*\n?)*)/gm)) if (!/^\s*enabled\s*=\s*false\b/m.test(m[3] ?? "")) found.set(m[1]!, m[2]!); else disabled.add(m[1]! + "@" + m[2]!);
+  for (const m of config.matchAll(/^\[hooks\.state\."([^"@]+)@([^":]+):/gm)) if (!disabled.has(m[1]! + "@" + m[2]!)) found.set(m[1]!, m[2]!);
   const out: Addon[] = [];
   for (const [plugin, market] of found) {
     const name = PLUGINS.get(plugin);

package/src/memory/store.ts

@@ -533,13 +533,18 @@ export class MemoryStore {
     return gone.size;
   }
 
+  /** Index deferred writes before any note, goal or suggestion read. */
+  private ensureFresh(): void {
+    // Another process (a CLI, another project's hub, a sync) may have written since this one last read the segments.
+    if (this.stale || this.shape() !== this.seen) try { this.stale = false; this.refresh(); } catch { this.stale = true; /* still busy: the next read tries again */ }
+  }
+
   /**
    * What a read sees: rows that expired and promotions that became due while the store sat idle are settled first, so a
    * read, and the index after it, never differ from a rebuild.
    */
   private live(): View[] {
-    // Another process (a CLI, another project's hub, a sync) may have written since this one last read the segments.
-    if (this.stale || this.shape() !== this.seen) try { this.stale = false; this.refresh(); } catch { this.stale = true; /* still busy: the next read tries again */ }
+    this.ensureFresh();
     this.prune(); this.promoteHeld(); return this.views();
   }
   /** A write whose index update failed: the next read refreshes first. */
@@ -677,6 +682,7 @@ export class MemoryStore {
 
   /** Every long-term task with its derived state, links and lease, newest first; `project` keeps its own and shared ones. */
   goals(project?: string): GoalView[] {
+    this.ensureFresh();
     const now = this.now();
     const rows = this.db.query("SELECT * FROM goals").all() as { id: string; at: string; machine: string; project: string; scope: string; title: string; milestones: string; depends: string }[];
     const ops = this.db.query("SELECT op, at, machine, target, by FROM ops WHERE op IN ('goal_state', 'goal_link', 'lease', 'lease_force') ORDER BY at, id").all() as { op: string; at: string; machine: string; target: string; by: string | null }[];
@@ -726,6 +732,7 @@ export class MemoryStore {
     return s;
   }
   suggestions(project?: string): Suggestion[] {
+    this.ensureFresh();
     const visible = project ? new Set(this.list({ project, limit: Number.MAX_SAFE_INTEGER, includeSuperseded: true }).map((v) => v.id)) : undefined;
     const ops = this.db.query("SELECT id, op, at, target, by FROM ops WHERE op IN ('suggest', 'confirm', 'reject') ORDER BY at, id").all() as { id: string; op: string; at: string; target: string; by: string | null }[];
     const verdict = new Map<string, "confirmed" | "rejected">();