@staix/agent-hub 0.12.24 → 0.12.26

package/docs/verification/2026-10-14-0.12.26.md

@@ -0,0 +1,31 @@
+# 0.12.26 release verification
+
+This record covers release preparation and source verification. It does not certify tagging, package publication, global installation or a live upgrade; those receipts are recorded separately.
+
+## Candidate
+
+0.12.26 carries the hub-collaboration round for issues #380, #385 and #386: PRs #389, #387 and #388. Control protocol remains 16.
+
+- #389 (#380): claude-mem imports derive their graph nodes from the observation text without consulting the checkout, so one observation is one content-hashed entry on every machine and sync converges regardless of import order; the import scan filters the project in SQL and resumes from a persisted machine-local cursor (`--restart` re-scans), so unrelated projects cannot exhaust the window; `ahub memory dedupe [--apply]` reconciles pre-fix duplicate groups with append-only supersede operations onto the lexicographically smallest id.
+- #387 (#385): an exact or trailing-`**` data-policy entry that matches a directory resolves that directory's direct-child symlinks and protects their targets, matching what `data/*` already did for a matched link; discovery of the on-disk root is case-compatible, the scan streams inside the shared 4096-entry budget without descending, a dangling link covers its lexical target, an unresolvable link loop aliases nothing, a root whose budget is exhausted contributes no aliases, and an unreadable protected root fails closed. The failure semantics for the new scan are the user's direct ruling of 2026-10-14. The spec paragraph in docs/specs/2026-09-19-agent-hub-design.md was amended in the same PR.
+- #388 (#386): the text-projection converter comment and both docs state the project-scoped read guarantee and the 1024-entry, cleared-when-full in-memory failure record.
+
+Every fix carries regression tests that failed before it. Review was adversarial and multi-round on the board (tasks #45-#52): the review of #387 found the case-sensitive exact-root miss (P1) and the unbounded readdir (P2), CI found the Linux EACCES-at-read edge (#51) and two seed guards that needed retargeting after the refactor (#52), each fixed and re-gated before merge.
+
+## Document review
+
+Every stale document was rechecked against the ten source commits of the three PRs. README, Quickstart and Operations carry the 0.12.26 version and install/upgrade strings; Operations' converter failure-record wording landed with #388. The data-policy contract document (docs/data-policy.md) and docs/memory.md were updated inside their fix PRs. The adapters and daemon area notes were confirmed accurate against the `cliCommandLabel` addition, the tests note against the seed-selector repairs, and Security against the policy-matching change (it makes no per-form matching claim; the contract lives in data-policy.md). Budget, Bus, Benchmarks, Models, Tasks and the local-worker notes were not stale.
+
+## Recorded checks
+
+- PR #388 head 483ca546: CI Linux, macOS and seeded guards passed; board review approved.
+- PR #389 head d5738472: worktree `scripts/check.sh` 2702 pass, 0 fail, 189163 assertions, `check: OK`, no daemon leaks; CI green; board review approved.
+- PR #387 head 5fbe5d3a: worktree full gate 2714 pass, `check: OK`; CI Linux, macOS and seeded guards passed; board review approved.
+- Release candidate fbf96c08: local `scripts/check.sh` in an isolated worktree — 2728 pass, 0 fail, 189269 assertions, `check: OK`, no daemon leaks. Later commits on this branch change documentation only.
+- Release head: CI, document freshness at the merge commit, and the release workflow are required before tagging is reported complete.
+
+Note: `scripts/check.sh` in the main checkout fails 35/68 daemon tests on unmodified main because the live hub daemon serving the project interferes; the isolated worktree gate is the valid signal (recorded in shared memory #194264).
+
+## Not verified
+
+Native, account and research legs remain open in #273 and #1. The installed runtime and live hubs are not upgraded by this release.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "22993206f309720e714cbd7c045aadaef9ac9ba1",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "230833b4ef9df745552f292ffd6965e4b261ce24",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "22993206f309720e714cbd7c045aadaef9ac9ba1",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "22993206f309720e714cbd7c045aadaef9ac9ba1",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "230833b4ef9df745552f292ffd6965e4b261ce24",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -62,7 +62,7 @@
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "042c440e23452d62b5aaaf86330431fe0b16baba",
+      "verifiedAgainst": "d093a5a81b341a3ae1c777154a41497aeaf1899d",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -74,7 +74,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "6dcc7fe00c38f13613bcf53524fa3d1527a708e5",
+      "verifiedAgainst": "d093a5a81b341a3ae1c777154a41497aeaf1899d",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -86,7 +86,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "6dcc7fe00c38f13613bcf53524fa3d1527a708e5",
+      "verifiedAgainst": "d093a5a81b341a3ae1c777154a41497aeaf1899d",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -98,7 +98,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "230833b4ef9df745552f292ffd6965e4b261ce24",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -155,7 +155,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "230833b4ef9df745552f292ffd6965e4b261ce24",
+      "verifiedAgainst": "d093a5a81b341a3ae1c777154a41497aeaf1899d",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -172,7 +172,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "8ffd8babb35b5970c881f81babe951ed70d3f387",
+      "verifiedAgainst": "fbf96c0804f823282de4e3c4c19f16d94b725e57",
       "paths": [
         "test/",
         "scripts/check.sh",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.24",
+  "version": "0.12.26",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.24",
+  "version": "0.12.26",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -16157,7 +16157,7 @@ import { join as join4 } from "path";
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.12.24",
+  version: "0.12.26",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/adapters/pi.ts

@@ -28,6 +28,10 @@ export interface PiExit {
 export interface PiToolContext { userBash: boolean; isCurrent: () => boolean; onApproval: (provenance: ApprovalProvenance) => void; }
 export interface PiToolResult { text: string; exitCode: number | null; }
 class PiToolSettlementFailure extends Error {}
+class PiPromptNotStarted extends Error {
+  constructor(readonly promptId: string) { super("Pi native session changed before prompt insertion; reverify its retained terminal before retrying"); }
+}
+class PiPromptUncertain extends Error {}
 export interface PiOptions {
   cwd: string; stateDir: string; cmd?: string[]; mode: "headless" | "tui"; backend: "auto" | "dgx" | "mlx"; sessionFile?: string; sessionId?: string;
   model?: string;
@@ -101,6 +105,11 @@ export class PiPeer extends BasePeer {
   private stopping = true;
   private rosterDetached = false;
   private rosterEpoch = 0;
+  private rosterLifecycleRevision = 0;
+  private fencedPrompt = false;
+  private hubPromptId: string | undefined;
+  private hubPromptGeneration: number | undefined;
+  private pendingPromptId: string | undefined;
   /** A personal native turn observed on reattach has no hub reply audience. */
   private rosterUnownedRun = false;
   private exitReported = false;
@@ -319,6 +328,7 @@ export class PiPeer extends BasePeer {
     this.rosterDetached = false; this.rosterUnownedRun = false;
     this.requestedStopReason = undefined;
     this.approvalTurnAbort = false;
+    this.fencedPrompt = false; this.hubPromptId = undefined; this.hubPromptGeneration = undefined; this.pendingPromptId = undefined;
     this.exitReported = false; this.started = false; this.lastToolName = undefined; this.shutdownExit = undefined;
     this.approvalExpiries = 0; this.approvalAnswerEpoch = undefined; this.approvalStopReason = ""; this.approvalAbortSent = false;
     mkdirSync(this.opts.stateDir, { recursive: true });
@@ -347,7 +357,13 @@ export class PiPeer extends BasePeer {
       if (url.pathname === "/ack") {
         const pending = this.tuiCommands.get(String(body.id));
         if (!pending) return Response.json({ ok: false }, { status: 404 });
-        this.tuiCommands.delete(String(body.id)); body.ok ? pending.resolve(body.result) : pending.reject(new Error(String(body.error ?? "Pi TUI command failed")));
+        this.tuiCommands.delete(String(body.id));
+        const refusal = body.refusal;
+        const boundRefusal = this.fencedPrompt && this.verifiedOwner() && pending.command.type === "prompt" && pending.command.sessionId === this.sessionId
+          && refusal?.promptId === pending.command.id && refusal.sessionId === this.sessionId
+          && Number.isSafeInteger(refusal.generation) && refusal.generation >= Number(pending.command.generation);
+        body.ok ? pending.resolve(body.result) : pending.reject(boundRefusal && refusal.kind === "prompt_not_started" ? new PiPromptNotStarted(String(body.id))
+          : boundRefusal && refusal.kind === "prompt_uncertain" ? new PiPromptUncertain("Pi native prompt insertion is uncertain; inspect its retained terminal before retrying") : new Error(String(body.error ?? "Pi TUI command failed")));
         return Response.json({ ok: true });
       }
       if (url.pathname === "/tool") return this.handleToolRequest(body);
@@ -437,10 +453,14 @@ export class PiPeer extends BasePeer {
   async resumeFromRoster(): Promise<void> {
     if (!this.rosterDetached) return;
     if (this.opts.mode !== "tui" || this.stopping || !this.rosterDetached || !this.server || !this.verifiedOwner()) throw new Error("Pi roster return has no verified live TUI owner");
-    const epoch = this.rosterEpoch, session = this.sessionId, file = this.sessionFile;
+    if (!this.fencedPrompt) throw new Error("Pi roster return needs a fenced-prompt extension; restart the retained terminal with the current hub extension");
+    if (this.pendingPromptId) throw new Error("Pi prompt admission is still pending; wait before reverifying the retained terminal");
+    const epoch = this.rosterEpoch, lifecycle = this.rosterLifecycleRevision, session = this.sessionId, file = this.sessionFile;
     const snapshot = await this.sendTui({ type: "get_session_state" });
     if (epoch !== this.rosterEpoch || this.stopping || !this.verifiedOwner() || this.activeTools || snapshot?.sessionId !== session || snapshot?.sessionFile !== file || typeof snapshot?.idle !== "boolean") throw new Error("Pi roster return could not verify the current native session");
+    if (lifecycle !== this.rosterLifecycleRevision) throw new Error("Pi native activity changed during roster return; retry with a fresh session snapshot");
     this.rosterDetached = false;
+    this.hubPromptId = undefined; this.hubPromptGeneration = undefined;
     this.rosterUnownedRun = !snapshot.idle; this.agentRunning = !snapshot.idle;
     this.setState(snapshot.idle ? "idle" : "busy");
     if (!snapshot.idle) this.clearWatchdog();
@@ -534,6 +554,7 @@ export class PiPeer extends BasePeer {
     this.setState("busy"); this.activeEnvs = envs; this.currentReply = replyParent(envs); this.settledText = "";
     const rosterEpoch = this.rosterEpoch;
     let attempted = false;
+    let promptId: string | undefined;
     try {
       const requested = await this.opts.selectModel?.(envs);
       if (rosterEpoch !== this.rosterEpoch || !this.acceptingTools) throw new Error("Pi is off roster or stopped");
@@ -542,10 +563,32 @@ export class PiPeer extends BasePeer {
       this.noteActivity();
       attempted = true;
       if (deliveryId) this.activeDeliveryIds.add(deliveryId);
-      if (this.opts.mode === "tui") await this.sendTui({ type: "prompt", message: renderDigest(envs, true) });
+      if (this.opts.mode === "tui") { const pending = this.sendTui({ type: "prompt", message: renderDigest(envs, true) }); promptId = this.pendingPromptId; await pending; }
       else await this.sendRpc({ type: "prompt", message: renderDigest(envs, true) });
+      if (promptId !== undefined && promptId !== this.pendingPromptId) return;
+      if (this.fencedPrompt && this.rosterDetached) {
+        if (deliveryId && this.activeDeliveryIds.delete(deliveryId)) this.delivery({ id: deliveryId, state: "needs_review", reason: "Pi native activity changed before prompt acceptance was confirmed" });
+        this.setState("offline");
+        return;
+      }
       if (deliveryId && this.activeDeliveryIds.has(deliveryId)) this.delivery({ id: deliveryId, state: "accepted" });
     } catch (error) {
+      if (promptId !== undefined && promptId !== this.pendingPromptId) return;
+      if (error instanceof PiPromptUncertain) { this.pendingPromptId = undefined; await this.detachForRoster(); return; }
+      if (error instanceof PiPromptNotStarted && error.promptId === this.pendingPromptId) {
+        this.pendingPromptId = undefined;
+        if (deliveryId) this.activeDeliveryIds.delete(deliveryId);
+        if (deliveryId) this.delivery({ id: deliveryId, state: "failed_safe", reason: error.message });
+        else this.onFailed?.(envs);
+        await this.detachForRoster();
+        return;
+      }
+      if (this.fencedPrompt && this.pendingPromptId && this.rosterDetached) {
+        this.pendingPromptId = undefined;
+        if (deliveryId && this.activeDeliveryIds.delete(deliveryId)) this.delivery({ id: deliveryId, state: "needs_review", reason: "Pi prompt acknowledgement is uncertain after personal native activity" });
+        this.setState("offline");
+        return;
+      }
       if (rosterEpoch !== this.rosterEpoch) {
         if (!attempted && deliveryId) this.delivery({ id: deliveryId, state: "failed_safe", reason: "Pi withdrawn before native dispatch" });
         return;
@@ -563,11 +606,13 @@ export class PiPeer extends BasePeer {
         this.delivery({ id: deliveryId, state: "failed_safe", reason });
       }
       await this.terminateFailedTurn(error instanceof Error ? error : new Error(reason));
+    } finally {
+      if (promptId !== undefined && this.pendingPromptId === promptId) this.pendingPromptId = undefined;
     }
   }
 
   async steer(envs: Envelope[], deliveryId?: string): Promise<void> {
-    if (this.state !== "busy" || !this.acceptingTools || envs.some((e) => e.kind !== "chat" || e.private || e.priority !== "important")) {
+    if (this.state !== "busy" || !this.acceptingTools || (this.fencedPrompt && this.pendingPromptId && this.hubPromptGeneration === undefined) || envs.some((e) => e.kind !== "chat" || e.private || e.priority !== "important")) {
       const reason = `Pi workflow/private messages must queue${this.rosterDetached ? ": off roster" : this.rosterUnownedRun ? ": native turn pending" : ""}`;
       if (deliveryId) this.delivery({ id: deliveryId, state: "failed_safe", reason });
       throw new Error(reason);
@@ -597,14 +642,39 @@ export class PiPeer extends BasePeer {
   }
 
   private handleBridgeEvent(event: any): void {
+    if (this.fencedPrompt && this.opts.mode === "tui" && !this.rosterUnownedRun && ["agent_start", "agent_end", "agent_settled"].includes(event.type)
+      && typeof event.promptId === "string" && event.promptId !== this.hubPromptId) return;
+    if (this.fencedPrompt && this.opts.mode === "tui" && (this.activeEnvs.length > 0 || this.pendingPromptId || this.hubPromptId) && !this.rosterDetached && !this.rosterUnownedRun && !this.stopping && ["agent_start", "agent_end", "agent_settled"].includes(event.type)) {
+      const bound = this.verifiedOwner() && (event.sessionId === undefined || event.sessionId === this.sessionId);
+      if (!bound || !Number.isSafeInteger(event.generation) || event.generation < this.budgetGeneration) return;
+      const owned = this.hubPromptId !== undefined && event.promptId === this.hubPromptId;
+      if (event.type === "agent_start" && event.generation > this.budgetGeneration) {
+        if (owned) this.hubPromptGeneration = event.generation;
+        else {
+          if (this.pendingPromptId || this.activeEnvs.length) {
+            // Await the prompt's exact ACK before deciding whether its effect was absent or uncertain.
+            this.rosterDetached = true; this.rosterEpoch++; this.clearWatchdog();
+            this.activeEnvs = []; this.currentReply = undefined; this.settledText = ""; this.settledError = "";
+            this.abortTools();
+            if (!this.pendingPromptId) {
+              for (const id of this.activeDeliveryIds) this.delivery({ id, state: "needs_review", reason: "Pi personal native activity replaced the accepted hub turn" });
+              this.activeDeliveryIds.clear(); this.setState("offline");
+            }
+          } else { this.rosterUnownedRun = true; this.setState("busy"); this.clearWatchdog(); }
+        }
+      } else if (!this.rosterUnownedRun && (!owned || event.generation !== this.hubPromptGeneration)) return;
+    }
     if (this.rosterDetached || this.rosterUnownedRun) {
       // The shipped extension's legacy agent_start omits sessionId. Its authenticated bridge
       // and still-verified owner bind that event to this session; an explicit mismatch never does.
       const bound = !this.stopping && this.verifiedOwner() && (event.sessionId === undefined || event.sessionId === this.sessionId);
       if (bound && event.type === "agent_start" && Number.isSafeInteger(event.generation) && event.generation > this.budgetGeneration) {
+        this.rosterLifecycleRevision++;
         this.budgetGeneration = event.generation;
         this.noteActivity(); // personal native activity also revokes an earlier ID-only empty-resume proof
       }
+      // Snapshot ACKs and lifecycle events use separate requests, so their arrival order is not native state order.
+      if (bound && event.type === "agent_settled" && (event.generation === undefined || event.generation === this.budgetGeneration)) this.rosterLifecycleRevision++;
       if (!bound && event.type !== "session_shutdown") return;
     }
     if (this.rosterDetached && event.type !== "session_shutdown") return;
@@ -619,6 +689,7 @@ export class PiPeer extends BasePeer {
     if (event.type === "session_start") {
       if (!this.ownerClaimed) { this.ownerClaimed = true; this.ownerToken = String(event.ownerToken ?? ""); }
       this.approvalTurnAbort = event.approvalTurnAbort === true;
+      this.fencedPrompt ||= event.fencedPrompt === true;
       this.sessionId = String(event.sessionId ?? ""); this.sessionFile = String(event.sessionFile ?? "");
       this.ownerPid = Number.isInteger(event.pid) ? event.pid : undefined; this.ownerSignature = typeof event.signature === "string" ? event.signature : undefined;
       if ((this.opts.sessionId && this.sessionId !== this.opts.sessionId) || (this.opts.sessionFile && this.sessionFile !== this.opts.sessionFile)) { this.opts.log?.(`[${this.id}] Pi session identity mismatch`); return; }
@@ -699,6 +770,7 @@ export class PiPeer extends BasePeer {
       for (const id of this.activeDeliveryIds) this.delivery({ id, state: approvalStopReason ? "completed" : error || cancelled ? "needs_review" : "completed", ...(error || cancelled ? { reason: error || "Pi turn cancelled; partial effects are possible" } : {}) });
       this.activeDeliveryIds.clear();
       this.currentReply = undefined; this.activeEnvs = [];
+      this.hubPromptId = undefined; this.hubPromptGeneration = undefined;
       this.executionAbort?.abort(); this.executionAbort = undefined;
       this.approvalExpiries = 0; this.approvalAnswerEpoch = undefined; this.approvalStopReason = ""; this.approvalAbortSent = false;
       this.abortedToolIds.clear(); this.abortIdsOverflow = false;
@@ -717,7 +789,9 @@ export class PiPeer extends BasePeer {
   }
   private sendTui(command: Record<string, unknown>): Promise<any> {
     const id = `ahub-${++this.seq}`;
-    const wire = { id, ...command };
+    const fenced = this.fencedPrompt && command.type === "prompt";
+    if (fenced) { this.pendingPromptId = id; this.hubPromptId = id; this.hubPromptGeneration = undefined; }
+    const wire = { id, ...command, ...(fenced ? { sessionId: this.sessionId, generation: this.budgetGeneration } : {}) };
     return new Promise((resolvePromise, reject) => {
       const timer = setTimeout(() => {
         this.tuiCommands.delete(id);

package/src/cli/help.ts

@@ -110,7 +110,7 @@ const SECTIONS: [string, [usage: string, description: string][]][] = [
     ["ahub memory search <words> | show <id> | graph <id|node> [--hops 1|2] [--json]", "find entries, read one with its provenance, or list its graph neighbourhood"],
     ["ahub memory promote|demote|forget <id> | supersede <old> <new> | rebuild", "a person's changes to memory: move an entry between tiers, forget it, mark it superseded, or rebuild the index from the logs"],
     ["ahub memory sync [--remote <private git url>] | machine [--label <name>]", "sync hub memory with your other machines through a private git remote (a person's), or show or name this machine"],
-    ["ahub memory import claude-mem [--db <path>] [--limit N] | suggestions | confirm|reject <id>", "copy the hub's notes from claude-mem into hub memory (a person's); review the model's suggested edges"],
+    ["ahub memory import claude-mem [--db <path>] [--limit N] [--restart] | dedupe [--apply] | suggestions | confirm|reject <id>", "copy the hub's notes from claude-mem into hub memory (a person's); review the model's suggested edges"],
     ["ahub goal [list] [--all] | show <id> [--json]", "long-term tasks: state, which machine holds each and until when, linked board tasks"],
     ["ahub goal new <title> [--milestone <text>]... [--depends <id>]... [--shared] | link <id> <task> | state <id> <state> | done <id> | take <id> [--force]", "a person's changes to long-term tasks; take --force voids other machines' claims"],
   ]],

package/src/cli/identity.ts

@@ -61,7 +61,7 @@ export function cliCommandLabel(command: string, args: readonly string[]): strin
   if (!["upgrade", "restart", "recovery", "recovery-run", "help", "--help", "--version", "version", "projects", "ui", "manager", "setup", "init", "daemon", "up", "console", "claude", "codex", "kimi", "qwen", "jcode", "pi", "local", "stop", "models", "say", "queue", "tail", "watch", "budget", "board", "task", "review", "remember", "ask", "route", "pause", "resume", "permit", "permission", "settings", "roster", "status", "pet", "logs", "export", "report", "research", "memory", "goal", "bench", "sdlc", "role", "facts", "check-path", "turns", "undo", "kill", "reset", "doctor"].includes(command)) return "unknown";
   if (["task", "queue", "budget", "route", "recovery", "models", "projects", "research", "memory", "goal", "bench"].includes(command)) {
     const sub = command === "bench" || command === "memory" || command === "goal" ? args.find((arg) => arg !== "--json") : args[0];
-    if (sub && ["propose", "show", "assign", "escalate", "label", "list", "resolve", "resume", "set", "execution", "explain", "status", "abort", "dispose", "setup", "start", "stop", "remove", "export", "backfill", "addons", "run", "report", "compare", "search", "graph", "promote", "demote", "forget", "supersede", "rebuild", "sync", "machine", "import", "suggestions", "confirm", "reject", "new", "link", "state", "done", "take"].includes(sub)) return `${command} ${sub}`;
+    if (sub && ["propose", "show", "assign", "escalate", "label", "list", "resolve", "resume", "set", "execution", "explain", "status", "abort", "dispose", "setup", "start", "stop", "remove", "export", "backfill", "addons", "run", "report", "compare", "search", "graph", "promote", "demote", "forget", "supersede", "dedupe", "rebuild", "sync", "machine", "import", "suggestions", "confirm", "reject", "new", "link", "state", "done", "take"].includes(sub)) return `${command} ${sub}`;
   }
   return (/^[a-z][a-z0-9-]*$/.test(command) && !/\s/.test(command)) || ["--help", "--version"].includes(command) ? command : "unknown";
 }

package/src/cli/memory.ts

@@ -12,7 +12,7 @@ const loadConfigSafe = (cwd: string) => { try { return loadConfig(cwd); } catch
  * #258: `ahub memory`, straight on the machine's store (no hub needed). Reading is anyone's; promote, demote, forget,
  * supersede and rebuild are a person's (the identity gate refuses agent shells).
  */
-export const MEMORY_USAGE = "usage: ahub memory [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> | show <id> | graph <id|node> [--hops 1|2] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] | suggestions | confirm|reject <suggestion id>  [--json]";
+export const MEMORY_USAGE = "usage: ahub memory [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> | show <id> | graph <id|node> [--hops 1|2] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] [--restart] | dedupe [--apply] | suggestions | confirm|reject <suggestion id>  [--json]";
 export const GOAL_USAGE = "usage: ahub goal [list] [--all] | show <id> | new <title> [--milestone <text>]... [--depends <id>]... [--shared] | link <id> <task id> | state <id> open|active|blocked|done|dropped | done <id> | take <id> [--force]  [--json]";
 
 const fail = (message: string): never => { throw new Error(message); };
@@ -85,17 +85,27 @@ export async function memoryCommand(args: string[], cwd: string, opts: { store?:
         if (!r.ok) fail(`hub memory sync: ${r.error}`);
         return `synced${r.pushed ? " and pushed" : ""}: ${r.entries} long-term entries visible here${r.warning ? `\nnote: ${r.warning}` : ""}`;
       }
+      case "dedupe": {
+        const apply = rest.includes("--apply");
+        if (rest.some(arg => arg !== "--apply")) fail("usage: ahub memory dedupe [--apply] [--json]");
+        const result = store.dedupe(project, apply);
+        if (json) return JSON.stringify(result, null, 2);
+        return [result.groups.length ? `${result.groups.length} duplicate import group(s)${apply ? `; appended ${result.applied} supersede operation(s)` : "; use --apply to reconcile"}` : "no duplicate import groups to reconcile",
+          ...result.groups.map(g => `${g.members.map(v => v.id.slice(0, 8)).join(", ")} -> ${g.target.slice(0, 8)}: ${g.members[0]!.text}`)].join("\n");
+      }
       case "import": {
         const db = flag("--db"), limit = flag("--limit");
-        if (rest[0] !== "claude-mem" || rest.length !== 1) fail("usage: ahub memory import claude-mem [--db <path>] [--limit N]");
+        const restart = rest.includes("--restart");
+        if (restart) rest.splice(rest.indexOf("--restart"), 1);
+        if (rest[0] !== "claude-mem" || rest.length !== 1) fail("usage: ahub memory import claude-mem [--db <path>] [--limit N] [--restart]");
         if (limit && !(Number(limit) > 0)) fail("--limit takes a positive number");
         const routing = currentRouting(cwd);
         const policy = privatePaths(); // a note about a private path never reaches the synced log
-        const key = memoryProjectKey(cwd), deny = loadConfigSafe(cwd)?.local.deny ?? [];
-        const nodes = (text: string) => extractNodes(text, { cwd, project: key, repo: key.startsWith("github.com/") ? key.slice("github.com/".length) : key, deny });
-        const r = importClaudeMem(store, { project: key, chain: projectChain(cwd), nodes, isPii: (text) => detectSignals({ title: text, detail: "", refs: {} }, routing, cwd).includes("pii") || mentionsPrivatePath(text, [], policy, cwd), ...(db ? { db } : {}), ...(limit ? { limit: Number(limit) } : {}) });
+        const key = memoryProjectKey(cwd);
+        const nodes = (text: string) => extractNodes(text, { cwd, project: key, repo: key.startsWith("github.com/") ? key.slice("github.com/".length) : key, checkExists: false });
+        const r = importClaudeMem(store, { project: key, chain: projectChain(cwd), nodes, restart, isPii: (text) => detectSignals({ title: text, detail: "", refs: {} }, routing, cwd).includes("pii") || mentionsPrivatePath(text, [], policy, cwd), ...(db ? { db } : {}), ...(limit ? { limit: Number(limit) } : {}) });
         if (json) return JSON.stringify(r, null, 2);
-        return `imported ${r.added} of ${r.read} hub notes from claude-mem as long-term entries (skipped: ${r.skipped.project} other projects, ${r.skipped.model} model answers, ${r.skipped.pii} PII, ${r.skipped.secret} secret-looking; the rest were already here)`;
+        return `imported ${r.added} of ${r.read} hub notes from claude-mem as long-term entries (skipped: ${r.skipped.model} model answers, ${r.skipped.pii} PII, ${r.skipped.secret} secret-looking; other candidates were empty, malformed or already imported)${r.more ? "\nmore remain: run it again" : ""}`;
       }
       case "suggestions": {
         const pending = store.suggestions(project).filter((x) => x.status === "suggested");

package/src/hub/daemon.ts

@@ -419,6 +419,8 @@ interface Client {
   peer?: PeerId;
   tail?: () => void;
   watch?: () => void;
+  /** The one-launch Kimi TUI admission this socket attached under; its close clears only that admission. */
+  kimiAdmission?: string;
 }
 type Sock = ServerWebSocket<Client>;
 
@@ -655,7 +657,7 @@ export async function startDaemon(opts: DaemonOptions) {
         const peer = sock.data.peer ? bus.peers.get(sock.data.peer) : undefined;
         if (peer instanceof WsPeer) {
           peer.detach(sock);
-          if (sock.data.peer === "kimi" && peer.state === "offline" && !peer.claiming) clearKimiAdmission();
+          if (sock.data.peer === "kimi" && peer.state === "offline" && !peer.claiming && sock.data.kimiAdmission === kimiAdmissionId) clearKimiAdmission();
         }
       },
     },
@@ -3869,7 +3871,7 @@ export async function startDaemon(opts: DaemonOptions) {
         preparedSessionRoles.delete(c.peer); // an external transport has no receipt for this daemon's native preamble
         preparedSessionRoleIdentities.delete(c.peer);
         ws.claim(sock, msg.channel === false);
-        if (kimiPull) { clearTimeout(kimiAdmissionExpiry); kimiAdmissionExpiry = undefined; }
+        if (kimiPull) { clearTimeout(kimiAdmissionExpiry); kimiAdmissionExpiry = undefined; c.kimiAdmission = kimiAdmissionId; }
         if (c.peer === "claude") logPermissionStart(c.peer);
         writeStatus(); // the claim has to be visible before the preface, or a standing-by session takes the id back
         void ensurePreface(c.peer).finally(() => {
@@ -4154,7 +4156,9 @@ export async function startDaemon(opts: DaemonOptions) {
         if (c.role !== "console") return void reply({ ok: false, error: "watch is a person-only console command" });
         if (msg.peer !== "kimi" && msg.peer !== "qwen") return void reply({ ok: false, error: "watch supports headless kimi and qwen only" });
         const peer = msg.peer as "kimi" | "qwen";
-        if (peer === "kimi" && (kimiSessionMode ?? startMode("kimi")) === "tui") return void reply({ ok: false, error: "Kimi is in pull-only TUI mode; use its native terminal or start headless" });
+        // Judged by the live owner: a headless Kimi started by --mode headless is watchable under a TUI start mode.
+        const kimiOwner = bus.peers.get("kimi");
+        if (peer === "kimi" && !(kimiOwner instanceof AcpPeer) && (kimiOwner instanceof WsPeer || (kimiSessionMode ?? startMode("kimi")) === "tui")) return void reply({ ok: false, error: "Kimi is in pull-only TUI mode; use its native terminal or start headless" });
         if (!membershipAllowed(peer)) return void reply({ ok: false, error: `${peer} is off roster` });
         c.watch?.();
         c.watch = activityRings[peer].subscribe(item => {

package/src/hub/path-policy.ts

@@ -1,6 +1,7 @@
-import { lstatSync, opendirSync, statSync } from "node:fs";
+import { accessSync, constants, lstatSync, opendirSync, readlinkSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { realPath } from "./project.ts";
+import { foldSegment } from "./permission-mode.ts";
 /** Bounded project-relative exact paths/subtrees or *, ? and whole-segment ** globs. */
 export function policyPaths(raw: unknown, field: string): string[] {
   if (raw === undefined) return [];
@@ -15,16 +16,68 @@ export function policyRealPath(path: string): string {
   while (!existing(ancestor)) { const parent = dirname(ancestor); if (parent === ancestor) throw new Error("path cannot be resolved"); ancestor = parent; }
   return join(realPath(ancestor), relative(ancestor, path));
 }
-const beneath = (path: string, root: string) => { path = path.toLowerCase(); root = root.toLowerCase(); return path === root || path.startsWith(root.endsWith(sep) ? root : root + sep); };
+const within = (path: string, root: string) => path === root || path.startsWith(root.endsWith(sep) ? root : root + sep);
+// Either spelling protects, as for globs: lowercase as before, or folded like a case-insensitive disk opens names (NFD/NFC,
+// compatibility forms, long s, ignorable code points). Folding is not a function of the lowercase form for every name.
+const beneath = (path: string, root: string) => within(path.toLowerCase(), root.toLowerCase()) || within(foldSegment(path), foldSegment(root));
+const lowerBeneath = (path: string, root: string) => within(path.toLowerCase(), root.toLowerCase());
 export function policyTargets(cwd: string, paths: string[]): string[] {
   const root = realPath(cwd);
   return [...new Set(paths.flatMap(path => { const lexical = resolve(root, path); return [lexical, policyRealPath(lexical)]; }))];
 }
-/** Linear-space wildcard DP, avoiding regex backtracking on untrusted paths. */
+type DiscoveryBudget = { entries: number };
+/** A dangling direct child names a future lexical target; an ELOOP child opens no file. */
+function directAliasTarget(path: string): string | undefined {
+  let target = path;
+  // Include the final target resolution after the last bounded redirect.
+  for (let hops = 0; hops <= 40; hops++) {
+    try { return policyRealPath(target); }
+    catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      if (code === "ELOOP") return undefined;
+      if (code !== "ENOENT") throw error;
+    }
+    let ancestor = target;
+    while (!existing(ancestor)) {
+      const parent = dirname(ancestor);
+      if (parent === ancestor) return undefined;
+      ancestor = parent;
+    }
+    if (!lstatSync(ancestor).isSymbolicLink()) return undefined;
+    target = resolve(dirname(ancestor), readlinkSync(ancestor), relative(ancestor, target));
+  }
+  return undefined;
+}
+/** Only a completed bounded scan contributes aliases; a truncated root contributes none. */
+function aliasScope(dir: string, lexical: string, actual: string, includeParents: boolean, budget: DiscoveryBudget): boolean {
+  // Readability must not depend on reaching readSync after an exhausted-budget return.
+  accessSync(dir, constants.R_OK);
+  const handle = opendirSync(dir);
+  let matched = false;
+  try {
+    if (budget.entries >= 4096) return false;
+    for (let entry = handle.readSync(); entry; entry = handle.readSync()) {
+      if (budget.entries >= 4096) return false;
+      budget.entries++;
+      if (!entry.isSymbolicLink()) continue;
+      const target = directAliasTarget(join(dir, entry.name));
+      if (target !== undefined && (beneath(lexical, target) || beneath(actual, target) || includeParents && (beneath(target, lexical) || beneath(target, actual)))) matched = true;
+    }
+  } finally { handle.closeSync(); }
+  return matched;
+}
+/**
+ * Either spelling protects: the lowercase comparison keeps `?` matching one code point whose fold expands (ß, fi), and
+ * the folded one catches NFD/NFC, compatibility and long-s aliases. Adding a match only ever adds protection.
+ */
 function segmentMatches(pattern: string, name: string): boolean {
-  const chars = [...name.toLowerCase()];
+  return wildcard(pattern.toLowerCase(), name.toLowerCase()) || wildcard(foldSegment(pattern), foldSegment(name));
+}
+/** Linear-space wildcard DP, avoiding regex backtracking on untrusted paths. */
+function wildcard(pattern: string, name: string): boolean {
+  const chars = [...name];
   let previous = new Array<boolean>(chars.length + 1).fill(false); previous[0] = true;
-  for (const char of pattern.toLowerCase()) {
+  for (const char of pattern) {
     const next = new Array<boolean>(chars.length + 1).fill(false);
     next[0] = char === "*" && previous[0]!;
     for (let i = 1; i <= chars.length; i++) next[i] = char === "*" ? previous[i]! || next[i - 1]! : previous[i - 1]! && (char === "?" || char === chars[i - 1]);
@@ -57,23 +110,34 @@ function patternScope(pattern: string[], states: Set<number>, path: string, incl
   return includeParents && states.size > 0; // this scope can contain a future protected descendant
 }
 /** Resolve wildcard directory aliases without trusting a cached expansion. Bound all filesystem discovery. */
-function globScope(root: string, lexical: string, actual: string, path: string, includeParents: boolean, budget: { entries: number }): boolean {
+function globScope(root: string, lexical: string, actual: string, path: string, includeParents: boolean, budget: DiscoveryBudget, roots: Set<string>, aliasDiscovery = false): boolean {
   const pattern = path.split("/").filter(p => p && p !== ".");
   const start = closure(pattern, new Set([0]));
   if (patternScope(pattern, start, relative(root, lexical), includeParents) || patternScope(pattern, start, relative(root, actual), includeParents)) return true;
   const visit = (dir: string, states: Set<number>, depth: number, ancestors: Set<string>): boolean => {
     const real = policyRealPath(dir);
-    if (states.has(pattern.length)) return beneath(lexical, real) || beneath(actual, real) || includeParents && (beneath(real, lexical) || beneath(real, actual));
+    if (states.has(pattern.length)) {
+      if (beneath(lexical, real) || beneath(actual, real) || includeParents && (beneath(real, lexical) || beneath(real, actual))) return true;
+      // Defer new child aliases until every pre-existing policy match has had its discovery budget.
+      if (pattern.at(-1) === "**" && existing(real) && statSync(real).isDirectory()) roots.add(real);
+      // An earlier `**` can still match deeper: an alias below this match (`ss/ß -> other` for `**/ß`) is searched too.
+      // A trailing `**` only re-matches everything below, so it never walks the subtree (as before, for paths outside it).
+      states = new Set([...states].filter(i => i !== pattern.length && !(i === pattern.length - 1 && pattern[i] === "**")));
+      if (!states.size) return false;
+    }
     if (patternScope(pattern, states, relative(real, actual), includeParents)) return true;
     if (!existing(dir)) return false;
-    if (!beneath(real, root)) throw new Error("policy glob discovery outside project");
+    // Unfolded: a sibling whose folded spelling looks like the project is outside it, and discovery there fails closed.
+    if (!lowerBeneath(real, root)) throw new Error("policy glob discovery outside project");
     const info = statSync(dir);
     if (!info.isDirectory()) return false;
+    if (aliasDiscovery && budget.entries >= 4096) return false;
     if (depth > 32 || ancestors.has(real) || budget.entries > 4096) throw new Error("policy glob discovery unavailable");
     const chain = new Set(ancestors); chain.add(real);
     const handle = opendirSync(dir);
     try {
       for (let entry = handle.readSync(); entry; entry = handle.readSync()) {
+        if (aliasDiscovery && budget.entries >= 4096) return false;
         if (++budget.entries > 4096) throw new Error("policy glob discovery unavailable");
         const next = advance(pattern, states, entry.name);
         if (next.size && visit(join(dir, entry.name), next, depth + 1, chain)) return true;
@@ -83,14 +147,28 @@ function globScope(root: string, lexical: string, actual: string, path: string,
   };
   return visit(root, start, 0, new Set());
 }
-/** Compare declared spelling, real targets and wildcard aliases. Unknown discovery conservatively protects. */
+/** Compare declared spelling, real targets and bounded aliases; legacy discovery errors fail closed. */
 export function matchesPolicy(cwd: string, path: string, paths: string[], includeParents = false): boolean {
   if (!paths.length) return false;
   try {
     if (path.length > 4096) return true;
     const root = realPath(cwd), lexical = resolve(root, path), actual = policyRealPath(lexical);
     includeParents &&= !existing(lexical) || statSync(lexical).isDirectory();
-    const budget = { entries: 0 };
-    return paths.some(entry => /[?*]/.test(entry) ? globScope(root, lexical, actual, entry, includeParents, budget) : policyTargets(root, [entry]).some(target => beneath(lexical, target) || beneath(actual, target) || (includeParents && (beneath(target, lexical) || beneath(target, actual)))));
+    const budget = { entries: 0 }, roots = new Set<string>(), exact: string[] = [];
+    if (paths.some(entry => {
+      if (/[?*]/.test(entry)) return globScope(root, lexical, actual, entry, includeParents, budget, roots);
+      const targets = policyTargets(root, [entry]);
+      if (targets.some(target => beneath(lexical, target) || beneath(actual, target) || includeParents && (beneath(target, lexical) || beneath(target, actual)))) return true;
+      const real = targets.at(-1)!;
+      if (existing(real) && statSync(real).isDirectory()) roots.add(real);
+      exact.push(entry);
+      return false;
+    })) return true;
+    // New exact-root discovery cannot consume the budget before legacy wildcard matches are checked.
+    for (const entry of exact) {
+      if (globScope(root, lexical, actual, `${entry}/**`, includeParents, budget, roots, true)) return true;
+    }
+    for (const dir of roots) if (aliasScope(dir, lexical, actual, includeParents, budget)) return true;
+    return false;
   } catch { return true; }
 }