@staix/agent-hub 0.12.28 → 0.12.30

package/src/cli/identity-audit.ts

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { cliCommandLabel } from "./identity.ts";
 
 export interface CliAudit {
-  v: 1; id: string; at: number; peer: string; command: string; outcome: "run" | "refused" | "invalid";
+  v: 1; id: string; at: number; peer: string; command: string; outcome: "run" | "refused" | "invalid" | "delegated";
 }
 const MAX_FILES = 256;
 const MAX_BYTES = 64 * 1024;
@@ -14,7 +14,7 @@ const valid = (row: any): row is CliAudit => row?.v === 1 && typeof row.id === "
   && typeof row.at === "number" && Number.isFinite(row.at) && row.at > 0
   && typeof row.peer === "string" && /^[a-z][a-z0-9-]{0,31}$/.test(row.peer) && !/\s/.test(row.peer)
   && typeof row.command === "string" && row.command.length <= 64 && row.command === cliCommandLabel(...splitLabel(row.command))
-  && ["run", "refused", "invalid"].includes(row.outcome);
+  && ["run", "refused", "invalid", "delegated"].includes(row.outcome);
 const splitLabel = (label: string): [string, string[]] => { const [command = "unknown", ...args] = label.split(" "); return [command, args]; };
 
 /**

package/src/cli/identity.ts

@@ -1,5 +1,19 @@
 import { isSupportedPeer } from "../hub/peer-catalog.ts";
 
+/** Recovery reads this declaration before delegating to another package's CLI. */
+export const LIVE_TEST_SUPPORTED = true;
+
+/** Person verdicts and user-authored workflow content are never delegated. */
+export function liveTestRefusal(command: string, args: readonly string[]): boolean {
+  if (args.some(arg => arg === "--as-user" || arg.startsWith("--as-user="))) return true;
+  const sub = args.find(arg => arg !== "--json");
+  return ["task", "role", "goal"].includes(command)
+    || (command === "backlog" && sub !== "list") || (command === "release" && !["list", "show"].includes(sub ?? ""))
+    || (command === "memory" && sub !== "graph")
+    || (command === "board" && args[0] === "import") || (command === "sdlc" && args[0] === "record")
+    || (command === "bench" && args.find(arg => arg !== "--json") === "run") || command === "pet";
+}
+
 export type CliIdentity =
   | { role: "console" }
   | { role: "tools"; peer: string }
@@ -63,7 +77,7 @@ export function cliCommandLabel(command: string, args: readonly string[]): strin
   if (!["upgrade", "restart", "recovery", "recovery-run", "help", "--help", "--version", "version", "projects", "ui", "manager", "setup", "init", "daemon", "up", "console", "claude", "codex", "kimi", "qwen", "jcode", "pi", "local", "stop", "models", "say", "queue", "tail", "watch", "budget", "board", "task", "review", "remember", "ask", "route", "pause", "resume", "permit", "permission", "settings", "roster", "status", "pet", "logs", "export", "report", "research", "memory", "goal", "bench", "sdlc", "role", "facts", "check-path", "turns", "undo", "kill", "reset", "doctor"].includes(command)) return "unknown";
   if (["task", "queue", "budget", "route", "recovery", "models", "projects", "research", "memory", "goal", "bench"].includes(command)) {
     const sub = command === "bench" || command === "memory" || command === "goal" ? args.find((arg) => arg !== "--json") : args[0];
-    if (sub && ["propose", "show", "assign", "escalate", "label", "list", "resolve", "resume", "set", "execution", "explain", "status", "abort", "dispose", "setup", "start", "stop", "remove", "export", "backfill", "addons", "run", "report", "compare", "search", "graph", "promote", "demote", "forget", "supersede", "dedupe", "rebuild", "sync", "machine", "import", "suggestions", "confirm", "reject", "new", "link", "state", "done", "take"].includes(sub)) return `${command} ${sub}`;
+    if (sub && ["propose", "show", "assign", "unassign", "escalate", "label", "list", "resolve", "resume", "set", "execution", "explain", "status", "abort", "dispose", "setup", "start", "stop", "remove", "export", "backfill", "addons", "run", "report", "compare", "search", "graph", "promote", "demote", "forget", "supersede", "dedupe", "decay", "rebuild", "sync", "machine", "import", "suggestions", "confirm", "reject", "new", "link", "state", "done", "take"].includes(sub)) return `${command} ${sub}`;
   }
   return (/^[a-z][a-z0-9-]*$/.test(command) && !/\s/.test(command)) || ["--help", "--version"].includes(command) ? command : "unknown";
 }

package/src/cli/main.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 // Keep this entrypoint plain JavaScript: Node must fail before loading TypeScript or bun:sqlite.
 const version = /^(\d+)\.(\d+)\.(\d+)$/.exec(process.versions.bun ?? "");
-if (!version || !(Number(version[1]) > 1 || (Number(version[1]) === 1 && Number(version[2]) >= 3))) {
-  console.error("ahub: Bun >=1.3.0 is required. Install Bun: https://bun.sh");
+if (!version || !(Number(version[1]) > 1 || (Number(version[1]) === 1 && (Number(version[2]) > 4 || (Number(version[2]) === 4 && Number(version[3]) >= 2))))) {
+  console.error("ahub: Bun >=1.4.2 is required. Install Bun: https://bun.sh");
   process.exit(1);
 }
 

package/src/cli/main.ts

@@ -59,11 +59,13 @@ import { armRuns, benchCompare, benchCsv, benchReport, formatCompare, formatRepo
 import { benchPreflight, defaultIo, runBench } from "./bench.ts";
 import { ADDONS, isAddon, type AddonName } from "../hub/tooling.ts";
 import { goalCommand, memoryCommand } from "./memory.ts";
+import { selectedMemoryProfile } from "../hub/memory-profile.ts";
+import { checkMemoryProfiles, formatMemoryProfileCheck } from "../hub/memory-profile-check.ts";
 import { addonReport, appendRecords, formatAddons, formatResearch, LABELS, labelTarget, RESEARCH_SCHEMA, projectKey, readStores, researchReport, taskRecords, toCsv, type Label, type TaskRecord } from "../hub/research.ts";
 import { summarize, summarizeByTask } from "../hub/report.ts";
 import { hasTree, planUndo, repoOf, restore, Turns } from "../hub/snapshots.ts";
 import { pathWarnings } from "../hub/conflicts.ts";
-import { classifyPeerCommand, cliCommandLabel, detectCliIdentity, peerCommandRefusal } from "./identity.ts";
+import { classifyPeerCommand, cliCommandLabel, detectCliIdentity, liveTestRefusal, peerCommandRefusal } from "./identity.ts";
 import { recordCliAudit } from "./identity-audit.ts";
 import { runConsole } from "./console.ts";
 import { paint, permissionBoundary, resolveColor, wrap, type Span } from "./console-state.ts";
@@ -83,10 +85,16 @@ const since = (): number => {
 
 const argv = process.argv.slice(2);
 let selector: string | undefined;
-if (argv[0] === "--project") {
-  argv.shift();
-  selector = argv.shift();
-  if (!selector || selector.startsWith("--")) fail("--project needs a path or project ID");
+let liveTest = false;
+while (argv[0] === "--project" || argv[0] === "--live-test") {
+  if (argv.shift() === "--live-test") {
+    if (liveTest) fail("--live-test may appear only once");
+    liveTest = true;
+  } else {
+    if (selector !== undefined) fail("--project may appear only once");
+    selector = argv.shift();
+    if (!selector || selector.startsWith("--")) fail("--project needs a path or project ID");
+  }
 }
 const [given = "help", ...rest] = argv;
 // `ahub <command> -h` alone asks for that command's help instead of running it. Elsewhere `-h` may be message text
@@ -114,17 +122,27 @@ const projectConfig = () => {
   return config;
 };
 const stateDir = selected.stateDir;
-const identity = detectCliIdentity(process.env);
+const caller = detectCliIdentity(process.env);
 const commandLabel = cliCommandLabel(cmd, args);
 const commandAccess = classifyPeerCommand(cmd, args);
+// Agent-authored content keeps its peer. Operational starts/holds may borrow console authority for live verification.
+const delegationRefused = liveTest && caller.role === "tools" && commandAccess !== "allowed" && liveTestRefusal(cmd, args);
+const delegatedPeer = liveTest && caller.role === "tools" && commandAccess !== "allowed" && !delegationRefused ? caller.peer : undefined;
+const identity = delegatedPeer ? { role: "console" as const } : caller;
 function audit(outcome: "run" | "refused" | "invalid"): void {
-  if (identity.role === "console") return;
-  try { recordCliAudit(stateDir, identity.role === "tools" ? identity.peer : "unknown", commandLabel, outcome); }
-  catch { console.error("ahub: CLI audit could not be recorded (outbox unavailable or full)"); }
+  if (caller.role === "console") return;
+  try { recordCliAudit(stateDir, caller.role === "tools" ? caller.peer : "unknown", commandLabel, delegatedPeer && outcome === "run" ? "delegated" : outcome); }
+  catch {
+    if (delegatedPeer) fail("live-test delegation audit unavailable; nothing was executed");
+    console.error("ahub: CLI audit could not be recorded (outbox unavailable or full)");
+  }
 }
 if (identity.role === "invalid") { audit("invalid"); fail(`${identity.reason}; use ahub console or a terminal with no agent markers`); }
+if (delegationRefused) { audit("refused"); fail("live-test cannot write person-attributed content; use peer tools or a person's terminal"); }
 if (identity.role === "tools" && commandAccess === "console") { audit("refused"); fail(peerCommandRefusal(identity.peer, commandLabel)); }
-if (identity.role === "tools") audit("run");
+if (identity.role === "tools" || delegatedPeer) audit("run");
+// Forward only to ahub's own continuation commands, never to native agent argv or an environment flag.
+const liveTestArgs = liveTest ? ["--live-test"] : [];
 const invokedFrom = process.cwd(); // relative paths a person types (a bench suite) are theirs, not the project's
 try { process.chdir(cwd); } catch { fail(`project directory is unavailable: ${cwd}`); }
 /** One-shot output flags do not alter the fetched JSON document. */
@@ -381,7 +399,7 @@ async function hold(t: "pause" | "resume"): Promise<void> {
 }
 
 function spawnRecovery(operation: RecoveryOperation, quiet = false): void {
-  const child = spawn(process.execPath, [join(operation.sourceRoot, "src/cli/main.js"), "recovery-run", operation.id], {
+  const child = spawn(process.execPath, [join(operation.sourceRoot, "src/cli/main.js"), ...liveTestArgs, "recovery-run", operation.id], {
     cwd, detached: true, stdio: "ignore", env: { ...process.env, AGENTHUB_RECOVERY_OPERATION: operation.id },
   });
   child.on("error", () => console.error(`runner launch failed; use ${recoveryCommand(operation, "resume")}`));
@@ -415,7 +433,7 @@ async function onTerminal(screens: (io: ScreenIO) => Promise<void>): Promise<voi
         // The command owns the terminal while it runs; a reader whose input already ended has nothing to pause.
         if (!ended) rl.pause();
         const done = (code: number) => { if (!ended) rl.resume(); resolve(code); };
-        const child = spawn(process.execPath, argv, { cwd, stdio: "inherit" });
+        const child = spawn(process.execPath, [argv[0]!, ...liveTestArgs, ...argv.slice(1)], { cwd, stdio: "inherit" });
         child.on("error", () => done(1));
         child.on("close", (code) => done(code ?? 1));
       }),
@@ -444,7 +462,7 @@ function upgradeHost(kind: "restart" | "upgrade", version: string): UpgradeHost
     lock: recoveryLock,
     read: (id) => readOperation<RecoveryOperation>(id),
     runner: recoveryRunner,
-    live: (op) => liveProjects(op, makeRecoveryDriver().inspect),
+    live: (op) => liveProjects(op, makeRecoveryDriver(undefined, delegatedPeer).inspect),
     endPeer: (planned, peer) => endPlannedPeer(planned, peer),
     runnerStoppable: (id) => signedRunner(id) !== undefined,
     stopRunner: (id) => stopSignedRunner(id),
@@ -470,7 +488,7 @@ async function upgrade(kind: "restart" | "upgrade"): Promise<void> {
   if (to !== undefined) { try { exactVersion(to); } catch (error) { fail((error as Error).message); } }
   // An older CLI must not coordinate a newer target (docs/operations.md): the target's own coordinator takes over.
   if (kind === "upgrade" && newerVersion(to!, VERSION) && process.env.AGENTHUB_UPGRADE_HANDOVER !== "1") {
-    const argv = ["x", "--package", `@staix/agent-hub@${to}`, "ahub", "upgrade", "--to", to!, ...rest];
+    const argv = ["x", "--package", `@staix/agent-hub@${to}`, "ahub", ...liveTestArgs, "upgrade", "--to", to!, ...rest];
     console.error(`ahub: ${to} is newer than this CLI (${VERSION}), so its own coordinator runs the upgrade: bun ${argv.join(" ")}`);
     if (interactive) {
       const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -532,31 +550,31 @@ const commands: Record<string, () => Promise<void> | void> = {
     const runner = recoveryRunner(id);
     if (action === "status") {
       // #215: abort and resume are offered by what the open sources show, read as the runner's errors read them.
-      const live = runner ? {} : await liveProjects(operation, makeRecoveryDriver().inspect);
+      const live = runner ? {} : await liveProjects(operation, makeRecoveryDriver(undefined, delegatedPeer).inspect);
       console.log(JSON.stringify(publicOperation(operation, runner, live), null, 2));
     }
-    else if (action === "abort") { await abortRecovery(id, makeRecoveryDriver()); console.log("preflight cancelled; no committed transition was rolled back"); }
+    else if (action === "abort") { await abortRecovery(id, makeRecoveryDriver(undefined, delegatedPeer)); console.log("preflight cancelled; no committed transition was rolled back"); }
     else if (action === "dispose") {
-      // #215: human-only (the identity gate refuses agent shells); the reason is kept in the operation's audit.
+      // Console authority (including explicit --live-test delegation); the reason is kept in the operation's audit.
       const { one, rest: flags } = takeFlags(rest, ["--fresh-session", "--reason"], []);
       const stop = flags.length === 1 && flags[0] === "--stop-and-archive";
       const reason = one["--reason"]?.trim() ?? "";
       if (!reason || reason.length > 500 || (flags.length && !stop) || stop === !!one["--fresh-session"]) fail(usage);
-      const result = await disposeRecovery(id, stop ? { stop: true } : { fresh: one["--fresh-session"]! }, reason, makeRecoveryDriver());
+      const result = await disposeRecovery(id, stop ? { stop: true } : { fresh: one["--fresh-session"]! }, reason, makeRecoveryDriver(undefined, delegatedPeer));
       if (!stop) { console.log(`${one["--fresh-session"]}: a fresh session is accepted and the lost one is recorded; resuming`); return spawnRecovery(result); }
       console.log(JSON.stringify(publicOperation(result), null, 2));
       console.log(`${result.plan.kind} abandoned, not completed; the recovery lock is released. A project whose target ran starts again with that version's CLI.`);
     }
     else if (["completed", "cancelled"].includes(operation.phase)) console.log(`recovery is already ${operation.phase}`);
     // #215: an operation being abandoned is never resumed, whichever coordinator started it (an older one would).
-    else if (operation.disposition) fail(`a stop-and-archive of this operation is partway; nothing was resumed; ${nextActionsText(operation, await liveProjects(operation, makeRecoveryDriver().inspect))}`);
+    else if (operation.disposition) fail(`a stop-and-archive of this operation is partway; nothing was resumed; ${nextActionsText(operation, await liveProjects(operation, makeRecoveryDriver(undefined, delegatedPeer).inspect))}`);
     else if (runner === "unknown") console.log(`whether a runner holds this operation could not be read; nothing was started; ${recoveryCommand(operation, "status")}`);
     else if (runner) console.log(`runner ${runner} is still working on this operation; ${recoveryCommand(operation, "status")}`);
     else spawnRecovery(operation);
   },
   "recovery-run": async () => {
     if (args.length !== 1 || process.env.AGENTHUB_RECOVERY_OPERATION !== args[0]) fail("recovery-run is an internal command");
-    const result = await runRecovery(args[0]!, makeRecoveryDriver());
+    const result = await runRecovery(args[0]!, makeRecoveryDriver(undefined, delegatedPeer));
     if (result.phase !== "completed") process.exitCode = 1;
   },
   help: () => {
@@ -593,12 +611,13 @@ const commands: Record<string, () => Promise<void> | void> = {
       return console.log("dashboard manager stopped; project hubs were kept running");
     }
     let url: string;
-    if (args.includes("--all")) url = await openManager();
+    if (args.includes("--all")) url = await openManager({ liveTest: !!delegatedPeer });
     else {
       const hub = await connect();
       try {
-        const res = await hub.request({ t: "ui", ...(settings ? { settings: true } : {}) }, 10_000);
+        const res = await hub.request({ t: "ui", ...(settings ? { settings: true } : {}), ...(delegatedPeer ? { liveTest: true } : {}) }, 10_000);
         if (!res.ok) fail(res.error);
+        if (delegatedPeer && res.liveTest !== true) fail("this hub cannot restrict delegated dashboard content; use a live-test-capable hub");
         // A hub older than #269 ignores the field and would hand out an ordinary session without saying so.
         if (settings && res.settings !== true) fail("this hub does not open settings sessions; upgrade the running hub to use ahub ui --settings");
         url = res.url;
@@ -673,17 +692,17 @@ const commands: Record<string, () => Promise<void> | void> = {
     if (args.some(arg => arg !== "--panels" && arg !== "--no-pet" && !arg.startsWith("--color=")) || args.filter(arg => arg.startsWith("--color=")).length > 1) fail("usage: ahub console [--panels] [--no-pet] [--color=auto|always|never]");
     const color = resolveColor(args.find(arg => arg.startsWith("--color="))?.slice("--color=".length), { isTTY: !!process.stdin.isTTY && !!process.stdout.isTTY, TERM: process.env.TERM, NO_COLOR: process.env.NO_COLOR });
     if (color instanceof Error) return fail("usage: ahub console [--panels] [--no-pet] [--color=auto|always|never]");
-    await runConsole({ client: await connect(), cwd, stateDir, panels: args.includes("--panels"), noPet: args.includes("--no-pet"), color });
+    await runConsole({ client: await connect(), cwd, stateDir, liveTest, panels: args.includes("--panels"), noPet: args.includes("--no-pet"), color });
   },
 
   up: async () => {
     const unattended = unattendedEnv || args.includes("--unattended");
     if (unattended) console.error(UNATTENDED_WARNING);
-    const status = await startProject(registeredProject(), { unattended });
+    const status = await startProject(registeredProject(), { unattended, liveTest });
     console.log(`ahub up (ws://127.0.0.1:${status.controlPort}), state in ${stateDir}`);
     try { if (loadPetConfig(cwd).window) console.log(await startPetWindow(stateDir, cwd)); }
     catch { console.error("Pet window was not started; run ahub pet --window to inspect it."); }
-    if (process.stdin.isTTY && process.stdout.isTTY && !args.includes("--no-console")) await runConsole({ client: await connect(), cwd, stateDir });
+    if (process.stdin.isTTY && process.stdout.isTTY && !args.includes("--no-console")) await runConsole({ client: await connect(), cwd, stateDir, liveTest });
   },
 
   claude: async () => {
@@ -958,17 +977,24 @@ const commands: Record<string, () => Promise<void> | void> = {
         return;
       }
       const [id, ...flags] = rest;
-      if (!id || !["show", "resolve"].includes(operation)) fail("usage: ahub queue show <id> | resolve <id> --action completed|retry|discard --reason <text>");
-      const shown = await hub.request({ t: "queue", op: "show", id });
-      if (!shown.ok) fail(shown.error);
+      if (!id || !["show", "resolve"].includes(operation)) fail("usage: ahub queue show <id> | resolve <id> --action completed|retry|discard --reason <text> [--revision N]");
       if (operation === "show") {
         if (flags.length) fail("usage: ahub queue show <id>");
+        const shown = await hub.request({ t: "queue", op: "show", id });
+        if (!shown.ok) fail(shown.error);
         if (options.json) return console.log(JSON.stringify(shown.delivery, null, 2));
         return printOutput(renderQueueShow(shown.delivery, options.columns, Date.now()), options.color);
       }
-      const { one, rest: extra } = takeFlags(args.slice(2), ["--action", "--reason"], []);
-      if (extra.length || !["completed", "retry", "discard"].includes(one["--action"] ?? "") || !one["--reason"]?.trim()) fail("usage: ahub queue resolve <id> --action completed|retry|discard --reason <text>");
-      const result = await hub.request({ t: "queue", op: "resolve", id, revision: shown.delivery.revision, action: one["--action"], reason: one["--reason"] });
+      const { one, rest: extra } = takeFlags(flags, ["--action", "--reason", "--revision"], []);
+      const rawRevision = one["--revision"], parsedRevision = rawRevision === undefined ? undefined : Number(rawRevision);
+      if (extra.length || !["completed", "retry", "discard"].includes(one["--action"] ?? "") || !one["--reason"]?.trim() || (rawRevision !== undefined && (!/^\d+$/.test(rawRevision) || !Number.isSafeInteger(parsedRevision)))) fail("usage: ahub queue resolve <id> --action completed|retry|discard --reason <text> [--revision N]");
+      let revision = parsedRevision;
+      if (revision === undefined) {
+        const shown = await hub.request({ t: "queue", op: "show", id });
+        if (!shown.ok) fail(shown.error);
+        revision = shown.delivery.revision;
+      }
+      const result = await hub.request({ t: "queue", op: "resolve", id, revision, action: one["--action"], reason: one["--reason"] });
       if (!result.ok) fail(result.error);
       console.log(JSON.stringify(result.delivery, null, 2));
     } finally { hub.close(); }
@@ -1166,10 +1192,16 @@ const commands: Record<string, () => Promise<void> | void> = {
     if (sub === "show") return console.log(await taskOp("task_show", { id: rest[0] }));
     if (sub === "escalate") return console.log(await taskOp("task_escalate", { id: rest[0] }));
     if (sub === "assign") {
-      const { one, rest: positional } = takeFlags(rest, ["--role"], []);
-      const role = one["--role"] ?? "owner";
-      if (positional.length !== 2 || !["owner", "reviewer"].includes(role)) fail("usage: ahub task assign <id> <peer> [--role owner|reviewer]");
-      return console.log(await taskOp("task_assign", { id: positional[0], peer: positional[1], ...(role === "reviewer" ? { role } : {}) }));
+      const { one, rest: positional } = takeFlags(rest, ["--role", "--revision"], []);
+      const role = one["--role"] ?? "owner", rawRevision = one["--revision"], revision = rawRevision === undefined ? undefined : Number(rawRevision);
+      if (positional.length !== 2 || !["owner", "reviewer"].includes(role) || (rawRevision !== undefined && (!/^\d+$/.test(rawRevision) || !Number.isSafeInteger(revision)))) fail("usage: ahub task assign <id> <peer> [--role owner|reviewer] [--revision N]");
+      return console.log(await taskOp(revision === undefined ? "task_assign" : "task_assign_checked", { id: positional[0], peer: positional[1], ...(role === "reviewer" ? { role } : {}), ...(revision === undefined ? {} : { revision }) }));
+    }
+    if (sub === "unassign") {
+      const { one, rest: positional } = takeFlags(rest, ["--role", "--revision"], []);
+      const role = one["--role"] ?? "owner", rawRevision = one["--revision"], revision = rawRevision === undefined ? undefined : Number(rawRevision);
+      if (positional.length !== 1 || !["owner", "reviewer"].includes(role) || (rawRevision !== undefined && (!/^\d+$/.test(rawRevision) || !Number.isSafeInteger(revision)))) fail("usage: ahub task unassign <id> [--role owner|reviewer] [--revision N]");
+      return console.log(await taskOp("task_unassign", { id: positional[0], role, ...(revision === undefined ? {} : { revision }) }));
     }
     if (sub === "label") {
       // #247: a person's later verdict on an approved task (the identity gate keeps it human-only), for research records.
@@ -1182,7 +1214,7 @@ const commands: Record<string, () => Promise<void> | void> = {
       appendRecords(project.id, [{ schema: RESEARCH_SCHEMA, kind: "label", project: projectKey(project.id), task: id, createdAt: record!.createdAt!, label, at: new Date().toISOString() }]);
       return console.log(`task #${id} (approved ${record!.approvedAt}) labelled ${label} in the research records`);
     }
-    if (sub !== "propose" || rest.length < 1) fail("usage: ahub task propose [<class>] <title...> | show <id> | assign <id> <peer> | escalate <id>");
+    if (sub !== "propose" || rest.length < 1) fail("usage: ahub task propose [<class>] <title...> | show <id> | assign <id> <peer> | unassign <id> | escalate <id>");
     // `--class` is the explicit form. A first word that is a class name is still taken as the class (the documented
     // short form), but said out loud: "review the auth module" would otherwise be filed as class review, silently.
     const urgent = rest.includes("--urgent"), backlog = rest.includes("--backlog");
@@ -1394,7 +1426,7 @@ const commands: Record<string, () => Promise<void> | void> = {
       printOutput(renderStatus({ ...status, budget: quota.budget ?? {} }, options.columns, Date.now(), options.full), options.color);
       if (status.needs) { const pet = loadPetConfig(cwd); if (pet.enabled) console.log(renderPet(petView(status), false, pet.character)); }
       // #258: open long-term tasks and who holds them, as of this machine's last memory sync.
-      if (existsSync(join(hubHome(), "memory", "index.db"))) {
+      if (status.memoryProfile ? status.memoryProfile.state === "ready" : existsSync(join(hubHome(), "memory", "index.db"))) {
         try { const lines = await goalCommand(["list"], cwd); if (!lines.startsWith("no open")) console.log(`\nlong-term tasks\n${lines}`); } catch { /* memory unreadable: status goes on */ }
       }
     } finally { hub.close(); }
@@ -1470,7 +1502,14 @@ const commands: Record<string, () => Promise<void> | void> = {
   },
   memory: async () => {
     // #258: the hub's own memory on this machine; reads are anyone's, changes a person's.
-    try { console.log(await memoryCommand(args, cwd)); } catch (e) { fail((e as Error).message); }
+    if (args.filter(arg => arg !== "--json")[0] === "profile-check") {
+      if (args.some(arg => arg !== "profile-check" && arg !== "--json")) fail("usage: ahub memory profile-check [--json]");
+      const result = await checkMemoryProfiles(selectedMemoryProfile());
+      console.log(args.includes("--json") ? JSON.stringify(result, null, 2) : formatMemoryProfileCheck(result));
+      if (!result.ready) process.exitCode = 1;
+      return;
+    }
+    try { console.log(await memoryCommand(args, cwd, { person: caller.role === "console" })); } catch (e) { fail((e as Error).message); }
   },
   goal: async () => {
     // #258: long-term tasks; a link goes through the project's hub, so Tasks validates the board task.
@@ -1479,7 +1518,7 @@ const commands: Record<string, () => Promise<void> | void> = {
       try { const r = await hub.request({ t: "goal_link", goal, task: Number(task) }); if (!r.ok) throw new Error(String(r.error)); return String(r.text); }
       finally { hub.close(); }
     };
-    try { console.log(await goalCommand(args, cwd, { link })); } catch (e) { fail((e as Error).message); }
+    try { console.log(await goalCommand(args, cwd, { link, person: caller.role === "console" })); } catch (e) { fail((e as Error).message); }
   },
   research: () => {
     // #247: measures from the opt-in research records; `export` writes them out, `backfill` builds them from events.jsonl.