@staix/agent-hub 0.12.31 → 0.12.32

package/src/hub/config-apply.ts

@@ -0,0 +1,242 @@
+import type { HubConfig } from "./daemon.ts";
+import { ALL_MACHINE_LOCAL, configRepositoryPresent, configTracked } from "./config-trust.ts";
+import { SUPPORTED_PEERS, PLANNER_PEERS } from "./peer-catalog.ts";
+import { CLASSES } from "./board.ts";
+import { permissionDefaults } from "./permission-mode.ts";
+import { peerStartConfig, terminalTemplate } from "./start-mode.ts";
+import { catalogAssignments } from "./roles.ts";
+import { resolveProfile } from "./profiles.ts";
+import { taskSweepConfig } from "./task-sweep.ts";
+import { projectionConfig } from "./text-projection.ts";
+
+export type ApplyClass = "live" | "next use" | "restart";
+export interface ApplyRule { applies: ApplyClass; reason?: string }
+export interface ConfigChange extends ApplyRule { key: string; before: unknown; after: unknown }
+export interface ConfigLayer { name: "config.json" | "config.local.json"; raw: Record<string, unknown> }
+export interface ReloadGuard { key: string; path: readonly string[]; risk: "safe" | "raises"; floor?: string | boolean | number; store: "runtime" | "config" | "routing" }
+export interface ConfigAuthorizationInput {
+  key: string;
+  before: unknown;
+  after: unknown;
+  source: "config" | "routing";
+  tracked: boolean | undefined;
+  authority: "ordinary" | "settings" | "terminal";
+  /** The daemon supplies this only for the selected setting or an explicitly confirmed reload key. */
+  confirmed?: boolean;
+  /** Root proved the destination equals an unchanged, effective startup declaration in this origin. */
+  acceptedFallback?: boolean;
+  /** The prospective settled planner/conductor holder sets change, even if the raw role list shrinks. */
+  settledHolderChange?: boolean;
+  guard?: ReloadGuard;
+}
+export interface ConfigAuthorizationDecision { key: string; allowed: boolean; guarded: boolean; reason: string }
+
+/** Pure per-leaf authority. Schema validation and named-key selection precede this decision. */
+export function authorizeConfigLeaf(input: ConfigAuthorizationInput): ConfigAuthorizationDecision {
+  const { key, before, after } = input;
+  const result = (allowed: boolean, guarded: boolean, reason: string): ConfigAuthorizationDecision => ({ key, allowed, guarded, reason });
+  if (same(before, after)) return result(true, false, "unchanged");
+  const supplied = input.guard;
+  const guard = supplied && (key === supplied.key || key === `${supplied.store === "routing" ? "routing." : ""}${supplied.path.join(".")}`) ? supplied : undefined;
+  const machine = input.source === "config" && ALL_MACHINE_LOCAL.some(path => key === path || key.startsWith(`${path}.`));
+  const strings = (value: unknown): value is string[] => Array.isArray(value) && value.every(item => typeof item === "string");
+  const subset = (smaller: unknown, larger: unknown) => strings(larger) && (smaller === undefined || strings(smaller) && smaller.every(item => larger.includes(item)));
+  const numeric = (value: unknown): value is number => typeof value === "number" && Number.isFinite(value);
+  let tightening = false;
+  if (guard?.floor !== undefined && same(after, guard.floor)) tightening = true;
+  if (key.startsWith("tasks.wip_limits.") && numeric(before) && numeric(after) && after <= before) tightening = true;
+  if (key === "routing.constraints.pii" && before === "off" && after === "local_only") tightening = true;
+  if (key === "routing.signals.pii_screen" && before === "off" && after === "local") tightening = true;
+  if (key === "routing.signals.pii_patterns" && strings(after) && (before === undefined || strings(before) && before.every(pattern => after.includes(pattern)))) tightening = true;
+  if (key.startsWith("roles.") && subset(after, before)) tightening = true;
+  if (key.startsWith("capabilities.") && strings(after) && (before === undefined || subset(after, before))) tightening = true;
+  if (["limits.sender_per_min", "limits.pair_per_min", "limits.important_per_hour"].includes(key)
+    && numeric(before) && numeric(after) && after > 0 && (before === 0 || after <= before)) tightening = true;
+  if (key === "limits.repeat_window_s" && numeric(before) && numeric(after) && after >= before) tightening = true;
+  if (key === "conductor.feed") {
+    const levels = ["off", "own", "all"];
+    if (typeof before === "string" && typeof after === "string" && levels.includes(before) && levels.includes(after) && levels.indexOf(after) < levels.indexOf(before)) tightening = true;
+  }
+  if (["inference.enabled", "inference.triage", "review.adaptive"].includes(key) && before === true && after === false) tightening = true;
+  if (key === "review.min_reviews" && numeric(before) && numeric(after) && after >= before) tightening = true;
+  if (tightening && !input.settledHolderChange) return result(true, false, "semantic tightening");
+  if (guard?.risk === "safe" && !machine) return result(true, false, "safe registered setting");
+  if (input.acceptedFallback && !machine) {
+    const person = input.authority === "terminal" || input.authority === "settings" && !!guard;
+    return result(person && input.confirmed === true, true, "restoring an unchanged effective startup value needs this key to be explicitly confirmed");
+  }
+  // Every other policy change is conservative: person intent never turns tracked or unknown code into host authority.
+  if (input.tracked !== false) return result(false, true, input.tracked ? "guarded source is tracked; retain the running value" : "guarded source trust is unknown; retain the running value");
+  if (input.authority === "ordinary") return result(false, true, "guarded change needs a selected setting or a confirmed terminal reload");
+  if (input.authority === "settings" && !guard) return result(false, true, "nonregistered policy requires a confirmed terminal reload");
+  if (input.confirmed !== true) return result(false, true, "guarded change needs explicit confirmation for this key");
+  return result(true, true, guard ? "confirmed registered setting" : "confirmed terminal reload");
+}
+type TrustLayer = ConfigLayer | { name: "routing.toml" | "routing.local.toml"; raw: Record<string, unknown> };
+type Authority = "ordinary" | "settings" | "terminal";
+type Check = (value: unknown, key: string) => void;
+const fail = (key: string, reason = "invalid value"): never => { throw new Error(`${key}: ${reason}`); };
+const object = (value: unknown, key: string): Record<string, unknown> => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return fail(key, "must be an object");
+  return value as Record<string, unknown>;
+};
+const bool: Check = (v, k) => { if (typeof v !== "boolean") fail(k, "must be a boolean"); };
+const text: Check = (v, k) => { if (typeof v !== "string" || v.length > 16_384 || /[\x00-\x1f\x7f]/.test(v)) fail(k, "must be bounded text"); };
+const number = (min = 0, max = Number.MAX_SAFE_INTEGER, integer = false): Check => (v, k) => {
+  if (typeof v !== "number" || !Number.isFinite(v) || v < min || v > max || integer && !Number.isSafeInteger(v)) fail(k, "number outside bounds");
+};
+const words = (values: readonly string[]): Check => (v, k) => { if (typeof v !== "string" || !values.includes(v)) fail(k, "unknown choice"); };
+const strings: Check = (v, k) => { if (!Array.isArray(v) || v.length > 1024) return fail(k, "must be a bounded string list"); for (const x of v) text(x, k); };
+const argv: Check = (v, k) => { strings(v, k); if (!(v as string[]).length || (v as string[]).some(x => !x)) fail(k, "must be a nonempty argv"); };
+const shapes = new WeakMap<Check, { fields?: Record<string, Check>; item?: Check; keys?: readonly string[] }>();
+const map = (check: Check, keys?: readonly string[]): Check => {
+  const fn: Check = (v, k) => { for (const [key, value] of Object.entries(object(v, k))) {
+    if (["__proto__", "constructor", "prototype"].includes(key) || keys && !keys.includes(key)) fail(`${k}.${key}`, "unknown key"); check(value, `${k}.${key}`);
+  } };
+  shapes.set(fn, { item: check, keys }); return fn;
+};
+const block = (schema: Record<string, Check>): Check => {
+  const fn: Check = (v, k) => { for (const [key, value] of Object.entries(object(v, k))) {
+    if (!Object.hasOwn(schema, key)) fail(`${k}.${key}`, "unknown key"); if (value !== undefined) schema[key]!(value, `${k}.${key}`);
+  } };
+  shapes.set(fn, { fields: schema }); return fn;
+};
+const peerMap = (check: Check) => map(check, SUPPORTED_PEERS);
+const timerSeconds = number(1, 2_147_483_647 / 1000), timerMinutes = number(1, 2_147_483_647 / 60_000);
+const schema: Record<string, Check> = {
+  watchdog_ms: number(1, 2_147_483_647), kimi_cmd: argv, qwen_cmd: argv, jcode_cmd: argv, codex_bin: text, jcode_home: text, jcode_provider_profile: text,
+  permission_modes: v => { permissionDefaults(v); }, protect_instruction_files: bool,
+  batch_max: number(1, 100_000, true), batch_ms: number(0, 2_147_483_647), queue_cap: number(1, 1_000_000, true),
+  memory: block({ enabled: bool, worker_url: text, inject_tokens: number(0, 1_000_000, true), brief_items: number(0, 10_000, true), native: bool,
+    short_ttl_days: number(1, 3650, true), sync_interval_min: number(0, 1440, true), suggest_edges: bool }),
+  roster: peerMap(bool), roles: map(strings), planner: words(PLANNER_PEERS), profile: words(["dev", "research", "writing", "general"]),
+  profile_overrides: (v, k) => { map(() => {})(v, k); const fields = object(v, k); for (const name of ["classes", "role_text", "catalog_roles"]) if (fields[name] !== undefined) map(() => {})(fields[name], `${k}.${name}`); resolveProfile("dev", v); },
+  catalog_roles: (v, k) => { map(() => {})(v, k); catalogAssignments(v); },
+  pii: block({ paths: strings }), data: block({ readonly: strings }),
+  text_projection: v => { projectionConfig(v); },
+  conductor: block({ feed: words(["own", "all", "off"]), approval_wait_s: number(0, 2_147_483_647 / 1000) }),
+  budget: block({ gate: number(0, 1), stale_min: timerMinutes, poll_min: timerMinutes, checkpoint_timeout_s: timerSeconds, kimi_tokens_5h: number(0), wait_max_min: number(0) }),
+  context: block({ gate: number(0, 1), stale_min: timerMinutes }),
+  inference: block({ enabled: bool, digest_min_items: number(1, 100_000, true), digest_min_chars: number(1, 10_000_000, true), triage: bool }),
+  omniroute: block({ urls: strings, api_key_file: text, access_hosts: strings, cf_client_id_file: text, cf_client_secret_file: text }),
+  pi: block({ enabled: bool, auto_start: bool, cmd: argv, backend: words(["auto", "dgx", "mlx"]), dgx_coding: text, dgx_fast: text, max_steps: number(1, 1_000_000, true) }),
+  mlx: block({ enabled: bool, provider: words(["legacy", "ollama"]), host: text, runtimeDir: text, modelPath: text, bin: text, port: number(1, 65535, true), model: text, sourceModel: text,
+    contextWindow: number(1), maxInputTokens: number(1), maxTokens: number(1), maxConcurrency: number(1, 1024, true) }),
+  local: block({ deny: strings, bash_network: (v, k) => { if (v !== "direct") bool(v, k); }, network_allow: strings, max_steps: number(1, 1_000_000, true), read_allow: strings }),
+  approvals: block({ timeout_s: timerSeconds, notify: bool }), tasks: block({ release_after_min: number(0), wip_limits: map(number(0, 32, true)) }),
+  task_sweep: (v, k) => { block({ enabled: bool, auto_reassign: bool, interval_s: timerSeconds, unaccepted_min: timerMinutes, idle_min: timerMinutes, review_min: timerMinutes, ready_min: timerMinutes, ladder_min: timerMinutes })(v, k); taskSweepConfig(v); },
+  checks: (v, k) => { for (const [key, value] of Object.entries(object(v, k))) {
+    if (value === undefined) continue;
+    if (key === "timeout_s") timerSeconds(value, `${k}.${key}`);
+    else if (key === "runner") words(["container"])(value, `${k}.${key}`);
+    else if (/^[a-z][a-z0-9_]{0,47}$/.test(key)) text(value, `${k}.${key}`); else fail(`${k}.${key}`, "unknown key");
+  } },
+  snapshots: block({ enabled: bool, keep: number(1, 1_000_000, true) }), research: block({ enabled: bool }), bench: block({ enabled: bool }),
+  peers: (v, k) => { map(block({ start_mode: words(["tui", "headless"]) }), ["pi", "codex", "kimi"])(v, k); peerStartConfig(v); },
+  terminal: (v, k) => { block({ open: strings })(v, k); terminalTemplate(object(v, k).open); },
+  limits: block({ sender_per_min: number(0), pair_per_min: number(0), important_per_hour: number(0), repeat_window_s: number(0) }),
+  review: block({ adaptive: bool, min_reviews: number(1, Number.MAX_SAFE_INTEGER, true) }), recovery: block({ auto_resume_after_crash: bool }),
+  capabilities: map(strings), coordination: words(["advisory", "turn-free"]), experiments: block({ stale_notices: words(["drop", "deliver"]) }),
+};
+export function validateRawConfig(raw: unknown): asserts raw is Record<string, unknown> { block(schema)(raw, "config"); }
+export function validateEffectiveConfig(value: unknown): asserts value is HubConfig {
+  const raw = { ...object(value, "config") };
+  delete raw.ignored; delete raw.retired; delete raw.permission_default_sources;
+  validateRawConfig(raw);
+  const profile = resolveProfile(raw.profile, raw.profile_overrides);
+  for (const key of Object.keys(object(raw.checks, "checks"))) if (!["timeout_s", "runner", ...CLASSES, ...Object.keys(profile.classes)].includes(key)) fail(`checks.${key}`, "unknown task class");
+  if (object(raw.mlx, "mlx").enabled === false && object(raw.pi, "pi").backend === "mlx") fail("pi.backend", "conflicts with disabled mlx");
+}
+
+const restart: Record<string, string> = {
+  "pi.dgx_coding": "Published Pi relay model catalogue requires a new daemon relay",
+  "pi.dgx_fast": "Published Pi relay model catalogue requires a new daemon relay",
+  "routing.pi": "Pi relay context and model publication are bound to the running relay",
+  memory: "Open memory consumers, selected profile, client and sync timer must be quiesced together",
+  omniroute: "Credentials and gateway clients are bound to relay ownership", mlx: "Model runtime ownership and device resources belong to this daemon",
+  checks: "Bounded runner and completion-check contracts are constructed together",
+  pii: "Existing native sessions retain their startup privacy boundary", data: "Existing native sessions retain their startup read-only policy",
+  "local.deny": "Existing native sessions retain their sandbox deny policy", "local.read_allow": "Existing native sessions retain their sandbox read grants",
+  "local.bash_network": "Existing sandbox and egress proxy contracts require a new instance", "local.network_allow": "Existing egress proxy ownership requires a new instance",
+  profile: "Session tool schemas and profile contracts are bound at startup", profile_overrides: "Session tool schemas and profile contracts are bound at startup",
+  text_projection: "Converter and cache ownership are bound at startup", terminal: "Terminal provider is supplied by the daemon lifecycle", bench: "Benchmark execution environment is selected before work starts",
+};
+const live = new Set(["permission", "roster", "roles", "planner", "conductor", "protect_instruction_files", "task_sweep", "capabilities", "research", "snapshots", "tasks.wip_limits", "approvals.notify"]);
+const nextMemory = new Set(["memory.inject_tokens", "memory.brief_items", "memory.suggest_edges"]);
+/** Closed top-level schema; leaf overrides retain the existing session/runtime boundaries. */
+export function configApply(key: string): ApplyRule {
+  const top = key.split(".")[0]!;
+  if (!(Object.hasOwn(schema, top) || top === "permission" || top === "routing")) return fail(key, "unknown configuration key");
+  if (top !== "routing" && top !== "permission" && key.includes(".")) {
+    const special: Record<string, readonly string[]> = {
+      task_sweep: ["enabled", "auto_reassign", "interval_s", "unaccepted_min", "idle_min", "review_min", "ready_min", "ladder_min"],
+      checks: ["timeout_s", "runner", ...CLASSES], terminal: ["open"],
+    };
+    let check = schema[top];
+    for (const [index, part] of key.split(".").slice(1).entries()) {
+      const shape = check && shapes.get(check);
+      if (shape?.fields) { if (!Object.hasOwn(shape.fields, part)) return fail(key, "unknown configuration key"); check = shape.fields[part]; }
+      else if (shape?.item) { if (shape.keys && !shape.keys.includes(part)) return fail(key, "unknown configuration key"); check = shape.item; }
+      else if (index === 0 && (special[top]?.includes(part) || top === "checks" && /^[a-z][a-z0-9_]{0,47}$/.test(part))) break;
+      else if (["permission_modes", "catalog_roles", "profile_overrides", "text_projection", "peers"].includes(top)) break;
+      else return fail(key, "unknown configuration key");
+    }
+  }
+  if (top === "routing" && !key.startsWith("routing.pi") && key !== "routing") {
+    return { applies: ["classes", "stay_switch", "signals", "constraints", "hub_routes", "max_switch_prefill_tokens"].includes(key.split(".")[1]!) ? "live" : "next use" };
+  }
+  if (nextMemory.has(key)) return { applies: "next use" };
+  for (const [path, reason] of Object.entries(restart)) if (key === path || key.startsWith(`${path}.`)) return { applies: "restart", reason };
+  if ([...live].some(path => key === path || key.startsWith(`${path}.`))) return { applies: "live" };
+  return { applies: "next use" };
+}
+const canonical = (v: unknown): unknown => Array.isArray(v) ? v.map(canonical) : v && typeof v === "object" ? Object.fromEntries(Object.keys(v).sort().map(k => [k, canonical((v as Record<string, unknown>)[k])])) : v;
+const same = (a: unknown, b: unknown): boolean => JSON.stringify(canonical(a)) === JSON.stringify(canonical(b));
+const at = (raw: unknown, path: readonly string[]): unknown => path.reduce<unknown>((v, k) => v && typeof v === "object" && Object.hasOwn(v, k) ? (v as Record<string, unknown>)[k] : undefined, raw);
+export function configChanges(running: HubConfig, next: HubConfig): ConfigChange[] {
+  const changes: ConfigChange[] = [];
+  const walk = (before: unknown, after: unknown, key: string) => {
+    if (same(before, after)) return;
+    if (before && after && typeof before === "object" && typeof after === "object" && !Array.isArray(before) && !Array.isArray(after)) {
+      for (const child of new Set([...Object.keys(before), ...Object.keys(after)])) walk(at(before, [child]), at(after, [child]), key ? `${key}.${child}` : child);
+    } else changes.push({ key, before, after, ...configApply(key) });
+  };
+  const clean = (v: HubConfig) => Object.fromEntries(Object.entries(v).filter(([key]) => !["ignored", "retired", "permission_default_sources"].includes(key)));
+  walk(clean(running), clean(next), ""); return changes.sort((a, b) => a.key.localeCompare(b.key));
+}
+
+/** Legacy all-or-nothing authority helper; daemon reload uses authorizeConfigLeaf for scoped publication. */
+export function assertReloadTrust(cwd: string, layers: readonly TrustLayer[], previousLayers: readonly TrustLayer[], guardedRules: readonly ReloadGuard[], authority: Authority, defaults?: object): void {
+  const complete = [...layers, ...previousLayers.filter(prior => !layers.some(layer => layer.name === prior.name)).map(prior => ({ ...prior, raw: {} }))];
+  for (const layer of complete) {
+    const prior = previousLayers.find(p => p.name === layer.name)?.raw;
+    const routing = layer.name.endsWith(".toml");
+    const paths = new Map<string, { path: readonly string[]; floor?: unknown; machine: boolean; registered?: boolean }>();
+    if (!routing) for (const key of ALL_MACHINE_LOCAL) {
+      const path = key.split("."), value = at(layer.raw, path), old = at(prior, path);
+      const children = new Set([...(value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value) : []), ...(old && typeof old === "object" && !Array.isArray(old) ? Object.keys(old) : [])]);
+      if (children.size) for (const child of children) paths.set(`${key}.${child}`, { path: [...path, child], machine: true });
+      else paths.set(key, { path, machine: true });
+    }
+    for (const rule of guardedRules) if (rule.risk === "raises" && rule.store === (routing ? "routing" : "config")) {
+      const key = rule.path.join(".");
+      paths.set(key, { path: rule.path, floor: rule.floor, registered: true, machine: !routing && ALL_MACHINE_LOCAL.some(p => key === p || key.startsWith(`${p}.`)) });
+    }
+    for (const [key, guard] of paths) {
+      const value = at(layer.raw, guard.path), old = at(prior, guard.path);
+      if (same(value, old)) continue;
+      const inherit = guard.registered && value === undefined && old !== undefined;
+      if (!inherit && guard.machine && defaults && same(value, at(defaults, guard.path))) continue;
+      // Removal can expose a lower layer: registry inherit is guarded just like a direct raise.
+      if (!guard.machine && value !== undefined && same(value, guard.floor)) continue;
+      // Empty machine-local declarations choose no program/path and are stripped at startup.
+      if (!inherit && guard.machine && (value === undefined || value === null || value === "" || Array.isArray(value) && !value.length)) continue;
+      let tracked = configTracked(cwd, layer.name);
+      if (!guard.machine && tracked === undefined && !configRepositoryPresent(cwd)) tracked = false;
+      if (tracked !== false) fail(`${layer.name}:${key}`, tracked ? "guarded change is tracked" : "guarded source trust is unknown");
+      if (guard.machine && authority === "settings" && !guard.registered) fail(`${layer.name}:${key}`, "non-editable machine policy requires terminal authority");
+      if (value !== undefined && guard.floor !== undefined && same(value, guard.floor)) continue;
+      if (authority === "ordinary") fail(`${layer.name}:${key}`, "guarded change requires settings or terminal authority");
+    }
+  }
+}

package/src/hub/config-reload.ts

@@ -0,0 +1,120 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { validateRawConfig, type ConfigLayer } from "./config-apply.ts";
+import { parseOverlay, parseRouting, type Routing } from "./routing.ts";
+import { CLASSES } from "./board.ts";
+
+export const CONFIG_SOURCE_FILES = ["config.json", "config.local.json", "routing.toml", "routing.local.toml"] as const;
+export type ConfigSourceName = typeof CONFIG_SOURCE_FILES[number];
+export type ConfigSourceTexts = Record<ConfigSourceName, string | null>;
+export interface ConfigSources {
+  texts: ConfigSourceTexts;
+  layers: ConfigLayer[];
+  trustLayers: { name: ConfigSourceName; raw: Record<string, unknown> }[];
+  routing: Routing;
+  fingerprint: string;
+}
+const MAX_CONFIG_BYTES = 1024 * 1024;
+
+/** Capture once; a missing file is distinct from a read failure. Errors never quote file contents. */
+export function configSourceTexts(cwd: string): ConfigSourceTexts {
+  return Object.fromEntries(CONFIG_SOURCE_FILES.map(name => {
+    try {
+      const text = readFileSync(join(cwd, ".agenthub", name), "utf8");
+      if (Buffer.byteLength(text) > MAX_CONFIG_BYTES) throw new Error("oversized");
+      return [name, text];
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "ENOENT") return [name, null];
+      throw new Error(`.agenthub/${name}: configuration unavailable or oversized`);
+    }
+  })) as ConfigSourceTexts;
+}
+
+export const configFingerprint = (texts: ConfigSourceTexts): string => createHash("sha256").update(JSON.stringify(texts)).digest("hex");
+
+/** Validate only the hub-owned routing schema; Switchyard target/route fields remain extensible. */
+function validateRoutingRaw(value: unknown): void {
+  const bad = (key: string): never => { throw new Error(`.agenthub/routing.toml: ${key} is invalid or unknown`); };
+  const table = (v: unknown, key: string): Record<string, unknown> => {
+    if (!v || typeof v !== "object" || Array.isArray(v) || Object.keys(v).length > 256) return bad(key);
+    if (Object.keys(v).some(name => ["__proto__", "constructor", "prototype"].includes(name))) return bad(key);
+    return v as Record<string, unknown>;
+  };
+  const text = (v: unknown, key: string) => { if (typeof v !== "string" || !v || v.length > 4096 || /[\x00-\x1f\x7f]/.test(v)) bad(key); };
+  const numeric = (v: unknown, key: string, min = 1, max = Number.MAX_SAFE_INTEGER) => { if (typeof v !== "number" || !Number.isSafeInteger(v) || v < min || v > max) bad(key); };
+  const choice = (v: unknown, key: string, choices: readonly string[]) => { if (typeof v !== "string" || !choices.includes(v)) bad(key); };
+  const closed = (v: unknown, key: string, fields: Record<string, (v: unknown, key: string) => void>) => {
+    for (const [name, item] of Object.entries(table(v, key))) { if (!Object.hasOwn(fields, name)) bad(`${key}.${name}`); fields[name]!(item, `${key}.${name}`); }
+  };
+  const peers = (v: unknown, key: string) => {
+    if (!Array.isArray(v) || v.length > 128 || new Set(v).size !== v.length || v.some(peer => typeof peer !== "string" || !/^[a-z][a-z0-9-]{0,31}$/.test(peer))) bad(key);
+  };
+  const strings = (v: unknown, key: string) => { if (!Array.isArray(v) || v.length > 256 || v.some(x => typeof x !== "string" || x.length > 4096)) bad(key); };
+  const bool = (v: unknown, key: string) => { if (typeof v !== "boolean") bad(key); };
+  const openValue = (v: unknown, key: string, depth = 0): void => {
+    if (depth > 16) bad(key);
+    if (typeof v === "string") { if (v.length > 16_384) bad(key); }
+    else if (typeof v === "number") { if (!Number.isFinite(v)) bad(key); }
+    else if (typeof v === "boolean" || v === null) return;
+    else if (Array.isArray(v)) { if (v.length > 1024) bad(key); for (const item of v) openValue(item, key, depth + 1); }
+    else for (const item of Object.values(table(v, key))) openValue(item, key, depth + 1);
+  };
+  const switchyard = (v: unknown, key: string, required: "id" | "type") => {
+    for (const [name, item] of Object.entries(table(v, key))) {
+      if (!name || name.length > 128 || ["__proto__", "constructor", "prototype"].includes(name)) bad(key);
+      const entry = table(item, `${key}.${name}`); text(entry[required], `${key}.${name}.${required}`); openValue(entry, `${key}.${name}`);
+    }
+  };
+  closed(value, "routing", {
+    local: (v, k) => closed(v, k, { route: text, fixed_model: text }),
+    targets: (v, k) => switchyard(v, k, "id"), routes: (v, k) => switchyard(v, k, "type"),
+    // parseRouting delegates these tables to the existing parseHubRoutes validator.
+    hub_routes: (v, k) => { table(v, k); },
+    stay_switch: (v, k) => choice(v, k, ["off", "shadow", "enforce"]), max_switch_prefill_tokens: numeric,
+    signals: (v, k) => closed(v, k, { pii_patterns: strings, long_context_tokens: numeric, pii_screen: (x, p) => choice(x, p, ["off", "local"]) }),
+    constraints: (v, k) => closed(v, k, { pii: (x, p) => choice(x, p, ["local_only", "off"]), long_context: (x, p) => choice(x, p, ["skip_local", "off"]), budget_paused: (x, p) => choice(x, p, ["skip_peer", "off"]) }),
+    pi: (v, k) => closed(v, k, { dgx_max_context_tokens: numeric, mlx_max_context_tokens: numeric, efficient_wait_ms: (x, p) => numeric(x, p, 0, 119999) }),
+    classes: (v, k) => { for (const [name, item] of Object.entries(table(v, k))) {
+      if (!(CLASSES as readonly string[]).includes(name)) bad(`${k}.${name}`);
+      closed(item, `${k}.${name}`, { peers, escalate_to: peers, route: text, fixed_model: text, local_allowed: bool, pi_backend: (x, p) => choice(x, p, ["dgx", "mlx"]) });
+    } },
+  });
+}
+
+/** Strict reloads never use routing's last-good fallback. Startup can retain its existing fallback explicitly. */
+export function parseConfigSources(texts: ConfigSourceTexts, fallbackRouting?: Routing): ConfigSources {
+  const layers: ConfigLayer[] = [], trustLayers: ConfigSources["trustLayers"] = [];
+  for (const name of CONFIG_SOURCE_FILES) {
+    const text = texts[name];
+    if (text === null) continue;
+    let raw: Record<string, unknown>;
+    try {
+      const value: unknown = name.endsWith(".json") ? JSON.parse(text) : Bun.TOML.parse(text);
+      if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error();
+      raw = value as Record<string, unknown>;
+    } catch {
+      if (!fallbackRouting) throw new Error(`.agenthub/${name}: invalid ${name.endsWith(".json") ? "JSON object" : "TOML"}`);
+      continue;
+    }
+    if (name === "config.json" || name === "config.local.json") {
+      if (!fallbackRouting) {
+        try { validateRawConfig(raw); }
+        catch (error) { throw new Error(`.agenthub/${name}: ${(error as Error).message}`); }
+      }
+      layers.push({ name, raw });
+    }
+    trustLayers.push({ name, raw });
+  }
+  let routing = fallbackRouting;
+  if (!routing) {
+    const base = texts["routing.toml"] ?? readFileSync(new URL("../../templates/routing.toml", import.meta.url), "utf8");
+    validateRoutingRaw(Bun.TOML.parse(base));
+    let overlay;
+    try { overlay = texts["routing.local.toml"] === null ? undefined : parseOverlay(texts["routing.local.toml"]); }
+    catch { throw new Error(".agenthub/routing.local.toml: invalid routing overlay"); }
+    try { routing = parseRouting(base, overlay); }
+    catch { throw new Error(".agenthub/routing.toml / routing.local.toml: invalid effective routing"); }
+  }
+  return { texts, layers, trustLayers, routing, fingerprint: configFingerprint(texts) };
+}

package/src/hub/config-trust.ts

@@ -1,5 +1,5 @@
-import { statSync } from "node:fs";
-import { join } from "node:path";
+import { lstatSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { childEnv } from "./child-process.ts";
 import { hubGitSync } from "./git.ts";
 
@@ -31,6 +31,15 @@ export const MACHINE_LOCAL = [
 /** Legacy exported field list stays compatible; new policies use the complete list below. */
 export const ALL_MACHINE_LOCAL = [...MACHINE_LOCAL, "protect_instruction_files", "qwen_cmd", "jcode_cmd", "jcode_home", "jcode_provider_profile", "text_projection"] as const;
 
+/** A known repository, including an unreadable marker, must never be mistaken for a plain directory. */
+export function configRepositoryPresent(cwd: string): boolean {
+  for (let at = cwd; ; at = dirname(at)) {
+    try { lstatSync(join(at, ".git")); return true; }
+    catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") return true; }
+    if (dirname(at) === at) return false;
+  }
+}
+
 /**
  * Why `.agenthub/<name>` must not set machine-local fields, or undefined when git confirms nobody committed it.
  * Unknown is not untracked: no repository, no git, or a git error all refuse. The directory itself counts too (a

package/src/hub/crash.ts

@@ -1,3 +1,4 @@
+import { definitionOf } from "../adapters/registry.ts";
 import { chmodSync, existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import type { JournalDelivery } from "./delivery-journal.ts";
@@ -47,7 +48,7 @@ export function removeSessions(stateDir: string, instanceId?: string): void {
   if (instanceId === undefined || readSessions(stateDir)?.instanceId === instanceId) rmSync(fileOf(stateDir), { force: true });
 }
 
-export const qwenSessionId = (value: unknown): value is string => typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/.test(value);
+export { qwenSessionId } from "../adapters/definitions/qwen-native.ts";
 
 const str = (v: unknown) => (typeof v === "string" && v ? v : undefined);
 
@@ -59,6 +60,12 @@ export function crashPlan(records: SessionRecord[]): { peer: string; resume?: Re
   return records.map(({ peer, meta }) => {
     const launch = (meta.launch && typeof meta.launch === "object" ? meta.launch : {}) as Record<string, unknown>;
     const model = str(launch.model);
+    const adapter = definitionOf(peer);
+    if (adapter?.transport === "acp" && adapter.start.create) {
+      const sessionId = adapter.session.crashIdentity?.(meta).sessionId;
+      if (!sessionId) return { peer, how: `${peer}: saved ACP session identity unavailable; start it deliberately with ahub ${peer}` };
+      return { peer, resume: { sessionId, ...(model ? { model } : {}) }, how: `${peer}: the recorded conversation can be loaded again (ACP session/load)` };
+    }
     switch (peer) {
       case "claude":
         return { peer, how: "claude: the Claude Code plugin reconnects by itself while that session is still open" };
@@ -66,11 +73,6 @@ export function crashPlan(records: SessionRecord[]): { peer: string; resume?: Re
         return { peer, how: `codex: its app-server died with the hub; run ahub codex again${str(meta.threadId) ? ` (its conversation was thread ${meta.threadId})` : ""}` };
       case "jcode":
         return { peer, how: "jcode: native 0.94.0 load does not prove the restored id; reopen the original conversation with its native client, no automatic fresh replacement" };
-      case "qwen": {
-        const sessionId = meta.sessionId;
-        if (!qwenSessionId(sessionId)) return { peer, how: "qwen: saved ACP session identity unavailable; start it deliberately with ahub qwen" };
-        return { peer, resume: { sessionId, ...(model ? { model } : {}) }, how: "qwen: the recorded conversation can be loaded again (ACP session/load)" };
-      }
       case "kimi": {
         const sessionId = str(meta.sessionId);
         if (!sessionId) return { peer, how: "kimi: no session id was recorded; start it again with ahub kimi" };