@staix/agent-hub 0.12.37 → 0.12.38

package/plugins/agent-hub/server.js

@@ -505,6 +505,10 @@ var init_reviewer_print = __esm(() => {
     hubNative = true;
     generation = 0;
     child;
+    childStop;
+    childCleanup;
+    childCurrent;
+    reviewMcpClose;
     activeDeliveryId;
     batch;
     preparation;
@@ -514,8 +518,23 @@ var init_reviewer_print = __esm(() => {
     }
     reviewing;
     reviewSeq = 0;
+    runningBinding;
+    reviewBinding(task) {
+      return this.reviewing === task && this.runningBinding?.task === task ? this.runningBinding.binding : undefined;
+    }
     reviewToken(task) {
-      return this.reviewing === task ? this.reviewSeq : undefined;
+      if (this.reviewing !== task)
+        return;
+      try {
+        if (this.childCurrent?.() === false) {
+          this.abortReview("review policy changed");
+          return;
+        }
+      } catch {
+        this.abortReview("review policy changed");
+        return;
+      }
+      return this.reviewSeq;
     }
     constructor(id, opts) {
       super(id, opts.watchdogMs);
@@ -550,6 +569,7 @@ var init_reviewer_print = __esm(() => {
     }
     async stop(reason) {
       this.generation++;
+      this.reviewMcpClose?.();
       this.receipt = undefined;
       this.batch = undefined;
       this.preparation?.abort.abort();
@@ -566,6 +586,7 @@ var init_reviewer_print = __esm(() => {
     abortReview(reason) {
       const generation = ++this.generation, batch = this.batch, preparation = this.preparation;
       this.reviewing = undefined;
+      this.reviewMcpClose?.();
       this.receipt = undefined;
       this.clearWatchdog();
       preparation?.abort.abort();
@@ -694,23 +715,28 @@ var init_reviewer_print = __esm(() => {
         }
       }
     }
-    prepare(sessionId) {
+    prepare(sessionId, input, task, mcpConfig) {
       const abort = new AbortController;
       const done = (async () => {
+        if (this.opts.backend.taskMcp && !this.opts.taskMcp)
+          throw new Error("task-bound reviewer MCP is unavailable");
         const launch = await this.opts.backend.prepare({
           peer: this.id,
           cwd: this.opts.cwd,
           sessionId,
-          mcpConfig: this.opts.mcpConfig,
+          mcpConfig: this.opts.backend.taskMcp ? mcpConfig ?? '{"mcpServers":{}}' : this.opts.mcpConfig,
           systemPrompt: this.opts.systemPrompt,
           privatePaths: this.opts.privatePaths ?? [],
           command: this.opts.command,
-          signal: abort.signal
+          signal: abort.signal,
+          ...input === undefined ? {} : { input },
+          ...task === undefined ? {} : { task }
         });
         if ("unavailable" in launch)
           throw new Error(launch.unavailable);
         const proof = launch.isolation;
-        if (abort.signal.aborted || !proof || proof.backend !== this.opts.backend.id || proof.readOnly !== true || proof.strictMcp !== true || proof.ephemeral !== true || !proof.binary || !proof.version || !proof.profile || !proof.evidence.length || !launch.command.length) {
+        const policy = this.opts.backend.nativePolicy ? proof?.enforcement === "native-policy" && proof.freshSession === true && proof.hubToolsOnly === true : proof?.strictMcp === true && proof.ephemeral === true;
+        if (abort.signal.aborted || !proof || proof.backend !== this.opts.backend.id || proof.readOnly !== true || !policy || !proof.binary || !proof.version || !proof.profile || !proof.evidence.length || !launch.command.length) {
           await launch.cleanup?.();
           throw new Error("reviewer isolation is unavailable or preparation was cancelled");
         }
@@ -725,19 +751,58 @@ var init_reviewer_print = __esm(() => {
       return done;
     }
     async review(env, task, generation) {
-      const launch = await this.prepare(randomUUID());
+      if (this.opts.admit?.(env) === false)
+        throw new Error("review admission changed");
+      let facts;
+      try {
+        facts = this.opts.facts?.(env);
+      } catch (error) {
+        this.opts.log?.(`[${this.id}] review facts for task #${task} failed: ${error.message}`);
+      }
+      const input = `${frame(env)}${facts ? `
+
+${facts}` : ""}`;
+      let launch;
+      const revision = Number(env.refs?.reviewRevision);
+      const binding = Object.freeze({ head: env.refs?.commit, flowRevision: Number.isSafeInteger(revision) && revision > 0 ? revision : undefined });
+      const mcp = this.opts.backend.taskMcp ? this.opts.taskMcp?.(task, () => generation === this.generation && this.reviewToken(task) !== undefined && this.opts.bindingCurrent?.(task, binding) !== false) : undefined;
+      let mcpClosed = false;
+      const closeMcp = () => {
+        if (mcpClosed)
+          return;
+        mcpClosed = true;
+        mcp?.close();
+        if (this.reviewMcpClose === closeMcp)
+          this.reviewMcpClose = undefined;
+      };
+      this.reviewMcpClose = closeMcp;
+      let ownedChild, releasing;
+      let policyTimer;
+      const release = () => releasing ??= Promise.resolve().then(() => launch?.cleanup?.()).then(() => {});
       try {
-        if (generation !== this.generation || launch.current?.() === false)
-          throw new Error("reviewer isolation changed before child spawn");
+        launch = await this.prepare(randomUUID(), input, task, mcp?.config);
+        if (generation !== this.generation || this.opts.admit?.(env) === false || launch.current?.() === false)
+          throw new Error("reviewer isolation or admission changed before child spawn");
         this.receipt = launch.isolation;
         const [cmd, ...prefix] = launch.command;
         let quota = false;
         return await new Promise((resolve, reject) => {
-          const child = spawn(cmd, [...prefix, ...launch.args], { cwd: this.opts.cwd, detached: true, env: peerChildEnv(this.id, { ...process.env, ...launch.env }), stdio: ["pipe", "pipe", "ignore"] });
+          const child = spawn(cmd, [...prefix, ...launch.args], {
+            cwd: launch.cwd ?? this.opts.cwd,
+            detached: true,
+            env: peerChildEnv(this.id, launch.envMode === "replace" ? launch.env : { ...process.env, ...launch.env }),
+            stdio: ["pipe", "pipe", "ignore"]
+          });
           this.child = child;
+          ownedChild = child;
+          this.childStop = launch.stop;
+          this.childCleanup = release;
+          this.childCurrent = launch.watchCurrent ? launch.current : undefined;
           child.once("error", (error) => {
-            if (this.child === child)
+            if (this.child === child) {
               this.child = undefined;
+              this.childStop = undefined;
+            }
             reject(error);
           });
           child.stdin.on("error", () => {});
@@ -747,17 +812,14 @@ var init_reviewer_print = __esm(() => {
               child.stdin.destroy();
               return;
             }
+            this.runningBinding = { task, binding };
             this.reviewing = task;
             this.reviewSeq++;
-            let facts;
-            try {
-              facts = this.opts.facts?.(env);
-            } catch (error) {
-              this.opts.log?.(`[${this.id}] review facts for task #${task} failed: ${error.message}`);
-            }
-            child.stdin.end(`${frame(env)}${facts ? `
-
-${facts}` : ""}`);
+            if (this.childCurrent)
+              policyTimer = setInterval(() => {
+                this.reviewToken(task);
+              }, 100);
+            child.stdin.end(input);
           });
           let buffer = "", outputBytes = 0;
           child.stdout.on("data", (chunk) => {
@@ -793,18 +855,29 @@ ${facts}` : ""}`);
             this.touch();
           });
           child.once("exit", (code) => {
-            if (this.child === child)
+            if (this.child === child) {
               this.reviewing = undefined;
-            stopOwnedProcess(child, { group: true }).then(() => {
-              if (this.child === child)
+              this.runningBinding = undefined;
+            }
+            (launch.stop ? launch.stop(child) : stopOwnedProcess(child, { group: true })).then(() => {
+              if (this.child === child) {
                 this.child = undefined;
+                this.childStop = undefined;
+              }
               resolve({ code, quota });
             }, (error) => reject(new GroupCleanupError(error.message)));
           });
         });
       } finally {
+        closeMcp();
+        if (policyTimer)
+          clearInterval(policyTimer);
         try {
-          await launch.cleanup?.();
+          if (!ownedChild || this.child !== ownedChild) {
+            await release();
+            if (this.childCleanup === release)
+              this.childCleanup = undefined;
+          }
         } catch {
           this.opts.log?.(`[${this.id}] reviewer isolation cleanup incomplete`);
         }
@@ -818,12 +891,18 @@ ${facts}` : ""}`);
     }
     async kill() {
       this.reviewing = undefined;
+      this.runningBinding = undefined;
       const child = this.child;
       if (!child)
         return;
-      await stopOwnedProcess(child, { group: true });
-      if (this.child === child)
+      await (this.childStop ? this.childStop(child) : stopOwnedProcess(child, { group: true }));
+      if (this.child === child) {
+        await this.childCleanup?.();
         this.child = undefined;
+        this.childStop = undefined;
+        this.childCleanup = undefined;
+        this.childCurrent = undefined;
+      }
     }
   };
 });
@@ -1047,19 +1126,27 @@ function configFiles(cwd, env) {
 }
 function hostCredentialRoots(env, cwd) {
   const home = resolve3(cwd, env.HOME || homedir());
-  const homes = [...new Set([home, credentialCanonicalPath(home)])];
-  const roots = homes.flatMap((base) => HOST_CREDENTIAL_PATHS.map((entry) => join3(base, entry)));
-  const configured = HOST_CREDENTIAL_ENV.flatMap((key) => env[key] ? [env[key]] : []);
+  const homes = [...new Set([home, canonicalLabelled(home, "HOME")])];
+  const roots = homes.flatMap((base) => HOST_CREDENTIAL_PATHS.map((entry) => ({ path: join3(base, entry), label: `~/${entry}` })));
+  const configured = HOST_CREDENTIAL_ENV.flatMap((key) => env[key] ? [{ path: env[key], label: `$${key}` }] : []);
   if (env.KUBECONFIG)
-    configured.push(...env.KUBECONFIG.split(delimiter).filter(Boolean));
+    configured.push(...env.KUBECONFIG.split(delimiter).filter(Boolean).map((path) => ({ path, label: "$KUBECONFIG" })));
   if (configured.length > 64)
     throw new Error("credential root bound exceeded");
-  for (const entry of configured) {
+  for (const { path: entry, label } of configured) {
     if (Buffer.byteLength(entry) > 4096 || /\p{Cc}/u.test(entry))
-      throw new Error("invalid credential root");
-    roots.push(entry.startsWith("~/") ? resolve3(home, entry.slice(2)) : resolve3(cwd, entry));
+      throw new CredentialRootError(label, "unsupported");
+    roots.push({ path: entry.startsWith("~/") ? resolve3(home, entry.slice(2)) : resolve3(cwd, entry), label });
+  }
+  const seen = new Set;
+  return roots.filter((root) => !seen.has(root.path) && seen.add(root.path));
+}
+function canonicalLabelled(lexical, label) {
+  try {
+    return credentialCanonicalPath(lexical);
+  } catch (error) {
+    throw new CredentialRootError(label, error.code === "ENOENT" ? "dangling" : "unreadable");
   }
-  return [...new Set(roots)];
 }
 function credentialCanonicalPath(lexical) {
   let ancestor = lexical;
@@ -1076,15 +1163,13 @@ function credentialCanonicalPath(lexical) {
   return join3(realPath(ancestor), relative(ancestor, lexical));
 }
 function denyCredentialRoots(filesystem, roots, cwd) {
-  for (const lexical of roots) {
+  for (const { path: lexical, label } of roots) {
     if (/[?*\[\]{}]/.test(lexical))
-      throw new Error("unverified credential root syntax");
-    const targets = new Set([lexical, credentialCanonicalPath(lexical)]);
+      throw new CredentialRootError(label, "unsupported");
+    const targets = new Set([lexical, canonicalLabelled(lexical, label)]);
     for (const target of targets) {
-      if (/[?*\[\]{}]/.test(target))
-        throw new Error("unverified credential root syntax");
-      if (inside(cwd, target))
-        throw new Error("credential root overlaps checkout");
+      if (/[?*\[\]{}]/.test(target) || inside(cwd, target))
+        throw new CredentialRootError(label, "unsupported");
       filesystem[target] = "deny";
       filesystem[`${target.replace(/\/$/, "")}/**`] = "deny";
     }
@@ -1337,12 +1422,16 @@ AHUB_CODEX_HOST_ALIAS_DENIED` || existsSync2(writeFile))
         evidence: ["model-free-mcp-inventory-disabled-ambient", "hub-tools-exact-allowlist", "plugins-and-hooks-disabled", "apps-disabled-effective-feature-readback", "web-search-disabled", "project-untrusted", "native-public-read-private-deny-write-deny", "native-glob-and-symlink-private-deny", "portable-core-name-and-state-deny", "standard-host-credential-roots-denied", "binary-config-stable", "binary-hash-once-metadata-fence", "session-ephemeral"]
       }
     };
-  } catch {
+  } catch (error) {
     if (root) {
       try {
         rmSync(root, { recursive: true, force: true });
       } catch {}
     }
+    if (error instanceof CredentialRootError) {
+      const why = { dangling: "a dangling link", unreadable: "an unreadable path", unsupported: "unsupported syntax or overlapping the checkout" }[error.kind];
+      return { unavailable: `Codex reviewer isolation receipt unavailable (credential root ${error.label} is ${why}; remove or repair it)` };
+    }
     return { unavailable: "Codex reviewer isolation receipt unavailable (version, MCP inventory, sandbox, configuration or process proof)" };
   }
 }
@@ -1353,7 +1442,7 @@ var VERSION = "0.146.0", TOOLS, CAP, MAX_SERVERS = 64, digest = (value) => creat
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("invalid metadata");
   return value;
-}, HOST_CREDENTIAL_PATHS, HOST_CREDENTIAL_ENV, codexReviewerBackend;
+}, HOST_CREDENTIAL_PATHS, HOST_CREDENTIAL_ENV, CredentialRootError, codexReviewerBackend;
 var init_codex_review_isolation = __esm(() => {
   init_platform();
   init_child_process();
@@ -1362,6 +1451,15 @@ var init_codex_review_isolation = __esm(() => {
   CAP = 128 * 1024;
   HOST_CREDENTIAL_PATHS = [".config", ".ssh", ".aws", ".azure", ".kube", ".docker", ".gnupg", ".codex", ".claude", ".kimi", ".kimi-code", ".gemini", ".git-credentials", ".vault-token", "Library/Keychains", ".local/share/keyrings", ".password-store"];
   HOST_CREDENTIAL_ENV = ["XDG_CONFIG_HOME", "CODEX_HOME", "CLAUDE_CONFIG_DIR", "KIMI_CODE_HOME", "KIMI_HOME", "GEMINI_CLI_HOME", "GNUPGHOME", "AWS_SHARED_CREDENTIALS_FILE", "AWS_CONFIG_FILE", "AZURE_CONFIG_DIR", "DOCKER_CONFIG", "GOOGLE_APPLICATION_CREDENTIALS"];
+  CredentialRootError = class CredentialRootError extends Error {
+    label;
+    kind;
+    constructor(label, kind) {
+      super("credential root refused");
+      this.label = label;
+      this.kind = kind;
+    }
+  };
   codexReviewerBackend = {
     id: "codex",
     prepare,
@@ -1372,10 +1470,271 @@ var init_codex_review_isolation = __esm(() => {
   };
 });
 
+// src/adapters/kimi-review.ts
+import { spawn as spawn3 } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync3, lstatSync as lstatSync3, mkdirSync as mkdirSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, rmSync as rmSync2, symlinkSync as symlinkSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2, tmpdir as tmpdir2 } from "os";
+import { basename as basename3, dirname as dirname4, join as join4, resolve as resolve4 } from "path";
+function assertCleanCwdAncestors(...candidates) {
+  const seen = new Set;
+  for (const candidate of candidates) {
+    let ancestor = resolve4(candidate);
+    for (;; ) {
+      if (!seen.has(ancestor)) {
+        seen.add(ancestor);
+        for (const marker of [".git", ".kimi-code", "AGENTS.md"]) {
+          if (lstatSync3(join4(ancestor, marker), { throwIfNoEntry: false }) !== undefined) {
+            throw new Error("private cwd ancestor contains ambient configuration");
+          }
+        }
+      }
+      const parent = dirname4(ancestor);
+      if (parent === ancestor)
+        break;
+      ancestor = parent;
+    }
+  }
+}
+function managedConfig(raw) {
+  const config = Bun.TOML.parse(raw);
+  if (!object2(config.providers) || !object2(config.models) || typeof config.default_model !== "string")
+    throw new Error("managed Kimi configuration required");
+  const provider = config.providers[MANAGED], model = config.models[config.default_model];
+  if (!object2(provider) || provider.type !== "kimi" || provider.api_key && provider.api_key !== "" || !object2(provider.oauth) || provider.oauth.storage !== "file" || !object2(model) || model.provider !== MANAGED)
+    throw new Error("managed file-backed Kimi OAuth required");
+  const oauth = provider.oauth;
+  const key = oauth.key;
+  const lock = !key || key === "kimi-code" || key === "oauth/kimi-code" ? "kimi-code" : typeof key === "string" && key.startsWith("oauth/") ? key.slice(6) : key;
+  if (typeof lock !== "string" || !lock || basename3(lock) !== lock || lock.startsWith("."))
+    throw new Error("unsupported OAuth slot");
+  if (typeof provider.base_url !== "string")
+    throw new Error("managed Kimi endpoint required");
+  const endpoint = new URL(provider.base_url);
+  if (endpoint.protocol !== "https:" || !["api.kimi.ai", "api.kimi.com"].includes(endpoint.hostname) || endpoint.username || endpoint.password)
+    throw new Error("unsupported managed Kimi endpoint");
+  if (oauth.oauth_host !== undefined) {
+    const auth = new URL(String(oauth.oauth_host));
+    if (auth.protocol !== "https:" || !["auth.kimi.ai", "auth.kimi.com"].includes(auth.hostname) || auth.username || auth.password)
+      throw new Error("unsupported OAuth endpoint");
+  }
+  const lines = [
+    "telemetry = false",
+    "hooks = []",
+    `default_model = ${scalar(config.default_model)}`,
+    ...config.thinking === undefined ? [] : [`thinking = ${scalar(config.thinking)}`],
+    `[providers.${scalar(MANAGED)}]`,
+    'type = "kimi"',
+    `base_url = ${scalar(provider.base_url)}`,
+    `[providers.${scalar(MANAGED)}.oauth]`
+  ];
+  for (const name of ["storage", "key", "oauth_host"])
+    if (oauth[name] !== undefined)
+      lines.push(`${name} = ${scalar(oauth[name])}`);
+  lines.push(`[models.${scalar(config.default_model)}]`);
+  const modelFields = ["provider", "model", "protocol", "max_context_size", "max_input_size", "capabilities", "display_name", "support_efforts", "default_effort", "beta_api", "adaptive_thinking", "overrides"];
+  if (Object.keys(model).some((name) => !modelFields.includes(name)))
+    throw new Error("unsupported managed model setting");
+  if (model.overrides !== undefined && (!object2(model.overrides) || Object.keys(model.overrides).some((name) => !modelFields.includes(name) || ["provider", "overrides"].includes(name))))
+    throw new Error("unsupported managed model override");
+  for (const name of modelFields)
+    if (model[name] !== undefined)
+      lines.push(`${name} = ${scalar(model[name])}`);
+  return { config: lines.join(`
+`) + `
+`, lock };
+}
+function mcpConfig(context) {
+  const config = JSON.parse(context.mcpConfig);
+  if (!object2(config) || !object2(config.mcpServers))
+    throw new Error("review MCP unavailable");
+  if (context.task === undefined && Object.keys(config.mcpServers).length === 0)
+    return context.mcpConfig;
+  if (Object.keys(config.mcpServers).join() !== "agent-hub")
+    throw new Error("ambient MCP refused");
+  const server = config.mcpServers["agent-hub"];
+  if (!object2(server) || Object.keys(server).some((k) => !["transport", "url", "headers"].includes(k)) || server.transport !== "http" || typeof server.url !== "string" || !object2(server.headers) || Object.keys(server.headers).join() !== "Authorization" || typeof server.headers.Authorization !== "string" || !server.headers.Authorization.startsWith("Bearer "))
+    throw new Error("task-bound HTTP MCP required");
+  const url = new URL(server.url);
+  if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || !url.port || url.pathname !== "/mcp" || url.username || url.password || url.search || url.hash)
+    throw new Error("local review MCP required");
+  return context.mcpConfig;
+}
+async function version(command, cwd, env, signal) {
+  return await new Promise((accept, reject) => {
+    const child = spawn3(command[0], [...command.slice(1), "--version"], { cwd, env, detached: true, stdio: ["ignore", "pipe", "ignore"] });
+    let text = "", done = false;
+    const finish = async (code) => {
+      if (done)
+        return;
+      done = true;
+      clearTimeout(timer);
+      signal.removeEventListener("abort", abort);
+      try {
+        await stopOwnedProcess(child, { group: true });
+      } catch {
+        reject(new Error("version probe cleanup failed"));
+        return;
+      }
+      if (code !== 0 || signal.aborted)
+        reject(new Error("version probe failed"));
+      else
+        accept(text.trim());
+    };
+    const abort = () => {
+      finish(null);
+    };
+    const timer = setTimeout(abort, 5000);
+    signal.addEventListener("abort", abort, { once: true });
+    child.once("spawn", () => trackGroup(child));
+    child.stdout.on("data", (bytes) => {
+      text += bytes.toString();
+      if (text.length > 4096)
+        abort();
+    });
+    child.once("error", () => {
+      finish(null);
+    });
+    child.once("close", (code) => {
+      finish(code);
+    });
+    if (signal.aborted)
+      abort();
+  });
+}
+async function stopKimiReview(child, locks, graceMs = 1e4) {
+  const locked = () => locks.some((file) => existsSync3(file));
+  if (child.exitCode === null && child.signalCode === null && locked()) {
+    child.kill("SIGTERM");
+    const end = Date.now() + graceMs;
+    while (child.exitCode === null && child.signalCode === null && locked() && Date.now() < end)
+      await Bun.sleep(50);
+    if (child.exitCode === null && child.signalCode === null && locked())
+      throw new Error("Kimi OAuth refresh still locked; graceful stop incomplete");
+  }
+  await stopOwnedProcess(child, { group: true });
+}
+var VERSION2 = "2.2.0", MANAGED = "managed:kimi-code", object2 = (v) => !!v && typeof v === "object" && !Array.isArray(v), hash = (text) => createHash3("sha256").update(text).digest("hex"), read = (file, limit = 262144) => {
+  const stat = lstatSync3(file);
+  if (!stat.isFile() || stat.size > limit)
+    throw new Error("unsupported reviewer file");
+  return readFileSync3(file, "utf8");
+}, scalar = (value, depth = 0) => {
+  if (depth > 4)
+    throw new Error("managed model setting too deeply nested");
+  if (typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value))
+    return JSON.stringify(value);
+  if (Array.isArray(value) && value.every((v) => typeof v === "string"))
+    return JSON.stringify(value);
+  if (object2(value) && Object.keys(value).length <= 32)
+    return `{ ${Object.entries(value).map(([key, item]) => `${JSON.stringify(key)} = ${scalar(item, depth + 1)}`).join(", ")} }`;
+  throw new Error("unsupported managed model setting");
+}, kimiReviewerBackend;
+var init_kimi_review = __esm(() => {
+  init_child_process();
+  init_project();
+  kimiReviewerBackend = {
+    id: "kimi",
+    taskMcp: true,
+    nativePolicy: true,
+    async prepare(context) {
+      let own;
+      try {
+        if (context.signal.aborted)
+          throw new Error("cancelled");
+        const sourcePath = process.env.KIMI_CODE_HOME ?? join4(process.env.HOME ?? homedir2(), ".kimi-code"), source = realPath(sourcePath);
+        const sourceConfig = join4(source, "config.toml"), original = read(sourceConfig), selected = managedConfig(original);
+        const sources = ["credentials", "oauth", "device_id"].map((name) => realPath(join4(source, name)));
+        if (!sources.every((file, index) => index < 2 ? lstatSync3(file).isDirectory() : lstatSync3(file).isFile()))
+          throw new Error("native OAuth directories and device identity required");
+        const mcp = mcpConfig(context);
+        if (Buffer.byteLength(context.input ?? "") > 1048576)
+          throw new Error("review facts exceed limit");
+        const lexicalRoot = mkdtempSync2(join4(process.env.TMPDIR ?? tmpdir2(), "ahub-kimi-review-"));
+        own = realPath(lexicalRoot);
+        assertCleanCwdAncestors(join4(lexicalRoot, "workspace"), join4(own, "workspace"));
+        const root = own, home = join4(root, "home"), tool = join4(root, "tool"), cwd = join4(root, "workspace"), skills = join4(root, "empty-skills"), temporary = join4(root, "tmp");
+        for (const dir of [home, tool, cwd, skills, temporary])
+          mkdirSync2(dir, { mode: 448 });
+        ["credentials", "oauth", "device_id"].forEach((name, index) => symlinkSync2(sources[index], join4(tool, name), index < 2 ? "dir" : "file"));
+        const agentFile = join4(cwd, "reviewer.md"), configFile = join4(tool, "config.toml"), mcpFile = join4(tool, "mcp.json");
+        writeFileSync2(configFile, selected.config, { mode: 384 });
+        writeFileSync2(mcpFile, mcp, { mode: 384 });
+        writeFileSync2(agentFile, `---
+name: hub-reviewer
+description: Fresh agent-hub reviewer
+tools:
+  - mcp__agent-hub__hub_review
+  - mcp__agent-hub__hub_task_show
+subagents: []
+---
+
+${context.systemPrompt}
+
+Use only the supplied public facts and hub_task_show. Never claim to have read evidence that was not supplied.
+
+${context.input ?? "No review is active; startup self-check only."}
+`, { mode: 384 });
+        const env = { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: home, KIMI_CODE_HOME: tool, TMPDIR: `${temporary}/`, XDG_CONFIG_HOME: join4(home, ".config"), LANG: process.env.LANG ?? "en_US.UTF-8", TERM: "dumb", ...process.env.USER ? { USER: process.env.USER } : {} };
+        const native = context.command ?? [Bun.which("kimi", { PATH: process.env.PATH }) ?? "kimi"];
+        const executable = realPath(Bun.which(native[0], { PATH: process.env.PATH }) ?? resolve4(native[0]));
+        const command = [executable, ...native.slice(1)];
+        const executableStat = lstatSync3(executable);
+        if (await version(command, cwd, env, context.signal) !== VERSION2)
+          throw new Error("unsupported Kimi version; receipt covers 2.2.0");
+        const fingerprints = [configFile, mcpFile, agentFile].map((file) => hash(read(file, 2097152)));
+        let cleaned = false;
+        const cleanup = () => {
+          if (cleaned)
+            return;
+          rmSync2(root, { recursive: true, force: true });
+          cleaned = true;
+        };
+        return {
+          command,
+          args: ["-p", "Review the supplied task facts and record the evidence-based verdict with hub_review.", "--output-format", "stream-json", "--agent-file", agentFile, "--skills-dir", skills],
+          cwd,
+          env,
+          envMode: "replace",
+          cleanup,
+          watchCurrent: true,
+          stop: (child) => stopKimiReview(child, [join4(sources[1], "kimi-code.lock"), join4(sources[1], `${selected.lock}.lock`)]),
+          current: () => {
+            try {
+              assertCleanCwdAncestors(join4(lexicalRoot, "workspace"), cwd);
+              const now = lstatSync3(executable);
+              return !cleaned && !context.signal.aborted && realPath(sourcePath) === source && now.dev === executableStat.dev && now.ino === executableStat.ino && now.size === executableStat.size && now.mtimeMs === executableStat.mtimeMs && now.ctimeMs === executableStat.ctimeMs && hash(read(sourceConfig)) === hash(original) && [configFile, mcpFile, agentFile].every((file, index) => hash(read(file, 2097152)) === fingerprints[index]) && ["credentials", "oauth", "device_id"].every((name, index) => realPath(join4(source, name)) === sources[index] && realPath(join4(tool, name)) === sources[index]);
+            } catch {
+              return false;
+            }
+          },
+          isolation: {
+            backend: "kimi",
+            version: VERSION2,
+            binary: executable,
+            profile: "private-config-exact-two-tools-shared-native-oauth",
+            readOnly: true,
+            strictMcp: true,
+            ephemeral: true,
+            enforcement: "native-policy",
+            freshSession: true,
+            hubToolsOnly: true,
+            evidence: ["#533 person ruling2026-10-19: native execution-time exact tool allowlist, no kernel sandbox", "private config/cwd/empty skills; shared OAuth directory symlinks and native lock/atomic rename", "task-bound in-process hub MCP; no full control token", "residual: interruption mid-refresh may require native re-login"]
+          }
+        };
+      } catch (error) {
+        if (own)
+          rmSync2(own, { recursive: true, force: true });
+        return { unavailable: `Kimi reviewer unavailable: ${error.message}` };
+      }
+    }
+  };
+});
+
 // src/adapters/definitions/native-context.ts
 function claudeContext(value, sessionId, measuredAt) {
-  const c = object2(value);
-  const current = object2(c.current_usage);
+  const c = object3(value);
+  const current = object3(c.current_usage);
   const parts = [current.input_tokens, current.cache_creation_input_tokens, current.cache_read_input_tokens];
   const window = positive(c.context_window_size) ? c.context_window_size : null;
   const sum = c.current_usage != null && parts.every(nonnegative) ? parts.reduce((sum, n) => sum + n, 0) : null;
@@ -1384,7 +1743,7 @@ function claudeContext(value, sessionId, measuredAt) {
   return { source: "claude_statusline", sessionId, measuredAt, tokens, window, used };
 }
 function codexContext(value, sessionId, measuredAt) {
-  const c = object2(value), last = object2(c.last);
+  const c = object3(value), last = object3(c.last);
   const window = positive(c.modelContextWindow) ? c.modelContextWindow : null;
   const tokens = nonnegative(last.totalTokens) ? last.totalTokens : null;
   return { source: "codex_token_usage", sessionId, measuredAt, tokens, window, used: tokens !== null && window !== null ? Math.min(1, tokens / window) : null };
@@ -1395,16 +1754,16 @@ function acpContext(usage, sessionId, measuredAt) {
   return { source: "acp_usage_update", sessionId, measuredAt, tokens, window, used: tokens !== null && window !== null ? Math.min(1, tokens / window) : null };
 }
 function acpContextValue(value, sessionId, measuredAt) {
-  const raw = object2(value);
+  const raw = object3(value);
   return acpContext({ used: raw.used, size: raw.size }, sessionId, measuredAt);
 }
-var nonnegative = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0, positive = (n) => nonnegative(n) && n > 0, record = (v) => v !== null && typeof v === "object" && !Array.isArray(v), object2 = (v) => record(v) ? v : {};
+var nonnegative = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0, positive = (n) => nonnegative(n) && n > 0, record = (v) => v !== null && typeof v === "object" && !Array.isArray(v), object3 = (v) => record(v) ? v : {};
 
 // src/hub/context-window.ts
 var init_context_window = () => {};
 
 // src/adapters/codex-appserver.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 function parse(raw) {
   try {
     return JSON.parse(raw);
@@ -1752,7 +2111,7 @@ ${renderDigest(envs, false)}`;
       }
       let gone = "";
       const env = peerChildEnv(this.id, { ...process.env, ...this.opts.env ?? {} });
-      this.proc = spawn3(this.opts.bin ?? "codex", ["app-server", "--listen", `ws://127.0.0.1:${port}`, ...this.opts.extraArgs ?? []], {
+      this.proc = spawn4(this.opts.bin ?? "codex", ["app-server", "--listen", `ws://127.0.0.1:${port}`, ...this.opts.extraArgs ?? []], {
         cwd: this.opts.cwd,
         env,
         stdio: ["ignore", "ignore", "pipe"],
@@ -2152,7 +2511,7 @@ var init_qwen_native = __esm(() => {
 });
 
 // src/adapters/acp.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { createInterface } from "readline";
 function normalizeACPUsage(value, source = "usage_update") {
   const unknown = { source, availability: "unsupported", shape: "none" };
@@ -2314,7 +2673,7 @@ var init_acp = __esm(() => {
     async start() {
       this.stopping = false;
       const [bin, ...args] = this.opts.cmd;
-      const proc = spawn4(bin, args, { cwd: this.opts.cwd, env: peerChildEnv(this.id, { ...process.env, ...this.opts.env ?? {} }), stdio: ["pipe", "pipe", "pipe"], detached: true });
+      const proc = spawn5(bin, args, { cwd: this.opts.cwd, env: peerChildEnv(this.id, { ...process.env, ...this.opts.env ?? {} }), stdio: ["pipe", "pipe", "pipe"], detached: true });
       this.proc = proc;
       trackGroup(proc);
       proc.on("error", (e) => this.down(`spawn failed: ${e.message}`));
@@ -2744,10 +3103,10 @@ ${renderDigest(envs, false)}` }] });
 });
 
 // src/adapters/jcode.ts
-import { spawn as spawn5, spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync3, lstatSync as lstatSync3, mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { isAbsolute as isAbsolute3, join as join4 } from "path";
+import { spawn as spawn6, spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync4, lstatSync as lstatSync4, mkdtempSync as mkdtempSync3, rmSync as rmSync3 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { isAbsolute as isAbsolute3, join as join5 } from "path";
 function jcodeCommand(command, kind, socket, cwd, model, profile) {
   if (!command.length || command.some((word) => typeof word !== "string" || !word))
     throw new Error("jcode_cmd must name an executable argv");
@@ -2786,7 +3145,7 @@ var init_jcode = __esm(() => {
       if (!isAbsolute3(jcode.home))
         throw new Error("jcode_home must be an absolute native data path");
       jcodeCommand(jcode.command, "acp", "preview", jcode.cwd);
-      const root = mkdtempSync2(join4(tmpdir2(), "ahub-jcode-")), socket = join4(root, "j.sock");
+      const root = mkdtempSync3(join5(tmpdir3(), "ahub-jcode-")), socket = join5(root, "j.sock");
       const cmd = jcodeCommand(jcode.command, "acp", socket, jcode.cwd, jcode.launchModel, jcode.providerProfile);
       super("jcode", { ...jcode, cmd, env: { ...jcode.env, JCODE_HOME: jcode.home, JCODE_SOCKET: socket, ...JCODE_OWNED_ENV }, mcpServers: [], requireLoadSessionEcho: true, expectedAgent: { name: "jcode", version: jcodeVersionSupported } });
       this.jcode = jcode;
@@ -2794,15 +3153,15 @@ var init_jcode = __esm(() => {
       this.socket = socket;
     }
     async start() {
-      if (!existsSync3(join4(this.jcode.home, "mcp.json")))
+      if (!existsSync4(join5(this.jcode.home, "mcp.json")))
         throw new Error("initialize Jcode's global MCP store with its native client before enabling this peer; the hub never initializes or copies it");
-      if (existsSync3(this.socket)) {
+      if (existsSync4(this.socket)) {
         this.preserveRoot = true;
         throw new Error("Jcode private socket is occupied; no daemon was adopted or removed");
       }
       this.ending = false;
       const [bin, ...args] = jcodeCommand(this.jcode.command, "serve", this.socket, this.jcode.cwd, this.jcode.launchModel, this.jcode.providerProfile);
-      const server = spawn5(bin, args, { cwd: this.jcode.cwd, detached: true, env: { ...peerChildEnv("jcode"), JCODE_HOME: this.jcode.home, JCODE_SOCKET: this.socket, JCODE_READY_FD: "3", ...JCODE_OWNED_ENV }, stdio: ["ignore", "ignore", "ignore", "pipe"] });
+      const server = spawn6(bin, args, { cwd: this.jcode.cwd, detached: true, env: { ...peerChildEnv("jcode"), JCODE_HOME: this.jcode.home, JCODE_SOCKET: this.socket, JCODE_READY_FD: "3", ...JCODE_OWNED_ENV }, stdio: ["ignore", "ignore", "ignore", "pipe"] });
       this.server = server;
       trackGroup(server);
       try {
@@ -2818,7 +3177,7 @@ var init_jcode = __esm(() => {
           ready.once("data", () => {
             clearTimeout(timer);
             server.off("exit", fail);
-            if (lstatSync3(this.socket, { throwIfNoEntry: false })?.isSocket())
+            if (lstatSync4(this.socket, { throwIfNoEntry: false })?.isSocket())
               resolve();
             else
               reject(new Error("Jcode readiness has no private socket"));
@@ -2887,7 +3246,7 @@ var init_jcode = __esm(() => {
       }
       if (!failure && !this.server) {
         if (!this.preserveRoot)
-          rmSync2(this.root, { recursive: true, force: true });
+          rmSync3(this.root, { recursive: true, force: true });
         super.setState("offline");
       }
       if (failure)
@@ -2900,11 +3259,11 @@ var init_jcode = __esm(() => {
 });
 
 // src/pi/launch.ts
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 function buildPiLaunch(opts, inherited, extension, bridgePort, bridgeToken) {
   const adapter = ADAPTERS.find((adapter) => adapter.start.daemonPort === "pi-rpc");
-  const env = { ...peerChildEnv(opts.instance ?? adapter.kind, inherited), ...opts.hubStateDir !== undefined ? { AGENTHUB_STATE_DIR: opts.hubStateDir } : {}, PI_CODING_AGENT_DIR: join5(opts.stateDir, "pi"), AGENTHUB_PI_BRIDGE_URL: `http://127.0.0.1:${bridgePort}`, AGENTHUB_PI_BRIDGE_TOKEN: bridgeToken, AGENTHUB_PI_OWNER_TOKEN: bridgeToken, AGENTHUB_PI_RELAY_URL: opts.relay.url, AGENTHUB_PI_RELAY_TOKEN: opts.relay.token, AGENTHUB_PI_MODELS: JSON.stringify(opts.relay.models), AGENTHUB_PI_TOOLS: JSON.stringify(opts.tools), AGENTHUB_PI_MAX_STEPS: String(opts.maxSteps ?? 30) };
-  const args = [...opts.mode === "headless" ? ["--mode", "rpc"] : [], "--provider", "agent-hub-local", "--model", opts.model ?? modelFor(opts.backend, opts.relay.models), "--models", opts.relay.models.map((model) => `agent-hub-local/${model.id}`).join(","), "--no-builtin-tools", "--no-skills", "--no-prompt-templates", "--no-extensions", "--extension", extension, ...opts.preamble ? ["--append-system-prompt", opts.preamble] : [], "--session-dir", join5(opts.stateDir, "pi-sessions")];
+  const env = { ...peerChildEnv(opts.instance ?? adapter.kind, inherited), ...opts.hubStateDir !== undefined ? { AGENTHUB_STATE_DIR: opts.hubStateDir } : {}, PI_CODING_AGENT_DIR: join6(opts.stateDir, "pi"), AGENTHUB_PI_BRIDGE_URL: `http://127.0.0.1:${bridgePort}`, AGENTHUB_PI_BRIDGE_TOKEN: bridgeToken, AGENTHUB_PI_OWNER_TOKEN: bridgeToken, AGENTHUB_PI_RELAY_URL: opts.relay.url, AGENTHUB_PI_RELAY_TOKEN: opts.relay.token, AGENTHUB_PI_MODELS: JSON.stringify(opts.relay.models), AGENTHUB_PI_TOOLS: JSON.stringify(opts.tools), AGENTHUB_PI_MAX_STEPS: String(opts.maxSteps ?? 30) };
+  const args = [...opts.mode === "headless" ? ["--mode", "rpc"] : [], "--provider", "agent-hub-local", "--model", opts.model ?? modelFor(opts.backend, opts.relay.models), "--models", opts.relay.models.map((model) => `agent-hub-local/${model.id}`).join(","), "--no-builtin-tools", "--no-skills", "--no-prompt-templates", "--no-extensions", "--extension", extension, ...opts.preamble ? ["--append-system-prompt", opts.preamble] : [], "--session-dir", join6(opts.stateDir, "pi-sessions")];
   if (opts.sessionFile)
     args.push("--session", opts.sessionFile);
   else if (opts.sessionId)
@@ -2940,8 +3299,8 @@ var init_recovery_store = __esm(() => {
 });
 
 // src/pi/session.ts
-import { readFileSync as readFileSync3, openSync, closeSync, fsyncSync, mkdirSync as mkdirSync2 } from "fs";
-import { join as join6, relative as relative2, resolve as resolve4, dirname as dirname4 } from "path";
+import { readFileSync as readFileSync4, openSync, closeSync, fsyncSync, mkdirSync as mkdirSync3 } from "fs";
+import { join as join7, relative as relative2, resolve as resolve5, dirname as dirname5 } from "path";
 function sessionReadFailure(error) {
   if (error.code === "ENOENT")
     throw new PiSessionUnresumable("missing", error.message, { cause: error });
@@ -2951,16 +3310,16 @@ function validatePiSession(stateDir, cwd, sessionFile, sessionId) {
   let file, sessions;
   try {
     file = realPath(sessionFile);
-    sessions = realPath(join6(stateDir, "pi-sessions"));
+    sessions = realPath(join7(stateDir, "pi-sessions"));
   } catch (error) {
     return sessionReadFailure(error);
   }
   const rel = relative2(sessions, file);
-  if (!rel || rel.startsWith("..") || resolve4(sessions, rel) !== file)
+  if (!rel || rel.startsWith("..") || resolve5(sessions, rel) !== file)
     throw new PiSessionUnresumable("outside_managed", "Pi session file is outside the managed project session directory");
   let first;
   try {
-    first = readFileSync3(file, "utf8").split(`
+    first = readFileSync4(file, "utf8").split(`
 `, 1)[0];
   } catch (error) {
     return sessionReadFailure(error);
@@ -3009,11 +3368,11 @@ var init_permission_mode = __esm(() => {
 });
 
 // src/hub/path-policy.ts
-import { accessSync, constants, lstatSync as lstatSync4, opendirSync, readlinkSync, statSync as statSync2 } from "fs";
-import { dirname as dirname5, isAbsolute as isAbsolute4, join as join7, relative as relative3, resolve as resolve5, sep as sep2 } from "path";
+import { accessSync, constants, lstatSync as lstatSync5, opendirSync, readlinkSync, statSync as statSync2 } from "fs";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join8, relative as relative3, resolve as resolve6, sep as sep2 } from "path";
 function existing(path) {
   try {
-    lstatSync4(path);
+    lstatSync5(path);
     return true;
   } catch (error) {
     if (error.code === "ENOENT")
@@ -3024,17 +3383,17 @@ function existing(path) {
 function policyRealPath(path) {
   let ancestor = path;
   while (!existing(ancestor)) {
-    const parent = dirname5(ancestor);
+    const parent = dirname6(ancestor);
     if (parent === ancestor)
       throw new Error("path cannot be resolved");
     ancestor = parent;
   }
-  return join7(realPath(ancestor), relative3(ancestor, path));
+  return join8(realPath(ancestor), relative3(ancestor, path));
 }
 function policyTargets(cwd, paths) {
   const root = realPath(cwd);
   return [...new Set(paths.flatMap((path) => {
-    const lexical = resolve5(root, path);
+    const lexical = resolve6(root, path);
     return [lexical, policyRealPath(lexical)];
   }))];
 }
@@ -3052,14 +3411,14 @@ function directAliasTarget(path) {
     }
     let ancestor = target;
     while (!existing(ancestor)) {
-      const parent = dirname5(ancestor);
+      const parent = dirname6(ancestor);
       if (parent === ancestor)
         return;
       ancestor = parent;
     }
-    if (!lstatSync4(ancestor).isSymbolicLink())
+    if (!lstatSync5(ancestor).isSymbolicLink())
       return;
-    target = resolve5(dirname5(ancestor), readlinkSync(ancestor), relative3(ancestor, target));
+    target = resolve6(dirname6(ancestor), readlinkSync(ancestor), relative3(ancestor, target));
   }
   return;
 }
@@ -3076,7 +3435,7 @@ function aliasScope(dir, lexical, actual, includeParents, budget) {
       budget.entries++;
       if (!entry.isSymbolicLink())
         continue;
-      const target = directAliasTarget(join7(dir, entry.name));
+      const target = directAliasTarget(join8(dir, entry.name));
       if (target !== undefined && (beneath(lexical, target) || beneath(actual, target) || includeParents && (beneath(target, lexical) || beneath(target, actual))))
         matched = true;
     }
@@ -3172,7 +3531,7 @@ function globScope(root, lexical, actual, path, includeParents, budget, roots, a
         if (++budget.entries > 4096)
           throw new Error("policy glob discovery unavailable");
         const next = advance(pattern, states, entry.name);
-        if (next.size && visit(join7(dir, entry.name), next, depth + 1, chain))
+        if (next.size && visit(join8(dir, entry.name), next, depth + 1, chain))
           return true;
       }
     } finally {
@@ -3188,7 +3547,7 @@ function matchesPolicy(cwd, path, paths, includeParents = false) {
   try {
     if (path.length > 4096)
       return true;
-    const root = realPath(cwd), lexical = resolve5(root, path), actual = policyRealPath(lexical);
+    const root = realPath(cwd), lexical = resolve6(root, path), actual = policyRealPath(lexical);
     includeParents &&= !existing(lexical) || statSync2(lexical).isDirectory();
     const budget = { entries: 0 }, roots = new Set, exact = [];
     if (paths.some((entry) => {
@@ -3223,7 +3582,7 @@ var init_path_policy = __esm(() => {
 });
 
 // src/local/deny.ts
-import { basename as basename3, dirname as dirname6 } from "path";
+import { basename as basename4, dirname as dirname7 } from "path";
 function hubWriteRegexes(root, gitDirs = [], moduleGit) {
   const git = hfsFoldedName(".git");
   const re = (s) => `(regex ${sbplString(s)})`;
@@ -3235,7 +3594,7 @@ function hubWriteRegexes(root, gitDirs = [], moduleGit) {
   const modules = moduleGit ? [
     `(require-all ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?${hfsFoldedName("config")}$`)} (require-not ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?(refs|logs)/`)}))`,
     `(require-all ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?${hfsFoldedName("hooks")}(/|$)`)} (require-not ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?(refs|logs)/`)}))`,
-    ...moduleGit.entries.map((d) => re(`^${sbplEscape(dirname6(d))}/${hfsFoldedName(basename3(d))}$`))
+    ...moduleGit.entries.map((d) => re(`^${sbplEscape(dirname7(d))}/${hfsFoldedName(basename4(d))}$`))
   ] : [];
   return [
     `(require-all (subpath ${sbplString(root)}) ${re(`^.*/${hfsFoldedName(".agenthub")}(/|$)`)})`,
@@ -3267,10 +3626,10 @@ var init_deny = __esm(() => {
 });
 
 // src/local/sandbox.ts
-import { spawn as spawn6, spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync4, mkdtempSync as mkdtempSync3, readdirSync, rmSync as rmSync3 } from "fs";
-import { homedir as homedir2, tmpdir as tmpdir3 } from "os";
-import { dirname as dirname7, join as join8, resolve as resolve6 } from "path";
+import { spawn as spawn7, spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync5, mkdtempSync as mkdtempSync4, readdirSync, rmSync as rmSync4 } from "fs";
+import { homedir as homedir3, tmpdir as tmpdir4 } from "os";
+import { dirname as dirname8, join as join9, resolve as resolve7 } from "path";
 function developerDir() {
   const out = spawnSync3("xcode-select", ["-p"], { encoding: "utf8" });
   let dir = out.status === 0 ? out.stdout.trim() : "";
@@ -3284,14 +3643,14 @@ function externalGitDirs(root) {
   if (out.status !== 0)
     return [];
   const dirs = out.stdout.trim().split(`
-`).map((d) => resolve6(root, d));
+`).map((d) => resolve7(root, d));
   return [...new Set(dirs)].filter((d) => !d.startsWith(`${root}/`));
 }
 function moduleGitDirs(root) {
   const out = memoryGitSync(["-C", root, "rev-parse", "--git-common-dir"], { encoding: "utf8" });
   if (out.status !== 0)
     return;
-  const modulesRoot = join8(resolve6(root, out.stdout.trim()), "modules");
+  const modulesRoot = join9(resolve7(root, out.stdout.trim()), "modules");
   const dirs = [];
   const walk = (dir, depth) => {
     if (depth > 8)
@@ -3305,31 +3664,31 @@ function moduleGitDirs(root) {
     const names = new Set(entries.map((e) => e.name));
     if (names.has("HEAD") && names.has("config")) {
       dirs.push(dir);
-      const nested = join8(dir, "modules");
+      const nested = join9(dir, "modules");
       if (names.has("modules"))
         walk(nested, depth + 1);
       return;
     }
     for (const e of entries)
       if (e.isDirectory())
-        walk(join8(dir, e.name), depth + 1);
+        walk(join9(dir, e.name), depth + 1);
   };
   walk(modulesRoot, 0);
   const entries = new Set([modulesRoot]);
   for (const d of dirs)
-    for (let p = d;p.length > modulesRoot.length; p = dirname7(p))
+    for (let p = d;p.length > modulesRoot.length; p = dirname8(p))
       entries.add(p);
   return { root: modulesRoot, entries: [...entries] };
 }
 function profile(cwd, network, readAllow = [], deny = [], readOnly = []) {
-  const home = homedir2();
-  const inHome = (p) => p.startsWith("~/") ? join8(home, p.slice(2)) : p;
+  const home = homedir3();
+  const inHome = (p) => p.startsWith("~/") ? join9(home, p.slice(2)) : p;
   const root = realPath(cwd);
   const gitDirs = externalGitDirs(root);
   const moduleGit = moduleGitDirs(root);
   const creds = [".ssh", ".aws", ".gnupg", ".config/gh", ".config/gcloud", ".kube", ".docker", ".netrc", ".npmrc", ".omniroute", ".claude", ".codex", ".kimi-code", "Library/Keychains"];
   const dev = developerDir();
-  const readable = [root, ...HOME_READABLE.map((p) => join8(home, p)), ...readAllow.map(inHome), ...gitDirs, ...dev ? [dev] : []];
+  const readable = [root, ...HOME_READABLE.map((p) => join9(home, p)), ...readAllow.map(inHome), ...gitDirs, ...dev ? [dev] : []];
   const subpaths = (paths) => paths.map((p) => `(subpath ${q(p)})`).join(" ");
   const globals = (names) => names.map((n) => `(global-name ${q(n)})`).join(" ");
   const proxy = typeof network === "object" ? `(allow network-outbound (remote ip ${q(`localhost:${network.proxyPort}`)}))` : undefined;
@@ -3347,14 +3706,14 @@ function profile(cwd, network, readAllow = [], deny = [], readOnly = []) {
     '(allow file-ioctl (regex #"^/dev/"))',
     ...proxy ? [proxy] : network ? ["(allow network*)"] : []
   ];
-  const places = `${creds.map((c) => `(subpath ${q(join8(home, c))})`).join(" ")} ${denyRegexes(root, deny, false).join(" ")}`;
+  const places = `${creds.map((c) => `(subpath ${q(join9(home, c))})`).join(" ")} ${denyRegexes(root, deny, false).join(" ")}`;
   return [
     "(version 1)",
     ...start,
     "(deny file-write*)",
     ...readOnly.length ? ['(allow file-write* (literal "/dev/null"))'] : [`(allow file-write* (subpath ${q(root)}) (regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`],
     `(deny file-write* ${hubWriteRegexes(root, gitDirs, moduleGit).join(" ")})`,
-    `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join8(home, c))})`).join(" ")})`,
+    `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join9(home, c))})`).join(" ")})`,
     `(deny file-read* file-write* ${denyRegexes(root, deny).join(" ")})`,
     ...network ? [`(allow file-read* ${CA_BUNDLES.map((p) => `(literal ${q(p)})`).join(" ")} (regex ${q("/certifi/cacert\\.pem$")}))`, `(deny file-read* file-write* ${places})`] : []
   ].join(`
@@ -3368,11 +3727,11 @@ function sandboxedExec(argv, opts) {
   if (opts.signal?.aborted)
     return Promise.resolve({ code: null, output: "error: command cancelled before execution" });
   return new Promise((resolve) => {
-    const own = realPath(mkdtempSync3(join8(tmpdir3(), "ahub-cmd-")));
+    const own = realPath(mkdtempSync4(join9(tmpdir4(), "ahub-cmd-")));
     const sandbox = `${opts.profile}
 (allow file-read* ${opts.readOnlyData ? "" : "file-write* "}process-exec (subpath ${q(own)}))`;
-    const env = { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: homedir2(), LANG: process.env.LANG ?? "en_US.UTF-8", TERM: "dumb", ...opts.env, TMPDIR: `${own}/` };
-    const child = spawn6(SANDBOX_EXEC, ["-p", sandbox, ...argv], { cwd: opts.cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
+    const env = { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: homedir3(), LANG: process.env.LANG ?? "en_US.UTF-8", TERM: "dumb", ...opts.env, TMPDIR: `${own}/` };
+    const child = spawn7(SANDBOX_EXEC, ["-p", sandbox, ...argv], { cwd: opts.cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
     let output = "";
     const take = (d) => {
       if (output.length < OUTPUT_CAP)
@@ -3391,11 +3750,11 @@ function sandboxedExec(argv, opts) {
     opts.signal?.addEventListener("abort", abort, { once: true });
     const dropOwn = () => {
       try {
-        rmSync3(own, { recursive: true, force: true });
+        rmSync4(own, { recursive: true, force: true });
       } catch {
         try {
           spawnSync3("chflags", ["-R", "nouchg", own]);
-          rmSync3(own, { recursive: true, force: true });
+          rmSync4(own, { recursive: true, force: true });
         } catch {}
       }
     };
@@ -3424,7 +3783,7 @@ function proxyEnv(network) {
   const url = `http://127.0.0.1:${network.proxyPort}`;
   return { HTTPS_PROXY: url, https_proxy: url, HTTP_PROXY: url, http_proxy: url, ALL_PROXY: url, all_proxy: url, NO_PROXY: "", no_proxy: "" };
 }
-var SANDBOX_EXEC = "/usr/bin/sandbox-exec", OUTPUT_CAP = 20000, sandboxAvailable = () => process.platform === "darwin" && existsSync4(SANDBOX_EXEC), q, HOME_READABLE, CA_BUNDLES, SYSTEM_READABLE, MACH_SERVICES, NETWORK_MACH_SERVICES, PROXY_MACH_SERVICES;
+var SANDBOX_EXEC = "/usr/bin/sandbox-exec", OUTPUT_CAP = 20000, sandboxAvailable = () => process.platform === "darwin" && existsSync5(SANDBOX_EXEC), q, HOME_READABLE, CA_BUNDLES, SYSTEM_READABLE, MACH_SERVICES, NETWORK_MACH_SERVICES, PROXY_MACH_SERVICES;
 var init_sandbox = __esm(() => {
   init_project();
   init_git();
@@ -3439,29 +3798,29 @@ var init_sandbox = __esm(() => {
 });
 
 // src/local/tools.ts
-import { lstatSync as lstatSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, statSync as statSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname8, join as join9, relative as relative4, resolve as resolve7 } from "path";
+import { lstatSync as lstatSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync5, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname9, join as join10, relative as relative4, resolve as resolve8 } from "path";
 function guardPath(ctx, path, mode) {
   const root = realPath(ctx.cwd);
-  const abs = resolve7(root, path);
+  const abs = resolve8(root, path);
   let existing = abs;
   while (!lexists(existing))
-    existing = dirname8(existing);
+    existing = dirname9(existing);
   let realExisting;
   try {
     realExisting = realPath(existing);
   } catch {
     throw new Error(`${path} goes through a dangling symlink`);
   }
-  const real = join9(realExisting, relative4(existing, abs));
+  const real = join10(realExisting, relative4(existing, abs));
   const rel = relative4(root, real);
-  if (rel.startsWith("..") || resolve7(root, rel) !== real)
+  if (rel.startsWith("..") || resolve8(root, rel) !== real)
     throw new Error(`${path} is outside the project directory`);
   if (isDenied(rel, ctx.deny))
     throw new Error(`${path} is on the secrets denylist`);
   if (mode === "write" && isHubWritePath(rel))
     throw new Error(`${path} is not writable by the local worker`);
-  if (mode === "write" && ctx.readOnly?.length && (lstatSync5(real, { throwIfNoEntry: false })?.nlink ?? 1) > 1)
+  if (mode === "write" && ctx.readOnly?.length && (lstatSync6(real, { throwIfNoEntry: false })?.nlink ?? 1) > 1)
     throw new Error("hardlinked write target cannot be verified with data.readonly");
   if (mode === "write" && matchesPolicy(root, path, ctx.readOnly ?? []))
     throw new Error("target is protected by data.readonly");
@@ -3511,7 +3870,7 @@ async function runTool(name, rawArgs, ctx) {
         const file = guardPath(ctx, String(a.path), "read");
         if (statSync3(file).size > 5000000)
           return "error: file is larger than 5 MB; use bash (head, grep, sed -n) to look at parts of it";
-        const lines = readFileSync4(file, "utf8").split(`
+        const lines = readFileSync5(file, "utf8").split(`
 `);
         const from = Math.max(1, Number(a.offset) || 1);
         const out = lines.slice(from - 1, from - 1 + (Number(a.limit) || 2000)).map((l, i) => `${from + i}	${l}`).join(`
@@ -3532,14 +3891,14 @@ ${preview(content)}`, "write", ctx.signal, file, undefined, String(a.path)), "er
         file = guardPath(ctx, String(a.path), "write");
         if (file !== approvedTarget)
           return "error: path target changed during approval; inspect before retrying";
-        mkdirSync3(dirname8(file), { recursive: true });
-        writeFileSync2(file, content);
+        mkdirSync4(dirname9(file), { recursive: true });
+        writeFileSync3(file, content);
         return `wrote ${a.path}`;
       }
       case "edit": {
         let file = guardPath(ctx, String(a.path), "write");
         const approvedTarget = file;
-        let text = readFileSync4(file, "utf8");
+        let text = readFileSync5(file, "utf8");
         let count = text.split(String(a.old)).length - 1;
         if (!a.old || count !== 1)
           return `error: \`old\` must match exactly once, it matched ${count} times`;
@@ -3553,11 +3912,11 @@ ${preview(content)}`, "write", ctx.signal, file, undefined, String(a.path)), "er
         file = guardPath(ctx, String(a.path), "write");
         if (file !== approvedTarget)
           return "error: path target changed during approval; inspect before retrying";
-        text = readFileSync4(file, "utf8");
+        text = readFileSync5(file, "utf8");
         count = text.split(String(a.old)).length - 1;
         if (count !== 1)
           return `error: file changed during approval; \`old\` must match exactly once, it matched ${count} times`;
-        writeFileSync2(file, text.replace(String(a.old), () => String(a.new ?? "")));
+        writeFileSync3(file, text.replace(String(a.old), () => String(a.new ?? "")));
         return `edited ${a.path}`;
       }
       case "bash": {
@@ -3607,7 +3966,7 @@ ${preview(content)}`, "write", ctx.signal, file, undefined, String(a.path)), "er
 }
 var APPROVAL_EXPIRED_TEXT = "error: approval expired: no person answered; do not retry this call; hand the task off or stop", ApprovalWaitStop, approvalError = (picked, denied) => picked === true ? undefined : picked === "expired" ? APPROVAL_EXPIRED_TEXT : picked === "aborted" ? "error: approval withdrawn because the turn ended; no operation was executed" : denied, lexists = (p) => {
   try {
-    lstatSync5(p);
+    lstatSync6(p);
     return true;
   } catch {
     return false;
@@ -3661,9 +4020,9 @@ var PI_CEILING_KIND = "tool-step-ceiling", PI_CEILING_UNIT = "tool-step";
 
 // src/adapters/pi.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { existsSync as existsSync5, mkdirSync as mkdirSync4 } from "fs";
-import { join as join10, resolve as resolve8 } from "path";
-import { spawn as spawn7 } from "child_process";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5 } from "fs";
+import { join as join11, resolve as resolve9 } from "path";
+import { spawn as spawn8 } from "child_process";
 function ownerStillAlive(pid, signature) {
   const current = processSignature(pid);
   if (current !== undefined)
@@ -3779,7 +4138,7 @@ var init_pi = __esm(() => {
     get recoveryReady() {
       if (this.state === "busy" || this.starting || this.activeTools)
         return false;
-      if (this.sessionFile && !existsSync5(this.sessionFile) && (this.activityObserved || this.persistedOnce))
+      if (this.sessionFile && !existsSync6(this.sessionFile) && (this.activityObserved || this.persistedOnce))
         return false;
       if (this.opts.mode === "headless")
         return this.state === "idle" || !this.proc || this.proc.exitCode !== null || this.proc.signalCode !== null;
@@ -3798,7 +4157,7 @@ var init_pi = __esm(() => {
       return this.ownerClaimed && this.ownerPid && this.ownerSignature ? `${this.ownerPid}:${this.ownerSignature}:${this.sessionId ?? ""}` : undefined;
     }
     recoveryMetadata() {
-      const exists = !!this.sessionFile && existsSync5(this.sessionFile);
+      const exists = !!this.sessionFile && existsSync6(this.sessionFile);
       if (exists) {
         this.persistedOnce = true;
         this.verifiedEmptyResume = undefined;
@@ -3811,14 +4170,14 @@ var init_pi = __esm(() => {
       if (this.state === "offline") {
         if (this.canReuseVerifiedEmptyResume())
           return this.recoveryMetadata();
-        if (this.recoveryReady && this.sessionFile && existsSync5(this.sessionFile))
+        if (this.recoveryReady && this.sessionFile && existsSync6(this.sessionFile))
           return this.recoveryMetadata();
         throw new Error("Pi source session is offline and has no verified persisted resume state; inspect preserved history, then a person may run ahub pi --replace-session --session-file <managed-file>");
       }
       this.emptyResumeVerified = false;
       if (this.state !== "idle" || this.stopping || this.activeTools)
         throw new Error("Pi must settle before session capture");
-      if (this.sessionFile && existsSync5(this.sessionFile))
+      if (this.sessionFile && existsSync6(this.sessionFile))
         return this.recoveryMetadata();
       const snapshot = this.opts.mode === "headless" ? (await this.waitRpc("get_state", 15000)).data : await this.sendTui({ type: "get_session_state" });
       if (this.state !== "idle" || this.activeTools || snapshot?.sessionId !== this.sessionId || snapshot?.sessionFile !== this.sessionFile)
@@ -3833,7 +4192,7 @@ var init_pi = __esm(() => {
       return captured;
     }
     canReuseVerifiedEmptyResume() {
-      return !!this.verifiedEmptyResume && this.recoveryReady && !this.activityObserved && !this.persistedOnce && this.sessionId === this.verifiedEmptyResume.sessionId && (!this.sessionFile || !existsSync5(this.sessionFile));
+      return !!this.verifiedEmptyResume && this.recoveryReady && !this.activityObserved && !this.persistedOnce && this.sessionId === this.verifiedEmptyResume.sessionId && (!this.sessionFile || !existsSync6(this.sessionFile));
     }
     noteActivity() {
       this.activityObserved = true;
@@ -4025,9 +4384,9 @@ var init_pi = __esm(() => {
       this.approvalAnswerEpoch = undefined;
       this.approvalStopReason = "";
       this.approvalAbortSent = false;
-      mkdirSync4(this.opts.stateDir, { recursive: true });
-      const sessions = join10(this.opts.stateDir, "pi-sessions");
-      mkdirSync4(sessions, { recursive: true, mode: 448 });
+      mkdirSync5(this.opts.stateDir, { recursive: true });
+      const sessions = join11(this.opts.stateDir, "pi-sessions");
+      mkdirSync5(sessions, { recursive: true, mode: 448 });
       if (this.opts.sessionFile) {
         try {
           validatePiSession(this.opts.stateDir, this.opts.cwd, this.opts.sessionFile, this.opts.sessionId);
@@ -4084,7 +4443,7 @@ var init_pi = __esm(() => {
         return new Response("not found", { status: 404 });
       } });
       this.server = bridge;
-      const extension = resolve8(join10(import.meta.dir, "../pi/extension.ts"));
+      const extension = resolve9(join11(import.meta.dir, "../pi/extension.ts"));
       const inherited = {};
       for (const key of ["PATH", "HOME", "USER", "SHELL", "TMPDIR", "TERM", "TERM_PROGRAM", "LANG", "LC_ALL", "LC_CTYPE", "NO_COLOR", "CODEX_HOME"])
         if (process.env[key])
@@ -4094,7 +4453,7 @@ var init_pi = __esm(() => {
       if (this.opts.mode === "tui") {
         return;
       }
-      this.proc = spawn7(bin, args, { cwd: this.opts.cwd, env, stdio: ["pipe", "pipe", "pipe"], detached: true });
+      this.proc = spawn8(bin, args, { cwd: this.opts.cwd, env, stdio: ["pipe", "pipe", "pipe"], detached: true });
       trackGroup(this.proc);
       this.proc.stdout.on("data", (chunk) => this.onOutput(String(chunk)));
       this.proc.stderr.on("data", (chunk) => this.opts.log?.(`[${this.id}] ${String(chunk).trimEnd()}`));
@@ -4126,7 +4485,7 @@ var init_pi = __esm(() => {
         this.ownerToken = String(this._tuiLaunch?.env.AGENTHUB_PI_OWNER_TOKEN ?? "");
         this.ownerClaimed = true;
       }
-      this.persistedOnce = existsSync5(this.sessionFile);
+      this.persistedOnce = existsSync6(this.sessionFile);
       if (this.opts.sessionId && this.sessionId !== this.opts.sessionId || this.opts.sessionFile && this.sessionFile !== this.opts.sessionFile)
         throw new Error("Pi startup session identity mismatch");
       this.started = true;
@@ -5865,7 +6224,7 @@ var init_signals = __esm(() => {
 });
 
 // src/models/route/labels.ts
-import { createHash as createHash3, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID3 } from "crypto";
 
 class RouteLabelTracker {
   sink;
@@ -6015,7 +6374,7 @@ function safeJson(value) {
     return "";
   }
 }
-var discreteSeverity = (value) => value >= 1 ? 1 : value >= 0.7 ? 0.7 : value >= 0.3 ? 0.3 : 0, sha256 = (value) => createHash3("sha256").update(value).digest("hex");
+var discreteSeverity = (value) => value >= 1 ? 1 : value >= 0.7 ? 0.7 : value >= 0.3 ? 0.3 : 0, sha256 = (value) => createHash4("sha256").update(value).digest("hex");
 var init_labels = __esm(() => {
   init_signals();
 });
@@ -6883,9 +7242,9 @@ var init_shipped_roles = __esm(() => {
 });
 
 // src/hub/roles.ts
-import { createHash as createHash4 } from "crypto";
-import { constants as constants2, closeSync as closeSync2, fstatSync, lstatSync as lstatSync6, openSync as openSync2, readSync, readdirSync as readdirSync2 } from "fs";
-import { join as join11 } from "path";
+import { createHash as createHash5 } from "crypto";
+import { constants as constants2, closeSync as closeSync2, fstatSync, lstatSync as lstatSync7, openSync as openSync2, readSync, readdirSync as readdirSync2 } from "fs";
+import { join as join12 } from "path";
 function parseRole(text, stem, layer) {
   if (Buffer.byteLength(text) > 8192 || text.includes("\r") || !ID.test(stem))
     throw new Error("invalid role size, encoding or file id");
@@ -6929,7 +7288,7 @@ function parseRole(text, stem, layer) {
   }
   const reviewStart = sections[4].index + sections[4][0].length;
   const review = body.slice(reviewStart, sections[5].index).trim();
-  return { id: stem, name: header.name, group: header.group, summary: header.summary, source: header.source, base: list("base", BASES2), classes: list("classes", CLASSES2), body, review, layer, hash: createHash4("sha256").update(text).digest("hex") };
+  return { id: stem, name: header.name, group: header.group, summary: header.summary, source: header.source, base: list("base", BASES2), classes: list("classes", CLASSES2), body, review, layer, hash: createHash5("sha256").update(text).digest("hex") };
 }
 function projectRole(file) {
   const fd = openSync2(file, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
@@ -6964,9 +7323,9 @@ function loadRoleCatalog(cwd) {
   if (!cwd)
     return { roles, errors };
   try {
-    const config = join11(cwd, ".agenthub"), dir = join11(config, "roles");
+    const config = join12(cwd, ".agenthub"), dir = join12(config, "roles");
     for (const path of [config, dir]) {
-      const stat = lstatSync6(path);
+      const stat = lstatSync7(path);
       if (!stat.isDirectory() || stat.isSymbolicLink())
         throw new Error("unsafe role directory");
     }
@@ -6976,7 +7335,7 @@ function loadRoleCatalog(cwd) {
     for (const file of files) {
       const id = file.slice(0, -3);
       try {
-        roles.set(id, parseRole(projectRole(join11(dir, file)), id, "project"));
+        roles.set(id, parseRole(projectRole(join12(dir, file)), id, "project"));
       } catch {
         errors.push({ id: ID.test(id) ? id : "invalid-file-id", reason: "invalid or unsafe project role" });
       }
@@ -7878,21 +8237,748 @@ function reviewerVariant(kind, displayName, reviewer, display) {
     display
   };
 }
-var codexVariant, CODEX_REVIEWER_VARIANT, KIMI_REVIEWER_VARIANT, AGY_DEFINITION;
+var codexVariant, CODEX_REVIEWER_VARIANT, KIMI_REVIEWER_VARIANT, AGY_REVIEWER_VARIANT;
 var init_reviewer_variants = __esm(() => {
   init_claude_print();
   init_codex_review_isolation();
+  init_kimi_review();
   init_native_factories();
   init_native_display();
   codexVariant = reviewerVariant("codex", "Codex reviewer", { backend: codexReviewerBackend, defaultPool: true, declaration: "explicit" }, CODEX_DISPLAY);
   CODEX_REVIEWER_VARIANT = { ...codexVariant, start: { ...codexVariant.start, create: createCodexReviewer } };
-  KIMI_REVIEWER_VARIANT = reviewerVariant("kimi", "Kimi reviewer", { defaultPool: false, declaration: "explicit", unavailable: "Kimi reviewer unavailable: runtime and isolation verification deferred to #533" }, KIMI_DISPLAY);
-  AGY_DEFINITION = {
-    ...reviewerVariant("agy", "agy reviewer", { defaultPool: false, declaration: "automatic", unavailable: "agy reviewer unavailable: native adapter and isolation verification deferred to #533" }, { palette: { fg: "#6558a6", bg: "#f1effa" } }),
+  KIMI_REVIEWER_VARIANT = reviewerVariant("kimi", "Kimi reviewer", { backend: kimiReviewerBackend, defaultPool: true, declaration: "explicit" }, KIMI_DISPLAY);
+  AGY_REVIEWER_VARIANT = {
+    ...reviewerVariant("agy", "agy reviewer", { defaultPool: false, declaration: "automatic", unavailable: "agy is an implementer peer (#485)" }, { palette: { fg: "#6558a6", bg: "#f1effa" } }),
     optional: true
   };
 });
 
+// src/adapters/agy/hooks.ts
+import { closeSync as closeSync3, constants as constants3, fstatSync as fstatSync2, lstatSync as lstatSync8, openSync as openSync3, readSync as readSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { isAbsolute as isAbsolute5, join as join13, relative as relative5 } from "path";
+import { createHash as createHash6 } from "crypto";
+function decodeAgyHook(event, value) {
+  if (!EVENTS.includes(event) || !record3(value) || typeof value.conversationId !== "string" || !UUID.test(value.conversationId) || typeof value.transcriptPath !== "string" || !isAbsolute5(value.transcriptPath) || value.transcriptPath.length > 4096 || !Array.isArray(value.workspacePaths) || !value.workspacePaths.length || value.workspacePaths.length > 32 || !value.workspacePaths.every((path) => typeof path === "string" && path.length <= 4096 && isAbsolute5(path)))
+    return;
+  if (event === "Stop" && typeof value.fullyIdle !== "boolean")
+    return;
+  const call = record3(value.toolCall) ? value.toolCall : undefined;
+  if ((event === "PreToolUse" || event === "PostToolUse") && (!call || typeof call.name !== "string" || call.name.length > 128 || !record3(call.args)))
+    return;
+  const native = call?.args;
+  const observedRead = call?.name === "view_file" && typeof native?.AbsolutePath === "string";
+  const phase = { SessionStart: "session", PreInvocation: "start", PostInvocation: "post", PreToolUse: "pre", PostToolUse: "post", Stop: "stop" }[event];
+  return {
+    event,
+    phase,
+    sessionId: value.conversationId,
+    transcriptPath: value.transcriptPath,
+    workspacePaths: value.workspacePaths,
+    tool: observedRead ? "Read" : typeof call?.name === "string" ? call.name : "",
+    input: observedRead ? { file_path: native.AbsolutePath } : native ?? {},
+    ...Number.isSafeInteger(value.stepIdx) && value.stepIdx >= 0 ? { toolUseId: `${value.conversationId}:${value.stepIdx}` } : {},
+    ...Number.isSafeInteger(value.invocationNum) && value.invocationNum >= 0 ? { invocation: value.invocationNum } : {},
+    ...event === "Stop" ? { fullyIdle: value.fullyIdle, terminationReason: typeof value.terminationReason === "string" ? value.terminationReason : "" } : {}
+  };
+}
+function encodeAgyHook(event, text) {
+  if (text && (event === "SessionStart" || event === "PreInvocation"))
+    return { injectSteps: [{ ephemeralMessage: text }] };
+  return;
+}
+function readAgyTranscript(session, transcript) {
+  const empty = { factIds: [] };
+  if (!UUID.test(session))
+    return empty;
+  const home = process.env.HOME ?? homedir4();
+  const candidates = ["antigravity-cli", "antigravity", "antigravity-ide"].map((surface) => join13(home, ".gemini", surface, "brain", session, ".system_generated/logs/transcript_full.jsonl"));
+  if (!candidates.includes(transcript))
+    return empty;
+  let fd;
+  try {
+    let cursor = home;
+    for (const name of relative5(home, transcript).split("/")) {
+      cursor = join13(cursor, name);
+      if (lstatSync8(cursor).isSymbolicLink())
+        return empty;
+    }
+    fd = openSync3(transcript, constants3.O_RDONLY | constants3.O_NOFOLLOW);
+    const stat = fstatSync2(fd);
+    if (!stat.isFile() || stat.nlink !== 1)
+      return empty;
+    const cap = 4 * 1024 * 1024;
+    for (let window = 64 * 1024;; window = Math.min(cap, window * 2)) {
+      const start = Math.max(0, stat.size - window), from = start > 0 ? start - 1 : 0;
+      const buffer = Buffer.alloc(stat.size - from);
+      let bytes = 0;
+      while (bytes < buffer.length) {
+        const count = readSync2(fd, buffer, bytes, buffer.length - bytes, from + bytes);
+        if (!count)
+          break;
+        bytes += count;
+      }
+      const lines = buffer.subarray(0, bytes).toString("utf8").split(`
+`);
+      if (start)
+        lines.shift();
+      const out = { factIds: [] };
+      for (const line of lines) {
+        let row;
+        try {
+          row = JSON.parse(line);
+        } catch {
+          continue;
+        }
+        if (!record3(row) || row.status !== "DONE")
+          continue;
+        if (row.source === "SYSTEM_SDK" && row.type === "EPHEMERAL_MESSAGE" && typeof row.content === "string") {
+          for (const match of row.content.matchAll(/agent-hub facts \[([a-zA-Z0-9-]{1,128})\]/g))
+            out.factIds.push(match[1]);
+        }
+        if (row.source === "MODEL" && row.type === "PLANNER_RESPONSE" && Number.isSafeInteger(row.step_index) && typeof row.content === "string" && row.content.trim().length > 0 && (!Array.isArray(row.tool_calls) || row.tool_calls.length === 0))
+          out.completion = { id: createHash6("sha256").update(`${session}:${row.step_index}:${line}`).digest("hex"), index: row.step_index };
+      }
+      if (out.completion || start === 0 || window === cap)
+        return out;
+    }
+  } catch {
+    return empty;
+  } finally {
+    if (fd !== undefined)
+      closeSync3(fd);
+  }
+}
+var EVENTS, UUID, record3 = (value) => !!value && typeof value === "object" && !Array.isArray(value), AGY_FACTS_HOOK;
+var init_hooks = __esm(() => {
+  EVENTS = ["SessionStart", "PreInvocation", "PostInvocation", "PreToolUse", "PostToolUse", "Stop"];
+  UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  AGY_FACTS_HOOK = { decode: decodeAgyHook, encode: encodeAgyHook, read: readAgyTranscript };
+});
+
+// src/adapters/agy/definition.ts
+function agyLaunch(ctx) {
+  const argv = ["agy", ...ctx.userArgs], command = argv.map(shellQuote).join(" ");
+  const metadata = { packageEntrypoint: ctx.entrypoint, command, argv, env: {}, kind: "agy", peer: ctx.instance };
+  return { cmd: "agy", args: ctx.userArgs, metadata };
+}
+var DISPLAY, shellQuote = (value) => `'${value.replace(/'/g, `'\\''`)}'`, AGY_DEFINITION;
+var init_definition = __esm(() => {
+  init_reviewer_variants();
+  init_hooks();
+  DISPLAY = { palette: { fg: "#6558a6", bg: "#f1effa" } };
+  AGY_DEFINITION = {
+    api: 1,
+    kind: "agy",
+    displayName: "Antigravity",
+    family: "agy",
+    transport: "ws-pull",
+    roles: ["implementer", "verifier"],
+    optional: true,
+    defaultOnRoster: false,
+    trust: { onPrem: false, hubSandboxed: false },
+    start: {
+      forms: ["tui"],
+      defaultForm: "tui",
+      ownsTerminal: (form) => form === "tui",
+      launch: agyLaunch,
+      conductorStartable: false,
+      hubSwitches: [],
+      ownedFlags: ["--new", "--continue", "--conversation", "--resume"],
+      conductorStartArgs: (args) => args.length ? new Error("conductor starts accept no launch overrides; use ahub agy") : {}
+    },
+    identity: { mcp: "channel-plugin" },
+    attach: {
+      pullOnlyForms: ["tui"],
+      recoveryLaunch: (instance) => ({ kind: "agy", peer: instance }),
+      pullOnlyNotice: "pull-only: messages wait for hub_inbox; permission modes and session recovery are not managed"
+    },
+    permission: {
+      modes: {},
+      unmanaged: "Antigravity selects its own permission mode in its TUI; no hub permission mode",
+      unmanagedForms: ["tui"],
+      unmanagedNote: "Antigravity approves tools in its own TUI; no hub permission mode",
+      unmanagedStatusNote: "unmanaged native permission policy"
+    },
+    session: {
+      idField: "sessionId",
+      currentId: () => {
+        return;
+      },
+      freshOnRestore: true,
+      recoveryRefusal: () => "Antigravity session continuity and resume are unavailable until native behavior is verified"
+    },
+    turnEnd: "native-hook",
+    cli: { command: "agy", authority: "person", startWords: () => ["agy"] },
+    display: DISPLAY,
+    routing: { allowedRoles: ["implementer", "verifier"] },
+    reviewer: { defaultPool: false, declaration: "automatic", unavailable: "agy is an implementer peer (#485)" },
+    reviewerVariant: AGY_REVIEWER_VARIANT,
+    hooks: { factsHook: AGY_FACTS_HOOK }
+  };
+});
+
+// src/adapters/definitions/native-cli-preview-common.ts
+function publicArg(arg) {
+  const flags = new Set(["--settings", "--model", "--mcp-config", "--session-id", "--session-file", "--resume", "--continue", "--print", "--safe", "--new"]);
+  const key = arg.split("=", 1)[0];
+  return flags.has(key) ? arg.includes("=") ? key + "=" + REDACTED : key : REDACTED;
+}
+function nativeCommand(command, trusted) {
+  return command.map((value, i) => value === trusted[i] ? value : REDACTED);
+}
+function previewState(args, baseEnvNames) {
+  const unresolved = [];
+  const envNames = [...baseEnvNames];
+  const value = (flag) => {
+    const at = args.indexOf(flag);
+    if (at < 0)
+      return;
+    const next = args[at + 1];
+    if (!next || next.startsWith("--"))
+      throw new Error("missing option value");
+    return next;
+  };
+  return { unresolved, envNames, value };
+}
+function finishPreview(ctx, launch, envNames, unresolved, metadata, settings) {
+  return { tool: ctx.tool, ...metadata ?? {}, cmd: launch.cmd, args: launch.args, settings, envNames: [...new Set(envNames)].sort(), ...launch.warning ? { warning: launch.warning } : {}, unresolved, redaction: "Arbitrary user arguments, settings, commands and configured executable overrides are redacted. Environment values are never displayed.", needs: ["Native executable, accounts and runtime readiness are not checked."] };
+}
+var REDACTED = "[redacted]", UNRESOLVED = "[unresolved]";
+
+// src/hub/status-roster.ts
+function rosterInStatus(status, peer) {
+  const rows = status?.roster;
+  if (!Array.isArray(rows))
+    return;
+  const row = rows.find((r) => !!r && typeof r === "object" && r.peer === peer);
+  return typeof row?.on === "boolean" ? row.on : undefined;
+}
+function bundleInStatus(status) {
+  const value = status?.pluginBundle;
+  return typeof value === "string" && value.startsWith("/") && /[\\/]plugins[\\/]agent-hub[\\/]server\.js$/.test(value) ? value : undefined;
+}
+
+// src/cli/agy-mcp.ts
+import { randomUUID as randomUUID5 } from "crypto";
+import { closeSync as closeSync4, fstatSync as fstatSync3, lstatSync as lstatSync9, mkdirSync as mkdirSync6, openSync as openSync4, readFileSync as readFileSync6, renameSync, rmdirSync, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
+import { isAbsolute as isAbsolute6, join as join14, resolve as resolve10 } from "path";
+import { isDeepStrictEqual } from "util";
+function object4(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function jsonFile(value, name) {
+  if (!object4(value))
+    throw new Error(`${name} must be a JSON object`);
+  return value;
+}
+function parseJson(bytes, name) {
+  try {
+    return jsonFile(JSON.parse(bytes.toString("utf8")), name);
+  } catch (error) {
+    if (error instanceof SyntaxError)
+      throw new Error(`${name} is invalid JSON`);
+    throw error;
+  }
+}
+function shellQuote2(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function shellUnquote(value) {
+  if (!value.startsWith("'") || !value.endsWith("'"))
+    return;
+  let out = "";
+  for (let index = 1;index < value.length - 1; ) {
+    if (value.startsWith("'\\''", index)) {
+      out += "'";
+      index += 4;
+    } else if (value[index] === "'")
+      return;
+    else
+      out += value[index++];
+  }
+  return out;
+}
+function validateOptions(options) {
+  const peer = options.peer ?? "agy";
+  if (!/^[a-z][a-z0-9-]{0,31}$/.test(peer))
+    throw new Error("agy peer id is invalid");
+  for (const [name, value] of Object.entries({ projectRoot: options.projectRoot, stateDir: options.stateDir, serverJs: options.serverJs, hookScript: options.hookScript })) {
+    if (typeof value !== "string" || !isAbsolute6(value) || value.length > 4096 || /[\u0000-\u001f\u007f]/.test(value))
+      throw new Error(`${name} must be an absolute control-free path`);
+  }
+  for (const [name, value] of Object.entries({ instanceId: options.instanceId, launchId: options.launchId })) {
+    if (typeof value !== "string" || !/^[A-Za-z0-9._:-]{1,128}$/.test(value))
+      throw new Error(`${name} is invalid`);
+  }
+  const root = resolve10(options.projectRoot);
+  return { root, peer };
+}
+function safeDirectory(path) {
+  const stat = lstatSync9(path, { throwIfNoEntry: false });
+  if (stat && (!stat.isDirectory() || stat.isSymbolicLink()))
+    throw new Error(`${path} must be a project directory, not a link`);
+  return stat;
+}
+function safeFile(path) {
+  const stat = lstatSync9(path, { throwIfNoEntry: false });
+  if (!stat)
+    return;
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > MAX_CONFIG_BYTES)
+    throw new Error(`${path} must be a bounded regular file, not a link`);
+  const bytes = readFileSync6(path);
+  if (bytes.length > MAX_CONFIG_BYTES)
+    throw new Error(`${path} exceeds the configuration size limit`);
+  return { stat, bytes };
+}
+function pluginDirectories(root) {
+  const directories = [];
+  for (const relative of [".", ".agents", ".agents/plugins", PLUGIN_DIR]) {
+    const path = relative === "." ? root : join14(root, relative);
+    const stat = safeDirectory(path);
+    if (!stat)
+      throw new Error(`${path} must be an existing project directory`);
+    directories.push({ path, stat });
+  }
+  return directories;
+}
+function verifyPluginDirectory(plan, target) {
+  if (!plan.canonicalPluginDir || !plan.directories)
+    throw new Error("managed agy plugin directory identity is unavailable");
+  if (realPath(plan.root) !== plan.canonicalRoot || realPath(plan.pluginDir) !== plan.canonicalPluginDir || plan.canonicalPluginDir !== join14(plan.canonicalRoot, PLUGIN_DIR)) {
+    throw new Error("managed agy plugin path changed; inspect it before writing");
+  }
+  for (const expected of plan.directories) {
+    const current = safeDirectory(expected.path);
+    if (!current || current.dev !== expected.stat.dev || current.ino !== expected.stat.ino)
+      throw new Error("managed agy plugin directory changed; inspect it before writing");
+  }
+  if (!FILES.some((file) => join14(plan.root, file) === target)) {
+    throw new Error("atomic write target is outside the managed agy plugin files");
+  }
+}
+function hookCommand(phase, options, peer) {
+  return `AGENTHUB_HOOK_EVENT='${phase}' AGENTHUB_INSTANCE_ID='${options.instanceId}' AGENTHUB_LAUNCH_ID='${options.launchId}' AGENTHUB_HOOK_PURPOSE='facts' AGENTHUB_PEER_ID=${shellQuote2(peer)} AGENTHUB_STATE_DIR=${shellQuote2(options.stateDir)} AGENTHUB_PROJECT_DIR=${shellQuote2(resolve10(options.projectRoot))} bun ${shellQuote2(options.hookScript)}`;
+}
+function desired(options, root, peer) {
+  const events = {};
+  for (const phase of EVENTS2) {
+    if (phase === "PostInvocation") {
+      events[phase] = [];
+      continue;
+    }
+    const command = { type: "command", command: hookCommand(phase, options, peer), timeout: 5 };
+    events[phase] = phase === "PreToolUse" || phase === "PostToolUse" ? [{ matcher: ".*", hooks: [command] }] : [command];
+  }
+  return {
+    [MANIFEST_FILE]: { name: PLUGIN_KEY, description: MANAGED_DESCRIPTION },
+    [MCP_FILE]: { mcpServers: { [PLUGIN_KEY]: { command: "bun", args: ["run", options.serverJs], env: { AGENTHUB_PEER_ID: peer, AGENTHUB_STATE_DIR: options.stateDir, AGENTHUB_PROJECT_DIR: root } } } },
+    [HOOKS_FILE]: { [PLUGIN_KEY]: events }
+  };
+}
+function parseManagedHookCommand(command, phase, options, peer) {
+  if (typeof command !== "string")
+    return;
+  const prefix = `AGENTHUB_HOOK_EVENT='${phase}' AGENTHUB_INSTANCE_ID='`;
+  const middle = `' AGENTHUB_LAUNCH_ID='`;
+  const suffix = `' AGENTHUB_HOOK_PURPOSE='facts' AGENTHUB_PEER_ID=${shellQuote2(peer)} AGENTHUB_STATE_DIR=${shellQuote2(options.stateDir)} AGENTHUB_PROJECT_DIR=${shellQuote2(resolve10(options.projectRoot))} bun `;
+  if (!command.startsWith(prefix))
+    return;
+  const rest = command.slice(prefix.length);
+  const launchSplit = rest.indexOf(middle);
+  if (launchSplit < 1)
+    return;
+  const instanceId = rest.slice(0, launchSplit);
+  const afterInstance = rest.slice(launchSplit + middle.length);
+  const pathSplit = afterInstance.indexOf(suffix);
+  if (pathSplit < 1)
+    return;
+  const launchId = afterInstance.slice(0, pathSplit);
+  const hookScript = shellUnquote(afterInstance.slice(pathSplit + suffix.length));
+  if (!/^[A-Za-z0-9._:-]{1,128}$/.test(instanceId) || !/^[A-Za-z0-9._:-]{1,128}$/.test(launchId) || !hookScript || !isAbsolute6(hookScript) || !hookScript.endsWith("/src/cli/facts-hook.ts"))
+    return;
+  return { instanceId, launchId };
+}
+function managedHookLaunch(value, options, peer) {
+  if (Object.keys(value).length !== 1 || !Object.hasOwn(value, PLUGIN_KEY))
+    return;
+  const events = value[PLUGIN_KEY];
+  if (!object4(events) || Object.keys(events).length !== EVENTS2.length || EVENTS2.some((phase) => !Object.hasOwn(events, phase)))
+    return;
+  let identity;
+  for (const phase of EVENTS2) {
+    const rows = events[phase];
+    if (phase === "PostInvocation") {
+      if (!Array.isArray(rows) || rows.length !== 0)
+        return;
+      continue;
+    }
+    if (!Array.isArray(rows) || rows.length !== 1 || !object4(rows[0]))
+      return;
+    let command;
+    if (phase === "PreToolUse" || phase === "PostToolUse") {
+      const row = rows[0];
+      if (Object.keys(row).sort().join(",") !== "hooks,matcher" || row.matcher !== ".*" || !Array.isArray(row.hooks) || row.hooks.length !== 1 || !object4(row.hooks[0]))
+        return;
+      command = row.hooks[0];
+    } else
+      command = rows[0];
+    if (!object4(command) || Object.keys(command).sort().join(",") !== "command,timeout,type" || command.type !== "command" || command.timeout !== 5)
+      return;
+    const found = parseManagedHookCommand(command.command, phase, options, peer);
+    if (!found || identity && (identity.instanceId !== found.instanceId || identity.launchId !== found.launchId))
+      return;
+    identity = found;
+  }
+  return identity;
+}
+function nextDocuments(current, wanted) {
+  const nextMcp = current[MCP_FILE] ? { ...current[MCP_FILE] } : {};
+  const currentServers = nextMcp.mcpServers;
+  const servers = currentServers === undefined ? {} : currentServers;
+  if (!object4(servers))
+    throw new Error(`${MCP_FILE} mcpServers must be an object`);
+  nextMcp.mcpServers = { ...servers, [PLUGIN_KEY]: wanted[MCP_FILE].mcpServers[PLUGIN_KEY] };
+  return { [MANIFEST_FILE]: wanted[MANIFEST_FILE], [MCP_FILE]: nextMcp, [HOOKS_FILE]: wanted[HOOKS_FILE] };
+}
+function internalPlan(options) {
+  const { root, peer } = validateOptions(options);
+  const rootStat = safeDirectory(root);
+  if (!rootStat)
+    throw new Error("project root must be an existing directory");
+  const canonicalRoot = realPath(root);
+  const pluginDir = join14(root, PLUGIN_DIR);
+  let parentsPresent = true;
+  for (const relative of [".agents", ".agents/plugins", PLUGIN_DIR]) {
+    if (!parentsPresent)
+      break;
+    parentsPresent = !!safeDirectory(join14(root, relative));
+  }
+  let directories;
+  let canonicalPluginDir;
+  if (parentsPresent) {
+    directories = pluginDirectories(root);
+    canonicalPluginDir = realPath(pluginDir);
+    if (canonicalPluginDir !== join14(canonicalRoot, PLUGIN_DIR))
+      throw new Error("managed agy plugin path traverses a symlink");
+  }
+  const snapshots = Object.fromEntries(FILES.map((relative) => {
+    const path = join14(root, relative);
+    const found = parentsPresent ? safeFile(path) : undefined;
+    return [relative, found];
+  }));
+  const current = {};
+  for (const relative of FILES) {
+    const found = snapshots[relative];
+    current[relative] = found ? parseJson(found.bytes, relative) : undefined;
+  }
+  const manifest = current[MANIFEST_FILE];
+  if (manifest && (Object.keys(manifest).sort().join(",") !== "description,name" || manifest.name !== PLUGIN_KEY || manifest.description !== MANAGED_DESCRIPTION)) {
+    throw new Error(`${MANIFEST_FILE} is a foreign agent-hub plugin manifest; it was not changed`);
+  }
+  const mcp = current[MCP_FILE];
+  if (mcp) {
+    if (Object.hasOwn(mcp, "mcpServers") && !object4(mcp.mcpServers))
+      throw new Error(`${MCP_FILE} mcpServers must be an object`);
+    const entry = mcp.mcpServers?.[PLUGIN_KEY];
+    if (entry !== undefined && (!object4(entry) || Object.keys(entry).sort().join(",") !== "args,command,env" || entry.command !== "bun" || !Array.isArray(entry.args) || entry.args.length !== 2 || entry.args[0] !== "run" || typeof entry.args[1] !== "string" || !isAbsolute6(entry.args[1]) || !object4(entry.env) || Object.keys(entry.env).sort().join(",") !== "AGENTHUB_PEER_ID,AGENTHUB_PROJECT_DIR,AGENTHUB_STATE_DIR" || entry.env.AGENTHUB_PEER_ID !== peer || entry.env.AGENTHUB_PROJECT_DIR !== root || entry.env.AGENTHUB_STATE_DIR !== options.stateDir)) {
+      throw new Error(`${MCP_FILE} agent-hub is a foreign MCP entry; it was not changed`);
+    }
+  }
+  const hooks = current[HOOKS_FILE];
+  const oldLaunch = hooks ? managedHookLaunch(hooks, options, peer) : undefined;
+  if (hooks && !oldLaunch)
+    throw new Error(`${HOOKS_FILE} agent-hub is a foreign hooks entry; it was not changed`);
+  const wanted = desired(options, root, peer);
+  const docs = nextDocuments(current, wanted);
+  const targets = FILES.map((relative) => {
+    const old = snapshots[relative];
+    const next = Buffer.from(`${JSON.stringify(docs[relative], null, 2)}
+`);
+    return { path: join14(root, relative), relative, ...old ? { current: old.bytes, stat: old.stat } : {}, next, changed: !old || !isDeepStrictEqual(current[relative], docs[relative]) };
+  });
+  const git = memoryGitSync(["ls-files", "--", ...FILES], { cwd: root, encoding: "utf8", timeout: 3000 });
+  const tracked = git.status === 0 && !!git.stdout.trim();
+  const changed = targets.some((target) => target.changed);
+  return { file: pluginDir, tracked, changed, action: changed ? "create or update the managed agent-hub plugin" : "keep the managed agent-hub plugin", root, pluginDir, canonicalRoot, ...canonicalPluginDir ? { canonicalPluginDir } : {}, ...directories ? { directories } : {}, targets };
+}
+function identityMatches(path, before) {
+  const now = lstatSync9(path, { throwIfNoEntry: false });
+  return before ? !!now && now.dev === before.dev && now.ino === before.ino : !now;
+}
+function atomicWrite(path, bytes, expected, plan) {
+  const temporary = `${path}.${randomUUID5()}.tmp`;
+  let fd;
+  let tempIdentity;
+  try {
+    verifyPluginDirectory(plan, path);
+    fd = openSync4(temporary, "wx", 384);
+    const tempStat = fstatSync3(fd);
+    tempIdentity = { dev: tempStat.dev, ino: tempStat.ino };
+    writeFileSync4(fd, bytes);
+    closeSync4(fd);
+    fd = undefined;
+    verifyPluginDirectory(plan, path);
+    if (!identityMatches(path, expected))
+      throw new Error(`${path} changed while the managed plugin was being written`);
+    renameSync(temporary, path);
+    const stat = lstatSync9(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1)
+      throw new Error(`${path} changed while the managed plugin was written`);
+    return { dev: stat.dev, ino: stat.ino };
+  } finally {
+    if (fd !== undefined)
+      closeSync4(fd);
+    try {
+      const current = lstatSync9(temporary, { throwIfNoEntry: false });
+      if (current && tempIdentity && current.dev === tempIdentity.dev && current.ino === tempIdentity.ino)
+        unlinkSync(temporary);
+    } catch {}
+  }
+}
+function rollback(plan, written, createdDirs) {
+  for (const { target, own } of written.reverse()) {
+    try {
+      const now = lstatSync9(target.path, { throwIfNoEntry: false });
+      if (!now || now.dev !== own.dev || now.ino !== own.ino)
+        continue;
+      if (target.current)
+        atomicWrite(target.path, target.current, now, plan);
+      else
+        unlinkSync(target.path);
+    } catch {}
+  }
+  for (const { path, dev, ino } of createdDirs.reverse()) {
+    try {
+      const now = lstatSync9(path);
+      if (now.isDirectory() && !now.isSymbolicLink() && now.dev === dev && now.ino === ino)
+        rmdirSync(path);
+    } catch {}
+  }
+}
+function ensureAgyMcp(options) {
+  const plan = internalPlan(options);
+  if (!plan.changed)
+    return { changed: false, tracked: plan.tracked };
+  const createdDirs = [];
+  const written = [];
+  try {
+    for (const relative of [".agents", ".agents/plugins", PLUGIN_DIR]) {
+      const path = join14(plan.root, relative);
+      const prior = safeDirectory(path);
+      if (prior)
+        continue;
+      mkdirSync6(path, { mode: 448 });
+      const stat = safeDirectory(path);
+      createdDirs.push({ path, dev: stat.dev, ino: stat.ino });
+    }
+    plan.directories = pluginDirectories(plan.root);
+    plan.canonicalPluginDir = realPath(plan.pluginDir);
+    if (plan.canonicalRoot !== realPath(plan.root) || plan.canonicalPluginDir !== join14(plan.canonicalRoot, PLUGIN_DIR))
+      throw new Error("managed agy plugin path changed; inspect it before writing");
+    for (const target of plan.targets) {
+      if (!target.changed)
+        continue;
+      if (!identityMatches(target.path, target.stat))
+        throw new Error(`${target.path} changed while the managed plugin was being prepared`);
+      const own = atomicWrite(target.path, target.next, target.stat, plan);
+      written.push({ target, own });
+    }
+  } catch (error) {
+    rollback(plan, written, createdDirs);
+    throw error;
+  }
+  return { changed: true, tracked: plan.tracked };
+}
+function cleanupAgyMcp(options) {
+  const plan = internalPlan(options);
+  const present = plan.targets.filter((target) => target.current !== undefined);
+  if (!present.length)
+    return;
+  if (present.length !== FILES.length)
+    throw new Error("managed agy plugin is incomplete; inspect it before cleanup");
+  const currentHooks = parseJson(readFileSync6(join14(plan.root, HOOKS_FILE)), HOOKS_FILE);
+  const launch = managedHookLaunch(currentHooks, options, options.peer ?? "agy");
+  if (!launch || launch.instanceId !== options.instanceId || launch.launchId !== options.launchId)
+    return;
+  if (plan.changed)
+    return;
+  const deleted = [];
+  try {
+    for (const target of plan.targets) {
+      const stat = lstatSync9(target.path);
+      if (!target.stat || stat.dev !== target.stat.dev || stat.ino !== target.stat.ino)
+        throw new Error(`${target.path} changed before agy plugin cleanup`);
+    }
+    for (const target of plan.targets) {
+      if (!identityMatches(target.path, target.stat))
+        throw new Error(`${target.path} changed before agy plugin cleanup`);
+      if (target.relative === MCP_FILE) {
+        const currentMcp = parseJson(target.current, MCP_FILE);
+        const servers = { ...currentMcp.mcpServers };
+        delete servers[PLUGIN_KEY];
+        const nextMcp = { ...currentMcp, mcpServers: servers };
+        const retain = Object.keys(servers).length > 0 || Object.keys(currentMcp).some((key) => key !== "mcpServers");
+        if (retain) {
+          const own = atomicWrite(target.path, Buffer.from(`${JSON.stringify(nextMcp, null, 2)}
+`), target.stat, plan);
+          deleted.push({ path: target.path, bytes: target.current, own });
+        } else {
+          unlinkSync(target.path);
+          deleted.push({ path: target.path, bytes: target.current });
+        }
+      } else {
+        unlinkSync(target.path);
+        deleted.push({ path: target.path, bytes: target.current });
+      }
+    }
+  } catch (error) {
+    for (const item of deleted.reverse()) {
+      try {
+        const current = lstatSync9(item.path, { throwIfNoEntry: false });
+        if (item.own) {
+          if (current?.dev === item.own.dev && current.ino === item.own.ino)
+            atomicWrite(item.path, item.bytes, current, plan);
+        } else if (!current)
+          atomicWrite(item.path, item.bytes, undefined, plan);
+      } catch {}
+    }
+    throw error;
+  }
+}
+var PLUGIN_DIR = ".agents/plugins/agent-hub", PLUGIN_KEY = "agent-hub", MANIFEST_FILE, MCP_FILE, HOOKS_FILE, FILES, EVENTS2, MANAGED_DESCRIPTION = "Managed by ahub agy launcher.", MAX_CONFIG_BYTES;
+var init_agy_mcp = __esm(() => {
+  init_git();
+  init_project();
+  MANIFEST_FILE = `${PLUGIN_DIR}/plugin.json`;
+  MCP_FILE = `${PLUGIN_DIR}/mcp_config.json`;
+  HOOKS_FILE = `${PLUGIN_DIR}/hooks.json`;
+  FILES = [MANIFEST_FILE, MCP_FILE, HOOKS_FILE];
+  EVENTS2 = ["SessionStart", "PreInvocation", "PostInvocation", "PreToolUse", "PostToolUse", "Stop"];
+  MAX_CONFIG_BYTES = 256 * 1024;
+});
+
+// src/adapters/agy/entry.ts
+import { spawn as spawn9, spawnSync as spawnSync4 } from "child_process";
+import { resolve as resolve11 } from "path";
+function agyTuiSpawnOptions(cwd, env) {
+  return { cwd, env, stdio: "inherit" };
+}
+function runAgyTui(argv, cwd, env) {
+  const child = spawn9("agy", argv, agyTuiSpawnOptions(cwd, env));
+  return new Promise((resolveExit, reject) => {
+    const forward = (signal) => {
+      if (child.exitCode !== null || child.signalCode !== null)
+        return;
+      try {
+        child.kill(signal);
+      } catch {}
+    };
+    const onInterrupt = () => forward("SIGINT");
+    const onTerminate = () => forward("SIGTERM");
+    const onHangup = () => forward("SIGHUP");
+    const cleanup = () => {
+      process.off("SIGINT", onInterrupt);
+      process.off("SIGTERM", onTerminate);
+      process.off("SIGHUP", onHangup);
+    };
+    process.on("SIGINT", onInterrupt);
+    process.on("SIGTERM", onTerminate);
+    process.on("SIGHUP", onHangup);
+    child.once("error", (error) => {
+      cleanup();
+      reject(error);
+    });
+    child.once("close", (code) => {
+      cleanup();
+      resolveExit(code ?? 1);
+    });
+  });
+}
+async function runAgyEntry(ctx) {
+  const { args, cwd, stateDir, cliDir, connect, fail } = ctx;
+  if (ctx.instance)
+    fail("extra Antigravity TUI instances are not verified in P1");
+  const preview = args.includes("--print-command") || args.includes("--dry-run");
+  const unattended = ctx.unattendedEnv || args.includes("--unattended");
+  const nativeArgs = args.filter((arg) => !["--print-command", "--dry-run", "--unattended"].includes(arg));
+  if (nativeArgs.some((arg) => ["--print", "-p", "--prompt", "--input-format", "--output-format", "--conversation", "--continue", "-c", "--new", "--mode", "--dangerously-skip-permissions"].some((flag) => arg === flag || arg.startsWith(`${flag}=`))))
+    fail("agy P1 supports a fresh TUI only; headless, resume and permission flags need a verified mapping");
+  if (unattended)
+    fail("agy P1 native permissions are unmanaged; unattended mode has no verified prompt mapping");
+  const argv = nativeArgs;
+  if (preview) {
+    console.log(JSON.stringify({ command: "agy", args: argv.map(publicArg), mode: "tui", permission: "unmanaged", mcp: ".agents/plugins/agent-hub/", writes: false }));
+    return;
+  }
+  const version = spawnSync4("agy", ["--version"], { encoding: "utf8", timeout: 5000, maxBuffer: 4096, env: peerChildEnv("agy") });
+  if (version.status !== 0 || version.stdout.trim() !== "1.4.2")
+    fail("agy P1 requires the verified Antigravity CLI 1.4.2");
+  const hub = await connect();
+  let options;
+  let pluginWritten = false;
+  try {
+    if (!hub.features.includes("native_hook_launch"))
+      fail("running hub lacks the verified native hook launcher; upgrade or restart it before launching agy");
+    const status = (await hub.request({ t: "status" })).status;
+    if (rosterInStatus(status, "agy") !== true)
+      fail("agy is off roster; add it with ahub roster add agy");
+    const admitted = await hub.request({ t: "native_hook_launch", op: "begin", peer: "agy" });
+    if (!admitted.ok || typeof admitted.launchId !== "string" || typeof admitted.instanceId !== "string")
+      fail(admitted.error ?? "native hook launch was not admitted");
+    options = {
+      projectRoot: cwd,
+      stateDir,
+      serverJs: bundleInStatus(status) ?? resolve11(cliDir, "../../plugins/agent-hub/server.js"),
+      hookScript: resolve11(cliDir, "facts-hook.ts"),
+      peer: "agy",
+      launchId: admitted.launchId,
+      instanceId: admitted.instanceId
+    };
+    const written = ensureAgyMcp(options);
+    pluginWritten = written.changed;
+    if (written.tracked)
+      console.error("The managed agy plugin is tracked; review its local machine paths before committing");
+    console.error("Antigravity: pull-only TUI; native permissions unmanaged, no hub sandbox");
+    const env = { ...ctx.helpers.nativeLaunchEnv("agy", ctx.helpers.childEnv()), AGENTHUB_STATE_DIR: stateDir, AGENTHUB_PROJECT_DIR: cwd };
+    delete env.AGENTHUB_CHANNEL;
+    const code = await runAgyTui(argv, cwd, env);
+    if (code !== 0)
+      process.exitCode = code;
+  } finally {
+    if (options) {
+      await hub.request({ t: "native_hook_launch", op: "end", peer: "agy", launchId: options.launchId }).catch(() => {});
+      if (pluginWritten)
+        try {
+          cleanupAgyMcp(options);
+        } catch {
+          console.error("Managed agy plugin cleanup refused: files changed or ownership could not be verified");
+        }
+    }
+    hub.close();
+  }
+}
+var init_entry = __esm(() => {
+  init_agy_mcp();
+  init_child_process();
+});
+
+// src/adapters/definitions/native-cli-retained.ts
+function retainedLaunchWarning(status, peer, definition) {
+  const keys = definition.cli.launchConfigKeys;
+  const retained = status?.retainedConfig;
+  if (!keys?.length || !Array.isArray(retained))
+    return;
+  const pending = retained.flatMap((row) => {
+    if (!row || typeof row !== "object")
+      return [];
+    const key = row.key;
+    return typeof key === "string" && keys.some((candidate) => key === candidate || key.startsWith(`${candidate}.`)) ? [key] : [];
+  });
+  const unique = [...new Set(pending)];
+  return unique.length ? `ahub: config retained: ${unique.join(", ")}; starting ${peer} with the running value; run ahub settings reload to apply the file's value` : undefined;
+}
+
 // src/hub/claude-state.ts
 function claudeStateFile(base, peer) {
   return peer.includes("-") && PEER2.test(peer) ? `${base}.${peer}.json` : `${base}.json`;
@@ -7903,9 +8989,9 @@ var init_claude_state = __esm(() => {
 });
 
 // src/adapters/definitions/native-cli-entry-claude.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join12 } from "path";
-import { randomUUID as randomUUID5 } from "crypto";
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join15 } from "path";
+import { randomUUID as randomUUID6 } from "crypto";
 async function runClaudeEntry(ctx) {
   const { args, cwd, stateDir, cliDir, unattendedEnv, projectConfig, fail } = ctx;
   const peer = ctx.instance ?? "claude";
@@ -7914,6 +9000,10 @@ async function runClaudeEntry(ctx) {
       return console.log(JSON.stringify({ peer, start: "hub", note: "a headless reviewer the hub runs per review" }, null, 2));
     const hub = await ctx.connect();
     try {
+      const snapshot = (await hub.request({ t: "status" })).status;
+      const warning = retainedLaunchWarning(snapshot, peer, ctx.definition);
+      if (warning)
+        console.error(warning);
       const res = await hub.request({ t: "start", peer, operationId: process.env.AGENTHUB_RECOVERY_OPERATION });
       if (res.ok !== true)
         fail(String(res.error ?? `${peer} was not started`));
@@ -7935,20 +9025,20 @@ async function runClaudeEntry(ctx) {
     process.env.AGENTHUB_INSTANCE_ID = control.instanceId;
     const terminal = await recordTerminalLaunch(peer, cwd, stateDir, control.instanceId, ctx.instance ? { executionCwd: cwd } : undefined);
     if (!terminal)
-      process.env.AGENTHUB_LAUNCH_ID = randomUUID5();
+      process.env.AGENTHUB_LAUNCH_ID = randomUUID6();
   }
   let original;
-  for (const file of [join12(cwd, ".claude", "settings.local.json"), join12(cwd, ".claude", "settings.json"), join12(process.env.HOME ?? "", ".claude", "settings.json")]) {
+  for (const file of [join15(cwd, ".claude", "settings.local.json"), join15(cwd, ".claude", "settings.json"), join15(process.env.HOME ?? "", ".claude", "settings.json")]) {
     try {
-      original ??= JSON.parse(readFileSync5(file, "utf8")).statusLine;
+      original ??= JSON.parse(readFileSync7(file, "utf8")).statusLine;
     } catch {}
   }
-  const facts = claudeObservationHooks(projectConfig(), { script: join12(cliDir, "facts-hook.ts"), stateDir });
+  const facts = claudeObservationHooks(projectConfig(), { script: join15(cliDir, "facts-hook.ts"), stateDir });
   let previousLaunch;
   try {
-    previousLaunch = JSON.parse(readFileSync5(join12(stateDir, claudeStateFile("claude-launch", peer)), "utf8"));
+    previousLaunch = JSON.parse(readFileSync7(join15(stateDir, claudeStateFile("claude-launch", peer)), "utf8"));
   } catch {}
-  const launch = buildLaunch("claude", args, { unattended: unattendedEnv, statusLine: { script: join12(cliDir, "statusline-tee.ts"), stateDir, ...original ? { original } : {} }, ...facts ? { facts } : {} });
+  const launch = buildLaunch("claude", args, { unattended: unattendedEnv, statusLine: { script: join15(cliDir, "statusline-tee.ts"), stateDir, ...original ? { original } : {} }, ...facts ? { facts } : {} });
   let result;
   try {
     let launchRecord;
@@ -7992,6 +9082,10 @@ async function runCodexEntry(ctx) {
   if (recovering && !ctx.instance && before?.instanceId)
     await recordTerminalLaunch(peer, cwd, stateDir, before.instanceId);
   const hub = await connect();
+  const snapshot = (await hub.request({ t: "status" })).status;
+  const warning = retainedLaunchWarning(snapshot, peer, ctx.definition);
+  if (warning)
+    console.error(warning);
   const res = await hub.request({ t: "start", peer, args: { unattended: launch0.unattended === true }, operationId: process.env.AGENTHUB_RECOVERY_OPERATION });
   hub.close();
   if (!res.ok)
@@ -8004,27 +9098,16 @@ async function runCodexEntry(ctx) {
   const control = readControl(stateDir);
   if ((!recovering || ctx.instance) && control?.instanceId)
     await recordTerminalLaunch(peer, cwd, stateDir, control.instanceId, ctx.instance ? { executionCwd: ctx.executionCwd } : undefined);
-  const launch = buildLaunch("codex", args, { unattended: unattendedEnv, instance: peer, proxyUrl: res.proxyUrl, codexBin: projectConfig().codex_bin });
+  const runningCodexBin = res.retainedLaunchConfig?.codex_bin;
+  const launch = buildLaunch("codex", args, { unattended: unattendedEnv, instance: peer, proxyUrl: res.proxyUrl, codexBin: typeof runningCodexBin === "string" ? runningCodexBin : projectConfig().codex_bin });
   if (launch0.warning)
     console.error(launch0.warning);
   exec(launch.cmd, launch.args, "codex");
 }
-
-// src/hub/status-roster.ts
-function rosterInStatus(status, peer) {
-  const rows = status?.roster;
-  if (!Array.isArray(rows))
-    return;
-  const row = rows.find((r) => !!r && typeof r === "object" && r.peer === peer);
-  return typeof row?.on === "boolean" ? row.on : undefined;
-}
-function bundleInStatus(status) {
-  const value = status?.pluginBundle;
-  return typeof value === "string" && value.startsWith("/") && /[\\/]plugins[\\/]agent-hub[\\/]server\.js$/.test(value) ? value : undefined;
-}
+var init_native_cli_entry_codex = () => {};
 
 // src/adapters/definitions/native-cli-entry-jcode.ts
-import { resolve as resolve9 } from "path";
+import { resolve as resolve12 } from "path";
 async function runJcodeEntry(ctx) {
   const { args, cwd, stateDir, cliDir, unattendedEnv, connect, fail, takeFlags } = ctx;
   const { launcherPreview, qwenSessionId, configureJcodeMcp } = ctx.helpers;
@@ -8048,7 +9131,10 @@ async function runJcodeEntry(ctx) {
       fail("cannot read jcode's roster membership from the running hub; upgrade or restart it, then retry (nothing was started)");
     if (!rostered)
       fail("jcode is off roster; add it with ahub roster add jcode");
-    const written = configureJcodeMcp(cwd, stateDir, bundleInStatus(snapshot) ?? resolve9(cliDir, "../../plugins/agent-hub/server.js"));
+    const warning = retainedLaunchWarning(snapshot, "jcode", ctx.definition);
+    if (warning)
+      console.error(warning);
+    const written = configureJcodeMcp(cwd, stateDir, bundleInStatus(snapshot) ?? resolve12(cliDir, "../../plugins/agent-hub/server.js"));
     if (written.tracked)
       console.error(".jcode/mcp.json is tracked; review this local machine-path change before committing it");
     const reply = await hub.request({ t: "start", peer: "jcode", args: { mode: "headless", model: one["--model"], providerProfile: one["--provider-profile"], sessionId: one["--session-id"] }, operationId: process.env.AGENTHUB_RECOVERY_OPERATION }, 65000);
@@ -8081,6 +9167,10 @@ async function runQwenEntry(ctx) {
     fail("Qwen TUI is not offered before verification; usage: ahub qwen [--mode headless] [--model <alias>] [--session-id <id>]");
   const hub = await connect();
   try {
+    const snapshot = (await hub.request({ t: "status" })).status;
+    const warning = retainedLaunchWarning(snapshot, peer, ctx.definition);
+    if (warning)
+      console.error(warning);
     const reply = await hub.request({ t: "start", peer, args: { mode: "headless", ...one["--model"] ? { model: one["--model"] } : {}, ...one["--session-id"] ? { sessionId: one["--session-id"] } : {} }, operationId: process.env.AGENTHUB_RECOVERY_OPERATION }, 35000);
     if (!reply.ok)
       fail(reply.error);
@@ -8089,14 +9179,15 @@ async function runQwenEntry(ctx) {
     hub.close();
   }
 }
+var init_native_cli_entry_qwen = () => {};
 
 // src/adapters/definitions/native-cli-entry-kimi.ts
-import { resolve as resolve10 } from "path";
-import { spawnSync as spawnSync4 } from "child_process";
+import { resolve as resolve13 } from "path";
+import { spawnSync as spawnSync5 } from "child_process";
 async function runKimiEntry(ctx) {
   const peer = ctx.instance ?? "kimi";
   const { args, cwd, stateDir, cliDir, unattendedEnv, projectConfig, connect, fail, takeFlags } = ctx;
-  const { launcherPreview, startModeOf, buildKimiTuiLaunch, configureKimiMcp, nativeLaunchEnv, childEnv } = ctx.helpers;
+  const { launcherPreview, readControl, startModeOf, buildKimiTuiLaunch, configureKimiMcp, nativeLaunchEnv, childEnv } = ctx.helpers;
   if (args.includes("--print-command") || args.includes("--dry-run")) {
     try {
       return console.log(JSON.stringify(launcherPreview("kimi", args, cwd, stateDir, unattendedEnv), null, 2));
@@ -8105,7 +9196,8 @@ async function runKimiEntry(ctx) {
     }
   }
   const { one, rest } = takeFlags(args, ["--mode", "--model"], []);
-  const mode = one["--mode"] ?? (ctx.instance ? "headless" : startModeOf(projectConfig().peers, "kimi")), model = one["--model"];
+  const acceptedMode = readControl(stateDir)?.startModes?.[peer];
+  const mode = one["--mode"] ?? (ctx.instance ? "headless" : acceptedMode ?? startModeOf(projectConfig().peers, "kimi")), model = one["--model"];
   if (ctx.instance && mode !== "headless")
     fail("extra Kimi instances require headless mode");
   if (rest.length || !["tui", "headless"].includes(mode))
@@ -8115,6 +9207,10 @@ async function runKimiEntry(ctx) {
       fail("Kimi's TUI needs a terminal for these options; run in a terminal or add --mode headless");
     const hub = await connect();
     try {
+      const snapshot = (await hub.request({ t: "status" })).status;
+      const warning = retainedLaunchWarning(snapshot, peer, ctx.definition);
+      if (warning)
+        console.error(warning);
       const reply = await hub.request({ t: "peer_start", peer }, 35000);
       if (!reply.ok)
         fail(reply.error);
@@ -8126,25 +9222,29 @@ async function runKimiEntry(ctx) {
   const hub = await connect();
   try {
     if (mode === "tui") {
-      const launch = buildKimiTuiLaunch(projectConfig().kimi_cmd, model);
       const snapshot = (await hub.request({ t: "status" })).status;
       const rostered = rosterInStatus(snapshot, peer);
       if (rostered === undefined)
         fail("cannot read kimi's roster membership from the running hub; upgrade or restart it, then retry (nothing was started)");
       if (!rostered)
         fail("kimi is off roster; add it with ahub roster add kimi");
+      const warning = retainedLaunchWarning(snapshot, peer, ctx.definition);
+      if (warning)
+        console.error(warning);
       const owner = snapshot?.peers?.[peer];
       if (owner && !["offline"].includes(owner.state) && !owner.pullOnly)
         fail("Kimi is running headless; run ahub stop kimi before starting its TUI");
       const admission = await hub.request({ t: "start", peer, args: { mode: "tui" }, operationId: process.env.AGENTHUB_RECOVERY_OPERATION });
       if (!admission.ok)
         fail(admission.error);
+      const runningCommand = admission.retainedLaunchConfig?.kimi_cmd;
+      const launch = buildKimiTuiLaunch(Array.isArray(runningCommand) && runningCommand.every((arg) => typeof arg === "string") ? runningCommand : projectConfig().kimi_cmd, model);
       let result;
       try {
-        const written = configureKimiMcp(cwd, stateDir, bundleInStatus(snapshot) ?? resolve10(cliDir, "../../plugins/agent-hub/server.js"), "tui");
+        const written = configureKimiMcp(cwd, stateDir, bundleInStatus(snapshot) ?? resolve13(cliDir, "../../plugins/agent-hub/server.js"), "tui");
         if (written.tracked)
           console.error(".kimi-code/mcp.json is tracked; the agent-hub entry contains machine paths. Review this local change before committing it.");
-        result = spawnSync4(launch.cmd, launch.args, { cwd, stdio: "inherit", env: { ...nativeLaunchEnv("kimi", childEnv()), AGENTHUB_STATE_DIR: stateDir, AGENTHUB_PROJECT_DIR: cwd } });
+        result = spawnSync5(launch.cmd, launch.args, { cwd, stdio: "inherit", env: { ...nativeLaunchEnv("kimi", childEnv()), AGENTHUB_STATE_DIR: stateDir, AGENTHUB_PROJECT_DIR: cwd } });
       } finally {
         if (admission.admissionId)
           await hub.request({ t: "kimi_launch_end", admissionId: admission.admissionId }).catch(() => {});
@@ -8153,11 +9253,15 @@ async function runKimiEntry(ctx) {
         fail(`cannot run ${launch.cmd}: ${result.error.message}`);
       process.exit(result.status ?? 1);
     }
-    const owner = (await hub.request({ t: "status" })).status?.peers?.[peer];
+    const snapshot = (await hub.request({ t: "status" })).status;
+    const warning = retainedLaunchWarning(snapshot, peer, ctx.definition);
+    if (warning)
+      console.error(warning);
+    const owner = snapshot?.peers?.[peer];
     if (owner?.pullOnly && owner.state !== "offline")
       fail("Kimi runs in a terminal; end it there before starting a headless one");
     if (!ctx.instance)
-      configureKimiMcp(cwd, stateDir, resolve10(cliDir, "../../plugins/agent-hub/server.js"), "headless");
+      configureKimiMcp(cwd, stateDir, resolve13(cliDir, "../../plugins/agent-hub/server.js"), "headless");
     const res = await hub.request({ t: "start", peer, args: { mode: "headless", model }, operationId: process.env.AGENTHUB_RECOVERY_OPERATION });
     if (!res.ok)
       fail(res.error);
@@ -8224,7 +9328,8 @@ async function runPiEntry(ctx) {
     }
   }
   const flags = parsePiFlags(args, fail);
-  const options = { ...flags, mode: flags.mode ?? (ctx.instance ? "headless" : startModeOf(projectConfig().peers, "pi")) };
+  const acceptedMode = ctx.helpers.readControl(stateDir)?.startModes?.[peer];
+  const options = { ...flags, mode: flags.mode ?? (ctx.instance ? "headless" : acceptedMode ?? startModeOf(projectConfig().peers, "pi")) };
   if (ctx.instance && options.mode !== "headless")
     fail("extra Pi instances require headless mode");
   if (flags.mode === undefined && options.mode === "tui" && !(process.stdin.isTTY && process.stdout.isTTY)) {
@@ -8232,6 +9337,10 @@ async function runPiEntry(ctx) {
       fail("Pi's TUI needs a terminal, and these options are not passed to one the hub opens: run this in a terminal, or add --mode headless");
     const hub = await connect();
     try {
+      const snapshot = (await hub.request({ t: "status" })).status;
+      const warning = retainedLaunchWarning(snapshot, peer, ctx.definition);
+      if (warning)
+        console.error(warning);
       const reply = await hub.request({ t: "peer_start", peer }, 35000);
       if (reply.ok !== true) {
         const error = String(reply.error ?? "pi start refused");
@@ -8247,6 +9356,10 @@ async function runPiEntry(ctx) {
   if (recovering && before?.instanceId)
     await recordTerminalLaunch(peer, cwd, stateDir, before.instanceId);
   const hub = await connect();
+  const snapshot = (await hub.request({ t: "status" })).status;
+  const warning = retainedLaunchWarning(snapshot, peer, ctx.definition);
+  if (warning)
+    console.error(warning);
   const res = await hub.request({ t: "start", peer, args: options, operationId: process.env.AGENTHUB_RECOVERY_OPERATION });
   hub.close();
   if (!res.ok)
@@ -8280,21 +9393,31 @@ async function runLocalEntry(ctx) {
   if (args.some((a, i) => i % 2 === 0 && !["--route", "--model"].includes(a)))
     fail("usage: ahub local [--route <id> | --model <id>]");
   const hub = await connect();
+  const snapshot = (await hub.request({ t: "status" })).status;
+  const warning = retainedLaunchWarning(snapshot, peer, ctx.definition);
+  if (warning)
+    console.error(warning);
   const res = await hub.request({ t: "start", peer, args: { route: opt("--route"), model: opt("--model") }, operationId: process.env.AGENTHUB_RECOVERY_OPERATION });
   hub.close();
   if (!res.ok)
     fail(res.error);
   console.log(res.already ? `${peer} is already attached` : `${peer} attached on ${res.model}. Give it work with: ahub say @${peer} "..."`);
 }
+var init_native_cli_entry_local = () => {};
 
 // src/adapters/definitions/native-cli-entry.ts
 var builtinCliEntries;
 var init_native_cli_entry = __esm(() => {
+  init_entry();
   init_native_cli_entry_claude();
+  init_native_cli_entry_codex();
   init_native_cli_entry_jcode();
+  init_native_cli_entry_qwen();
   init_native_cli_entry_kimi();
   init_native_cli_entry_pi();
+  init_native_cli_entry_local();
   builtinCliEntries = Object.freeze([
+    { command: "agy", lifecycleAdmission: true, execute: runAgyEntry },
     { command: "claude", lifecycleAdmission: true, execute: runClaudeEntry },
     { command: "codex", lifecycleAdmission: true, execute: runCodexEntry },
     { command: "jcode", lifecycleAdmission: true, execute: runJcodeEntry },
@@ -8305,37 +9428,9 @@ var init_native_cli_entry = __esm(() => {
   ]);
 });
 
-// src/adapters/definitions/native-cli-preview-common.ts
-function publicArg(arg) {
-  const flags = new Set(["--settings", "--model", "--mcp-config", "--session-id", "--session-file", "--resume", "--continue", "--print", "--safe", "--new"]);
-  const key = arg.split("=", 1)[0];
-  return flags.has(key) ? arg.includes("=") ? key + "=" + REDACTED : key : REDACTED;
-}
-function nativeCommand(command, trusted) {
-  return command.map((value, i) => value === trusted[i] ? value : REDACTED);
-}
-function previewState(args, baseEnvNames) {
-  const unresolved = [];
-  const envNames = [...baseEnvNames];
-  const value = (flag) => {
-    const at = args.indexOf(flag);
-    if (at < 0)
-      return;
-    const next = args[at + 1];
-    if (!next || next.startsWith("--"))
-      throw new Error("missing option value");
-    return next;
-  };
-  return { unresolved, envNames, value };
-}
-function finishPreview(ctx, launch, envNames, unresolved, metadata, settings) {
-  return { tool: ctx.tool, ...metadata ?? {}, cmd: launch.cmd, args: launch.args, settings, envNames: [...new Set(envNames)].sort(), ...launch.warning ? { warning: launch.warning } : {}, unresolved, redaction: "Arbitrary user arguments, settings, commands and configured executable overrides are redacted. Environment values are never displayed.", needs: ["Native executable, accounts and runtime readiness are not checked."] };
-}
-var REDACTED = "[redacted]", UNRESOLVED = "[unresolved]";
-
 // src/adapters/definitions/native-cli-preview-claude.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { join as join13 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join16 } from "path";
 function previewClaude(ctx) {
   const { args, cwd, stateDir, cliDir, unattended, config } = ctx;
   const { buildLaunch, claudeObservationHooks } = ctx.helpers;
@@ -8343,13 +9438,13 @@ function previewClaude(ctx) {
   let envNames = state.envNames;
   let launch;
   let original;
-  for (const file of [join13(cwd, ".claude/settings.local.json"), join13(cwd, ".claude/settings.json"), join13(process.env.HOME ?? "", ".claude/settings.json")]) {
+  for (const file of [join16(cwd, ".claude/settings.local.json"), join16(cwd, ".claude/settings.json"), join16(process.env.HOME ?? "", ".claude/settings.json")]) {
     try {
-      original ??= JSON.parse(readFileSync6(file, "utf8")).statusLine;
+      original ??= JSON.parse(readFileSync8(file, "utf8")).statusLine;
     } catch {}
   }
-  const facts = claudeObservationHooks(config, { script: join13(cliDir, "facts-hook.ts"), stateDir });
-  launch = buildLaunch("claude", args, { preview: true, unattended, statusLine: { script: join13(cliDir, "statusline-tee.ts"), stateDir, ...original ? { original: { command: original.command ? REDACTED : "", ...typeof original.refreshInterval === "number" && Number.isFinite(original.refreshInterval) ? { refreshInterval: original.refreshInterval } : {}, ...typeof original.padding === "number" && Number.isFinite(original.padding) ? { padding: original.padding } : {} } } : {} }, ...facts ? { facts } : {} });
+  const facts = claudeObservationHooks(config, { script: join16(cliDir, "facts-hook.ts"), stateDir });
+  launch = buildLaunch("claude", args, { preview: true, unattended, statusLine: { script: join16(cliDir, "statusline-tee.ts"), stateDir, ...original ? { original: { command: original.command ? REDACTED : "", ...typeof original.refreshInterval === "number" && Number.isFinite(original.refreshInterval) ? { refreshInterval: original.refreshInterval } : {}, ...typeof original.padding === "number" && Number.isFinite(original.padding) ? { padding: original.padding } : {} } } : {} }, ...facts ? { facts } : {} });
   const safeArgs = args.map((arg, i) => {
     if (args[i - 1] === "--settings")
       return "{}";
@@ -8360,7 +9455,7 @@ function previewClaude(ctx) {
     return publicArg(arg);
   });
   const publicLaunch = buildLaunch("claude", safeArgs, { preview: true, unattended, statusLine: {
-    script: join13(cliDir, "statusline-tee.ts"),
+    script: join16(cliDir, "statusline-tee.ts"),
     stateDir,
     ...original ? { original: { command: original.command ? REDACTED : "", ...typeof original.refreshInterval === "number" && Number.isFinite(original.refreshInterval) ? { refreshInterval: original.refreshInterval } : {}, ...typeof original.padding === "number" && Number.isFinite(original.padding) ? { padding: original.padding } : {} } } : {}
   }, facts });
@@ -8393,7 +9488,7 @@ function previewCodex(ctx) {
 var init_native_cli_preview_codex = () => {};
 
 // src/adapters/definitions/native-cli-preview-kimi.ts
-import { join as join14 } from "path";
+import { join as join17 } from "path";
 function previewKimi(ctx) {
   const { args, cwd, stateDir, cliDir, config } = ctx;
   const { childEnv, startModeOf, buildKimiLaunch, buildKimiTuiLaunch, nativeLaunchEnv, kimiMcpPlan } = ctx.helpers;
@@ -8416,14 +9511,14 @@ function previewKimi(ctx) {
     launch = { ...native, cmd: native.cmd === "kimi" ? "kimi" : REDACTED, args: native.args.map((arg) => arg === "--model" || arg === REDACTED ? arg : REDACTED) };
     envNames = Object.keys(nativeLaunchEnv("kimi", childEnv())).concat(["AGENTHUB_STATE_DIR", "AGENTHUB_PROJECT_DIR"]);
   }
-  const { file, action, changed, tracked } = kimiMcpPlan(cwd, stateDir, join14(cliDir, "../../plugins/agent-hub/server.js"), mode);
+  const { file, action, changed, tracked } = kimiMcpPlan(cwd, stateDir, join17(cliDir, "../../plugins/agent-hub/server.js"), mode);
   kimiMetadata = { mode, mcp: { file, action, changed, tracked } };
   return finishPreview(ctx, launch, envNames, unresolved, kimiMetadata);
 }
 var init_native_cli_preview_kimi = () => {};
 
 // src/adapters/definitions/native-cli-preview-pi.ts
-import { join as join15, resolve as resolve11 } from "path";
+import { join as join18, resolve as resolve14 } from "path";
 function previewPi(ctx) {
   const { args, stateDir, cliDir, config } = ctx;
   const { relayModelIds, buildPiLaunch, startModeOf } = ctx.helpers;
@@ -8458,7 +9553,7 @@ function previewPi(ctx) {
     tools: [],
     preamble: REDACTED,
     maxSteps: config.pi.max_steps
-  }, {}, resolve11(join15(cliDir, "../pi/extension.ts")), UNRESOLVED, UNRESOLVED);
+  }, {}, resolve14(join18(cliDir, "../pi/extension.ts")), UNRESOLVED, UNRESOLVED);
   launch = pi;
   envNames = Object.keys(pi.env).concat(["PATH", "HOME", "USER", "SHELL", "TMPDIR", "TERM", "TERM_PROGRAM", "LANG", "LC_ALL", "LC_CTYPE", "NO_COLOR", "CODEX_HOME"].filter((key) => process.env[key] !== undefined));
   if (mode === "tui")
@@ -8471,7 +9566,7 @@ function previewPi(ctx) {
 var init_native_cli_preview_pi = () => {};
 
 // src/adapters/definitions/native-cli-preview-qwen.ts
-import { join as join16 } from "path";
+import { join as join19 } from "path";
 function previewQwen(ctx) {
   const { tool, args, cwd, stateDir, cliDir, config } = ctx;
   const state = previewState(args, ctx.baseEnvNames), { unresolved, value } = state;
@@ -8494,7 +9589,7 @@ function previewQwen(ctx) {
     form: "headless",
     projectRoot: cwd,
     stateDir,
-    entrypoint: join16(cliDir, "main.js"),
+    entrypoint: join19(cliDir, "main.js"),
     userArgs: [],
     unattended: false,
     env: {},
@@ -8602,8 +9697,8 @@ var init_native_config_policy = __esm(() => {
 });
 
 // src/adapters/definitions/native-policy-aux.ts
-import { closeSync as closeSync3, constants as constants3, fstatSync as fstatSync2, openSync as openSync3, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
-import { isAbsolute as isAbsolute5, join as join17, normalize } from "path";
+import { closeSync as closeSync5, constants as constants4, fstatSync as fstatSync4, openSync as openSync5, readdirSync as readdirSync3, readFileSync as readFileSync9 } from "fs";
+import { isAbsolute as isAbsolute7, join as join20, normalize } from "path";
 function claudeCrashPlan(_meta) {
   return { how: "claude: the Claude Code plugin reconnects by itself while that session is still open" };
 }
@@ -8648,13 +9743,13 @@ function localCrashPlan(meta) {
 }
 function claudePlugins(root, cwd) {
   const enabled = new Map;
-  for (const file of [join17(root, "settings.json"), ...cwd ? [join17(cwd, ".claude", "settings.json"), join17(cwd, ".claude", "settings.local.json")] : []]) {
+  for (const file of [join20(root, "settings.json"), ...cwd ? [join20(cwd, ".claude", "settings.json"), join20(cwd, ".claude", "settings.local.json")] : []]) {
     const map = json(file)?.enabledPlugins;
     if (map && typeof map === "object")
       for (const [key, on] of Object.entries(map))
         enabled.set(key, on === true);
   }
-  const installed = json(join17(root, "plugins", "installed_plugins.json"))?.plugins ?? {};
+  const installed = json(join20(root, "plugins", "installed_plugins.json"))?.plugins ?? {};
   const out = [];
   for (const [key, on] of enabled) {
     if (!on)
@@ -8663,12 +9758,12 @@ function claudePlugins(root, cwd) {
     const entries = Array.isArray(installed[key]) ? installed[key] : [];
     const entry = entries.find((e) => e?.scope === "user") ?? entries.find((e) => e?.projectPath === cwd);
     if (name && entry)
-      out.push({ name, version: version(entry.version) });
+      out.push({ name, version: version2(entry.version) });
   }
   return out;
 }
 function codexPlugins(root) {
-  const config = text(join17(root, "config.toml"));
+  const config = text(join20(root, "config.toml"));
   if (config === undefined)
     return [];
   const found = new Map, disabled = new Set;
@@ -8687,9 +9782,9 @@ function codexPlugins(root) {
       continue;
     let versions = [];
     try {
-      versions = readdirSync3(join17(root, "plugins", "cache", market, plugin));
+      versions = readdirSync3(join20(root, "plugins", "cache", market, plugin));
     } catch {}
-    out.push({ name, version: versions.length === 1 ? version(versions[0]) : null });
+    out.push({ name, version: versions.length === 1 ? version2(versions[0]) : null });
   }
   return out;
 }
@@ -8702,21 +9797,21 @@ function parsePiContinuity(value) {
   return { sessionId: value.sessionId, ...value.sessionFile === undefined ? {} : { sessionFile: value.sessionFile }, ...value.backend === undefined ? {} : { backend: value.backend }, ...value.model === undefined ? {} : { model: value.model } };
 }
 function absoluteContinuityPath(value) {
-  return typeof value === "string" && value.length > 0 && value.length <= 4096 && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute5(value) && normalize(value) === value;
+  return typeof value === "string" && value.length > 0 && value.length <= 4096 && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute7(value) && normalize(value) === value;
 }
 var str3 = (value) => typeof value === "string" && value ? value : undefined, PLUGINS, CLAUDE_ONLY, text = (file) => {
   let fd;
   try {
-    fd = openSync3(file, constants3.O_RDONLY | constants3.O_NONBLOCK);
-    const st = fstatSync2(fd);
+    fd = openSync5(file, constants4.O_RDONLY | constants4.O_NONBLOCK);
+    const st = fstatSync4(fd);
     if (!st.isFile() || st.size > 1024 * 1024)
       return;
-    return readFileSync7(fd, "utf8");
+    return readFileSync9(fd, "utf8");
   } catch {
     return;
   } finally {
     if (fd !== undefined)
-      closeSync3(fd);
+      closeSync5(fd);
   }
 }, json = (file) => {
   try {
@@ -8725,7 +9820,7 @@ var str3 = (value) => typeof value === "string" && value ? value : undefined, PL
   } catch {
     return;
   }
-}, version = (v) => typeof v === "string" && /^[0-9A-Za-z.+_-]{1,40}$/.test(v) ? v : null, claudePluginInventory = (ctx) => claudePlugins(ctx.env.CLAUDE_CONFIG_DIR?.trim() || join17(ctx.home, ".claude"), ctx.cwd), codexPluginInventory = (ctx) => codexPlugins(ctx.env.CODEX_HOME?.trim() || join17(ctx.home, ".codex")), codexToolSemantic = (name, _command) => name.toLowerCase() === "filechange" ? "edit" : undefined;
+}, version2 = (v) => typeof v === "string" && /^[0-9A-Za-z.+_-]{1,40}$/.test(v) ? v : null, claudePluginInventory = (ctx) => claudePlugins(ctx.env.CLAUDE_CONFIG_DIR?.trim() || join20(ctx.home, ".claude"), ctx.cwd), codexPluginInventory = (ctx) => codexPlugins(ctx.env.CODEX_HOME?.trim() || join20(ctx.home, ".codex")), codexToolSemantic = (name, _command) => name.toLowerCase() === "filechange" ? "edit" : undefined;
 var init_native_policy_aux = __esm(() => {
   PLUGINS = new Map([["claude-mem", "claude-mem"], ["ponytail", "ponytail"], ["open-code-review", "open-code-review"]]);
   CLAUDE_ONLY = new Map([["codex@openai-codex", "codex-plugin"]]);
@@ -8771,7 +9866,7 @@ var init_launch2 = __esm(() => {
 });
 
 // src/cli/shell-quote.ts
-function shellQuote(value) {
+function shellQuote3(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
@@ -8786,26 +9881,26 @@ function nativeLaunchArguments(tool, ctx, policy) {
 }
 function nativeLaunchPlan(launch, ctx) {
   const argv = [launch.cmd, ...launch.args];
-  return { ...launch, metadata: { packageEntrypoint: ctx.entrypoint, argv, env: {}, command: argv.map(shellQuote).join(" ") } };
+  return { ...launch, metadata: { packageEntrypoint: ctx.entrypoint, argv, env: {}, command: argv.map(shellQuote3).join(" ") } };
 }
 var init_native_cli_launch_common = __esm(() => {
   init_launch2();
 });
 
 // src/adapters/definitions/native-cli-claude-launch.ts
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, renameSync, unlinkSync, readFileSync as readFileSync8 } from "fs";
-import { randomUUID as randomUUID6 } from "crypto";
-import { resolve as resolve12, join as join18 } from "path";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync5, renameSync as renameSync2, unlinkSync as unlinkSync2, readFileSync as readFileSync10 } from "fs";
+import { randomUUID as randomUUID7 } from "crypto";
+import { resolve as resolve15, join as join21 } from "path";
 function claudeChannel(userArgs) {
-  const bundle = resolve12(import.meta.dir, "../../../plugins/agent-hub/server.js");
+  const bundle = resolve15(import.meta.dir, "../../../plugins/agent-hub/server.js");
   for (let i = 0;i < userArgs.length; i++) {
     const arg = userArgs[i];
     const path = arg === "--mcp-config" ? userArgs[i + 1] : arg.startsWith("--mcp-config=") ? arg.slice("--mcp-config=".length) : undefined;
     if (!path)
       continue;
     try {
-      const server = JSON.parse(readFileSync8(resolve12(path), "utf8")).mcpServers?.["agent-hub"];
-      if (server?.command === "bun" && Array.isArray(server.args) && server.args.some((value) => typeof value === "string" && resolve12(value) === bundle))
+      const server = JSON.parse(readFileSync10(resolve15(path), "utf8")).mcpServers?.["agent-hub"];
+      if (server?.command === "bun" && Array.isArray(server.args) && server.args.some((value) => typeof value === "string" && resolve15(value) === bundle))
         return "server:agent-hub";
     } catch {}
   }
@@ -8828,7 +9923,7 @@ function claudeNativeLaunch(ctx) {
         throw new Error("--settings requires a JSON object or readable file so the hub permission hook can be installed");
       let caller;
       try {
-        caller = JSON.parse(value.trim().startsWith("{") ? value : readFileSync8(resolve12(value), "utf8"));
+        caller = JSON.parse(value.trim().startsWith("{") ? value : readFileSync10(resolve15(value), "utf8"));
         if (!caller || typeof caller !== "object" || Array.isArray(caller))
           throw new Error("not an object");
       } catch {
@@ -8857,14 +9952,14 @@ function claudeNativeLaunch(ctx) {
       const stateDir = ctx.facts?.stateDir ?? ctx.statusLine?.stateDir;
       if (!stateDir)
         throw new Error("Claude session settings require the hub state directory");
-      const file = join18(stateDir, `claude-settings-${randomUUID6()}.json`);
+      const file = join21(stateDir, `claude-settings-${randomUUID7()}.json`);
       try {
-        mkdirSync5(stateDir, { recursive: true, mode: 448 });
-        writeFileSync3(`${file}.tmp`, settingsArgs[1], { mode: 384, flag: "wx" });
-        renameSync(`${file}.tmp`, file);
+        mkdirSync7(stateDir, { recursive: true, mode: 448 });
+        writeFileSync5(`${file}.tmp`, settingsArgs[1], { mode: 384, flag: "wx" });
+        renameSync2(`${file}.tmp`, file);
       } catch {
         try {
-          unlinkSync(`${file}.tmp`);
+          unlinkSync2(`${file}.tmp`);
         } catch {}
         throw new Error("cannot write private Claude session settings in the hub state directory");
       }
@@ -8914,11 +10009,11 @@ var init_native_cli_codex_launch = __esm(() => {
 });
 
 // src/hub/events.ts
-import { appendFileSync, closeSync as closeSync4, existsSync as existsSync6, fstatSync as fstatSync3, openSync as openSync4, readFileSync as readFileSync9, readSync as readSync2 } from "fs";
+import { appendFileSync, closeSync as closeSync6, existsSync as existsSync7, fstatSync as fstatSync5, openSync as openSync6, readFileSync as readFileSync11, readSync as readSync3 } from "fs";
 function readEvents(file, since = 0) {
-  if (!existsSync6(file))
+  if (!existsSync7(file))
     return [];
-  return readFileSync9(file, "utf8").split(`
+  return readFileSync11(file, "utf8").split(`
 `).flatMap((line) => {
     if (!line.trim())
       return [];
@@ -8935,14 +10030,14 @@ var init_events = () => {};
 
 // src/cli/recovery-session-file.ts
 import { statSync as statSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join19 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join22 } from "path";
 function checkedSessionPath(binding, kind) {
   if (kind === "rollout")
-    return join19(binding.launch.env.CODEX_HOME ?? join19(homedir3(), ".codex"), "sessions");
-  const config = binding.launch.env.CLAUDE_CONFIG_DIR ?? join19(homedir3(), ".claude");
+    return join22(binding.launch.env.CODEX_HOME ?? join22(homedir5(), ".codex"), "sessions");
+  const config = binding.launch.env.CLAUDE_CONFIG_DIR ?? join22(homedir5(), ".claude");
   const slug = binding.projectRoot.replace(/[^a-zA-Z0-9]/g, "-");
-  return join19(config, "projects", slug, `${binding.sessionId}.jsonl`);
+  return join22(config, "projects", slug, `${binding.sessionId}.jsonl`);
 }
 function recordedFileState(file) {
   try {
@@ -8955,17 +10050,17 @@ var init_recovery_session_file = () => {};
 
 // src/adapters/definitions/native-recovery.ts
 import { readdirSync as readdirSync4 } from "fs";
-import { basename as basename4, join as join20 } from "path";
+import { basename as basename5, join as join23 } from "path";
 var rolloutState = (binding) => {
   try {
-    return readdirSync4(checkedSessionPath(binding, "rollout"), { recursive: true }).some((name) => String(name).endsWith(".jsonl") && basename4(String(name)).includes(binding.sessionId));
+    return readdirSync4(checkedSessionPath(binding, "rollout"), { recursive: true }).some((name) => String(name).endsWith(".jsonl") && basename5(String(name)).includes(binding.sessionId));
   } catch (error) {
     return error.code === "ENOENT" ? false : "unknown";
   }
 }, transcriptState = (binding) => {
   const state = recordedFileState(checkedSessionPath(binding, "transcript"));
   return state === "unknown" ? "unknown" : state === "found";
-}, startupArgs = (peer) => Object.fromEntries(["mode", "backend", "model", "route"].flatMap((key) => typeof peer.args?.[key] === "string" ? [[key, peer.args[key]]] : [])), text2 = (value) => typeof value === "string" && value.length > 0, object3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {}, CODEX_RECOVERY_SESSION, CLAUDE_RECOVERY_SESSION, PI_RECOVERY_SESSION, KIMI_RECOVERY_SESSION, LOCAL_RECOVERY_SESSION, JCODE_RECOVERY_SESSION, QWEN_RECOVERY_SESSION;
+}, startupArgs = (peer) => Object.fromEntries(["mode", "backend", "model", "route"].flatMap((key) => typeof peer.args?.[key] === "string" ? [[key, peer.args[key]]] : [])), text2 = (value) => typeof value === "string" && value.length > 0, object5 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {}, CODEX_RECOVERY_SESSION, CLAUDE_RECOVERY_SESSION, PI_RECOVERY_SESSION, KIMI_RECOVERY_SESSION, LOCAL_RECOVERY_SESSION, JCODE_RECOVERY_SESSION, QWEN_RECOVERY_SESSION;
 var init_native_recovery = __esm(() => {
   init_events();
   init_recovery_session_file();
@@ -8979,7 +10074,7 @@ var init_native_recovery = __esm(() => {
       if (phase !== "plan")
         return false;
       let current, started = false, turned = false;
-      for (const e of readEvents(join20(stateDir, "events.jsonl"))) {
+      for (const e of readEvents(join23(stateDir, "events.jsonl"))) {
         if (e.type === "native_thread" && e.peer === binding.peer) {
           current = e.thread;
           if (e.thread === binding.sessionId && e.fresh)
@@ -9020,7 +10115,7 @@ var init_native_recovery = __esm(() => {
       return args;
     },
     crashIdentity: (row) => {
-      const value = object3(row), args = object3(value.args), session = object3(value.session);
+      const value = object5(row), args = object5(value.args), session = object5(value.session);
       const sessionId = [value.sessionId, value.agentSessionId, value.resumeSessionId, session.id, session.sessionId].find(text2);
       const sessionFile = [value.sessionFile, value.sessionPath, args.sessionFile, session.file, session.path].find(text2);
       return { ...sessionId ? { sessionId } : {}, ...sessionFile ? { sessionFile } : {} };
@@ -9094,12 +10189,12 @@ function compatibilityLaunch(kind, ctx) {
     ...ctx.env.CODEX_HOME !== undefined ? { CODEX_HOME: ctx.env.CODEX_HOME } : {},
     ...ctx.env.CLAUDE_CONFIG_DIR !== undefined ? { CLAUDE_CONFIG_DIR: ctx.env.CLAUDE_CONFIG_DIR } : {}
   };
-  const prefix = Object.entries(env).map(([name, value]) => `${name}=${shellQuote(value)}`);
+  const prefix = Object.entries(env).map(([name, value]) => `${name}=${shellQuote3(value)}`);
   return {
     cmd: process.execPath,
     args,
     ...unattended.length ? { unattended: true } : {},
-    metadata: { packageEntrypoint: ctx.entrypoint, argv, env, command: [...prefix, ...argv.map(shellQuote)].join(" ") }
+    metadata: { packageEntrypoint: ctx.entrypoint, argv, env, command: [...prefix, ...argv.map(shellQuote3)].join(" ") }
   };
 }
 function sessionId(field) {
@@ -9223,7 +10318,7 @@ var init_builtin_metadata = __esm(() => {
       session: { nativeRevert: true, idField: "threadId", currentId: sessionId("threadId"), configDirEnv: "CODEX_HOME", zeroTurnFresh: true, launchKind: "codex", launchRecord: true, ...CODEX_RECOVERY_SESSION, crashPlan: codexCrashPlan, unrecordedTerminal: "always" },
       turnEnd: "adapter",
       budget: { account: "codex", checkpoint: true, reader: { source: "codex rateLimits", read: codexWindows }, context: { source: "codex_token_usage", read: codexContext } },
-      cli: { command: "codex", retainedTerminalNotice: codexRetainedTerminalNotice, rosterReturnNotice: codexRosterReturnNotice, stopNotice: () => "this peer belongs to a native terminal; end it in its terminal", startWords: () => ["codex"] },
+      cli: { command: "codex", launchConfigKeys: ["codex_bin"], retainedTerminalNotice: codexRetainedTerminalNotice, rosterReturnNotice: codexRosterReturnNotice, stopNotice: () => "this peer belongs to a native terminal; end it in its terminal", startWords: () => ["codex"] },
       display: CODEX_DISPLAY,
       hooks: { recallPlatform: "codex", recallSource: "codex", recallInjected: true, pluginInventory: codexPluginInventory, classifyTool: codexToolSemantic }
     },
@@ -9258,7 +10353,7 @@ var init_builtin_metadata = __esm(() => {
       capabilities: { watch: true },
       init: { mcpFile: ".kimi-code/mcp.json" },
       hooks: { recallPlatform: "kimi", recallSource: "kimi" },
-      cli: { command: "kimi", stopNotice: (form) => form === "tui" ? "Kimi belongs to its own TUI terminal; end it in that terminal" : "", startWords: (form) => ["kimi", "--mode", form] },
+      cli: { command: "kimi", launchConfigKeys: ["kimi_cmd", "peers.kimi.start_mode"], stopNotice: (form) => form === "tui" ? "Kimi belongs to its own TUI terminal; end it in that terminal" : "", startWords: (form) => ["kimi", "--mode", form] },
       display: KIMI_DISPLAY
     },
     {
@@ -9280,7 +10375,7 @@ var init_builtin_metadata = __esm(() => {
       reporting: { tokensNotReported: true },
       configuration: { schema: piConfigSchema, routingSchema: piRoutingSchema, settings: PI_SETTINGS, restartReasons: PI_RESTART_REASONS, validateEffective: piEffectiveConfig },
       routing: { localAllowedRefusal: "local_allowed = false also excludes pi for this class", longContext: "backend-limit", preferredTier: true, handoffPriority: 0, trace: "backend", backendLabel: "pi" },
-      cli: { command: "pi", previewArgs: ["--mode", "tui"], retainedTerminalNotice: piRetainedTerminalNotice, personOnlyFlags: ["--replace-session"], startWords: (form) => ["pi", "--mode", form] },
+      cli: { command: "pi", launchConfigKeys: ["pi.cmd", "pi.backend", "pi.dgx_coding", "pi.dgx_fast", "pi.max_steps", "routing.pi", "peers.pi.start_mode"], previewArgs: ["--mode", "tui"], retainedTerminalNotice: piRetainedTerminalNotice, personOnlyFlags: ["--replace-session"], startWords: (form) => ["pi", "--mode", form] },
       display: PI_DISPLAY
     },
     {
@@ -9300,7 +10395,7 @@ var init_builtin_metadata = __esm(() => {
       budget: { account: "local", quotaExempt: true, instrumented: true },
       configuration: { schema: localConfigSchema, routingSchema: localRoutingSchema, restartReasons: LOCAL_RESTART_REASONS },
       routing: { localAllowedRefusal: "local_allowed = false for this class", longContext: "skip-owner", preferredTier: true, handoffPriority: 1, trace: "route" },
-      cli: { command: "local", startWords: () => ["local"] },
+      cli: { command: "local", launchConfigKeys: ["local.deny", "local.bash_network", "local.network_allow", "local.max_steps", "local.read_allow", "routing.local"], startWords: () => ["local"] },
       display: LOCAL_DISPLAY
     },
     {
@@ -9323,7 +10418,7 @@ var init_builtin_metadata = __esm(() => {
       session: { idField: "sessionId", currentId: sessionId("sessionId"), launchKind: "jcode", ...JCODE_RECOVERY_SESSION, crashPlan: jcodeCrashPlan },
       turnEnd: "adapter",
       budget: { account: "jcode" },
-      cli: { command: "jcode", authority: "person", startWords: () => ["jcode"] },
+      cli: { command: "jcode", authority: "person", launchConfigKeys: ["jcode_cmd", "jcode_home", "jcode_provider_profile"], startWords: () => ["jcode"] },
       display: JCODE_DISPLAY,
       hooks: { recallPlatform: "jcode" }
     }
@@ -9514,7 +10609,7 @@ var init_qwen = __esm(() => {
           throw new Error("Qwen TUI is not offered before its native verification; use ahub qwen --mode headless");
         const launch = buildQwenLaunch(context.nativeCommand ?? ["qwen", "--acp"], context.model);
         const argv = [launch.cmd, ...launch.args];
-        return { ...launch, metadata: { packageEntrypoint: context.entrypoint, argv, command: argv.map(shellQuote).join(" "), env: {} } };
+        return { ...launch, metadata: { packageEntrypoint: context.entrypoint, argv, command: argv.map(shellQuote3).join(" "), env: {} } };
       },
       create: (context) => {
         if (!("acp" in context.daemon))
@@ -9555,7 +10650,7 @@ var init_qwen = __esm(() => {
     turnEnd: "adapter",
     budget: { account: "qwen" },
     capabilities: { watch: true },
-    cli: { command: "qwen", startWords: () => ["qwen"] },
+    cli: { command: "qwen", launchConfigKeys: ["qwen_cmd"], startWords: () => ["qwen"] },
     display: QWEN_DISPLAY,
     hooks: { agentIdentity: (init) => {
       qwenNativeIdentity("qwen", true, init);
@@ -9644,7 +10739,8 @@ function assertNativeCapabilityScope(definition) {
     ["start.daemonPort pi-rpc", definition.start.daemonPort === "pi-rpc"],
     ["routing", definition.routing !== undefined],
     ["reviewerVariant", definition.reviewerVariant !== undefined],
-    ["reviewer", definition.reviewer !== undefined]
+    ["reviewer", definition.reviewer !== undefined],
+    ["hooks.factsHook", declared(definition.hooks, "factsHook")]
   ];
   const field = restricted.find(([, present]) => present)?.[0];
   if (field)
@@ -9652,6 +10748,7 @@ function assertNativeCapabilityScope(definition) {
 }
 var ADAPTER_API = 1, KNOWN_PEERS, OPTIONAL_PEERS, SUPPORTED_PEERS, fixedBuiltinDefinitions, ADAPTERS, declarationOnlyDefinitions, definitions, REVIEW_POOL_KINDS, DEFAULT_REVIEW_POOL, QUOTA_HANDOFF_PLATFORMS, ROLE_ORDER, CONDUCTOR_START_PRIORITY, CONDUCTOR_START_PEERS, ADAPTER_DISPLAY, BUILTIN_CLI_ENTRIES;
 var init_registry = __esm(() => {
+  init_definition();
   init_reviewer_variants();
   init_native_cli_entry();
   init_native_cli_preview();
@@ -9662,18 +10759,19 @@ var init_registry = __esm(() => {
   init_native_cli_doctor();
   init_native_display();
   KNOWN_PEERS = ["claude", "codex", "kimi", "pi", "local"];
-  OPTIONAL_PEERS = ["qwen", "jcode"];
+  OPTIONAL_PEERS = ["qwen", "jcode", "agy"];
   SUPPORTED_PEERS = [...KNOWN_PEERS, ...OPTIONAL_PEERS];
-  fixedBuiltinDefinitions = new Set([...NATIVE_BUILTIN_DEFINITIONS_WITHOUT_QWEN, QWEN_DEFINITION, AGY_DEFINITION]);
+  fixedBuiltinDefinitions = new Set([...NATIVE_BUILTIN_DEFINITIONS_WITHOUT_QWEN, QWEN_DEFINITION, AGY_DEFINITION, AGY_REVIEWER_VARIANT]);
   for (const definition of [...fixedBuiltinDefinitions])
     if (definition.reviewerVariant)
       fixedBuiltinDefinitions.add(definition.reviewerVariant);
   ADAPTERS = immutable([
     ...NATIVE_BUILTIN_DEFINITIONS_WITHOUT_QWEN.filter((definition) => definition.kind !== "jcode"),
     QWEN_DEFINITION,
-    ...NATIVE_BUILTIN_DEFINITIONS_WITHOUT_QWEN.filter((definition) => definition.kind === "jcode")
+    ...NATIVE_BUILTIN_DEFINITIONS_WITHOUT_QWEN.filter((definition) => definition.kind === "jcode"),
+    AGY_DEFINITION
   ]);
-  declarationOnlyDefinitions = immutable([AGY_DEFINITION]);
+  declarationOnlyDefinitions = immutable([]);
   definitions = new Map;
   for (const definition of [...ADAPTERS, ...declarationOnlyDefinitions]) {
     assertDaemonEngine(definition);
@@ -9689,7 +10787,7 @@ var init_registry = __esm(() => {
   REVIEW_POOL_KINDS = Object.freeze([...definitions.values()].filter((definition) => !!(definition.reviewerVariant ?? definition).reviewer).map((definition) => definition.kind));
   DEFAULT_REVIEW_POOL = Object.freeze(ADAPTERS.filter((definition) => (definition.reviewerVariant ?? definition).reviewer?.defaultPool === true).map((definition) => definition.kind));
   QUOTA_HANDOFF_PLATFORMS = Object.freeze(Object.fromEntries(ADAPTERS.flatMap((adapter) => adapter.hooks?.recallPlatform ? [[adapter.kind, adapter.hooks.recallPlatform]] : [])));
-  ROLE_ORDER = ["claude", "codex", "kimi", "local", "pi", "qwen", "jcode"];
+  ROLE_ORDER = ["claude", "codex", "kimi", "local", "pi", "qwen", "jcode", "agy"];
   CONDUCTOR_START_PRIORITY = ["local", "kimi", "pi"];
   CONDUCTOR_START_PEERS = [
     ...CONDUCTOR_START_PRIORITY,
@@ -16873,8 +17971,8 @@ var require_dist = __commonJS(function(exports, module) {
 
 // src/hub/instance-config.ts
 init_registry();
-import { readFileSync as readFileSync10 } from "fs";
-import { join as join23 } from "path";
+import { readFileSync as readFileSync12 } from "fs";
+import { join as join26 } from "path";
 
 // src/hub/conductor.ts
 init_registry();
@@ -16895,7 +17993,7 @@ var STDOUT_LIMIT = 512 * 1024;
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.12.37",
+  version: "0.12.38",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",
@@ -16945,7 +18043,7 @@ var package_default = {
 };
 
 // src/version.ts
-var VERSION2 = package_default.version;
+var VERSION3 = package_default.version;
 
 // src/hub/github-import.ts
 init_sdlc();
@@ -17036,7 +18134,7 @@ var USER2 = Symbol("shared-user-shard");
 // node_modules/@staix/agent-mem/src/mcp.ts
 var string = (maxLength, minLength = 1) => ({ type: "string", minLength, maxLength });
 var limit = { type: "integer", minimum: 1, maximum: 100 };
-var object4 = (properties, required = []) => ({ type: "object", properties, required, additionalProperties: false });
+var object6 = (properties, required = []) => ({ type: "object", properties, required, additionalProperties: false });
 var tool2 = (name, description, inputSchema, readOnlyHint = true) => ({
   name,
   description,
@@ -17044,20 +18142,20 @@ var tool2 = (name, description, inputSchema, readOnlyHint = true) => ({
   annotations: { readOnlyHint, destructiveHint: false, openWorldHint: false }
 });
 var MCP_TOOLS = [
-  tool2("amem_search", "Search screened memory in this project. Capture results are recall, not curated evidence.", object4({ query: string(1000), limit, since: string(40), includeCapture: { type: "boolean" } }, ["query"])),
-  tool2("amem_show", "Show a screened memory entry in this project by its exact id or unique prefix.", object4({ id: string(80) }, ["id"])),
-  tool2("amem_timeline", "Read screened memory near an entry or time in this project.", object4({ id: string(80), since: string(40), limit })),
-  tool2("amem_graph", "Read the screened curated-memory neighbourhood. Capture is never graph evidence.", object4({ start: string(500), hops: { type: "integer", minimum: 1, maximum: 2 }, limit }, ["start"])),
-  tool2("amem_work_state_read", "Read project work lists; closed lists/items can be included explicitly.", object4({ list: string(200), includeClosed: { type: "boolean" } })),
-  tool2("amem_work_state_write", "Append scalar project work-list fields; null clears, task selects an item, list status done closes.", object4({ list: string(200), fields: {
+  tool2("amem_search", "Search screened memory in this project. Capture results are recall, not curated evidence.", object6({ query: string(1000), limit, since: string(40), includeCapture: { type: "boolean" } }, ["query"])),
+  tool2("amem_show", "Show a screened memory entry in this project by its exact id or unique prefix.", object6({ id: string(80) }, ["id"])),
+  tool2("amem_timeline", "Read screened memory near an entry or time in this project.", object6({ id: string(80), since: string(40), limit })),
+  tool2("amem_graph", "Read the screened curated-memory neighbourhood. Capture is never graph evidence.", object6({ start: string(500), hops: { type: "integer", minimum: 1, maximum: 2 }, limit }, ["start"])),
+  tool2("amem_work_state_read", "Read project work lists; closed lists/items can be included explicitly.", object6({ list: string(200), includeClosed: { type: "boolean" } })),
+  tool2("amem_work_state_write", "Append scalar project work-list fields; null clears, task selects an item, list status done closes.", object6({ list: string(200), fields: {
     type: "object",
     minProperties: 1,
     maxProperties: 64,
     additionalProperties: { type: ["string", "number", "boolean", "null"], maxLength: 4000 }
   } }, ["list", "fields"]), false),
-  tool2("amem_remember", "Propose a general memory candidate for person acceptance. Never writes directly to curated notes.", object4({ text: string(3000), title: string(200), kind: { type: "string", enum: ["decision", "finding", "contract", "fail"] } }, ["text"]), false),
-  tool2("amem_vault_candidates", "List screened durable curated notes eligible for a person to move to the vault. Read only.", object4({ limit })),
-  tool2("amem_capacity", "Read this machine's bounded capture capacity proposal; applying it is person-only.", object4({}))
+  tool2("amem_remember", "Propose a general memory candidate for person acceptance. Never writes directly to curated notes.", object6({ text: string(3000), title: string(200), kind: { type: "string", enum: ["decision", "finding", "contract", "fail"] } }, ["text"]), false),
+  tool2("amem_vault_candidates", "List screened durable curated notes eligible for a person to move to the vault. Read only.", object6({ limit })),
+  tool2("amem_capacity", "Read this machine's bounded capture capacity proposal; applying it is person-only.", object6({}))
 ];
 // node_modules/@staix/agent-mem/src/mcp-memory.ts
 init_capture();
@@ -17084,14 +18182,14 @@ init_generation();
 // src/hub/routing.ts
 init_registry();
 init_board();
-import { join as join21, resolve as resolve13 } from "path";
+import { join as join24, resolve as resolve16 } from "path";
 
 // src/models/route/config.ts
 var TYPES = new Set(["stage", "plan_execute", "advisor", "escalation"]);
 
 // src/hub/routing.ts
 init_stage();
-var TEMPLATE = join21(import.meta.dir, "..", "..", "templates", "routing.toml");
+var TEMPLATE = join24(import.meta.dir, "..", "..", "templates", "routing.toml");
 var cache = new Map;
 
 // src/hub/memory-policy.ts
@@ -17118,8 +18216,8 @@ var OWNERSHIP_EVENTS = new Set(["assigned", "escalated", "reassigned", "unassign
 // src/hub/config-trust.ts
 init_child_process();
 init_git();
-import { lstatSync as lstatSync7, statSync as statSync5 } from "fs";
-import { dirname as dirname9, join as join22 } from "path";
+import { lstatSync as lstatSync10, statSync as statSync5 } from "fs";
+import { dirname as dirname10, join as join25 } from "path";
 var MACHINE_LOCAL = [
   "kimi_cmd",
   "permission_modes",
@@ -17151,7 +18249,7 @@ function configTracked(cwd, name) {
     return;
   let opened;
   try {
-    opened = statSync5(join22(cwd, ".agenthub", name));
+    opened = statSync5(join25(cwd, ".agenthub", name));
   } catch {}
   return r.stdout.split("\x00").filter(Boolean).some((row) => {
     const path = row.slice(row.indexOf("\t") + 1);
@@ -17160,7 +18258,7 @@ function configTracked(cwd, name) {
     if (!opened)
       return path === `.agenthub/${name}`;
     try {
-      const s = statSync5(join22(cwd, path));
+      const s = statSync5(join25(cwd, path));
       return !!opened && s.dev === opened.dev && s.ino === opened.ino;
     } catch {
       return false;
@@ -17293,7 +18391,7 @@ var INSTANCE_CONFIG_FILES = ["config.json", "config.local.json"];
 function readInstanceConfigLayers(cwd) {
   return INSTANCE_CONFIG_FILES.flatMap((name) => {
     try {
-      return [{ name, raw: JSON.parse(readFileSync10(join23(cwd, ".agenthub", name), "utf8")) }];
+      return [{ name, raw: JSON.parse(readFileSync12(join26(cwd, ".agenthub", name), "utf8")) }];
     } catch (error) {
       if (error.code === "ENOENT")
         return [];
@@ -17323,8 +18421,8 @@ function readInstanceConfig(cwd, layers = readInstanceConfigLayers(cwd)) {
 
 // src/hub/control-client.ts
 init_project();
-import { readFileSync as readFileSync11 } from "fs";
-import { join as join24 } from "path";
+import { readFileSync as readFileSync13 } from "fs";
+import { join as join27 } from "path";
 function stateDirFor(cwd) {
   return projectContext(cwd).stateDir;
 }
@@ -17332,10 +18430,11 @@ var PROTOCOL = 16;
 var RECOVERY_SOURCE_PROTOCOLS = [9, 10, 11, 12, 13, 14, 15, PROTOCOL];
 function readControl(stateDir) {
   try {
-    const status = JSON.parse(readFileSync11(join24(stateDir, "status.json"), "utf8"));
-    const token = readFileSync11(join24(stateDir, "control-token"), "utf8").trim();
+    const status = JSON.parse(readFileSync13(join27(stateDir, "status.json"), "utf8"));
+    const token = readFileSync13(join27(stateDir, "control-token"), "utf8").trim();
     if (!Number.isInteger(status.controlPort) || status.controlPort < 1 || status.controlPort > 65535 || !token)
       return;
+    const startModes = status.startModes && typeof status.startModes === "object" && !Array.isArray(status.startModes) ? Object.fromEntries(Object.entries(status.startModes).filter((entry) => entry[1] === "tui" || entry[1] === "headless")) : undefined;
     return {
       url: `ws://127.0.0.1:${status.controlPort}`,
       token,
@@ -17345,6 +18444,7 @@ function readControl(stateDir) {
       protocol: status.protocol,
       pid: status.pid,
       features: Array.isArray(status.features) ? status.features.filter((feature) => typeof feature === "string") : [],
+      ...startModes ? { startModes } : {},
       ...typeof status.pidSignature === "string" && status.pidSignature ? { pidSignature: status.pidSignature } : {}
     };
   } catch {
@@ -18811,7 +19911,7 @@ ${content.join(`
 }
 
 // node_modules/zod/v4/core/versions.js
-var version2 = {
+var version3 = {
   major: 4,
   minor: 6,
   patch: 5
@@ -18823,7 +19923,7 @@ var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
   inst ?? (inst = {});
   inst._zod.def = def;
   inst._zod.bag = inst._zod.bag || {};
-  inst._zod.version = version2;
+  inst._zod.version = version3;
   const defChecks = inst._zod.def.checks;
   const checks = inst._zod.traits.has("$ZodCheck") ? [inst, ...defChecks ?? []] : defChecks?.length ? [...defChecks] : [];
   for (const ch of checks) {
@@ -23131,7 +24231,7 @@ var ZodObject = /* @__PURE__ */ $constructor("ZodObject", (inst, def) => {
     return required(ZodNonOptional, this, args[0]);
   }
 });
-function object6(shape, params) {
+function object8(shape, params) {
   const def = {
     type: "object",
     shape: shape ?? {},
@@ -23192,7 +24292,7 @@ var ZodRecord = /* @__PURE__ */ $constructor("ZodRecord", (inst, def) => {
   inst.keyType = def.keyType;
   inst.valueType = def.valueType;
 });
-function record3(keyType, valueType, params) {
+function record4(keyType, valueType, params) {
   if (!valueType || !valueType._zod) {
     return new ZodRecord({
       type: "record",
@@ -23476,31 +24576,31 @@ var TaskCreationParamsSchema = looseObject({
   ttl: number2().optional(),
   pollInterval: number2().optional()
 });
-var TaskMetadataSchema = object6({
+var TaskMetadataSchema = object8({
   ttl: number2().optional()
 });
-var RelatedTaskMetadataSchema = object6({
+var RelatedTaskMetadataSchema = object8({
   taskId: string3()
 });
 var RequestMetaSchema = looseObject({
   progressToken: ProgressTokenSchema.optional(),
   [RELATED_TASK_META_KEY]: RelatedTaskMetadataSchema.optional()
 });
-var BaseRequestParamsSchema = object6({
+var BaseRequestParamsSchema = object8({
   _meta: RequestMetaSchema.optional()
 });
 var TaskAugmentedRequestParamsSchema = BaseRequestParamsSchema.extend({
   task: TaskMetadataSchema.optional()
 });
 var isTaskAugmentedRequestParams = (value) => TaskAugmentedRequestParamsSchema.safeParse(value).success;
-var RequestSchema = object6({
+var RequestSchema = object8({
   method: string3(),
   params: BaseRequestParamsSchema.loose().optional()
 });
-var NotificationsParamsSchema = object6({
+var NotificationsParamsSchema = object8({
   _meta: RequestMetaSchema.optional()
 });
-var NotificationSchema = object6({
+var NotificationSchema = object8({
   method: string3(),
   params: NotificationsParamsSchema.loose().optional()
 });
@@ -23508,18 +24608,18 @@ var ResultSchema = looseObject({
   _meta: RequestMetaSchema.optional()
 });
 var RequestIdSchema = union([string3(), number2().int()]);
-var JSONRPCRequestSchema = object6({
+var JSONRPCRequestSchema = object8({
   jsonrpc: literal(JSONRPC_VERSION),
   id: RequestIdSchema,
   ...RequestSchema.shape
 }).strict();
 var isJSONRPCRequest = (value) => JSONRPCRequestSchema.safeParse(value).success;
-var JSONRPCNotificationSchema = object6({
+var JSONRPCNotificationSchema = object8({
   jsonrpc: literal(JSONRPC_VERSION),
   ...NotificationSchema.shape
 }).strict();
 var isJSONRPCNotification = (value) => JSONRPCNotificationSchema.safeParse(value).success;
-var JSONRPCResultResponseSchema = object6({
+var JSONRPCResultResponseSchema = object8({
   jsonrpc: literal(JSONRPC_VERSION),
   id: RequestIdSchema,
   result: ResultSchema
@@ -23536,10 +24636,10 @@ var ErrorCode;
   ErrorCode[ErrorCode["InternalError"] = -32603] = "InternalError";
   ErrorCode[ErrorCode["UrlElicitationRequired"] = -32042] = "UrlElicitationRequired";
 })(ErrorCode || (ErrorCode = {}));
-var JSONRPCErrorResponseSchema = object6({
+var JSONRPCErrorResponseSchema = object8({
   jsonrpc: literal(JSONRPC_VERSION),
   id: RequestIdSchema.optional(),
-  error: object6({
+  error: object8({
     code: number2().int(),
     message: string3(),
     data: unknown().optional()
@@ -23562,16 +24662,16 @@ var CancelledNotificationSchema = NotificationSchema.extend({
   method: literal("notifications/cancelled"),
   params: CancelledNotificationParamsSchema
 });
-var IconSchema = object6({
+var IconSchema = object8({
   src: string3(),
   mimeType: string3().optional(),
   sizes: array(string3()).optional(),
   theme: _enum(["light", "dark"]).optional()
 });
-var IconsSchema = object6({
+var IconsSchema = object8({
   icons: array(IconSchema).optional()
 });
-var BaseMetadataSchema = object6({
+var BaseMetadataSchema = object8({
   name: string3(),
   title: string3().optional()
 });
@@ -23582,9 +24682,9 @@ var ImplementationSchema = BaseMetadataSchema.extend({
   websiteUrl: string3().optional(),
   description: string3().optional()
 });
-var FormElicitationCapabilitySchema = intersection(object6({
+var FormElicitationCapabilitySchema = intersection(object8({
   applyDefaults: boolean2().optional()
-}), record3(string3(), unknown()));
+}), record4(string3(), unknown()));
 var ElicitationCapabilitySchema = preprocess((value) => {
   if (value && typeof value === "object" && !Array.isArray(value)) {
     if (Object.keys(value).length === 0) {
@@ -23592,10 +24692,10 @@ var ElicitationCapabilitySchema = preprocess((value) => {
     }
   }
   return value;
-}, intersection(object6({
+}, intersection(object8({
   form: FormElicitationCapabilitySchema.optional(),
   url: AssertObjectSchema.optional()
-}), record3(string3(), unknown()).optional()));
+}), record4(string3(), unknown()).optional()));
 var ClientTasksCapabilitySchema = looseObject({
   list: AssertObjectSchema.optional(),
   cancel: AssertObjectSchema.optional(),
@@ -23617,18 +24717,18 @@ var ServerTasksCapabilitySchema = looseObject({
     }).optional()
   }).optional()
 });
-var ClientCapabilitiesSchema = object6({
-  experimental: record3(string3(), AssertObjectSchema).optional(),
-  sampling: object6({
+var ClientCapabilitiesSchema = object8({
+  experimental: record4(string3(), AssertObjectSchema).optional(),
+  sampling: object8({
     context: AssertObjectSchema.optional(),
     tools: AssertObjectSchema.optional()
   }).optional(),
   elicitation: ElicitationCapabilitySchema.optional(),
-  roots: object6({
+  roots: object8({
     listChanged: boolean2().optional()
   }).optional(),
   tasks: ClientTasksCapabilitySchema.optional(),
-  extensions: record3(string3(), AssertObjectSchema).optional()
+  extensions: record4(string3(), AssertObjectSchema).optional()
 });
 var InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
   protocolVersion: string3(),
@@ -23639,22 +24739,22 @@ var InitializeRequestSchema = RequestSchema.extend({
   method: literal("initialize"),
   params: InitializeRequestParamsSchema
 });
-var ServerCapabilitiesSchema = object6({
-  experimental: record3(string3(), AssertObjectSchema).optional(),
+var ServerCapabilitiesSchema = object8({
+  experimental: record4(string3(), AssertObjectSchema).optional(),
   logging: AssertObjectSchema.optional(),
   completions: AssertObjectSchema.optional(),
-  prompts: object6({
+  prompts: object8({
     listChanged: boolean2().optional()
   }).optional(),
-  resources: object6({
+  resources: object8({
     subscribe: boolean2().optional(),
     listChanged: boolean2().optional()
   }).optional(),
-  tools: object6({
+  tools: object8({
     listChanged: boolean2().optional()
   }).optional(),
   tasks: ServerTasksCapabilitySchema.optional(),
-  extensions: record3(string3(), AssertObjectSchema).optional()
+  extensions: record4(string3(), AssertObjectSchema).optional()
 });
 var InitializeResultSchema = ResultSchema.extend({
   protocolVersion: string3(),
@@ -23670,12 +24770,12 @@ var PingRequestSchema = RequestSchema.extend({
   method: literal("ping"),
   params: BaseRequestParamsSchema.optional()
 });
-var ProgressSchema = object6({
+var ProgressSchema = object8({
   progress: number2(),
   total: optional(number2()),
   message: optional(string3())
 });
-var ProgressNotificationParamsSchema = object6({
+var ProgressNotificationParamsSchema = object8({
   ...NotificationsParamsSchema.shape,
   ...ProgressSchema.shape,
   progressToken: ProgressTokenSchema
@@ -23694,7 +24794,7 @@ var PaginatedResultSchema = ResultSchema.extend({
   nextCursor: CursorSchema.optional()
 });
 var TaskStatusSchema = _enum(["working", "input_required", "completed", "failed", "cancelled"]);
-var TaskSchema = object6({
+var TaskSchema = object8({
   taskId: string3(),
   status: TaskStatusSchema,
   ttl: union([number2(), _null3()]),
@@ -23738,10 +24838,10 @@ var CancelTaskRequestSchema = RequestSchema.extend({
   })
 });
 var CancelTaskResultSchema = ResultSchema.merge(TaskSchema);
-var ResourceContentsSchema = object6({
+var ResourceContentsSchema = object8({
   uri: string3(),
   mimeType: optional(string3()),
-  _meta: record3(string3(), unknown()).optional()
+  _meta: record4(string3(), unknown()).optional()
 });
 var TextResourceContentsSchema = ResourceContentsSchema.extend({
   text: string3()
@@ -23758,12 +24858,12 @@ var BlobResourceContentsSchema = ResourceContentsSchema.extend({
   blob: Base64Schema
 });
 var RoleSchema = _enum(["user", "assistant"]);
-var AnnotationsSchema = object6({
+var AnnotationsSchema = object8({
   audience: array(RoleSchema).optional(),
   priority: number2().min(0).max(1).optional(),
   lastModified: datetime2({ offset: true }).optional()
 });
-var ResourceSchema = object6({
+var ResourceSchema = object8({
   ...BaseMetadataSchema.shape,
   ...IconsSchema.shape,
   uri: string3(),
@@ -23773,7 +24873,7 @@ var ResourceSchema = object6({
   annotations: AnnotationsSchema.optional(),
   _meta: optional(looseObject({}))
 });
-var ResourceTemplateSchema = object6({
+var ResourceTemplateSchema = object8({
   ...BaseMetadataSchema.shape,
   ...IconsSchema.shape,
   uriTemplate: string3(),
@@ -23826,12 +24926,12 @@ var ResourceUpdatedNotificationSchema = NotificationSchema.extend({
   method: literal("notifications/resources/updated"),
   params: ResourceUpdatedNotificationParamsSchema
 });
-var PromptArgumentSchema = object6({
+var PromptArgumentSchema = object8({
   name: string3(),
   description: optional(string3()),
   required: optional(boolean2())
 });
-var PromptSchema = object6({
+var PromptSchema = object8({
   ...BaseMetadataSchema.shape,
   ...IconsSchema.shape,
   description: optional(string3()),
@@ -23846,44 +24946,44 @@ var ListPromptsResultSchema = PaginatedResultSchema.extend({
 });
 var GetPromptRequestParamsSchema = BaseRequestParamsSchema.extend({
   name: string3(),
-  arguments: record3(string3(), string3()).optional()
+  arguments: record4(string3(), string3()).optional()
 });
 var GetPromptRequestSchema = RequestSchema.extend({
   method: literal("prompts/get"),
   params: GetPromptRequestParamsSchema
 });
-var TextContentSchema = object6({
+var TextContentSchema = object8({
   type: literal("text"),
   text: string3(),
   annotations: AnnotationsSchema.optional(),
-  _meta: record3(string3(), unknown()).optional()
+  _meta: record4(string3(), unknown()).optional()
 });
-var ImageContentSchema = object6({
+var ImageContentSchema = object8({
   type: literal("image"),
   data: Base64Schema,
   mimeType: string3(),
   annotations: AnnotationsSchema.optional(),
-  _meta: record3(string3(), unknown()).optional()
+  _meta: record4(string3(), unknown()).optional()
 });
-var AudioContentSchema = object6({
+var AudioContentSchema = object8({
   type: literal("audio"),
   data: Base64Schema,
   mimeType: string3(),
   annotations: AnnotationsSchema.optional(),
-  _meta: record3(string3(), unknown()).optional()
+  _meta: record4(string3(), unknown()).optional()
 });
-var ToolUseContentSchema = object6({
+var ToolUseContentSchema = object8({
   type: literal("tool_use"),
   name: string3(),
   id: string3(),
-  input: record3(string3(), unknown()),
-  _meta: record3(string3(), unknown()).optional()
+  input: record4(string3(), unknown()),
+  _meta: record4(string3(), unknown()).optional()
 });
-var EmbeddedResourceSchema = object6({
+var EmbeddedResourceSchema = object8({
   type: literal("resource"),
   resource: union([TextResourceContentsSchema, BlobResourceContentsSchema]),
   annotations: AnnotationsSchema.optional(),
-  _meta: record3(string3(), unknown()).optional()
+  _meta: record4(string3(), unknown()).optional()
 });
 var ResourceLinkSchema = ResourceSchema.extend({
   type: literal("resource_link")
@@ -23895,7 +24995,7 @@ var ContentBlockSchema = union([
   ResourceLinkSchema,
   EmbeddedResourceSchema
 ]);
-var PromptMessageSchema = object6({
+var PromptMessageSchema = object8({
   role: RoleSchema,
   content: ContentBlockSchema
 });
@@ -23907,33 +25007,33 @@ var PromptListChangedNotificationSchema = NotificationSchema.extend({
   method: literal("notifications/prompts/list_changed"),
   params: NotificationsParamsSchema.optional()
 });
-var ToolAnnotationsSchema = object6({
+var ToolAnnotationsSchema = object8({
   title: string3().optional(),
   readOnlyHint: boolean2().optional(),
   destructiveHint: boolean2().optional(),
   idempotentHint: boolean2().optional(),
   openWorldHint: boolean2().optional()
 });
-var ToolExecutionSchema = object6({
+var ToolExecutionSchema = object8({
   taskSupport: _enum(["required", "optional", "forbidden"]).optional()
 });
-var ToolSchema = object6({
+var ToolSchema = object8({
   ...BaseMetadataSchema.shape,
   ...IconsSchema.shape,
   description: string3().optional(),
-  inputSchema: object6({
+  inputSchema: object8({
     type: literal("object"),
-    properties: record3(string3(), AssertObjectSchema).optional(),
+    properties: record4(string3(), AssertObjectSchema).optional(),
     required: array(string3()).optional()
   }).catchall(unknown()),
-  outputSchema: object6({
+  outputSchema: object8({
     type: literal("object"),
-    properties: record3(string3(), AssertObjectSchema).optional(),
+    properties: record4(string3(), AssertObjectSchema).optional(),
     required: array(string3()).optional()
   }).catchall(unknown()).optional(),
   annotations: ToolAnnotationsSchema.optional(),
   execution: ToolExecutionSchema.optional(),
-  _meta: record3(string3(), unknown()).optional()
+  _meta: record4(string3(), unknown()).optional()
 });
 var ListToolsRequestSchema = PaginatedRequestSchema.extend({
   method: literal("tools/list")
@@ -23943,7 +25043,7 @@ var ListToolsResultSchema = PaginatedResultSchema.extend({
 });
 var CallToolResultSchema = ResultSchema.extend({
   content: array(ContentBlockSchema).default([]),
-  structuredContent: record3(string3(), unknown()).optional(),
+  structuredContent: record4(string3(), unknown()).optional(),
   isError: boolean2().optional()
 });
 var CompatibilityCallToolResultSchema = CallToolResultSchema.or(ResultSchema.extend({
@@ -23951,7 +25051,7 @@ var CompatibilityCallToolResultSchema = CallToolResultSchema.or(ResultSchema.ext
 }));
 var CallToolRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
   name: string3(),
-  arguments: record3(string3(), unknown()).optional()
+  arguments: record4(string3(), unknown()).optional()
 });
 var CallToolRequestSchema = RequestSchema.extend({
   method: literal("tools/call"),
@@ -23961,7 +25061,7 @@ var ToolListChangedNotificationSchema = NotificationSchema.extend({
   method: literal("notifications/tools/list_changed"),
   params: NotificationsParamsSchema.optional()
 });
-var ListChangedOptionsBaseSchema = object6({
+var ListChangedOptionsBaseSchema = object8({
   autoRefresh: boolean2().default(true),
   debounceMs: number2().int().nonnegative().default(300)
 });
@@ -23982,25 +25082,25 @@ var LoggingMessageNotificationSchema = NotificationSchema.extend({
   method: literal("notifications/message"),
   params: LoggingMessageNotificationParamsSchema
 });
-var ModelHintSchema = object6({
+var ModelHintSchema = object8({
   name: string3().optional()
 });
-var ModelPreferencesSchema = object6({
+var ModelPreferencesSchema = object8({
   hints: array(ModelHintSchema).optional(),
   costPriority: number2().min(0).max(1).optional(),
   speedPriority: number2().min(0).max(1).optional(),
   intelligencePriority: number2().min(0).max(1).optional()
 });
-var ToolChoiceSchema = object6({
+var ToolChoiceSchema = object8({
   mode: _enum(["auto", "required", "none"]).optional()
 });
-var ToolResultContentSchema = object6({
+var ToolResultContentSchema = object8({
   type: literal("tool_result"),
   toolUseId: string3().describe("The unique identifier for the corresponding tool call."),
   content: array(ContentBlockSchema).default([]),
-  structuredContent: object6({}).loose().optional(),
+  structuredContent: object8({}).loose().optional(),
   isError: boolean2().optional(),
-  _meta: record3(string3(), unknown()).optional()
+  _meta: record4(string3(), unknown()).optional()
 });
 var SamplingContentSchema = discriminatedUnion("type", [TextContentSchema, ImageContentSchema, AudioContentSchema]);
 var SamplingMessageContentBlockSchema = discriminatedUnion("type", [
@@ -24010,10 +25110,10 @@ var SamplingMessageContentBlockSchema = discriminatedUnion("type", [
   ToolUseContentSchema,
   ToolResultContentSchema
 ]);
-var SamplingMessageSchema = object6({
+var SamplingMessageSchema = object8({
   role: RoleSchema,
   content: union([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)]),
-  _meta: record3(string3(), unknown()).optional()
+  _meta: record4(string3(), unknown()).optional()
 });
 var CreateMessageRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
   messages: array(SamplingMessageSchema),
@@ -24043,13 +25143,13 @@ var CreateMessageResultWithToolsSchema = ResultSchema.extend({
   role: RoleSchema,
   content: union([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)])
 });
-var BooleanSchemaSchema = object6({
+var BooleanSchemaSchema = object8({
   type: literal("boolean"),
   title: string3().optional(),
   description: string3().optional(),
   default: boolean2().optional()
 });
-var StringSchemaSchema = object6({
+var StringSchemaSchema = object8({
   type: literal("string"),
   title: string3().optional(),
   description: string3().optional(),
@@ -24058,7 +25158,7 @@ var StringSchemaSchema = object6({
   format: _enum(["email", "uri", "date", "date-time"]).optional(),
   default: string3().optional()
 });
-var NumberSchemaSchema = object6({
+var NumberSchemaSchema = object8({
   type: _enum(["number", "integer"]),
   title: string3().optional(),
   description: string3().optional(),
@@ -24066,24 +25166,24 @@ var NumberSchemaSchema = object6({
   maximum: number2().optional(),
   default: number2().optional()
 });
-var UntitledSingleSelectEnumSchemaSchema = object6({
+var UntitledSingleSelectEnumSchemaSchema = object8({
   type: literal("string"),
   title: string3().optional(),
   description: string3().optional(),
   enum: array(string3()),
   default: string3().optional()
 });
-var TitledSingleSelectEnumSchemaSchema = object6({
+var TitledSingleSelectEnumSchemaSchema = object8({
   type: literal("string"),
   title: string3().optional(),
   description: string3().optional(),
-  oneOf: array(object6({
+  oneOf: array(object8({
     const: string3(),
     title: string3()
   })),
   default: string3().optional()
 });
-var LegacyTitledEnumSchemaSchema = object6({
+var LegacyTitledEnumSchemaSchema = object8({
   type: literal("string"),
   title: string3().optional(),
   description: string3().optional(),
@@ -24092,26 +25192,26 @@ var LegacyTitledEnumSchemaSchema = object6({
   default: string3().optional()
 });
 var SingleSelectEnumSchemaSchema = union([UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema]);
-var UntitledMultiSelectEnumSchemaSchema = object6({
+var UntitledMultiSelectEnumSchemaSchema = object8({
   type: literal("array"),
   title: string3().optional(),
   description: string3().optional(),
   minItems: number2().optional(),
   maxItems: number2().optional(),
-  items: object6({
+  items: object8({
     type: literal("string"),
     enum: array(string3())
   }),
   default: array(string3()).optional()
 });
-var TitledMultiSelectEnumSchemaSchema = object6({
+var TitledMultiSelectEnumSchemaSchema = object8({
   type: literal("array"),
   title: string3().optional(),
   description: string3().optional(),
   minItems: number2().optional(),
   maxItems: number2().optional(),
-  items: object6({
-    anyOf: array(object6({
+  items: object8({
+    anyOf: array(object8({
       const: string3(),
       title: string3()
     }))
@@ -24124,9 +25224,9 @@ var PrimitiveSchemaDefinitionSchema = union([EnumSchemaSchema, BooleanSchemaSche
 var ElicitRequestFormParamsSchema = TaskAugmentedRequestParamsSchema.extend({
   mode: literal("form").optional(),
   message: string3(),
-  requestedSchema: object6({
+  requestedSchema: object8({
     type: literal("object"),
-    properties: record3(string3(), PrimitiveSchemaDefinitionSchema),
+    properties: record4(string3(), PrimitiveSchemaDefinitionSchema),
     required: array(string3()).optional()
   })
 });
@@ -24150,24 +25250,24 @@ var ElicitationCompleteNotificationSchema = NotificationSchema.extend({
 });
 var ElicitResultSchema = ResultSchema.extend({
   action: _enum(["accept", "decline", "cancel"]),
-  content: preprocess((val) => val === null ? undefined : val, record3(string3(), union([string3(), number2(), boolean2(), array(string3())])).optional())
+  content: preprocess((val) => val === null ? undefined : val, record4(string3(), union([string3(), number2(), boolean2(), array(string3())])).optional())
 });
-var ResourceTemplateReferenceSchema = object6({
+var ResourceTemplateReferenceSchema = object8({
   type: literal("ref/resource"),
   uri: string3()
 });
-var PromptReferenceSchema = object6({
+var PromptReferenceSchema = object8({
   type: literal("ref/prompt"),
   name: string3()
 });
 var CompleteRequestParamsSchema = BaseRequestParamsSchema.extend({
   ref: union([PromptReferenceSchema, ResourceTemplateReferenceSchema]),
-  argument: object6({
+  argument: object8({
     name: string3(),
     value: string3()
   }),
-  context: object6({
-    arguments: record3(string3(), string3()).optional()
+  context: object8({
+    arguments: record4(string3(), string3()).optional()
   }).optional()
 });
 var CompleteRequestSchema = RequestSchema.extend({
@@ -24181,10 +25281,10 @@ var CompleteResultSchema = ResultSchema.extend({
     hasMore: optional(boolean2())
   })
 });
-var RootSchema = object6({
+var RootSchema = object8({
   uri: string3().startsWith("file://"),
   name: string3().optional(),
-  _meta: record3(string3(), unknown()).optional()
+  _meta: record4(string3(), unknown()).optional()
 });
 var ListRootsRequestSchema = RequestSchema.extend({
   method: literal("roots/list"),
@@ -25754,8 +26854,8 @@ class StdioServerTransport {
 }
 
 // src/adapters/claude-channel.ts
-import { readFileSync as readFileSync12 } from "fs";
-import { join as join25 } from "path";
+import { readFileSync as readFileSync14 } from "fs";
+import { join as join28 } from "path";
 init_hub_tools();
 init_envelope();
 
@@ -25794,7 +26894,7 @@ var channel = !toolsMode && process.env.AGENTHUB_CHANNEL === "1";
 function roles2() {
   const read = (name) => {
     try {
-      return JSON.parse(readFileSync12(join25(projectRoot2, ".agenthub", name), "utf8")).roles ?? {};
+      return JSON.parse(readFileSync14(join28(projectRoot2, ".agenthub", name), "utf8")).roles ?? {};
     } catch {
       return {};
     }
@@ -25813,7 +26913,7 @@ function sessionProfile() {
     for (const name of ["config.json", "config.local.json"]) {
       let data;
       try {
-        data = JSON.parse(readFileSync12(join25(projectRoot2, ".agenthub", name), "utf8"));
+        data = JSON.parse(readFileSync14(join28(projectRoot2, ".agenthub", name), "utf8"));
       } catch (error) {
         if (error.code === "ENOENT")
           continue;
@@ -25840,7 +26940,7 @@ function sessionRoles() {
     const read = (name) => {
       let raw;
       try {
-        raw = JSON.parse(readFileSync12(join25(projectRoot2, ".agenthub", name), "utf8")).catalog_roles;
+        raw = JSON.parse(readFileSync14(join28(projectRoot2, ".agenthub", name), "utf8")).catalog_roles;
       } catch {
         return {};
       }
@@ -25869,7 +26969,7 @@ var HELD = `another session is attached to the hub as "${peerId}"; this one is s
 var INBOX_CAP = 200;
 function peerHeld() {
   try {
-    const status = JSON.parse(readFileSync12(join25(stateDir, "status.json"), "utf8"));
+    const status = JSON.parse(readFileSync14(join28(stateDir, "status.json"), "utf8"));
     const peer = status.peers?.[peerId];
     if (channel && peer?.toolsOnly && !peer.claiming)
       return false;
@@ -25904,7 +27004,7 @@ var TOOLS_INSTRUCTIONS = ["agent-hub task tools for this project. Messages from
 `);
 var log = (line) => console.error(`[agent-hub] ${line}`);
 var text4 = (s) => ({ content: [{ type: "text", text: s }] });
-var server = new Server({ name: "agent-hub", version: VERSION2 }, toolsMode ? { capabilities: { tools: {} }, instructions: TOOLS_INSTRUCTIONS } : { capabilities: channel ? { experimental: { "claude/channel": {} }, tools: {} } : { tools: {} }, instructions: INSTRUCTIONS });
+var server = new Server({ name: "agent-hub", version: VERSION3 }, toolsMode ? { capabilities: { tools: {} }, instructions: TOOLS_INSTRUCTIONS } : { capabilities: channel ? { experimental: { "claude/channel": {} }, tools: {} } : { tools: {} }, instructions: INSTRUCTIONS });
 var inbox = [];
 var hub;
 var detached;
@@ -26144,6 +27244,8 @@ async function callTool(req) {
       return text4(`not sent: ${res.error}`);
     if (res.recorded)
       return text4("recorded only ([FYI]): it is on the hub console and log, and no peer spent a turn on it");
+    if (res.dropped === "hop")
+      return text4(res.notice);
     const sent = `sent to: ${res.targets.join(", ") || "(no other peers attached)"}`;
     return text4(typeof res.notice === "string" ? `${sent}; ${res.notice}` : sent);
   }