@staix/agent-hub 0.12.41 → 0.12.42

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the previous repository, archived on 2026-09-30 when this repository's history was rewritten; the one exception is the open smoke-check issue, formerly #12, which moved here as #1. Numbers in newer entries refer to this repository.
 
+## 0.12.42
+
+`ahub agy` starts again after the Antigravity CLI updated itself (#589); the rest is contributor tooling (#591, #593, #595).
+
+- `ahub agy` accepts the Antigravity CLI 1.4.x line instead of exactly 1.4.2: 1.4.2, the T0-verified version, launches as before, another 1.4.x patch launches with one stderr warning naming its version, and any other version is still refused before a hub connection or plugin write. agy updates itself, and 0.12.41 refused 1.4.3 (#589).
+- `scripts/build.mjs` builds the plugin bundle with the Bun named in `.bun-version`: when the running Bun differs it re-runs itself once through `bun x bun@<pinned>`. A self-updated local Bun made the bundle check call a clean `main` stale and its remedy rebuild with the wrong Bun (#591).
+- The test gate's whole-suite watchdog cut off passing runs: hosted CI now gives macOS 1260 s and Linux 1080 s inside a 25-minute job, and the local default is 960 s; the 20 s per-test timeout is unchanged (#593).
+- `test/terminal-recovery.test.ts` no longer records an ambient `CLAUDE_CONFIG_DIR` from the shell running the tests (#595).
+
 ## 0.12.41
 
 A one-fix release for a 0.12.40 regression.

package/README.md

@@ -5,7 +5,7 @@ Codex, Kimi Code, Pi and a hub-owned local worker (Qwen Code, Jcode and Antigrav
 optional) share a message bus and a task board per project and one memory on the
 machine, each attached through its own native interface.
 
-Status: 0.12.41, control protocol 16. Bun + TypeScript, one loopback daemon per
+Status: 0.12.42, control protocol 16. Bun + TypeScript, one loopback daemon per
 project. Site: [agent-hub.staix.net](https://agent-hub.staix.net).
 
 ## What it does today
@@ -85,14 +85,16 @@ Since 0.12.39 `ahub jcode` opens Jcode's native TUI on the hub-owned ACP session
 default (#464); `--mode headless` or `ahub settings set peers.jcode.start_mode headless`
 keeps headless startup. On 0.12.39 the TUI launcher stopped after the first hub turn;
 0.12.40 opens it again (#564). On 0.12.40 `ahub codex` in a recorded Orca terminal
-failed with `invalid remote address`; 0.12.41 starts it again (#586).
+failed with `invalid remote address`; 0.12.41 starts it again (#586). Since 0.12.42
+`ahub agy` accepts the Antigravity CLI 1.4.x line (1.4.2 verified; other patches warn),
+because agy updates itself and 0.12.41 refused 1.4.3 (#589).
 Cancellation needs a daemon advertising `task_cancel`; controlled downgrades
 refuse while cancelled rows exist. Live-test delegated CLI commands need a daemon
 advertising `cli_audit_delegated` and refuse with an upgrade remedy otherwise
 (#410). For local/Pi implementation, opt in to an available
 `checks.runner = "container"`; issue-backed owners also need authenticated
 spec access. PII work and designated reviewers retain their separate exemptions.
-See [release verification](docs/verification/2026-10-20-0.12.41.md) for the live legs
+See [release verification](docs/verification/2026-10-20-0.12.42.md) for the live legs
 still open, including #418 AC8, #438 AC7, the native console settings leg (#439 AC5),
 real upgrades with reattach (#463) and with a managed terminal and cancelled tasks
 (#478), a live headless Claude review (#223), a Claude session over 32 MiB (#517), a

package/docs/agent-notes/adapters.md

@@ -70,7 +70,7 @@ Scope: the Codex, ACP and Pi adapters and the Pi extension (turn `generation` an
 - Report reviewer failures (`onUnavailable`: `start_failed`, `quota`, `no_verdict`) only after the child's group is confirmed gone and only while its generation is current: a person's stop owns its hold and never reroutes. `quota` comes only from the backend's structured `failure(event)`, never from vendor text. An NDJSON frame over 256 KiB or more than 4 MiB of output aborts the review as `needs_review`.
 - Codex reviewer isolation (`src/adapters/codex-review-isolation.ts`): accept only the pinned `codex-cli` version; prove model-free that Apps, plugins and hooks are disabled (`features list`), ambient MCP servers are replaced by disabled stubs, and the hub server alone is enabled with exactly `hub_review` and `hub_task_show`; run the native sandbox fixture probe before every launch; hash the binary once and fence binary and config files by metadata. Credential denies come only from the bounded `HOST_CREDENTIAL_PATHS` and `HOST_CREDENTIAL_ENV` lists, denied at the lexical and canonical path; refuse glob syntax or a root inside the checkout. A root that is dangling or unreadable refuses too; the reason names only its path class (`~/.docker`, `$DOCKER_CONFIG`), never a path or contents. Never pass the control token in a reviewer child's argv, env or MCP config: keep the hub state dir in its `privatePaths`.
 
-- Antigravity P1 (`src/adapters/agy/`): keep it optional, cloud, off roster by default, implementer/verifier only and pull-only. Until per-mode native prompt behavior is verified, reject hub permission/unattended mappings, headless starts and resume selectors; do not infer a quota source. The launcher refuses extra instances, any `agy --version` other than the pinned 1.4.2, and a hub without the `native_hook_launch` feature.
+- Antigravity P1 (`src/adapters/agy/`): keep it optional, cloud, off roster by default, implementer/verifier only and pull-only. Until per-mode native prompt behavior is verified, reject hub permission/unattended mappings, headless starts and resume selectors; do not infer a quota source. The launcher refuses extra instances, any `agy --version` outside the 1.4.x line (1.4.2 is T0-verified; other 1.4.x patches launch with a stderr warning, #589), and a hub without the `native_hook_launch` feature.
 - Only the person's `ahub agy` launcher manages `.agents/plugins/agent-hub/{plugin.json,mcp_config.json,hooks.json}`. Refuse linked/foreign entries before any write; cleanup only the matching launch. Never write project-level `.agents/hooks.json` or personal Gemini settings. The plugin MCP server is named `agent-hub_agent-hub` by the pinned native client.
 - Managed native facts use the definition's typed `NativeFactsPort` and the daemon's ephemeral `native_hook_launch` authority. Bind every observation to the daemon, launch, native session, project and current socket generation. Stop requires `fullyIdle`, normal termination and a fresh validated completion row; a missing readback keeps the peer busy. Native fact acknowledgement accepts only SDK ephemeral-message rows in the exact session transcript path.
 - `terminalOwner(launchId)` (`src/hub/peers.ts`, #482) answers only for the adapter's current native TUI owner bound to that launch (Codex: the claimed link with that `launchId`, both sockets open; the launcher sends the id as the upgrade's bearer token through `--remote-auth-token-env`, because `codex --remote` refuses any path or query (#586); Pi: a started, verified TUI owner on its requested session); a start acknowledgement is never ownership. A Codex link that is not the claimed one or has a closed socket never adopts a thread.

package/docs/agent-notes/tests.md

@@ -16,7 +16,7 @@ Scope: tests, fakes and the test gate. Read before adding or changing a test or
 - Run `bun scripts/seeded-check.ts` before reporting the seeded-guard gate complete. Keep the `scripts/seeds.json` cases sequential; require the same named test green before its seeded assertion fails. Seed rot, survivors, setup/compiler failures, timeout/watchdog termination and process leaks fail the gate. Never run the full seed runner from a unit test or mutate the source checkout; inspect preserved failed fixtures before removing them. CI runs it as four sequential Linux shards (`--shard i/4`) beside the ordinary check, separately from `scripts/check.sh`; the required `seeded guards` job passes only when every shard passed, or when the decision job reused a verified identical-tree full gate (`admission == 'reuse'`). Keep that job name: branch protection and `scripts/ci-gates.mjs` read it (#457).
 
 - `scripts/check.sh` holds the repo's heavy-job slot (`<git common dir>/ahub-heavy.lock`, #398) for the whole run, so a test never runs the real gate; `test/check-lock.test.ts` runs a copy in a scratch repo.
-- The whole-suite watchdog is `AHUB_CHECK_HANG_S` (default in `scripts/check.sh`, hosted values for both OSes in `.github/workflows/check.yml`; #378, macOS CI hit it while tests still passed): raise it only when the suite was still progressing at the cutoff, never for a hung test, and keep the per-test 20 s timeout. The check job's `timeout-minutes` must leave room above that value for setup: raise them together.
+- The whole-suite watchdog is `AHUB_CHECK_HANG_S` (default in `scripts/check.sh`, hosted values for both OSes in `.github/workflows/check.yml`; #378 and #593, macOS CI hit it while tests still passed; currently 960 s local, 1080 s Linux, 1260 s macOS): raise it only when the suite was still progressing at the cutoff, never for a hung test, and keep the per-test 20 s timeout. The check job's `timeout-minutes` must leave room above that value for setup: raise them together.
 - A seed's named test must run on Linux, where the seeded job runs: a darwin-only test reports no result there and fails the job (#382). Cover a macOS-only protection with its regression test instead.
 
 - Keep CI's Bun version sourced from `.bun-version` through the pinned setup-bun action; update the version file rather than adding per-job version literals.

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.12.41 and control protocol 16. Live verification
+This guide describes ahub 0.12.42 and control protocol 16. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Agent-operated live verification
@@ -2044,21 +2044,21 @@ section is what they run.
 
 Upgrade running projects with the target release's own coordinator. It accepts
 a running source on control protocol 9 (0.6.x), 10 (0.7.0 through 0.12.0),
-11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15), 14 (0.12.16), 15 (0.12.17 through 0.12.19) or 16 (0.12.20 through 0.12.41), and only
+11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15), 14 (0.12.16), 15 (0.12.17 through 0.12.19) or 16 (0.12.20 through 0.12.42), and only
 a target on its own protocol, so the target's coordinator fits every supported
 source and carries every recovery fix released up to it. Protocol 8 and older
 (0.5.x and earlier) are refused as `manual-bootstrap-required`. Run from the
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.12.41 ahub upgrade --to 0.12.41 --dry-run
-bunx --package @staix/agent-hub@0.12.41 ahub upgrade --to 0.12.41 --yes
+bunx --package @staix/agent-hub@0.12.42 ahub upgrade --to 0.12.42 --dry-run
+bunx --package @staix/agent-hub@0.12.42 ahub upgrade --to 0.12.42 --yes
 ```
 
 | Running now | Coordinator to use |
 | --- | --- |
 | 0.6.x (protocol 9) | the target's, through `bunx` as above |
-| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15), 0.12.20 through 0.12.41 (protocol 16) | the target's, through `bunx` as above |
+| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15), 0.12.20 through 0.12.42 (protocol 16) | the target's, through `bunx` as above |
 | any supported source, with the installed CLI already at the target | `ahub upgrade` below, which is the same coordinator |
 | 0.5.x or earlier (protocol 8 and older) | not supported: bootstrap by hand with the matching CLI |
 
@@ -2090,14 +2090,14 @@ projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.12.41 --dry-run
+ahub upgrade --to 0.12.42 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.12.41 --yes
+ahub upgrade --to 0.12.42 --yes
 ahub recovery status [<operation-id>]
 ahub recovery resume [<operation-id>]
 ahub recovery abort [<operation-id>]
@@ -2946,8 +2946,8 @@ unreadable result runs the main gate again and refuses release. A manual
 it is never accepted as full-gate evidence. A `timing_runs=20` dispatch runs only the daemon, PII screen and ACP
 test files twenty times on macOS, in its own concurrency group; it does not replace the full gate.
 `scripts/check.sh` stops a suite still running after `AHUB_CHECK_HANG_S` seconds
-(600 by default); hosted macOS CI sets 780 inside the unchanged 15-minute job
-limit (#378).
+(960 by default); hosted CI sets 1080 on Linux and 1260 on macOS inside a 25-minute
+job limit (#378, #593).
 The gate holds `<git common dir>/ahub-heavy.lock` across every worktree of a
 repository. A second gate waits up to `AHUB_CHECK_LOCK_WAIT_S` (1800 seconds by
 default; 0 fails immediately) and names the holder. A holder whose PID is gone
@@ -3235,7 +3235,7 @@ Native policy is unmanaged and has NO hub sandbox; no permission_modes.jcode or
 
 ## Optional Antigravity (agy) peer
 
-Antigravity is optional and off roster by default. Use `ahub roster add agy`, then run `ahub agy` in a terminal: it runs the Antigravity CLI 1.4.2 as a fresh pull-only TUI in that terminal and refuses any other version. The running hub must advertise `native_hook_launch`; an older hub refuses before any write with an upgrade-or-restart remedy. Only the person's launcher starts it: conductor starts are refused, there is no controlled restore or resume, and extra agy instances are unavailable. Headless/print, resume (`--conversation`, `--continue`, `--new`), `--mode`, `--dangerously-skip-permissions` and `--unattended` are refused until their native mapping is verified; `--print-command` previews without writing.
+Antigravity is optional and off roster by default. Use `ahub roster add agy`, then run `ahub agy` in a terminal: it runs the Antigravity CLI as a fresh pull-only TUI in that terminal. It accepts the 1.4.x line: 1.4.2 is the verified version, any other 1.4.x launches with a stderr warning (agy updates itself), and other versions are refused (#589). The running hub must advertise `native_hook_launch`; an older hub refuses before any write with an upgrade-or-restart remedy. Only the person's launcher starts it: conductor starts are refused, there is no controlled restore or resume, and extra agy instances are unavailable. Headless/print, resume (`--conversation`, `--continue`, `--new`), `--mode`, `--dangerously-skip-permissions` and `--unattended` are refused until their native mapping is verified; `--print-command` previews without writing.
 
 The launcher writes exactly `plugin.json`, `mcp_config.json` and `hooks.json` in `.agents/plugins/agent-hub/`, refusing linked or foreign entries before any write, and removes only its own matching files when the TUI ends. It never writes project-level `.agents/hooks.json` or the person's `~/.gemini` settings. Run `ahub init` afterwards to ignore the untracked plugin directory; a tracked plugin is written with a warning. The native model sees the hub tools under the server name `agent-hub_agent-hub`.
 

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.41
+bun add -g github:STAIxBWLB/agent-hub#v0.12.42
 ahub setup
 ```
 
@@ -30,13 +30,17 @@ and upgrade or crash recovery, see the [operations guide](operations.md). To
 move running projects to a newer release later, run `ahub upgrade` in a
 terminal: it reviews the plan with you, applies it and follows it.
 
+## Upgrading to 0.12.42
+
+0.12.42 lets `ahub agy` start again after the Antigravity CLI updated itself to 1.4.3: the launcher accepts the 1.4.x line, launching 1.4.2 (the verified version) silently and another 1.4.x patch with a warning (#589). The rest of the release is contributor tooling (#591, #593, #595). Coming from 0.12.40 or older, the notes below apply too.
+
 ## Upgrading to 0.12.41
 
 0.12.41 fixes one 0.12.40 regression: `ahub codex` in a recorded Orca terminal stopped at `invalid remote address`, because the launcher put the terminal launch id into the `--remote` URL, which Codex accepts only as `ws://host:port`. The id now travels as the upgrade's bearer token (#586). Coming from 0.12.39 or older, the 0.12.40 notes below apply too.
 
 ## Upgrading to 0.12.40
 
-Restart Claude sessions after upgrading: each keeps the plugin server it started with until restarted, so a restart loads the 0.12.41 plugin. That plugin asks Claude Code to list the hub tools again when a hub reconnect changes them (#490), and one from an older `ahub claude` launch is refused and stops reconnecting instead of reclaiming the peer (#551).
+Restart Claude sessions after upgrading: each keeps the plugin server it started with until restarted, so a restart loads the 0.12.42 plugin. That plugin asks Claude Code to list the hub tools again when a hub reconnect changes them (#490), and one from an older `ahub claude` launch is refused and stops reconnecting instead of reclaiming the peer (#551).
 
 `ahub jcode` opens its TUI again; on 0.12.39 it stopped after the first hub turn (#564). A busy Jcode now takes an `important` message into its running turn (#572), and `ahub doctor` lists the extra MCP servers the hub-owned Jcode loads from its config files. See [Jcode operations](operations.md#optional-jcode-peer).
 
@@ -58,7 +62,7 @@ Upgrading from 0.12.37 or earlier, the 0.12.38 notes below also apply.
 
 The 0.12.38 plugin reports a reply stopped by the hop cap as not delivered instead of as sent (#546); the restart above loads it.
 
-Antigravity (`agy`) can join as an optional pull-only implementer (#485). It is off roster by default: install the Antigravity CLI 1.4.2, run `ahub roster add agy`, then run `ahub agy` in a terminal. Its native permissions are unmanaged and it has no hub sandbox. See [Antigravity operations](operations.md#optional-antigravity-agy-peer).
+Antigravity (`agy`) can join as an optional pull-only implementer (#485). It is off roster by default: install the Antigravity CLI 1.4.x (1.4.2 verified; other 1.4.x patches launch with a warning), run `ahub roster add agy`, then run `ahub agy` in a terminal. Its native permissions are unmanaged and it has no hub sandbox. See [Antigravity operations](operations.md#optional-antigravity-agy-peer).
 
 Reviews can rotate across fresh Claude, Codex and Kimi reviewer sessions (#519, #533). Declare headless reviewer-only instances in `.agenthub/config.local.json`; Codex and Kimi join only with `review_mode: "fresh"`. Codex also needs an installed Codex 0.146.0 (select it with `codex_bin` when PATH resolves another version), and Kimi needs Kimi Code 2.2.0 on PATH, signed in with its own OAuth login. A headless reviewer instance without `review_mode` keeps its native behavior and stays out of the pool. agy is not a reviewer: naming it in `review.pool` shows an unavailable skip in `ahub route explain`, never a review. Once a train is active or frozen, or `review.pool` is set or fresh reviewer instances are declared, `ahub upgrade` refuses a target release without that support, so an older release cannot take the project over. See [fresh reviewer pool](operations.md#fresh-reviewer-pool-519).
 

package/docs/security.md

@@ -254,7 +254,7 @@ this production table. Startup diagnostics withhold native host/payload details.
 
 Jcode is optional, source/version-fenced and runs native tools without a hub sandbox or hub permission-mode mapping. .jcode joins the scoped-grant exclusion, including lexical/resolved aliases. Only a person writes its unique project MCP entry; foreign/override/symlink entries refuse. The hub owns a private daemon/socket and ACP group, never the global daemon, and copies no credentials. It accepts only a plain jcode release from 0.98.0 up to, not including, 1.0.0 (#529), and runs every owned jcode process (probe, serve, ACP and TUI) with `JCODE_NO_TELEMETRY=1`, because jcode's telemetry can report the provider account's email. Native diagnostics withhold payloads/hosts. Unproved conversation loads refuse; no fresh replacement is called a restore. A finished task's advisory about the project root checkout names the branch only after the hub's whole public-text screen (`Tasks.publicMetadataText`: a PII pattern, a secret shape and a project-private path) passes it and it is a plain ref name; otherwise a generic sentence carries no part of it (#572). Native TUI launch exposes its private socket/session tuple only to the authenticated console, bound to the same live owned socket and session after read-only native persistence proof. Tools/status do not receive it. The TUI has no single-writer guard: person input may interleave with ACP. Native policy remains unmanaged and closing the frontend does not stop ACP. An `important` message reaches a busy Jcode as a soft interrupt written to the hub's own private server socket for the owned session (#572); the hub never cancels a turn to deliver, and a steer that was sent but not acknowledged, or whose turn ended first, is held as `needs_review`, never replayed. Jcode has no switch to choose its MCP servers, so the owned serve and ACP processes load every server named in `<JCODE_HOME>/mcp.json` and the project's `.jcode/mcp.json`, `.mcp.json` and `.claude/mcp.json`, besides the hub's own; `ahub doctor` lists their names only. Point `jcode_home` at a separate home, or remove a server from those files, to keep it out.
 
-Antigravity (`agy`, #485) is optional, cloud and off roster by default. It runs native tools under its own unmanaged permissions, without a hub sandbox or hub permission-mode mapping; headless, resume, unattended and native permission flags are refused. Its roles are capped at implementer and verifier, so it never plans, reviews or receives PII work. Only the person's `ahub agy` launcher writes its three plugin files in `.agents/plugins/agent-hub/` (`plugin.json`, `mcp_config.json`, `hooks.json`): linked or foreign entries refuse before any write, cleanup removes only that launch's matching files, and it never writes project-level `.agents/hooks.json` or the person's `~/.gemini` settings. Conductor starts are refused. Hook authority (`native_hook_launch`) comes only from that launcher, belongs to the console socket that began it and ends when that socket closes; hook input over 1 MiB is refused, and observations are bound to the daemon, launch, native session and project.
+Antigravity (`agy`, #485) is optional, cloud and off roster by default. The launcher accepts the Antigravity CLI 1.4.x line; only 1.4.2 has a native receipt, so another 1.4.x patch launches with a warning that it is unverified, and every other version is refused before a hub connection or plugin write (#589). It runs native tools under its own unmanaged permissions, without a hub sandbox or hub permission-mode mapping; headless, resume, unattended and native permission flags are refused. Its roles are capped at implementer and verifier, so it never plans, reviews or receives PII work. Only the person's `ahub agy` launcher writes its three plugin files in `.agents/plugins/agent-hub/` (`plugin.json`, `mcp_config.json`, `hooks.json`): linked or foreign entries refuse before any write, cleanup removes only that launch's matching files, and it never writes project-level `.agents/hooks.json` or the person's `~/.gemini` settings. Conductor starts are refused. Hook authority (`native_hook_launch`) comes only from that launcher, belongs to the console socket that began it and ends when that socket closes; hook input over 1 MiB is refused, and observations are bound to the daemon, launch, native session and project.
 
 # Transient ACP activity (#286)
 

package/docs/smoke.md

@@ -1966,7 +1966,7 @@ Kimi usage ceiling: 2.2.0 print stream-json exposes no token counts. Keep unobse
 
 ## Antigravity P1 (#485)
 
-- Pin agy 1.4.2; verify its executable/version and keep the actual TUI/IDE leg separate from the account-free [T0 transport receipt](verification/2026-10-19-agy-p1-t0.md).
+- Run agy on the 1.4.x line (1.4.2 verified; other patches warn, #589); verify its executable/version and keep the actual TUI/IDE leg separate from the account-free [T0 transport receipt](verification/2026-10-19-agy-p1-t0.md).
 - With a reviewed compatible daemon running and agy explicitly on roster, the person runs `ahub agy` in a terminal. Confirm peer `agy` is pull-only, native permissions unmanaged and no hub sandbox/budget source is claimed.
 - In the native TUI call `hub_inbox`, `hub_send`, and a permitted board read/proposal within a non-PII task. Confirm the tool audience and actor remain `agy`, the native model consumes the tool results, and no unsolicited push or PII task text reaches it.
 - End the TUI normally. Confirm its group/socket detaches and only its matching managed three-file plugin is cleaned up; unrelated project/global settings remain unchanged.

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -3881,3 +3881,5 @@ The pinned agy 1.4.2 T0 receipt precedes implementation: isolated HOME/`.gemini`
 The P1 host introduces additive `native_hook_launch` and `native_facts` control requests. Only the person begins/ends a launch; hook tools cannot grant themselves launcher authority, and conductor starts are refused. The interactive child remains in the launcher's foreground process group. Launch authority belongs to the console socket that began it and is revoked on that socket's close; an old socket cannot revoke a replacement launch. The managed launcher embeds its daemon/launch identity in the plugin hooks, and the host binds observations to one native conversation and socket generation. It acknowledges a normal fully-idle Stop only after a fresh native completion row. Turn-free facts are injected at the observed model boundary and acknowledged only from SDK transcript rows; unobserved native file effects receive no attribution. Hook input over one MiB is refused before decoding or forwarding. Out-of-ceiling agy roles are dropped with a config log notice before conductor validation, preserving other peers' admission.
 
 The collected T0 proves the plugin, hook codec and read transport, not a native prompt override. P1 therefore keeps all runtime modes unmanaged and refuses unattended/headless/resume selectors until those individual mappings are proved. The old daemon refuses the additive launch request rather than silently weakening hook identity. An actual project TUI launch requires a running daemon with this feature; source/fixture verification does not claim that live rollout.
+
+Version line (#589, owner decision 2026-10-20): agy updates itself, so the launcher accepts the 1.4.x line instead of exactly 1.4.2. 1.4.2 launches silently; another 1.4.x patch launches with one stderr warning naming the observed version and the 1.4.2 receipt; any other version, unparseable output or a failing `--version` is refused before a hub connection or plugin write. A T0 re-run on a newer patch is a separate follow-up.

package/docs/verification/2026-10-20-0.12.42.md

@@ -0,0 +1,48 @@
+# 0.12.42 release verification
+
+This record covers release preparation and source review. It does not claim publication, installation, a running-hub restart or a live `ahub agy` TUI launch.
+
+## Candidate
+
+Version 0.12.42, control protocol 16 (unchanged; no daemon feature added), from merged main. The local Antigravity CLI updated itself to 1.4.3 on 2026-10-20 and `ahub agy` refused it (`agy P1 requires the verified Antigravity CLI 1.4.2`). The person directed on 2026-10-20 to relax the gate to the 1.4.x line with a warning, register and fix the Bun drift and the problems found on the way, merge, and ship.
+
+- agy version line (#589, PR #590): 1.4.2 launches silently, another 1.4.x patch launches with one stderr warning, anything else is refused before a hub connection or plugin write.
+- Pinned Bun for the bundle (#591, PR #592): `scripts/build.mjs` re-runs itself through `bun x bun@<.bun-version>` when the running Bun differs.
+- Test watchdog budget (#593, PRs #594 and #598): hosted macOS 1260 s and Linux 1080 s inside a 25-minute job, local default 960 s; the 20 s per-test timeout unchanged. The first release PR run hit the old 780 s Linux cutoff one second after a passing test (run 39441258200), which led to #598.
+- Test isolation (#595, PR #596): the recorded-launch allowlist test clears the ambient `CLAUDE_CONFIG_DIR`.
+- Still open: a T0 re-run on agy 1.4.3 (its changelog changes `PostToolUse` failure handling and `agy plugin validate`, not the hook envelope the hub parses), and every live leg listed in [the 0.12.40 record](2026-10-20-0.12.40.md).
+
+## Reviews
+
+| PR | Final head | Review | CI |
+| --- | --- | --- | --- |
+| #590 (#589) | c8837f8f (reviewed diff 6a93e48f plus a merge of main) | OCR delegation review: no High or Medium findings. codex-connector: no findings | exact head, success (both OS checks) |
+| #592 (#591) | d1ac9033 | OCR delegation review: no findings. codex-connector: no findings | exact head, success (both OS checks, 4/4 seeded shards) |
+| #594 (#593) | 16ee60db | OCR delegation review: no findings (no other job runs `check.sh`; 25 minutes covers 1260 s plus setup). codex-connector: no findings | exact head, success (both OS checks) |
+| #598 (#593) | b023cd6b | Config-only diff reviewed: 1080 s plus setup fits the 25-minute job. codex-connector: no findings | exact head, success (both OS checks) |
+| #596 (#595) | 7adf8c45 (bf7c66b7 plus a merge of main) | Test-only diff reviewed (excluded from OCR by path). codex-connector: no findings | exact head, success (both OS checks) |
+
+Claude and Copilot PR reviews were skipped for quota on all five PRs.
+
+## Document review
+
+Seven documents were stale against the 0.12.41 stamps (`644f9a45`), through #590, #594 and this release. Restamped to the release branch head `6f012880`; `docs/agent-notes/tests.md` and `docs/operations.md` again to `ba26148f` after #598 merged.
+
+| Document | Result | Checked claims and correction |
+| --- | --- | --- |
+| `README.md` | corrected | Status 0.12.42; the agy 1.4.x line (#589); verification link. |
+| `docs/quickstart.md` | corrected | Install pin `v0.12.42`; "Upgrading to 0.12.42"; plugin restart names 0.12.42; agy install names the 1.4.x line (#590). |
+| `docs/operations.md` | corrected | Version line, protocol 16 range and upgrade commands name 0.12.42; agy 1.4.x line (#590); watchdog values (#594, #598). |
+| `docs/security.md` | corrected | The agy launcher's 1.4.x acceptance, the unverified-patch warning and the refusal boundary (#589). |
+| `docs/agent-notes/adapters.md` | corrected in #590 | The launcher refuses versions outside the 1.4.x line. |
+| `docs/agent-notes/tests.md` | corrected in #594 and #598 | Watchdog values per platform (Linux 1080 s). #596 changed a test only; no test-gate rule changed. |
+| `src/cli/help.ts` | corrected in #590 | `ahub agy` names the 1.4.x line; no command, subcommand or flag changed. |
+
+## Checks
+
+- Each PR's exact-head CI passed (table above); all checks share one serialized queue.
+- Local full `scripts/check.sh` runs before #593/#595 were cut off by the 600 s watchdog while tests still passed, and showed the `CLAUDE_CONFIG_DIR` failure fixed by #595. CI is the full gate for this release.
+- The bundle was rebuilt with `bun run build` under a local Bun 1.4.3; #591 re-ran it under 1.4.2 and the diff is the version stamp only.
+- `node scripts/check-docs.mjs --require-fresh`: `docs: OK (0 stale documents)` at the restamp.
+- Codex P1 on #597 (stamps not an ancestor of a squashed commit) declined: `6f012880` is an ancestor of the PR merge ref and `--require-fresh` passes there; release PRs use a merge commit.
+- Exact-head CI on the release PR.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "6f01288071848891e54ae1dda6ba87f365a060c8",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "6f01288071848891e54ae1dda6ba87f365a060c8",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "ba26148f52511968910d5596572bc8ad7b5c6a3a",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "6f01288071848891e54ae1dda6ba87f365a060c8",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "6f01288071848891e54ae1dda6ba87f365a060c8",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -215,7 +215,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "ba26148f52511968910d5596572bc8ad7b5c6a3a",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -242,7 +242,7 @@
       ]
     },
     "src/cli/help.ts": {
-      "verifiedAgainst": "644f9a45a05e8dcaa8adf2a3febc1bedc9bd331b",
+      "verifiedAgainst": "6f01288071848891e54ae1dda6ba87f365a060c8",
       "paths": [
         "src/cli/main.ts",
         "src/cli/launch.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.41",
+  "version": "0.12.42",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.41",
+  "version": "0.12.42",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -9190,6 +9190,14 @@ function runAgyTui(argv, cwd, env) {
     });
   });
 }
+function agyVersionGate(stdout) {
+  const version = stdout.trim();
+  if (version === "1.4.2")
+    return { ok: true };
+  if (/^1\.4\.\d+$/.test(version))
+    return { ok: true, message: `agy ${version}: only 1.4.2 is T0-verified; launching on the 1.4.x line unverified` };
+  return { ok: false, message: "agy P1 requires the Antigravity CLI 1.4.x line (1.4.2 verified)" };
+}
 async function runAgyEntry(ctx) {
   const { args, cwd, stateDir, cliDir, connect, fail } = ctx;
   if (ctx.instance)
@@ -9207,8 +9215,11 @@ async function runAgyEntry(ctx) {
     return;
   }
   const version = spawnSync4("agy", ["--version"], { encoding: "utf8", timeout: 5000, maxBuffer: 4096, env: peerChildEnv("agy") });
-  if (version.status !== 0 || version.stdout.trim() !== "1.4.2")
-    fail("agy P1 requires the verified Antigravity CLI 1.4.2");
+  const gate = agyVersionGate(version.status === 0 ? version.stdout : "");
+  if (!gate.ok)
+    fail(gate.message);
+  if (gate.message)
+    console.error(gate.message);
   const hub = await connect();
   let options;
   let pluginWritten = false;
@@ -18416,7 +18427,7 @@ init_spec_read();
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.12.41",
+  version: "0.12.42",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/adapters/agy/entry.ts

@@ -33,6 +33,14 @@ function runAgyTui(argv: string[], cwd: string, env: NodeJS.ProcessEnv): Promise
   });
 }
 
+/** agy auto-updates, so the 1.4.x line launches; only 1.4.2 has a T0 receipt and other patches warn (#589). */
+export function agyVersionGate(stdout: string): { ok: true; message?: string } | { ok: false; message: string } {
+  const version = stdout.trim();
+  if (version === "1.4.2") return { ok: true };
+  if (/^1\.4\.\d+$/.test(version)) return { ok: true, message: `agy ${version}: only 1.4.2 is T0-verified; launching on the 1.4.x line unverified` };
+  return { ok: false, message: "agy P1 requires the Antigravity CLI 1.4.x line (1.4.2 verified)" };
+}
+
 export async function runAgyEntry(ctx: NativeCliEntryContext): Promise<void> {
   const { args, cwd, stateDir, cliDir, connect, fail } = ctx;
   if (ctx.instance) fail("extra Antigravity TUI instances are not verified in P1");
@@ -45,7 +53,9 @@ export async function runAgyEntry(ctx: NativeCliEntryContext): Promise<void> {
   const argv = nativeArgs;
   if (preview) { console.log(JSON.stringify({ command: "agy", args: argv.map(publicArg), mode: "tui", permission: "unmanaged", mcp: ".agents/plugins/agent-hub/", writes: false })); return; }
   const version = spawnSync("agy", ["--version"], { encoding: "utf8", timeout: 5000, maxBuffer: 4096, env: peerChildEnv("agy") });
-  if (version.status !== 0 || version.stdout.trim() !== "1.4.2") fail("agy P1 requires the verified Antigravity CLI 1.4.2");
+  const gate = agyVersionGate(version.status === 0 ? version.stdout : "");
+  if (!gate.ok) fail(gate.message);
+  if (gate.message) console.error(gate.message);
   const hub = await connect();
   let options: AgyMcpOptions | undefined;
   let pluginWritten = false;

package/src/cli/help.ts

@@ -51,7 +51,7 @@ const SECTIONS: [string, [usage: string, description: string][]][] = [
     ["ahub codex [--print-command] [--unattended] [args...]", "start the Codex adapter and attach the TUI"],
     ["ahub kimi [--print-command] [--mode tui|headless] [--model <alias>]", "default: Kimi's own TUI, pull-only via hub_inbox; no push, steer, watchdog, console approvals or automatic quota handoff. Select headless for ACP"],
     ["ahub jcode [--mode tui|headless] [--model <alias>] [--provider-profile <name>] [--session-id <id>] [--print-command]", "optional Jcode (roster.jcode, default off): its TUI on the hub-owned ACP session, opened once that session is saved; --mode headless for ACP only; native policy unmanaged, no hub sandbox"],
-    ["ahub agy [--print-command | --dry-run] [args...]", "optional Antigravity CLI 1.4.2 TUI in this terminal (roster.agy, default off): pull-only via hub_inbox, implementer/verifier only; native permissions unmanaged, no hub sandbox"],
+    ["ahub agy [--print-command | --dry-run] [args...]", "optional Antigravity CLI 1.4.x TUI (1.4.2 verified) in this terminal (roster.agy, default off): pull-only via hub_inbox, implementer/verifier only; native permissions unmanaged, no hub sandbox"],
     ["ahub qwen [--mode headless] [--model <alias>] [--session-id <id>] [--print-command]", "start optional Qwen Code 0.25.0 ACP (roster.qwen, default off)"],
     ["ahub pi [--print-command] [--mode headless|tui | --headless] [--backend auto|dgx|mlx] [--model <alias>] [--session-id <id>] [--session-file <path>] [--replace-session]", "start Pi: its TUI in this terminal unless --headless or the start mode setting (peers.pi.start_mode) says headless; without a terminal the hub opens one or says how"],
     ["ahub local [--route <id> | --model <id>]", "start the hub-native worker on the self-hosted models (routing.toml)"],