@staix/agent-hub 0.14.0 → 0.15.0

package/src/cli/main.ts

@@ -18,6 +18,7 @@ import { matchesPolicy } from "../hub/path-policy.ts";
 import { projectedDiff } from "../hub/projected-diff.ts";
 import { TextProjections } from "../hub/text-projection.ts";
 import { terminalText } from "./console-state.ts";
+import { parseSettingsEditArgs, runSettingsEdit, SETTINGS_EDIT_USAGE } from "./settings-edit.ts";
 import { petView, readPet, renderPet } from "./pet.ts";
 import { startPetWindow, closePetWindow } from "../pet/window.ts";
 import { loadPetConfig, savePetPalette } from "./pet-config.ts";
@@ -36,7 +37,7 @@ import { chmodSync, existsSync, readFileSync, renameSync, writeFileSync } from "
 import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { basename, dirname, join, relative, resolve } from "node:path";
-import { ControlClient, readControl } from "../hub/control-client.ts";
+import { retryLaunchConnect, ControlClient, readControl } from "../hub/control-client.ts";
 import { loadConfig } from "../hub/daemon.ts";
 import { factsHook } from "./facts-hook.ts";
 import { hubHome, projectContext, projectRoot, realPath } from "../hub/project.ts";
@@ -89,7 +90,7 @@ import { agentShellCause, classifyPeerCommand, cliCommandLabel, detectCliIdentit
 import { recordCliAudit, recordDelegatedCliAudit } from "./identity-audit.ts";
 import { runConsole } from "./console.ts";
 import { paint, permissionBoundary, resolveColor, wrap, type Span } from "./console-state.ts";
-import { outputWidth, renderRoster, renderStatus, renderBoard, renderBoardColumns, boardColumnModel, renderBudget, renderDoctor, renderProjects, renderQueue, renderTurns, renderOrphans, renderQueueShow, renderModelsStatus, renderExecutionBudgetStatus, renderReport, renderUsage, renderLimits, renderTotal, type DoctorCheck } from "./output.ts";
+import { outputWidth, renderRoster, renderStatus, renderBoard, renderBacklog, renderBoardColumns, boardColumnModel, renderBudget, renderDoctor, renderProjects, renderQueue, renderTurns, renderOrphans, renderQueueShow, renderModelsStatus, renderExecutionBudgetStatus, renderReport, renderUsage, renderLimits, renderTotal, type DoctorCheck } from "./output.ts";
 import { renderHelp, configuredAcpHelp } from "./help.ts";
 import { renderTailEvent } from "./tail-render.ts";
 import { archiveProblem, archiveState, damagedState, failureText, MANIFEST, planReset, resetLines, resetRuntime, startState, type ResetPlan } from "./reset.ts";
@@ -274,13 +275,15 @@ function printOutput(lines: Span[][], color: boolean): void {
 }
 const unattendedEnv = process.env.AGENTHUB_UNATTENDED === "1";
 const lifecycle = { inspectProject, startProject, stopProject };
-const connect = async () => {
+const connect = async (timeoutMs = 3000) => {
   assertDelegatedAuditConsumer();
   if (delegatedAuditHub && !delegatedConnectionTaken) { delegatedConnectionTaken = true; return delegatedAuditHub; }
   return ControlClient.connect(stateDir, identity.role === "tools" ? { role: "tools", peer: identity.peer, projectRoot: cwd }
-    : { role: "console", projectRoot: cwd, ...(delegatedAuditHub ? { instanceId: delegatedAuditHub.instanceId } : {}) });
+    : { role: "console", projectRoot: cwd, ...(delegatedAuditHub ? { instanceId: delegatedAuditHub.instanceId } : {}) }, timeoutMs);
 };
 
+const connectLaunch = () => retryLaunchConnect(connect, () => console.error("hub busy, retrying"));
+
 function registeredProject(): Project {
   const registry = new Registry();
   try { return registry.register(cwd, stateDir); }
@@ -943,7 +946,7 @@ const commands: Record<string, () => Promise<void> | void> = {
     // Preserve the original guard before native effects; previews remain read-only and precede this guard.
     if (entry.lifecycleAdmission && !args.includes("--print-command") && !args.includes("--dry-run")) assertLifecycleAvailable();
     const nativeConnect = async () => {
-      const hub = await connect();
+      const hub = await connectLaunch();
       try { if (selectedInstance) { requirePeerInstances(hub.features); requireActiveInstance((await hub.request({ t: "status" })).status, selectedInstance); } return hub; }
       catch (error) { hub.close(); throw error; }
     };
@@ -955,7 +958,10 @@ const commands: Record<string, () => Promise<void> | void> = {
       projectConfig, connect: nativeConnect, fail,
       exec: (bin, argv, tool) => exec(bin, argv, tool, context.executionCwd),
       execWithEnv: (bin, argv, env) => execWithEnv(bin, argv, env, selectedInstance ?? entry.command, context.executionCwd), takeFlags,
-      helpers: { launcherPreview: (tool, raw, projectRoot, state, unattended) => launcherPreview(tool, raw, projectRoot, state, unattended, selectedInstance), readControl, recordTerminalLaunch, prepareTerminalLaunch, registerTerminalLaunch, recoveryLock, processSignature,
+      helpers: { resolveExecutionCwd: peer => {
+        const current = readInstanceRoleConfig(cwd);
+        return resolveInstanceExecutionCwd(cwd, peer, current.instances, effectiveInstanceRoles(peer, current.instances, current.roles, current.catalog), current.catalog);
+      }, launcherPreview: (tool, raw, projectRoot, state, unattended) => launcherPreview(tool, raw, projectRoot, state, unattended, selectedInstance), readControl, recordTerminalLaunch, prepareTerminalLaunch, registerTerminalLaunch, recoveryLock, processSignature,
         buildLaunch, claudeObservationHooks, recordClaudeLaunch, cleanupStaleClaudeSettings, cleanupClaudeSettings,
         nativeLaunchEnv, runClaudeLaunch, childEnv, qwenSessionId, configureJcodeMcp, configureKimiMcp,
         buildKimiTuiLaunch, startModeOf },
@@ -1141,7 +1147,15 @@ const commands: Record<string, () => Promise<void> | void> = {
 
   backlog: async () => {
     const [sub, id, revision, value, ...reason] = args;
-    if (sub === "list" && args.length === 1) return console.log(await taskOp("hub_backlog_list", {}));
+    if (sub === "list" && outputArguments().length === 1) {
+      // #399: a table by default; --json prints the hub's listing unchanged, and a refusal is printed as it came.
+      const options = outputOptions(), raw = await taskOp("hub_backlog_list", {});
+      if (options.json) return console.log(raw);
+      let cards: unknown;
+      try { cards = JSON.parse(raw); } catch { return console.log(raw); }
+      if (!Array.isArray(cards)) return console.log(raw);
+      return printOutput(renderBacklog(cards, options.columns, Date.now(), options.full), options.color);
+    }
     if (sub === "groom" && args.length === 1) return console.log(await taskOp("hub_planner_groom", {}));
     if (["return", "return-untouched"].includes(sub ?? "") && /^[1-9]\d*$/.test(id ?? "") && /^\d+$/.test(revision ?? "") && args.length >= 4) {
       return console.log(await taskOp("hub_backlog_return_untouched", { id: Number(id), revision: Number(revision), reason: args.slice(3).join(" ") }));
@@ -1509,7 +1523,31 @@ const commands: Record<string, () => Promise<void> | void> = {
     } finally { hub.close(); }
   },
   settings: async () => {
-    const usage = "usage: ahub settings [list] [--json] | get <key> [--json] | set <key> <value|inherit> [--yes] [--preview] | undo | reload";
+    // #689: structural config edits (instances, review, snapshots, approvals, context.gate, sdlc.toml) and their backups. The hub validates and writes.
+    if (args[0] === "edit" || args[0] === "backups") {
+      // A command line the parser refuses never reaches the hub, not even as a connection.
+      const early = args[0] === "backups" ? (args.length > 2 || (args[1] !== undefined && args[1] !== "--json") ? SETTINGS_EDIT_USAGE : undefined) : (() => { const parsed = parseSettingsEditArgs(args.slice(1)); return typeof parsed === "string" ? parsed : undefined; })();
+      if (early) fail(early);
+      const hub = await connect();
+      try {
+        const rl = process.stdin.isTTY ? createInterface({ input: process.stdin, output: process.stdout }) : undefined;
+        const usage = await runSettingsEdit(args, {
+          request: async message => {
+            const reply = await hub.request(message, 35_000);
+            if (reply.ok !== true) {
+              const error = String(reply.error ?? "config edit refused");
+              fail(/unknown (?:control )?(?:message|request|command)(?:\b|:)|this hub does not know "config_edit/i.test(error) ? `${error}; upgrade and restart the running hub to use ahub settings edit` : error);
+            }
+            return reply;
+          },
+          ask: async prompt => { if (!rl) return null; try { return await rl.question(prompt); } catch { return null; } },
+          print: line => console.log(terminalText(line)),
+        }).finally(() => rl?.close());
+        if (usage) fail(usage);
+      } finally { hub.close(); }
+      return;
+    }
+    const usage = "usage: ahub settings [list] [--json] | get <key> [--json] | set <key> <value|inherit> [--yes] [--preview] | undo | reload | edit <file> ... | backups";
     const flags = args.filter((arg) => arg.startsWith("--")), [sub = "list", key, text, ...extra] = args.filter((arg) => !arg.startsWith("--"));
     const allowed: Record<string, string[]> = { list: ["--json"], get: ["--json"], set: ["--yes", "--preview", "--now"], undo: [], reload: [] };
     if (!Object.hasOwn(allowed, sub) || flags.some((flag) => !allowed[sub]!.includes(flag)) || extra.length) fail(usage);
@@ -2254,7 +2292,7 @@ async function runConductorCommand(): Promise<void> {
 const runConfigured = configuredCommand ? async () => {
   const selection = parseConfiguredAcpArguments(cmd, args, projectCatalog, declaredInstances);
   if (!selection.preview) assertLifecycleAvailable();
-  await runConfiguredAcpEntry({ kind: cmd, raw: args, catalog: projectCatalog, instances: declaredInstances, connect, print: text => console.log(text), operationId: process.env.AGENTHUB_RECOVERY_OPERATION });
+  await runConfiguredAcpEntry({ kind: cmd, raw: args, catalog: projectCatalog, instances: declaredInstances, connect: connectLaunch, print: text => console.log(text), operationId: process.env.AGENTHUB_RECOVERY_OPERATION });
 } : undefined;
 const run = identity.role === "tools" && commandAccess === "conductor" ? runConductorCommand : (Object.hasOwn(commands, cmd) ? commands[cmd] : undefined) ?? runConfigured ?? (() => fail(`unknown command "${cmd}"; run ahub help`));
 try {

package/src/cli/output.ts

@@ -249,6 +249,7 @@ export function renderStatus(data: StatusOutput, columns?: number, now = Date.no
     const actionPolicy = data.actionPolicyInfo?.[id];
     if (actionPolicy?.note) out.push(...detail(`${id} action policy`, actionPolicy.note, columns, actionPolicy.enforceable ? "muted" : "attention"));
     if (typeof p.reviewerUnavailable === "string" && p.reviewerUnavailable) out.push(...detail("reviewer", flat(p.reviewerUnavailable), columns, "failure")); // #722: the cause class, never a path
+    if (p.ownerIsolationNote) out.push(...detail("owner isolation", p.ownerIsolationNote, columns, "attention"));
     if (p.permissionNote) out.push(...detail("permission", p.permissionNote, columns, "muted"));
     if (typeof p.statusNotice?.message === "string" && p.statusNotice.message) out.push(...detail("status notice", p.statusNotice.message, columns, "attention"));
     if (p.requestedModel && p.servedBy && p.requestedModel !== p.servedBy) out.push(...detail("requested model", p.requestedModel, columns));
@@ -279,6 +280,33 @@ export function stageCode(next: string): string {
 }
 const BOARD_LEGEND = "STAGE: [#---] SDLC progress, stage: next step. issue? no issue, PR? no PR, CI? checks, review? not reviewed, threads? open threads. Full advice: ahub board --full.";
 const ellipsis = (text: string, room: number) => width(text) <= room ? text : room <= 3 ? ".".repeat(Math.max(0, room)) : (() => { let out = ""; for (const unit of characters(text)) { if (width(out + unit) > room - 3) break; out += unit; } return out + "..."; })();
+/**
+ * #399: `ahub backlog list` as a table: one line per card, by rank (unranked last) then id. With a width, TITLE goes last and is
+ * cut like the compact board, and AGE then CLASS give way first on a narrow terminal; without one (piped) or with full, titles are whole.
+ */
+export function renderBacklog(cards: any[], columns?: number, now = Date.now(), full = false): Span[][] {
+  if (!cards.length) return [[span("no backlog cards")]];
+  const sorted = [...cards].sort((a, b) => (typeof a.rank === "number" ? a.rank : Infinity) - (typeof b.rank === "number" ? b.rank : Infinity) || a.id - b.id);
+  let names = ["RANK", "ID", "PRI", "RESERVED", "AFTER", "CLASS", "AGE", "TITLE"];
+  let table: OutputCell[][] = sorted.map(card => {
+    const deps: number[] = Array.isArray(card.deps) ? card.deps : [];
+    return [span(typeof card.rank === "number" ? card.rank : "-", "muted", true), span(`#${card.id}`, "info", true), span(typeof card.priority === "number" ? `P${card.priority}` : "-", undefined, true),
+      span(card.reserved ?? "-", peerTone(card.reserved ?? ""), true), span(deps.length ? (full || columns === undefined ? deps.map(id => `#${id}`).join(",") : `#${deps[0]}${deps.length > 1 ? `,+${deps.length - 1}` : ""}`) : "-", undefined, true), span(card.class ?? "-", undefined, true),
+      span(typeof card.created === "number" ? duration(now - card.created) : "-", "muted", true), span(flat(card.title))];
+  });
+  if (!full && columns !== undefined) {
+    const drop = (name: string) => { const at = names.indexOf(name); if (at < 0) return; names = names.filter((_, i) => i !== at); table = table.map(row => row.filter((_, i) => i !== at)); };
+    const room = () => columns - names.reduce((sum, name, i) => name === "TITLE" ? sum : sum + Math.max(width(name), ...table.map(row => width(flat(row[i]!.text)))), 0) - 2 * (names.length - 1);
+    const want = Math.min(30, Math.max(...table.map(row => width(row[row.length - 1]!.text))));
+    for (const name of ["AGE", "CLASS", "PRI"]) if (room() < want) drop(name);
+    const titleRoom = Math.max(5, room());
+    table = table.map(row => [...row.slice(0, -1), { ...row[row.length - 1]!, text: ellipsis(row[row.length - 1]!.text, titleRoom) }]);
+  }
+  const owners = new Map<string, number>();
+  for (const card of sorted) owners.set(card.reserved ?? "unreserved", (owners.get(card.reserved ?? "unreserved") ?? 0) + 1);
+  const summary = `${plural(sorted.length, "backlog card")}; reserved: ${[...owners].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([owner, n]) => `${owner} ${n}`).join(", ")}`;
+  return [...rows(names, table, columns), [], ...lines(summary, columns)];
+}
 /** #724: one line per task. TITLE goes last and is cut to the room left; at a narrow width REVIEWER, CLASS and AGE give way first. */
 function compactBoard(tasks: any[], data: OutputCell[][], columns: number, staged: boolean): Span[][] {
   const head = ["ID", "STATE", "OWNER", "REVIEWER", "CLASS", "AGE", "AFTER", ...(staged ? ["STAGE"] : []), "TITLE"];

package/src/cli/reset.ts

@@ -11,7 +11,7 @@ import { HUB_DB_BUSY_TIMEOUT_MS } from "../hub/db-timeout.ts";
 /** Agent session resume pointers. `pi-sessions/` holds Pi transcripts, history rather than pointers, and stays. */
 export const SESSION_POINTERS = ["sessions.json", "claude-session.json", "claude-context.json"];
 /** The fixed pointers plus each Claude instance's own session and context files (#450 I3). */
-const sessionPointers = (stateDir: string): string[] => [...SESSION_POINTERS, ...(existsSync(stateDir) ? readdirSync(stateDir).filter(name => /^claude-(session|context)\.[a-z][a-z0-9-]{0,31}\.json$/.test(name)) : [])];
+const sessionPointers = (stateDir: string): string[] => [...SESSION_POINTERS, ...(existsSync(stateDir) ? readdirSync(stateDir).filter(name => /^claude-(session|context|task-sessions)\.[a-z][a-z0-9-]{0,31}\.json$/.test(name)) : [])];
 /** What a running daemon publishes; a daemon that did not stop cleanly (crash, SIGKILL, forced exit) leaves it. */
 export const MANIFEST = ["status.json", "control-token", "hub.pid"];
 

package/src/cli/settings-edit.ts

@@ -0,0 +1,89 @@
+/** #689: `ahub settings edit` and `ahub settings backups`. Parsing and rendering only; the hub validates, previews and writes. */
+export interface SettingsEditArgs { file: "config.local.json" | "sdlc.toml"; set: { path: string[]; value: unknown }[]; reason?: string; preview: boolean; yes: boolean }
+export const SETTINGS_EDIT_USAGE = "usage: ahub settings edit <config.local.json|sdlc.toml> (set <path> <json> | remove <path>)... [--reason <text>] [--preview] [--yes] | ahub settings backups [--json]";
+
+/** The request a command line asks for, or the usage line. Values are JSON, so a string needs its quotes. */
+export function parseSettingsEditArgs(argv: readonly string[]): SettingsEditArgs | string {
+  const [file, ...rest] = argv;
+  if (file !== "config.local.json" && file !== "sdlc.toml") return SETTINGS_EDIT_USAGE;
+  const set: SettingsEditArgs["set"] = [];
+  let reason: string | undefined, preview = false, yes = false;
+  const path = (text: string | undefined): string[] | undefined => {
+    if (!text || text.startsWith(".") || text.endsWith(".") || text.includes("..")) return undefined;
+    return text.split(".");
+  };
+  for (let index = 0; index < rest.length; index++) {
+    const word = rest[index]!;
+    if (word === "--preview") preview = true;
+    else if (word === "--yes") yes = true;
+    else if (word === "--reason") { reason = rest[++index]; if (reason === undefined) return SETTINGS_EDIT_USAGE; }
+    else if (word === "set") {
+      const target = path(rest[++index]), text = rest[++index];
+      if (!target || text === undefined) return SETTINGS_EDIT_USAGE;
+      try { set.push({ path: target, value: JSON.parse(text) }); } catch { return SETTINGS_EDIT_USAGE; }
+    } else if (word === "remove") {
+      const target = path(rest[++index]);
+      if (!target) return SETTINGS_EDIT_USAGE;
+      set.push({ path: target, value: null });
+    } else return SETTINGS_EDIT_USAGE;
+  }
+  if (!set.length) return SETTINGS_EDIT_USAGE;
+  return { file, set, ...(reason !== undefined ? { reason } : {}), preview, yes };
+}
+
+/** What a person reads before confirming: the diff lines, the warning of a tier 3 key and the word to type. */
+export function renderEditPreview(reply: { ok?: unknown; lines?: unknown; warning?: unknown; confirm?: unknown }): string[] {
+  const lines = Array.isArray(reply.lines) ? reply.lines.map(line => String(line)) : [];
+  if (typeof reply.warning === "string") lines.push(`warning: ${reply.warning}`);
+  if (typeof reply.confirm === "string") lines.push(`type ${reply.confirm} to confirm`);
+  return lines;
+}
+
+export interface SettingsEditPorts {
+  request: (message: Record<string, unknown>) => Promise<Record<string, unknown>>;
+  /** Asks one line on a terminal; null when there is none. */
+  ask: (prompt: string) => Promise<string | null>;
+  print: (line: string) => void;
+}
+/**
+ * The whole command, with its ports injected. The person's terminal is the only place a tier 3 key can be changed, and only by
+ * typing the key's name: `--yes` confirms an ordinary structural edit and never a tier 3 one.
+ */
+export async function runSettingsEdit(argv: readonly string[], ports: SettingsEditPorts): Promise<string | undefined> {
+  const { request, ask, print } = ports;
+  if (argv[0] === "backups") {
+    if (argv.length > 2 || (argv[1] !== undefined && argv[1] !== "--json")) return SETTINGS_EDIT_USAGE;
+    const view = await request({ t: "config_edit_get" });
+    const backups = Array.isArray(view.backups) ? view.backups as { name: string; file: string; at: number; bytes: number }[] : [];
+    if (argv[1] === "--json") print(JSON.stringify(backups, null, 2));
+    else if (!backups.length) print("no config backups yet");
+    else for (const item of backups) print(`${new Date(item.at).toISOString()}  ${item.file}  ${item.bytes} bytes  ${item.name}`);
+    return undefined;
+  }
+  const parsed = parseSettingsEditArgs(argv[0] === "edit" ? argv.slice(1) : argv);
+  if (typeof parsed === "string") return parsed;
+  const view = await request({ t: "config_edit_get" });
+  const revisions = view.revisions as Record<string, string> | undefined;
+  const revision = revisions?.[parsed.file];
+  if (typeof revision !== "string") return "the running hub does not report config revisions: upgrade and restart it to use ahub settings edit";
+  const body = { file: parsed.file, revision, set: parsed.set };
+  const preview = await request({ t: "config_edit_preview", edit: body });
+  for (const line of renderEditPreview(preview)) print(line);
+  if (parsed.preview) { print("preview only; nothing was changed"); return undefined; }
+  const typed = typeof preview.confirm === "string" ? preview.confirm : undefined;
+  let confirm: string | undefined;
+  if (typed) {
+    const answer = await ask(`Type ${typed} to confirm: `);
+    if (answer === null) return "not a terminal: a key that runs code or locates secrets is confirmed by typing its name; nothing was changed";
+    if (answer.trim() !== typed) { print("nothing was changed"); return undefined; }
+    confirm = typed;
+  } else if (!parsed.yes) {
+    const answer = await ask("Write this change? [y/N] ");
+    if (answer === null) return "not a terminal: nothing was changed; rerun with --yes after reviewing the preview";
+    if (!/^(y|yes)$/i.test(answer.trim())) { print("nothing was changed"); return undefined; }
+  }
+  const result = await request({ t: "config_edit_apply", edit: body, ...(confirm ? { confirm } : {}), ...(parsed.reason !== undefined ? { reason: parsed.reason } : {}) });
+  print(String(result.text ?? "config written"));
+  if (Array.isArray(result.restartPending) && result.restartPending.length) print(`restart pending: ${result.restartPending.join(", ")}; restart the hub (ahub restart) to apply`);
+  return undefined;
+}

package/src/cli/terminal-recovery.ts

@@ -328,7 +328,7 @@ export function recordPath(stateDir: string): string {
   return join(stateDir, RECORD_FILE);
 }
 
-/** Extra terminal ownership is supported only for the native proxy transport; other I2 extras stay headless. */
+/** Resolve declared terminal roots without treating a launch candidate as daemon ownership proof. */
 function executionRoot(peer: string, projectRoot: string, captured?: string): string {
   const builtin = definitionOf(peer);
   if (builtin?.session.launchRecord) return projectRoot;
@@ -336,11 +336,6 @@ function executionRoot(peer: string, projectRoot: string, captured?: string): st
   const definition = catalog.definitionOf(peer, declarations);
   if (!definition?.session.launchRecord) throw new Error(`${peer}: no managed terminal recovery adapter`);
   if (!declarations?.[peer] || definition.transport !== "codex-appserver" && definition.transport !== "claude-channel") throw new Error(`${peer}: extra instance has no managed terminal support`);
-  // #450 I3: a Claude instance reviews or plans in the canonical checkout; it never owns an execution worktree.
-  if (definition.transport === "claude-channel") {
-    if (captured !== undefined && captured !== projectRoot) throw new Error(`${peer}: recorded execution root changed; manual recovery required`);
-    return projectRoot;
-  }
   const expected = resolveInstanceExecutionCwd(projectRoot, peer, declarations, effectiveInstanceRoles(peer, declarations, roles, catalog), catalog);
   if (captured !== undefined && captured !== expected) throw new Error(`${peer}: declared execution worktree changed; manual recovery required`);
   return expected;

package/src/hub/action-enforce.ts

@@ -0,0 +1,82 @@
+import { ACTION_CLASSES, classifyAction, type ActionClass } from "./action-class.ts";
+import { actionApprovalText, actionPolicyConfig, type ActionBudgets, type ActionPolicyConfig } from "./action-policy.ts";
+import type { ActionGateVerdict } from "../adapters/acp.ts";
+
+/**
+ * Where the always-ask policy (#636) meets the two surfaces that see a tool call before it runs: the Claude PreToolUse hook and ACP
+ * `session/request_permission`. The classifier (`action-class.ts`) and the budget ledger (`action-policy.ts`) decide; this file only
+ * connects them, and only ever adds an approval: an empty result keeps the native permission policy.
+ */
+
+/** One native tool call as an adapter saw it: every name it is known by, the ACP tool kind when reported, and its arguments. */
+export interface ActionCall { names: readonly string[]; kind?: string; input: unknown }
+
+/** The classes of one call. ACP names a shell call `execute` by kind whatever its tool is called, so that kind is also read as a shell. */
+export function classifyCall(call: ActionCall, root: string): ActionClass[] {
+  const names = new Set(call.names.filter(name => typeof name === "string" && name.length > 0));
+  if (call.kind === "execute") names.add("bash");
+  const found = new Set<ActionClass>();
+  for (const name of names) for (const key of classifyAction(name, call.input, root)) found.add(key);
+  return ACTION_CLASSES.filter(key => found.has(key));
+}
+
+/**
+ * The classes the Claude PreToolUse hook must `ask` about, in every permission mode. The budget never relaxes it: Claude's own dialog
+ * cannot carry a class-budget choice, so every classed Claude call asks (a count of zero approved calls, always). A handle-less request
+ * selects the classes without touching any session ledger.
+ */
+export function claudeActionClasses(budgets: ActionBudgets, tool: string, input: unknown, root: string): ActionClass[] {
+  const classes = classifyAction(tool, input, root);
+  if (!classes.length) return [];
+  const decision = budgets.request(undefined, classes);
+  return decision.kind === "ask" ? decision.classes : [];
+}
+
+/** The command line an approval shows: the shell command when there is one, else the arguments. Bounded by the caller's screen. */
+export function commandText(input: unknown): string {
+  let value: unknown = input;
+  if (typeof input === "string") { try { value = JSON.parse(input) as unknown; } catch { return input; } }
+  if (typeof value === "string") return value;
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const record = value as Record<string, unknown>, command = record.command ?? record.cmd;
+    if (typeof command === "string") return command;
+    if (Array.isArray(command) && command.every(word => typeof word === "string")) return (command as string[]).join(" ");
+    if (Array.isArray(record.args) && record.args.every(word => typeof word === "string")) return ["git", ...(record.args as string[])].join(" ");
+  }
+  try { return JSON.stringify(value) ?? ""; } catch { return ""; }
+}
+
+export interface ActionGatePorts<T> {
+  budgets: ActionBudgets;
+  policy(): ActionPolicyConfig | undefined;
+  /** The peer's execution root: a delete outside it is classed. */
+  root(peer: string): string;
+  /** The task the peer is working on, for the approval line. */
+  task(peer: string): T | undefined;
+  /** The task's public view (`Tasks.publicView`): the only way a task title reaches an approval. */
+  publicView(task: T): Record<string, unknown>;
+  /** A private turn or an open PII task: the command is withheld. */
+  isPrivate(peer: string): boolean;
+  /** The PII screen for text (`Tasks.nameable`). */
+  nameable(text: string): boolean;
+}
+
+/**
+ * The ACP gate of one peer. It returns a verdict only when a person must be asked: a classed call with no session budget left. A call
+ * within an approved class budget, and every unclassed call, return undefined and follow the permission mode as before (the budget
+ * spends here, once per request).
+ */
+export function actionGate<T>(ports: ActionGatePorts<T>, peer: string): (call: ActionCall, session: string) => ActionGateVerdict | undefined {
+  return (call, session) => {
+    const classes = classifyCall(call, ports.root(peer));
+    if (!classes.length) return undefined;
+    const decision = ports.budgets.request(ports.budgets.bindSession(peer, session), classes);
+    if (decision.kind !== "ask") return undefined; // native, or within an approved class budget
+    const title = actionApprovalText(decision.classes, commandText(call.input), ports.task(peer), {
+      publicView: task => ports.publicView(task), private: ports.isPrivate(peer), commandView: command => ports.nameable(command) ? command : undefined });
+    const challenge = decision.challenge, limits = actionPolicyConfig(ports.policy()).budgets;
+    // A budget of one is this call alone: the ordinary allow already says that, so no second choice is offered for it.
+    if (!challenge || !decision.classes.some(key => limits[key] > 1)) return { title };
+    return { title, budget: { label: decision.classes.map(key => `${key} x${limits[key]}`).join(", "), approve: () => ports.budgets.approve(challenge) } };
+  };
+}

package/src/hub/action-policy.ts

@@ -31,24 +31,25 @@ export function actionPolicyConfig(value?: unknown): ActionPolicyConfig {
 export interface ActionSessionBudget { readonly peer: string; readonly session: string }
 export interface ActionChallenge { readonly classes: readonly ActionClass[] }
 export type ActionDecision = { kind: "native" } | { kind: "ask"; classes: ActionClass[]; challenge?: ActionChallenge } | { kind: "budget"; classes: ActionClass[] };
-interface Session { handle: ActionSessionBudget; policy: string; remaining: Record<ActionClass, number> }
+/** `grants` counts the class-budget approvals of this session and policy: a challenge remembers it, so a later approval can tell that another one landed first. */
+interface Session { handle: ActionSessionBudget; policy: string; remaining: Record<ActionClass, number>; grants: Record<ActionClass, number> }
 const empty = (): Record<ActionClass, number> => ({ publish: 0, destroy: 0, "external-write": 0, install: 0 });
 /** Host-only ledger: session ids and policy come from current runtime ports, never a tool argument. */
 export class ActionBudgets {
   private sessions = new Map<string, Session>();
-  private challenges = new WeakMap<ActionChallenge, { handle: ActionSessionBudget; policy: string; classes: ActionClass[] }>();
+  private challenges = new WeakMap<ActionChallenge, { handle: ActionSessionBudget; policy: string; classes: ActionClass[]; grants: Record<ActionClass, number> }>();
   constructor(private readonly config: () => ActionPolicyConfig | undefined, private readonly currentSession: (peer: string) => string | undefined) {}
   bindSession(peer: string, session: string): ActionSessionBudget | undefined {
     if (!session || this.currentSession(peer) !== session) return undefined;
     const previous = this.sessions.get(peer);
     if (previous?.handle.session === session) return previous.handle;
     const handle = Object.freeze({ peer, session });
-    this.sessions.set(peer, { handle, policy: "", remaining: empty() });
+    this.sessions.set(peer, { handle, policy: "", remaining: empty(), grants: empty() });
     return handle;
   }
   revoke(peer: string): void { this.sessions.delete(peer); }
   policyChanged(): void {
-    for (const state of this.sessions.values()) { state.policy = ""; state.remaining = empty(); }
+    for (const state of this.sessions.values()) { state.policy = ""; state.remaining = empty(); state.grants = empty(); }
     this.challenges = new WeakMap();
   }
   private current(handle: ActionSessionBudget | undefined): Session | undefined {
@@ -56,7 +57,7 @@ export class ActionBudgets {
     const state = this.sessions.get(handle.peer);
     if (state?.handle !== handle || this.currentSession(handle.peer) !== handle.session) return undefined;
     const policy = JSON.stringify(actionPolicyConfig(this.config()));
-    if (state.policy !== policy) { state.policy = policy; state.remaining = empty(); }
+    if (state.policy !== policy) { state.policy = policy; state.remaining = empty(); state.grants = empty(); }
     return state;
   }
   private selected(actions: readonly ActionClass[]): ActionClass[] {
@@ -70,28 +71,39 @@ export class ActionBudgets {
     if (!state) return { kind: "ask", classes };
     if (classes.some(key => state.remaining[key] <= 0)) {
       const challenge = Object.freeze({ classes: Object.freeze([...classes]) });
-      this.challenges.set(challenge, { handle: state.handle, policy: state.policy, classes: [...classes] });
+      this.challenges.set(challenge, { handle: state.handle, policy: state.policy, classes: [...classes], grants: { ...state.grants } });
       return { kind: "ask", classes, challenge };
     }
     for (const key of classes) state.remaining[key]--;
     return { kind: "budget", classes };
   }
-  /** Explicit class-budget approval only, never an ordinary allow_once; this invocation consumes slot one. */
+  /**
+   * Explicit class-budget approval only, never an ordinary allow_once; this invocation consumes slot one. Requests run concurrently, so
+   * two challenges can be issued while a class is spent: the first approval opens the allowance (budget minus this call), and an approval of
+   * a challenge issued before it is a later call inside that allowance, which consumes one slot instead of opening another. With no slot
+   * left it is refused (the person asks again and sees a fresh challenge), so N approved calls is the most any budget lets through.
+   * Every class is checked before any is spent: a refusal changes nothing.
+   */
   approve(challenge: ActionChallenge | undefined): boolean {
     if (!challenge) return false;
     const grant = this.challenges.get(challenge); this.challenges.delete(challenge);
     if (!grant) return false;
     const state = this.current(grant.handle), config = actionPolicyConfig(this.config());
     if (!state || state.policy !== grant.policy) return false;
-    for (const key of grant.classes) state.remaining[key] = Math.max(0, config.budgets[key] - 1);
+    const late = (key: ActionClass) => state.grants[key] !== grant.grants[key];
+    if (grant.classes.some(key => late(key) && state.remaining[key] <= 0)) return false;
+    for (const key of grant.classes) {
+      state.remaining[key] = late(key) ? state.remaining[key] - 1 : Math.max(0, config.budgets[key] - 1);
+      state.grants[key]++;
+    }
     return true;
   }
   /** Read-only projection: no session is created, rebound or reset by a status poll. */
-  status(peer: string, enforced: boolean) {
+  status(peer: string, enforced: boolean, reason = "adapter integration pending") {
     const config = actionPolicyConfig(this.config()), state = this.sessions.get(peer);
     const bound = !!state && this.currentSession(peer) === state.handle.session && state.policy === JSON.stringify(config);
     return { enabled: config.enabled, alwaysAsk: [...config.always_ask], limits: { ...config.budgets }, remaining: bound ? { ...state.remaining } : empty(), sessionBound: bound,
-      enforceable: enforced, note: !enforced ? `always-ask not enforceable: adapter integration pending${config.enabled ? "" : "; policy disabled"}` : config.enabled ? "always-ask active" : "always-ask disabled" };
+      enforceable: enforced, note: !enforced ? `always-ask not enforceable: ${reason}${config.enabled ? "" : "; policy disabled"}` : config.enabled ? "always-ask active" : "always-ask disabled" };
   }
 }
 

package/src/hub/board.ts

@@ -9,6 +9,7 @@ import type { SweepRecord } from "./task-sweep.ts";
 import { HUB_DB_BUSY_TIMEOUT_MS } from "./db-timeout.ts";
 import type { SdlcReceipt } from "./sdlc.ts";
 import { parseReviewFindings, type ReviewFindingSet } from "./review-findings.ts";
+import { parseDeliverableRecords, type DeliverableRecord } from "./deliverables.ts";
 import type { CostPlan, ReviewCost } from "./cost-governance.ts";
 
 export const CLASSES = ["plan", "implement", "bulk_edit", "test", "review", "summarize", "triage"] as const;
@@ -66,6 +67,14 @@ export interface HistoryEntry {
   reviewContext?: "fresh" | "continuing";
   /** Structured review report bound to the reviewed artifact, stored in the existing history JSON. */
   reviewFindings?: ReviewFindingSet;
+  /**
+   * #509a: the files a `done`, a lifecycle record or an approval bound, with the content hashes the hub computed. An approval carries the hashes
+   * it was given at review time, so a later edit reads as "deliverable changed since review". Full paths live here; every view goes through
+   * `publicDeliverables`.
+   */
+  deliverables?: DeliverableRecord[];
+  /** #507b: the recorded acceptance criteria (S8 checklist ids) a verdict's unmet items named; derived by the hub from the checklist, never free text. */
+  unmetCriteria?: string[];
   /** Host-authored plan content revision, separate from backlog planningRevision. */
   planRevision?: { revision: number; fingerprint: string };
   planObservation?: { repo: string; pr: number; head: string; revision: number; fingerprint: string };
@@ -77,6 +86,11 @@ export interface HistoryEntry {
   reviewerFailure?: { peer: string; head?: string; cause: "start_failed" | "quota" | "no_verdict" };
   planning?: { revision: number; fields: (keyof PlanningFields)[]; previous: PlanningFields; pull?: true; split?: { children: { id: number; revision: number; history: number }[] } };
 }
+/** The ids a stored verdict may carry (#507b): bounded criterion identifiers in the S8 checklist's own format, at most its 32, each once. */
+function criterionIdList(value: unknown): string[] {
+  if (!Array.isArray(value) || value.length > 32 || value.some(id => typeof id !== "string" || !/^[A-Za-z][A-Za-z0-9-]{0,47}$/.test(id)) || new Set(value).size !== value.length) throw new Error("unmet criteria: expected up to 32 distinct criterion ids");
+  return [...value] as string[];
+}
 export type ReviewerHistory = Pick<HistoryEntry, "reviewerFamily" | "reviewerReason" | "reviewBlocked" | "reviewerFailure">;
 function reviewerHistory(extra: ReviewerHistory): ReviewerHistory {
   const id = (value: unknown) => typeof value === "string" && /^[a-z][a-z0-9-]{0,63}$/.test(value);
@@ -332,7 +346,7 @@ export class Board {
 
   /** The only way a task changes. Validates the move, records who did what, returns the new row. */
   /** A `plan` in the patch replaces the old one whole: a new plan is the owner's current intent, not an addition. */
-  update(id: number, by: PeerId, event: string, patch: Partial<Pick<Task, "state" | "owner" | "reviewer" | "reserved" | "refs" | "plan" | "rejections" | "signals" | "sdlc" | "role" | "cancelled" | "codeSymbols">>, note?: string, extra: Pick<HistoryEntry, "profile" | "sweep" | "reason" | "from" | "capacity" | "withheld" | "noWrites" | "reviewCost" | "reviewContext" | "reviewFindings" | "planObservation" | "planDeparture" | "planDepartureInvalidated" | keyof ReviewerHistory> = {}, expectedFlowRevision?: number, codeSymbolsAuthority?: typeof HOST_CODE_SYMBOLS): Task {
+  update(id: number, by: PeerId, event: string, patch: Partial<Pick<Task, "state" | "owner" | "reviewer" | "reserved" | "refs" | "plan" | "rejections" | "signals" | "sdlc" | "role" | "cancelled" | "codeSymbols">>, note?: string, extra: Pick<HistoryEntry, "profile" | "sweep" | "reason" | "from" | "capacity" | "withheld" | "noWrites" | "reviewCost" | "reviewContext" | "reviewFindings" | "unmetCriteria" | "deliverables" | "planObservation" | "planDeparture" | "planDepartureInvalidated" | keyof ReviewerHistory> = {}, expectedFlowRevision?: number, codeSymbolsAuthority?: typeof HOST_CODE_SYMBOLS): Task {
     const task = this.get(id);
     if (!task) throw new Error(`no task #${id}`);
     if (expectedFlowRevision !== undefined && (!Number.isSafeInteger(expectedFlowRevision) || expectedFlowRevision < 0 || task.history.length !== expectedFlowRevision)) throw new Error("task flow revision changed");
@@ -366,6 +380,16 @@ export class Board {
       if (head !== undefined && !/^[a-f0-9]{40}$/.test(head)) throw new Error("finding metadata requires a full reviewed head");
       reviewFindings = { ...(head ? { head } : {}), items: parseReviewFindings(extra.reviewFindings.items, { person: by === "user", maxNits: 64 }) };
     }
+    let deliverables: DeliverableRecord[] | undefined;
+    if (extra.deliverables !== undefined) {
+      if (!["done", "done (checking)", "lifecycle", "approved"].includes(event)) throw new Error("deliverable records require a done, a lifecycle record or an approval");
+      deliverables = parseDeliverableRecords(extra.deliverables);
+    }
+    let unmetCriteria: string[] | undefined;
+    if (extra.unmetCriteria !== undefined) {
+      if (!["approved", "changes_requested"].includes(event) || patch.state !== event) throw new Error("unmet criteria require a saved review verdict");
+      unmetCriteria = criterionIdList(extra.unmetCriteria);
+    }
     if (extra.planDeparture && (by !== "user" || event !== "plan departure accepted")) throw new Error("plan departure acceptance is person-only");
     const trackPlan = this.trackPlanRevisions?.() === true, hasDeparture = task.history.some(h => h.planDeparture);
     const fingerprint = patch.plan && (trackPlan || hasDeparture) ? planFingerprint(next.plan ?? {}) : undefined;
@@ -374,7 +398,7 @@ export class Board {
     // Disabling reporting must not let plan or repository refs edits/reverts resurrect prior consent.
     const repositoryRefsChanged = patch.refs !== undefined && JSON.stringify([task.refs.repo, task.refs.paths]) !== JSON.stringify([next.refs.repo, next.refs.paths]);
     const departureInvalidated = extra.planDepartureInvalidated === true || hasDeparture && (planChanged || repositoryRefsChanged);
-    const history = [...task.history, { at: Date.now(), by, event, ...(planRevision ? { planRevision } : {}), ...(extra.planObservation ? { planObservation: extra.planObservation } : {}), ...(extra.planDeparture ? { planDeparture: extra.planDeparture } : {}), ...(departureInvalidated ? { planDepartureInvalidated: true as const } : {}), ...reviewMetadata, ...(note ? { note } : {}), ...(patch.cancelled?.supersededBy ? { supersededBy: patch.cancelled.supersededBy } : {}), ...("owner" in patch ? { owner: next.owner } : {}), ...(extra.profile ? { profile: extra.profile } : {}), ...(extra.sweep ? { sweep: extra.sweep } : {}), ...(extra.reason && TASK_MOVE_REASONS.includes(extra.reason) ? { reason: extra.reason } : {}), ...(extra.from ? { from: extra.from } : {}), ...(extra.capacity === true ? { capacity: true as const } : {}), ...(extra.withheld && (note || reviewFindings) ? { withheld: true as const } : {}), ...(reviewFindings ? { reviewFindings } : {}), ...(extra.reviewContext === "fresh" || extra.reviewContext === "continuing" ? { reviewContext: extra.reviewContext } : {}), ...(extra.reviewCost ? { reviewCost: extra.reviewCost } : {}), ...(event === "done" && extra.noWrites === true ? { noWrites: true as const } : {}) }];
+    const history = [...task.history, { at: Date.now(), by, event, ...(planRevision ? { planRevision } : {}), ...(extra.planObservation ? { planObservation: extra.planObservation } : {}), ...(extra.planDeparture ? { planDeparture: extra.planDeparture } : {}), ...(departureInvalidated ? { planDepartureInvalidated: true as const } : {}), ...reviewMetadata, ...(note ? { note } : {}), ...(patch.cancelled?.supersededBy ? { supersededBy: patch.cancelled.supersededBy } : {}), ...("owner" in patch ? { owner: next.owner } : {}), ...(extra.profile ? { profile: extra.profile } : {}), ...(extra.sweep ? { sweep: extra.sweep } : {}), ...(extra.reason && TASK_MOVE_REASONS.includes(extra.reason) ? { reason: extra.reason } : {}), ...(extra.from ? { from: extra.from } : {}), ...(extra.capacity === true ? { capacity: true as const } : {}), ...(extra.withheld && (note || reviewFindings) ? { withheld: true as const } : {}), ...(reviewFindings ? { reviewFindings } : {}), ...(unmetCriteria?.length ? { unmetCriteria } : {}), ...(deliverables ? { deliverables } : {}), ...(extra.reviewContext === "fresh" || extra.reviewContext === "continuing" ? { reviewContext: extra.reviewContext } : {}), ...(extra.reviewCost ? { reviewCost: extra.reviewCost } : {}), ...(event === "done" && extra.noWrites === true ? { noWrites: true as const } : {}) }];
     this.taskWrite(() => {
       const result = this.db.query("UPDATE tasks SET state = ?, owner = ?, reviewer = ?, reserved = ?, refs = ?, plan = ?, rejections = ?, signals = ?, history = ?, sdlc = ?, task_role = ?, cancelled = ?, updated = ? WHERE id = ?")
         .run(next.state, next.owner, next.reviewer, next.reserved ?? null, JSON.stringify(next.refs), JSON.stringify(next.plan ?? {}), next.rejections, JSON.stringify(next.signals), JSON.stringify(history), next.sdlc ? JSON.stringify(next.sdlc) : null, next.role ?? null, next.cancelled ? JSON.stringify(next.cancelled) : null, Date.now(), id);

package/src/hub/budget.ts

@@ -248,6 +248,11 @@ export class Budget {
     this.evaluate(peer, hard).catch((e: Error) => this.closed || this.hooks.notify(`budget: evaluating ${peer} failed: ${e.message}`));
   }
 
+  /** A source that can no longer be trusted drops its reading of one window: the window shows unknown, never the last number. */
+  forget(peer: PeerId, id: UsageWindow["id"]): void {
+    this.readings.get(this.account(peer))?.delete(id);
+  }
+
   /** Readings that still say something: not stale, and not about a window that has reset since they were taken. */
   private fresh(peer: PeerId): Reading[] {
     peer = this.account(peer);

package/src/hub/bus.ts

@@ -429,14 +429,14 @@ export class Bus {
   }
 
   knownPeers(): string[] {
-    const pending = this.storageError ? [] : this.journal?.list().filter((row) => ["queued", "dispatching", "accepted", "needs_review"].includes(row.state)).map((row) => row.peer) ?? [];
+    const pending = this.storageError ? [] : this.journal?.pendingPeers() ?? [];
     return [...new Set([...this.peers.keys(), ...[...this.queues].filter(([, queue]) => queue.length).map(([id]) => id), ...pending])].sort();
   }
 
-  queueList(peer?: string): JournalDelivery[] {
+  queueList(peer?: string, unresolvedOnly = false): JournalDelivery[] {
     if (this.journal) {
-      const rows = this.journal.list(peer).filter((row) => !row.reason?.startsWith("grouped into delivery "));
-      const revision = this.journal.snapshot().revision;
+      const rows = (unresolvedOnly ? this.journal.unresolved(peer) : this.journal.list(peer)).filter((row) => !row.reason?.startsWith("grouped into delivery "));
+      const revision = this.journal.revision();
       const recorded = new Set(rows.filter((r) => ["queued", "dispatching", "accepted", "needs_review"].includes(r.state)).flatMap((r) => (r.originals as Envelope[]).map((e) => `${r.peer}:${e.id}`)));
       const ids = peer ? [peer] : [...this.queues.keys()];
       for (const p of ids) for (const e of this.queues.get(p) ?? []) if (!recorded.has(`${p}:${e.id}`)) rows.push({ id: `q:${p}:${e.id}`, peer: p, state: "queued", revision, createdAt: e.ts, updatedAt: e.ts, originals: [e], out: [e] });
@@ -525,7 +525,7 @@ export class Bus {
   }
 
   queueSummary(peer: string): { needsReview: number; heldBy?: string; liveAccepted?: string[]; oldestQueuedAt?: number } {
-    const rows = this.storageError ? [] : this.queueList(peer);
+    const rows = this.storageError ? [] : this.queueList(peer, true);
     const queued = this.queues.get(peer) ?? [];
     const review = rows.filter((r) => r.state === "needs_review");
     const needsReview = review.length;

package/src/hub/claude-launch-proof.ts

@@ -0,0 +1,33 @@
+import { closeSync, fstatSync, openSync, readSync, constants } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { claudeStateFile } from "./claude-state.ts";
+
+export interface ClaudeLaunchProof {
+  launchId: string;
+  executionCwd?: string;
+  privateRecord: boolean;
+  permissionHook: boolean;
+  unattended: boolean;
+  hookPurpose?: string;
+}
+
+/** One bounded reader for current managed launch metadata; no native identity or payload escapes. */
+export function readClaudeLaunchProof(stateDir: string, peer: string, instanceId: string): ClaudeLaunchProof | undefined {
+  let fd: number | undefined;
+  try {
+    fd = openSync(join(stateDir, claudeStateFile("claude-launch", peer)), constants.O_RDONLY | constants.O_NOFOLLOW);
+    const stat = fstatSync(fd);
+    // ponytail: launch metadata is capped at 16 KiB; add a versioned projection if it ever grows.
+    if (!stat.isFile() || stat.size > 16 * 1024) return;
+    const bytes = Buffer.alloc(16 * 1024 + 1);
+    const count = readSync(fd, bytes, 0, bytes.length, 0);
+    if (count > 16 * 1024) return;
+    const row = JSON.parse(bytes.subarray(0, count).toString("utf8"));
+    if (row?.instanceId !== instanceId || typeof row.launchId !== "string" || !row.launchId || row.launchId.length > 128) return;
+    return { launchId: row.launchId, privateRecord: stat.nlink === 1 && (stat.mode & 0o777) === 0o600 && !!process.getuid && stat.uid === process.getuid(),
+      ...(typeof row.executionCwd === "string" && row.executionCwd.length <= 4096 && isAbsolute(row.executionCwd) ? { executionCwd: row.executionCwd } : {}),
+      permissionHook: row.permissionHook === true, unattended: row.unattended === true,
+      ...(typeof row.hookPurpose === "string" ? { hookPurpose: row.hookPurpose } : {}) };
+  } catch { return; }
+  finally { if (fd !== undefined) closeSync(fd); }
+}