@staix/agent-hub 0.17.0 → 0.18.0

package/docs/verification/profiles/YYYY-MM-DD-research.md

@@ -0,0 +1,61 @@
+# Research profile weekly verification receipt
+
+Template only. No pilot result or verdict has been recorded.
+
+- Week ending: YYYY-MM-DD
+- Profile id: research
+- Window bounds: unknown
+
+## Recorded profile JSON
+
+Run ahub report --dogfood --since 7d --json once at the review boundary. Replace the null below with only the emitted profile subsection. Preserve numbers and null values. Include no project/person name, task title, path, raw log or model text; use anonymous identifiers where necessary.
+
+    null
+
+## Research measurements
+
+Copy only emitted counts and anonymous task/claim slots. These placeholders remain unknown until recorded evidence supports a value.
+
+- Current-plan declared sources and claims per task: unknown
+- Claims reaching a person verdict: unknown
+- Claim slots with model label, person verdict and agreement: unknown
+- Agreement counts by supported/unsupported/unclear label: unknown
+- Recorded task-check outcomes by class alias: unknown
+- Proven checks.fact_check selection and pass/fail by alias: unknown
+- Missing check keys per run: unknown
+- Section-overlap notices and confirmed section edits: unknown
+
+Task-check history alone does not prove checks.fact_check ran. A model label or task approval alone does not prove a person verdict or agreement. Preserve every emitted null.
+
+## Verification verdicts
+
+Choose exactly one listed verdict for each claim after inspecting recorded evidence. Unknown data alone cannot establish support. These placeholders are not verdicts.
+
+- writing-live-example
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- general-live-example
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- research-live-example
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- native-model-ingestion
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- context-retention
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- native-account-research
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- research-measurement
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown

package/docs/verification/profiles/YYYY-MM-DD-writing.md

@@ -0,0 +1,46 @@
+# Writing profile weekly verification receipt
+
+Template only. No pilot result or verdict has been recorded.
+
+- Week ending: YYYY-MM-DD
+- Profile id: writing
+- Window bounds: unknown
+
+## Recorded profile JSON
+
+Run ahub report --dogfood --since 7d --json once at the review boundary. Replace the null below with only the emitted profile subsection. Preserve numbers and null values. Include no project/person name, task title, path, raw log or model text; use anonymous identifiers where necessary.
+
+    null
+
+## Verification verdicts
+
+Choose exactly one listed verdict for each claim after inspecting recorded evidence. Unknown data alone cannot establish support. These placeholders are not verdicts.
+
+- writing-live-example
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- general-live-example
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- research-live-example
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- native-model-ingestion
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- context-retention
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- native-account-research
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown
+- research-measurement
+  - Verdict: [supported | partly supported | not supported]
+  - Evidence task/event/receipt ids: []
+  - Remaining unknowns: unknown

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -71,11 +71,14 @@
         "src/hub/roster.ts",
         "src/hub/instances.ts",
         "src/hub/action-enforce.ts",
-        "src/hub/permission-payload.ts"
+        "src/hub/permission-payload.ts",
+        "src/hub/read-only-shell.ts",
+        "src/hub/read-only-shell-proof.ts",
+        "src/hub/operational-authority.ts"
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -87,7 +90,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -111,7 +114,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -126,7 +129,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -199,7 +202,7 @@
       ]
     },
     "docs/agent-notes/local-worker.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "src/adapters/local-worker.ts",
         "src/local/",
@@ -211,7 +214,7 @@
       ]
     },
     "docs/agent-notes/models.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "src/models/",
         "src/hub/inference.ts",
@@ -219,7 +222,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -251,11 +254,13 @@
         "src/hub/spec-read.ts",
         "src/hub/workflow.ts",
         "src/hub/deliverables.ts",
-        "src/hub/deliverable-files.ts"
+        "src/hub/deliverable-files.ts",
+        "src/hub/sdlc-merge.ts",
+        "src/hub/sdlc-mirror.ts"
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -274,11 +279,12 @@
         "scripts/changed-tests.mjs",
         "scripts/check-closing-refs.mjs",
         ".github/workflows/closing-refs.yml",
-        "scripts/lib/ts-ast.ts"
+        "scripts/lib/ts-ast.ts",
+        "test/cli-json-guard.test.ts"
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",
@@ -287,7 +293,7 @@
       ]
     },
     "src/cli/help.ts": {
-      "verifiedAgainst": "66db760595ad8bec4d844e4094e8b9db45d38e7a",
+      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
       "paths": [
         "src/cli/main.ts",
         "src/cli/launch.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",
@@ -17,7 +17,7 @@
     "bun": ">=1.4.2"
   },
   "dependencies": {
-    "@staix/agent-mem": "0.7.0"
+    "@staix/agent-mem": "0.8.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -82,7 +82,7 @@ function memoryGitEnv(env = process.env, options = {}) {
 }
 function memoryGitSync(args, options) {
   const argv = memoryGitArgv(args);
-  return childProcess().spawnSync(argv[0], argv.slice(1), { ...options, env: memoryGitEnv(options.env ?? process.env) });
+  return childProcess().spawnSync(argv[0], argv.slice(1), { ...ambientGitTimeout !== undefined ? { timeout: ambientGitTimeout, killSignal: "SIGKILL" } : {}, ...options, env: memoryGitEnv(options.env ?? process.env) });
 }
 function processSignature(pid) {
   try {
@@ -118,7 +118,7 @@ var require2, processes, childProcess = () => processes ??= require2("node:child
     const parent = dirname(absolute);
     return parent === absolute ? absolute : join(canonical(parent), basename(absolute));
   }
-}, DENY_SEGMENTS, DENY_NAMES, hasSegment = (rel, seg) => `/${rel}/`.includes(`/${seg}/`), SAFE_CONFIG, CREDENTIAL_KEYS, memoryGitArgv = (args, opts = {}) => ["git", "--no-pager", ...SAFE_CONFIG.filter((c) => !opts.credentials || !CREDENTIAL_KEYS.has(c)).flatMap((c) => ["-c", c]), ...args];
+}, DENY_SEGMENTS, DENY_NAMES, hasSegment = (rel, seg) => `/${rel}/`.includes(`/${seg}/`), SAFE_CONFIG, CREDENTIAL_KEYS, memoryGitArgv = (args, opts = {}) => ["git", "--no-pager", ...SAFE_CONFIG.filter((c) => !opts.credentials || !CREDENTIAL_KEYS.has(c)).flatMap((c) => ["-c", c]), ...args], ambientGitTimeout;
 var init_platform = __esm(() => {
   require2 = createRequire(import.meta.url);
   DENY_SEGMENTS = [".maru/secrets", ".agenthub/state", ".agenthub/archive"];
@@ -6154,9 +6154,26 @@ ${preview(content)}`, "write", ctx.signal, file, undefined, String(a.path), a),
           return "error: empty command";
         if (command.length > 4000)
           return "error: command longer than 4000 characters; put it in a script file with write, then run that";
-        const refused = approvalError(await ctx.permit(`bash: ${command}`, "bash", ctx.signal, undefined, undefined, undefined, a), "error: the user did not approve this command");
-        if (refused)
-          return refused;
+        const input = Object.freeze({ ...a, command });
+        for (let attempt = 0;; attempt++) {
+          const refused = approvalError(await ctx.permit(`bash: ${command}`, "bash", ctx.signal, undefined, undefined, undefined, input, attempt ? { forceAsk: true } : undefined), "error: the user did not approve this command");
+          if (refused)
+            return refused;
+          if (ctx.signal?.aborted)
+            return "error: turn cancelled before shell execution";
+          let check = "valid";
+          try {
+            check = ctx.shellExecutionCheck?.(input) ?? "valid";
+          } catch {
+            check = "ask";
+          }
+          if (check === "aborted" || ctx.signal?.aborted)
+            return "error: turn cancelled before shell execution";
+          if (check === "valid")
+            break;
+          if (attempt)
+            return "error: read-only shell proof remained unstable; no command was executed";
+        }
         const res = await sandboxedExec(["/bin/bash", "-c", command], { cwd: ctx.cwd, profile: ctx.sandboxProfile, readOnlyData: !!ctx.readOnly?.length, timeoutMs: (Number(a.timeout_s) || 120) * 1000, ...ctx.sandboxEnv ? { env: ctx.sandboxEnv } : {}, ...ctx.signal ? { signal: ctx.signal } : {} });
         try {
           ctx.onProcessExit?.(res.code);
@@ -6220,7 +6237,7 @@ var init_tools = __esm(() => {
     fn("read", "Read a text file inside the project. Returns numbered lines.", { path: str, offset: { type: "integer", minimum: 1 }, limit: { type: "integer", minimum: 1 } }, ["path"]),
     fn("write", "Create or overwrite a file inside the project. Needs the user's approval.", { path: str, content: str }, ["path", "content"]),
     fn("edit", "Replace one exact, unique occurrence of `old` with `new` in a file. Needs the user's approval.", { path: str, old: str, new: str }, ["path", "old", "new"]),
-    fn("bash", "Run a shell command in the project directory, sandboxed: no writes outside the project, no credential reads, no network unless the hub enables it. Needs the user's approval.", { command: str, timeout_s: { type: "integer", minimum: 1, maximum: 600 } }, ["command"]),
+    fn("bash", "Run a shell command in the project directory, sandboxed: no writes outside the project, no credential reads, no network unless the hub enables it. Follows hub permission policy: proven bounded read-only commands may run automatically in ask-when-needed; other commands ask.", { command: str, timeout_s: { type: "integer", minimum: 1, maximum: 600 } }, ["command"]),
     fn("git", "Run git in the project. status, diff, log, show, ls-files, blame, rev-parse run freely; add, commit, restore, checkout, switch, stash, mv, rm, branch, merge, rebase, cherry-pick, revert, tag need approval; everything else (push, fetch, config, remote ...) is refused.", { args: { type: "array", items: str, minItems: 1 } }, ["args"]),
     fn("hub_send", "Send a message to the other agents now, before your turn ends. Conclusions only. Your final answer is shared anyway; use this for something that cannot wait.", { text: str, to: { type: "array", items: str } }, ["text"])
   ];
@@ -10017,7 +10034,7 @@ var init_hub_tools = __esm(() => {
     tool("hub_release_list", "Read public release scope and planned/actual dates for phased planning. Configured planners only.", {}),
     tool("hub_task_propose", "Put a piece of work on the shared task board. The hub assigns an owner by class (routing.toml) unless you name one. Classes: plan, implement, bulk_edit, test, review, summarize, triage. Name the class when you know it; without one the hub tries to pick it. Name yourself as owner to claim work nobody assigned you: it starts in progress. Put the paths the work touches in refs, set refs.repo for work in another repository, and when you claim work, a plan; the hub says when they overlap another open task.", { title: str2, class: { type: "string", enum: ["plan", "implement", "bulk_edit", "test", "review", "summarize", "triage"] }, detail: str2, role: { type: "string", description: "catalog role id for this task class; guidance only, no routing or authority change" }, refs, plan, owner: { type: "string", description: "peer id; yours to claim the work, omit to let the hub route it. With after, the owner is reserved: offered the task first once it is ready" }, after: { type: "array", items: { type: "integer" }, description: "ids of tasks that must be approved first; until then this one waits, offered to nobody, and cannot be claimed" }, backlog: { type: "boolean", description: "stage unoffered work; owner is only a reservation, even when naming yourself" }, urgent: { type: "boolean", description: "hand it over even when its owner is paused for quota only briefly" }, goal: { type: "string", description: "id of this project's long-term task (ahub goal list) the work is part of" } }, ["title"]),
     tool("hub_task_accept", "Take a task that was assigned to you, with your plan for it. Set refs.repo for work in another repository; acceptance may correct only that repository metadata.", { id, plan: acceptPlan, refs: { ...refs, properties: { repo: refs.properties.repo } } }, ["id"]),
-    tool("hub_task_cancel", "Cancel unaccepted proposed/backlog work you proposed as its configured planner; accepted work is person-only. Keeps history and does not stop a native turn or delete files.", { id, reason: str2, superseded_by: str2, revision: { type: "integer", minimum: 0 } }, ["id", "reason"]),
+    tool("hub_task_cancel", "Cancel proposed/backlog work you proposed as its configured planner, including work an owner accepted and then declined while it has no execution, branch, commit or PR evidence; work with any such evidence is person-only. Keeps history and does not stop a native turn or delete files.", { id, reason: str2, superseded_by: str2, revision: { type: "integer", minimum: 0 } }, ["id", "reason"]),
     tool("hub_task_decline", "Pass on a task assigned to you; the hub offers it to the next peer. A plain decline is a lasting refusal: you are never offered this task again. Pass capacity: true when you only have no room right now: you are skipped for this move only, and a later reroute or planner pull may offer it to you again.", { id, reason: str2, capacity: { type: "boolean" } }, ["id"]),
     tool("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs; no duplicate hub_send chat is needed. When the project configures a check for its class, the hub runs it first and the result comes as a task message: a failed check keeps the task with you.", { id, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs, deliverables: deliverablesSchema }, ["id", "summary"]),
     tool("hub_sdlc_record", "Record artifact ids or claimed local checks on your task. This grants no authority or external-check evidence. Only its owner/reviewer or the person may record; only its reviewer/person may name a reviewed head or phase checklist. Phase evidence refs are content hashes, not external verification.", { id, receipt: { type: "object", properties: { deliverables: deliverablesSchema, stage: { type: "string", enum: ["spec", "plan", "implement", "review", "verify", "merge", "release"] }, repo: str2, issue: id, pr: id, localHead: str2, localResult: { type: "string", enum: ["passed", "failed", "unknown"] }, reviewedHead: str2, phase: { type: "object", properties: { id: str2, head: str2, tasks: { type: "array", maxItems: 64, items: { type: "object", properties: { id, after: { type: "array", maxItems: 16, items: id } }, required: ["id", "after"], additionalProperties: false } }, criteria: { type: "array", maxItems: 32, items: { type: "object", properties: { id: str2, required: { type: "boolean" }, result: { type: "string", enum: ["verified", "failed", "unverified"] }, refs: { type: "array", maxItems: 8, items: str2 } }, required: ["id", "required", "result", "refs"], additionalProperties: false } } }, required: ["id", "tasks", "criteria"], additionalProperties: false } }, additionalProperties: false } }, ["id", "receipt"]),
@@ -10041,7 +10058,7 @@ var init_hub_tools = __esm(() => {
   TASK_TOOL_NAMES = new Set(TASK_TOOLS.map((t) => t.name));
   CONDUCTOR_TOOLS = [
     tool("hub_status", "Inspect public team state, holds, quota windows, task counts and pending approval peer/tool/age. Only the configured conductor may use this tool.", {}),
-    tool("hub_task_show", "Read a task's public view and history, its done summary and check result included. PII tasks remain stubs. Only the conductor and the task's current owner and reviewer may use this tool.", { id }, ["id"]),
+    tool("hub_task_show", "Read a task's public view and history, its done summary and check result included. PII tasks remain stubs. Only the conductor, the configured planner and the task's current owner and reviewer may use this tool.", { id }, ["id"]),
     tool("hub_task_assign", "Name an owner (default role) or reviewer. Only the conductor may name a reviewer through this tool. A proposer may redirect an unaccepted proposed task's owner; a task that still waits reserves that owner. Pull-only peers receive work when named while attached or when they claim it; a peer that cannot take the task is refused with the reason, and the task is unchanged. With an explicit capabilities list, the conductor needs assign capability for either role, the proposer only to give ownership to another peer.", { id, peer: str2, role: { type: "string", enum: ["owner", "reviewer"] } }, ["id", "peer"]),
     tool("hub_task_escalate", "Escalate a task through the normal task flow, as the conductor. Requires assign capability when explicitly listed.", { id }, ["id"]),
     tool("hub_peer_start", "Start local, kimi, qwen, jcode, pi, claude or codex in the start mode a person set for it; you cannot choose the mode. A headless peer starts at once. A TUI peer (claude, and pi and codex by default) opens in a terminal with a fixed command; when the hub cannot open a terminal the call fails with the command for the person to run.", { peer: { type: "string", enum: CONDUCTOR_START_PEERS } }, ["peer"]),
@@ -10367,11 +10384,12 @@ var init_local_worker = __esm(() => {
       return `(stopped after ${maxSteps} steps) ${progress.last}`.trim();
     }
     toolContext(envs, turnSignal, pii, reply) {
+      const executionGeneration = this.turn;
       return {
         cwd: this.opts.cwd,
         deny: this.opts.tools.deny,
         readOnly: this.opts.tools.readOnly,
-        permit: async (title, tool, _signal, canonicalTarget, _observe, originalPath, input) => {
+        permit: async (title, tool, _signal, canonicalTarget, _observe, originalPath, input, policy) => {
           if (turnSignal.aborted)
             return "aborted";
           const generation = this.turn;
@@ -10400,7 +10418,7 @@ var init_local_worker = __esm(() => {
             };
             const onAbort = () => finish("aborted");
             turnSignal.addEventListener("abort", onAbort, { once: true });
-            this.opts.tools.permit(title, tool, turnSignal, canonicalTarget, observe, originalPath, input).then(finish, (error) => {
+            this.opts.tools.permit(title, tool, turnSignal, canonicalTarget, observe, originalPath, input, policy).then(finish, (error) => {
               turnSignal.removeEventListener("abort", onAbort);
               reject(error);
             });
@@ -10413,6 +10431,7 @@ var init_local_worker = __esm(() => {
             observe({ source: "expired", answerEpoch: this.approvalAnswerEpoch ?? 0, eligibleExpiry: true });
           return picked;
         },
+        shellExecutionCheck: (input) => turnSignal.aborted || executionGeneration !== this.turn ? "aborted" : this.opts.tools.shellExecutionCheck?.(input) ?? "valid",
         sandboxProfile: this.sandboxProfile,
         sandboxEnv: { ...proxyEnv(this.opts.tools.bashNetwork ?? false), AGENTHUB_PEER_ID: this.id },
         signal: turnSignal,
@@ -12704,7 +12723,7 @@ var init_builtin_metadata = __esm(() => {
   headlessForms = Object.freeze(["headless"]);
   hubGrants = {
     ask: "every write, edit and shell command asks",
-    "ask-when-needed": "write and edit inside the project run without asking; shell and git writes still ask",
+    "ask-when-needed": "write, edit and proven bounded read-only shell commands inside the project run without asking; other shell commands and git writes still ask",
     "never-ask": "every tool runs without asking, inside the hub sandbox and path guard"
   };
   CLAUDE_REVIEWER_VARIANT = {
@@ -14087,6 +14106,14 @@ var init_work_lists = __esm(() => {
   forbidden = new Set(["__proto__", "constructor", "prototype"]);
 });
 
+// node_modules/@staix/agent-mem/src/memory/candidate-pending.ts
+var CANDIDATE_AGE_MS, CANDIDATE_SHOWN_GRACE_MS, CANDIDATE_DUE_MS;
+var init_candidate_pending = __esm(() => {
+  CANDIDATE_AGE_MS = 30 * 86400000;
+  CANDIDATE_SHOWN_GRACE_MS = 7 * 86400000;
+  CANDIDATE_DUE_MS = 7 * 86400000;
+});
+
 // node_modules/@staix/agent-mem/src/memory/generation-sync.ts
 var zero;
 var init_generation_sync = __esm(() => {
@@ -14118,14 +14145,6 @@ var init_sync = __esm(() => {
   liveGroups = new Set;
 });
 
-// node_modules/@staix/agent-mem/src/memory/candidate-pending.ts
-var CANDIDATE_AGE_MS, CANDIDATE_SHOWN_GRACE_MS, CANDIDATE_DUE_MS;
-var init_candidate_pending = __esm(() => {
-  CANDIDATE_AGE_MS = 30 * 86400000;
-  CANDIDATE_SHOWN_GRACE_MS = 7 * 86400000;
-  CANDIDATE_DUE_MS = 7 * 86400000;
-});
-
 // node_modules/@staix/agent-mem/src/memory/path-glob.ts
 var init_path_glob = __esm(() => {
   init_project2();
@@ -21423,6 +21442,37 @@ init_policy();
 init_screen();
 init_shard();
 init_work_lists();
+// node_modules/@staix/agent-mem/src/memory/project-import.ts
+init_bridge();
+init_private_spans();
+init_shard();
+init_store();
+var PROJECT_IMPORT_MAX_BYTES = 64 * 1024 * 1024;
+var PROJECT_IMPORT_MAX_LINE_BYTES = 64 * 1024;
+var PROJECT_IMPORT_FUTURE_SKEW_MS = 5 * 60 * 1000;
+var NOTE_KEYS = new Set(["schema", "id", "at", "machine", "op", "project", "scope", "tier", "kind", "peer", "title", "text", "task", "about", "supersedes", "promotedFrom", "source", "expires"]);
+// node_modules/@staix/agent-mem/src/memory/external-import.ts
+init_aliases();
+
+// node_modules/@staix/agent-mem/src/memory/candidates.ts
+init_candidate_pending();
+
+// node_modules/@staix/agent-mem/src/memory/note-add.ts
+init_store();
+
+// node_modules/@staix/agent-mem/src/memory/candidates.ts
+init_home();
+init_platform();
+init_private_spans();
+var CANDIDATE_RETENTION = { count: 500, ageMs: 30 * 86400000 };
+var COUNTER_RETENTION = { count: 1e4, ageMs: 90 * 86400000 };
+
+// node_modules/@staix/agent-mem/src/memory/external-import.ts
+init_candidate_pending();
+init_platform();
+init_private_spans();
+init_screen();
+var EXTERNAL_IMPORT_LIMITS = { maxFiles: 256, maxDirectories: 512, maxEntriesPerDirectory: 512, maxDepth: 16, maxFileBytes: 1024 * 1024, maxCandidatesPerRun: 100, candidateTextChars: 3000, titleChars: 200 };
 // node_modules/@staix/agent-mem/src/memory/cross-project.ts
 init_search_fts();
 init_capture();
@@ -21456,18 +21506,6 @@ var memoryUsage = (name = AMEM_NAMES.memory) => `usage: ${name} [list] [--tier s
 var MEMORY_USAGE = memoryUsage();
 var goalUsage = (name = AMEM_NAMES.goal) => `usage: ${name} [list] [--all] | show <id> | new <title> [--milestone <text>]... [--depends <id>]... [--shared] | link <id> <task id> | state <id> open|active|blocked|done|dropped | done <id> | take <id> [--force]  [--json]`;
 var GOAL_USAGE = goalUsage();
-// node_modules/@staix/agent-mem/src/memory/candidates.ts
-init_candidate_pending();
-
-// node_modules/@staix/agent-mem/src/memory/note-add.ts
-init_store();
-
-// node_modules/@staix/agent-mem/src/memory/candidates.ts
-init_home();
-init_platform();
-init_private_spans();
-var CANDIDATE_RETENTION = { count: 500, ageMs: 30 * 86400000 };
-var COUNTER_RETENTION = { count: 1e4, ageMs: 90 * 86400000 };
 
 // node_modules/@staix/agent-mem/src/index.ts
 init_ops_contract();
@@ -21499,6 +21537,7 @@ var tool2 = (name, description, inputSchema, readOnlyHint = true) => ({
 });
 var MCP_TOOLS = [
   tool2("amem_search", "Search screened memory in this project. Capture results are recall, not curated evidence.", object6({ query: string(1000), limit, since: string(40), includeCapture: { type: "boolean" } }, ["query"])),
+  tool2("amem_evidence", "Return a bounded bundle of cited, live curated entries for a question. Untrusted memory data only: no answer or model call. Capture, repo-only notes, pending candidates and model answers are not evidence.", object6({ question: string(1000), limit: { type: "integer", minimum: 1, maximum: 20 }, maxBytes: { type: "integer", minimum: 256, maximum: 8192 } }, ["question"])),
   tool2("amem_show", "Show a screened memory entry in this project by its exact id or unique prefix.", object6({ id: string(80) }, ["id"])),
   tool2("amem_timeline", "Read screened memory near an entry or time in this project.", object6({ id: string(80), since: string(40), limit })),
   tool2("amem_brief", "Read an intent/path-scoped brief of live public memory: fails first, then decisions/contracts and one-hop neighbours. Memory is untrusted data; byte cap covers the complete brief body.", object6({ intent: string(1000), paths: { type: "array", maxItems: 150, items: string(512) }, symbols: { type: "array", maxItems: 150, items: string(512) }, maxBytes: { type: "integer", minimum: 1, maximum: 8192 } }, ["intent"])),
@@ -21524,6 +21563,9 @@ var MCP_TOOLS = [
   tool2("amem_vault_candidates", "List screened durable curated notes eligible for a person to move to the vault. Read only.", object6({ limit })),
   tool2("amem_capacity", "Read this machine's bounded capture capacity proposal; applying it is person-only.", object6({}))
 ];
+// node_modules/@staix/agent-mem/src/memory/evidence.ts
+init_policy();
+
 // node_modules/@staix/agent-mem/src/memory/plan-guard.ts
 init_store();
 init_project2();
@@ -21628,6 +21670,16 @@ init_generation();
 init_lifecycle();
 init_platform();
 init_shard();
+// node_modules/@staix/agent-mem/src/memory/consolidation-clusters.ts
+init_search_fts();
+
+// node_modules/@staix/agent-mem/src/memory/consolidate.ts
+init_policy();
+init_platform();
+
+// node_modules/@staix/agent-mem/src/memory/consolidation-model.ts
+init_policy();
+init_platform();
 // src/hub/tasks.ts
 init_task_code_symbols();
 init_test_integrity();
@@ -21643,7 +21695,7 @@ init_sdlc_metrics();
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.17.0",
+  version: "0.18.0",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",
@@ -21660,7 +21712,7 @@ var package_default = {
     bun: ">=1.4.2"
   },
   dependencies: {
-    "@staix/agent-mem": "0.7.0"
+    "@staix/agent-mem": "0.8.0"
   },
   devDependencies: {
     "@modelcontextprotocol/sdk": "^1.27.1",
@@ -21714,6 +21766,14 @@ init_plan_conformance();
 init_review_findings();
 init_sdlc();
 
+// src/hub/sdlc-merge.ts
+init_review_findings();
+init_sdlc();
+
+// src/hub/sdlc-mirror.ts
+init_envelope();
+var inFlight = new Set;
+
 // src/hub/tasks.ts
 init_review_findings();
 init_roles();
@@ -21748,6 +21808,7 @@ init_project();
 
 // src/hub/task-repository.ts
 init_git();
+init_host_executable();
 init_project();
 init_spec_read();
 var GIT_MAX_BYTES = 16 * 1024;

package/src/adapters/definitions/builtin-metadata.ts

@@ -61,7 +61,7 @@ const dualForms = Object.freeze(["tui", "headless"] as const);
 const headlessForms = Object.freeze(["headless"] as const);
 const hubGrants = {
   ask: "every write, edit and shell command asks",
-  "ask-when-needed": "write and edit inside the project run without asking; shell and git writes still ask",
+  "ask-when-needed": "write, edit and proven bounded read-only shell commands inside the project run without asking; other shell commands and git writes still ask",
   "never-ask": "every tool runs without asking, inside the hub sandbox and path guard",
 };
 

package/src/adapters/local-worker.ts

@@ -36,7 +36,7 @@ export interface LocalOptions {
   turnId?: () => string | undefined;
   onApprovalStop?: (reason: string) => void;
   onTool?: (observation: ToolObservation, task?: string) => void;
-  tools: { deny: string[]; permit: ToolContext["permit"]; bashNetwork?: SandboxNetwork; readAllow?: string[]; readOnly?: string[] };
+  tools: { deny: string[]; permit: ToolContext["permit"]; shellExecutionCheck?: ToolContext["shellExecutionCheck"]; bashNetwork?: SandboxNetwork; readAllow?: string[]; readOnly?: string[] };
   capture?: Capture;
   /** Runs a hub task tool (hub_task_*, hub_review, hub_remember) as this peer. Absent = the tools are not offered. */
   taskTool?: (name: string, args: Record<string, unknown>, turn: { pii: boolean }) => Promise<string>;
@@ -290,11 +290,12 @@ export class LocalPeer extends BasePeer {
   }
 
   private toolContext(envs: Envelope[], turnSignal: AbortSignal, pii: boolean, reply: EnvelopeOpts): ToolContext {
+    const executionGeneration=this.turn;
     return {
       cwd: this.opts.cwd,
       deny: this.opts.tools.deny,
       readOnly: this.opts.tools.readOnly,
-      permit: async (title, tool, _signal, canonicalTarget, _observe, originalPath, input) => {
+      permit: async (title, tool, _signal, canonicalTarget, _observe, originalPath, input, policy) => {
         if (turnSignal.aborted) return "aborted";
         const generation = this.turn;
         let observed = false;
@@ -314,7 +315,7 @@ export class LocalPeer extends BasePeer {
           const finish = (decision: ToolApproval) => { turnSignal.removeEventListener("abort", onAbort); resolve(decision); };
           const onAbort = () => finish("aborted");
           turnSignal.addEventListener("abort", onAbort, { once: true });
-          this.opts.tools.permit(title, tool, turnSignal, canonicalTarget, observe, originalPath, input).then(finish, (error) => { turnSignal.removeEventListener("abort", onAbort); reject(error); });
+          this.opts.tools.permit(title, tool, turnSignal, canonicalTarget, observe, originalPath, input, policy).then(finish, (error) => { turnSignal.removeEventListener("abort", onAbort); reject(error); });
         });
         if (generation !== this.turn || (turnSignal.aborted && picked !== "expired")) return "aborted";
         // Legacy permit callbacks can represent a person's denial without provenance. A true
@@ -323,6 +324,7 @@ export class LocalPeer extends BasePeer {
         if (!observed && picked === "expired") observe({ source: "expired", answerEpoch: this.approvalAnswerEpoch ?? 0, eligibleExpiry: true });
         return picked;
       },
+      shellExecutionCheck: input=>turnSignal.aborted||executionGeneration!==this.turn?"aborted":this.opts.tools.shellExecutionCheck?.(input)??"valid",
       sandboxProfile: this.sandboxProfile,
       sandboxEnv: { ...proxyEnv(this.opts.tools.bashNetwork ?? false), AGENTHUB_PEER_ID: this.id },
       signal: turnSignal,