@staix/agent-hub 0.17.0 → 0.19.0

package/plugins/agent-hub/server.js

@@ -68,7 +68,10 @@ function realPath(path) {
 }
 function isDenied(path, extra = []) {
   const norm = path.split(sep).join("/");
-  return DENY_SEGMENTS.some((s) => hasSegment(norm, s)) || DENY_NAMES.some((re) => new RegExp(re).test(basename(norm))) || extra.some((e) => e && norm.includes(e));
+  if (DENY_SEGMENTS.some((s) => hasSegment(norm, s)))
+    return true;
+  const name = basename(norm);
+  return DENY_NAMES.some((re) => (denyNamePatterns.get(re) ?? new RegExp(re)).test(name)) || extra.some((e) => e && norm.includes(e));
 }
 function memoryGitEnv(env = process.env, options = {}) {
   const result = { ...env, GIT_TERMINAL_PROMPT: "0" };
@@ -82,7 +85,7 @@ function memoryGitEnv(env = process.env, options = {}) {
 }
 function memoryGitSync(args, options) {
   const argv = memoryGitArgv(args);
-  return childProcess().spawnSync(argv[0], argv.slice(1), { ...options, env: memoryGitEnv(options.env ?? process.env) });
+  return childProcess().spawnSync(argv[0], argv.slice(1), { ...ambientGitTimeout !== undefined ? { timeout: ambientGitTimeout, killSignal: "SIGKILL" } : {}, ...options, env: memoryGitEnv(options.env ?? process.env) });
 }
 function processSignature(pid) {
   try {
@@ -118,11 +121,12 @@ var require2, processes, childProcess = () => processes ??= require2("node:child
     const parent = dirname(absolute);
     return parent === absolute ? absolute : join(canonical(parent), basename(absolute));
   }
-}, DENY_SEGMENTS, DENY_NAMES, hasSegment = (rel, seg) => `/${rel}/`.includes(`/${seg}/`), SAFE_CONFIG, CREDENTIAL_KEYS, memoryGitArgv = (args, opts = {}) => ["git", "--no-pager", ...SAFE_CONFIG.filter((c) => !opts.credentials || !CREDENTIAL_KEYS.has(c)).flatMap((c) => ["-c", c]), ...args];
+}, DENY_SEGMENTS, DENY_NAMES, denyNamePatterns, hasSegment = (rel, seg) => `/${rel}/`.includes(`/${seg}/`), SAFE_CONFIG, CREDENTIAL_KEYS, memoryGitArgv = (args, opts = {}) => ["git", "--no-pager", ...SAFE_CONFIG.filter((c) => !opts.credentials || !CREDENTIAL_KEYS.has(c)).flatMap((c) => ["-c", c]), ...args], ambientGitTimeout;
 var init_platform = __esm(() => {
   require2 = createRequire(import.meta.url);
   DENY_SEGMENTS = [".maru/secrets", ".agenthub/state", ".agenthub/archive"];
   DENY_NAMES = ["^\\.env", "\\.pem$", "\\.key$", "^id_rsa", "^id_ed25519", "^credentials(\\.|$)", "^auth\\.json$", "^\\.netrc$", "^\\.npmrc$", "^\\.pypirc$"];
+  denyNamePatterns = new Map(DENY_NAMES.map((source) => [source, new RegExp(source)]));
   SAFE_CONFIG = ["core.fsmonitor=false", "core.hooksPath=/dev/null", "diff.external=", "core.pager=cat", "credential.helper=", "core.askpass="];
   CREDENTIAL_KEYS = new Set(["credential.helper=", "core.askpass="]);
 });
@@ -291,13 +295,24 @@ var plain = (text) => text.length <= 64 && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/
 var init_compat = __esm(() => {
   init_project();
   COMPAT = {
+    pi: {
+      label: "Pi",
+      verified: ["1.4.0"],
+      gate: "contract",
+      probe: ["pi", "--version"],
+      config: "pi.cmd",
+      parse: (out) => plain(out.trim()),
+      trustNote: "The model-free extension load, RPC session identity and managed tool receipt path were checked on 1.4.0. Permissions remain host-owned; account-backed inference and another version's extension contract are unverified.",
+      receipt: "docs/verification/2026-10-26-pi-140-compat.md"
+    },
     "claude-implementer": {
       label: "Claude headless implementer",
-      verified: ["2.1.309"],
+      verified: ["2.1.309", "2.1.310"],
       gate: "contract",
       probe: ["claude", "--version"],
       parse: (out) => plain(out.trim().replace(/ \(Claude Code\)$/, "")),
-      trustNote: "The native prompt-tool allow, deny, MCP error/disconnect and hook-failure fallthrough have an isolated receipt. No dontAsk/bypass fallback exists; another version's permission behavior is unverified."
+      trustNote: "The native prompt-tool transport and host-wrapper rewrite, environment isolation and replay contract have isolated receipts. No dontAsk/bypass fallback exists; another version's permission or rewrite behavior is unverified.",
+      receipt: "docs/verification/2026-10-26-headless-claude-shell-context.md"
     },
     "codex-review": {
       label: "Codex reviewer (codex-cli)",
@@ -306,19 +321,21 @@ var init_compat = __esm(() => {
       probe: ["codex", "--version"],
       config: "codex_bin",
       parse: (out) => plain(out.trim().replace(/^codex-cli /, "")),
-      trustNote: "Every launch still proves the MCP inventory, Apps/plugins/hooks disabled, sandbox read/write denial and the binary fence; a failed leg still refuses. Trust covers only the source-level claims those probes cannot see (docs/verification/2026-10-19-reviewer-isolation.md)."
+      trustNote: "Every launch still proves the MCP inventory, Apps/plugins/hooks disabled, sandbox read/write denial and the binary fence; a failed leg still refuses. Trust covers only the source-level claims those probes cannot see (docs/verification/2026-10-19-reviewer-isolation.md).",
+      receipt: "docs/verification/2026-10-24-codex-0164-reviewer-isolation.md"
     },
     "kimi-review": {
       label: "Kimi reviewer (kimi-code)",
-      verified: ["2.2.0", "2.3.0", "2.3.1"],
+      verified: ["2.2.0", "2.3.0", "2.3.1", "2.3.2"],
       gate: "isolation",
       probe: ["kimi", "--version"],
       parse: (out) => plain(out.trim()),
-      trustNote: "Every launch still builds the private config, exact two-tool agent file and task-bound MCP; the native tool allowlist behaviour of an untested version is not re-proven."
+      trustNote: "Every launch still builds the private config, exact two-tool agent file and task-bound MCP; the native tool allowlist behaviour of an untested version is not re-proven.",
+      receipt: "docs/verification/2026-10-26-kimi-232-reviewer-compat.md"
     },
     jcode: {
       label: "Jcode",
-      verified: ["0.98.1", "0.99.0"],
+      verified: ["0.98.1", "0.99.0", "0.99.1"],
       line: { min: "0.98.0", below: "1.0.0" },
       gate: "contract",
       probe: ["jcode", "--quiet", "version", "--json"],
@@ -331,25 +348,28 @@ var init_compat = __esm(() => {
           return;
         }
       },
-      trustNote: "The ACP, serve and MCP contract was verified on 0.98.1 and steering on 0.99.0; an untested version may change them."
+      trustNote: "The ACP, serve and MCP contract was verified on 0.98.1 and 0.99.1 and steering on 0.99.0 and 0.99.1; an untested version may change them.",
+      receipt: "docs/verification/2026-10-26-jcode-0.99.1.md"
     },
     agy: {
       label: "agy",
-      verified: ["1.4.2"],
+      verified: ["1.4.2", "1.4.7"],
       line: { min: "1.4.0", below: "1.5.0" },
       gate: "contract",
       probe: ["agy", "--version"],
       parse: (out) => plain(out.trim()),
-      trustNote: "Only 1.4.2 is T0-verified; the plugin MCP and hook contract of another version is unverified."
+      trustNote: "Only 1.4.2 and 1.4.7 are T0-verified; the plugin MCP and hook contract of another version is unverified.",
+      receipt: "docs/verification/2026-10-26-agy-1.4.7.md"
     },
     qwen: {
       label: "Qwen Code",
-      verified: ["0.25.0", "0.26.0"],
+      verified: ["0.25.0", "0.26.0", "0.26.1"],
       gate: "contract",
       probe: ["qwen", "--version"],
       config: "qwen_cmd",
       parse: (out) => plain(out.trim()),
-      trustNote: "Native ACP identity and mode ids have dated receipts; 0.26.0 permission callbacks were checked without inference. Another version may change those contracts."
+      trustNote: "Native ACP identity, mode ids and permission callbacks were re-checked without inference on 0.26.1; its two ACP fixes were judged not to change the hub contract. Another version may change those contracts.",
+      receipt: "docs/verification/2026-10-26-qwen-0261-acp.md"
     },
     "qwen-dual": {
       label: "Qwen Code dual-output TUI",
@@ -358,7 +378,8 @@ var init_compat = __esm(() => {
       probe: ["qwen", "--version"],
       config: "qwen_cmd",
       parse: (out) => plain(out.trim()),
-      trustNote: "The dual-output file contract (submit and confirmation_response input, user/assistant/stream_event/control events, session_start identity) was verified on 0.26.1 only. A hub deny ends the turn without any Qwen event, and no external stop of a running turn exists; another version may change either."
+      trustNote: "The dual-output file contract (submit and confirmation_response input, user/assistant/stream_event/control events, session_start identity) was verified on 0.26.1 only. A hub deny ends the turn without any Qwen event, and no external stop of a running turn exists; another version may change either.",
+      receipt: "docs/verification/2026-10-25-qwen-dual-output-t0.md"
     }
   };
   MAX_BYTES = 64 * 1024;
@@ -4819,7 +4840,10 @@ function qwenDualNamesStateDir(input, stateDir) {
   };
   return seen(input, 0);
 }
-var SUBMIT_CAP, READ_CAP, ANSWERED_CAP = 256, QWEN_STALLED_NOTE = "stalled: Qwen has said nothing for a while; the hub cannot stop a Qwen turn, press Esc in the Qwen terminal", QWEN_DETACHED_NOTE = "detached: the hub cannot read Qwen's event file; Qwen keeps working in its terminal and the hub reattaches when the file is readable again", DIR = "qwen-dual", QwenDualPeer;
+function isQwenTaskNotification(text) {
+  return text.length <= NOTIFICATION_CAP && QWEN_TASK_NOTIFICATIONS.test(text);
+}
+var SUBMIT_CAP, READ_CAP, ANSWERED_CAP = 256, QWEN_STALLED_NOTE = "stalled: Qwen has said nothing for a while; the hub cannot stop a Qwen turn, press Esc in the Qwen terminal", QWEN_DETACHED_NOTE = "detached: the hub cannot read Qwen's event file; Qwen keeps working in its terminal and the hub reattaches when the file is readable again", DIR = "qwen-dual", NOTIFICATION, QWEN_TASK_NOTIFICATIONS, NOTIFICATION_CAP, QwenDualPeer;
 var init_qwen_dual = __esm(() => {
   init_envelope();
   init_child_process();
@@ -4828,6 +4852,9 @@ var init_qwen_dual = __esm(() => {
   init_qwen_native();
   SUBMIT_CAP = 256 * 1024;
   READ_CAP = 1024 * 1024;
+  NOTIFICATION = String.raw`<task-notification>\n<task-id>bg_[0-9a-f]{4,32}<\/task-id>\n<kind>[a-z_-]{1,32}<\/kind>\n<status>[a-z_-]{1,32}<\/status>\n(?:(?!<task-notification>|<\/task-notification>)[\s\S])*<\/task-notification>`;
+  QWEN_TASK_NOTIFICATIONS = new RegExp(`^${NOTIFICATION}(?:\\n\\n${NOTIFICATION})*$`);
+  NOTIFICATION_CAP = 64 * 1024;
   QwenDualPeer = class QwenDualPeer extends BasePeer {
     opts;
     permissionModeState = "unmanaged";
@@ -5276,6 +5303,13 @@ ${text}`;
       if (!this.stopping && !this.detached && this.state === "offline")
         this.setState("idle");
     }
+    isNotificationEvent(event) {
+      const content = event.message?.content;
+      if (!Array.isArray(content) || content.length !== 1)
+        return false;
+      const block = content[0];
+      return !!block && typeof block === "object" && block.type === "text" && typeof block.text === "string" && isQwenTaskNotification(block.text);
+    }
     promptText(event) {
       const content = event.message?.content;
       if (typeof content === "string")
@@ -5286,6 +5320,8 @@ ${text}`;
       return blocks.length ? blocks.map((block) => block.text).join("") : undefined;
     }
     onUser(event) {
+      if (this.isNotificationEvent(event))
+        return;
       const text = this.promptText(event);
       if (text === undefined)
         return;
@@ -5808,26 +5844,61 @@ var init_path_policy = __esm(() => {
 
 // src/local/deny.ts
 import { basename as basename4, dirname as dirname8 } from "path";
-function hubWriteRegexes(root, gitDirs = [], moduleGit) {
+function hubWriteRegexes(root, gitDirs = [], moduleGit = [], worktreesRoot) {
   const git = hfsFoldedName(".git");
   const re = (s) => `(regex ${sbplString(s)})`;
   const external = gitDirs.flatMap((d) => [
     `(require-all ${re(`^${sbplEscape(d)}/[^/]+$`)} ${re(`^.*/(${hfsFoldedName("config")}|${hfsFoldedName("hooks")})$`)})`,
+    `(require-all ${re(`^${sbplEscape(d)}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
     `(subpath ${sbplString(`${d}/hooks`)})`,
     `(require-all (subpath ${sbplString(d)}) ${re(`^.*/${hfsFoldedName("commondir")}$`)})`
   ]);
-  const modules = moduleGit ? [
-    `(require-all ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?${hfsFoldedName("config")}$`)} (require-not ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?(refs|logs)/`)}))`,
-    `(require-all ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?${hfsFoldedName("hooks")}(/|$)`)} (require-not ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?(refs|logs)/`)}))`,
-    ...moduleGit.entries.map((d) => re(`^${sbplEscape(dirname8(d))}/${hfsFoldedName(basename4(d))}$`))
-  ] : [];
+  const allDirs = moduleGit.flatMap((tree) => tree.dirs ?? []);
+  const modules = moduleGit.flatMap((tree) => {
+    const root = sbplEscape(tree.root);
+    const found = tree.dirs ?? [];
+    const inside = found.map((d) => `(require-not ${re(`^${sbplEscape(d)}(/|$)`)})`).join(" ");
+    const anchored = found.flatMap((d) => {
+      const dir = sbplEscape(d);
+      return [
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${re(`^.*/${hfsFoldedName("config")}$`)})`,
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
+        `(require-all ${re(`^${dir}/`)} ${re(hooksUnder(d))})`,
+        `(require-all ${re(`^${dir}/worktrees/[^/]+/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${re(`^.*/${hfsFoldedName("worktrees")}$`)})`,
+        re(`^${dir}/worktrees/[^/]+$`),
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${re(`^.*/${hfsFoldedName("hooks")}$`)})`,
+        `(require-all ${re(`^${dir}/worktrees/[^/]+/modules/.`)} ${allDirs.filter((f) => f.startsWith(`${d}/worktrees/`)).map((f) => `(require-not ${re(`^${sbplEscape(f)}(/|$)`)})`).join(" ")})`,
+        `(require-all ${re(`^${dir}/worktrees/[^/]+/[^/]+$`)} ${re(`^.*/${hfsFoldedName("modules")}$`)})`
+      ];
+    });
+    return [
+      `(require-all ${re(`^${root}/.`)} ${inside})`,
+      ...anchored,
+      ...tree.entries.map((d) => `(require-all ${re(`^${sbplEscape(dirname8(d))}/[^/]+$`)} ${re(`^.*/${hfsFoldedName(basename4(d))}$`)})`)
+    ];
+  });
+  const siblings = worktreesRoot ? (() => {
+    const w = sbplEscape(worktreesRoot);
+    return [
+      `(require-all ${re(`^${sbplEscape(dirname8(worktreesRoot))}/[^/]+$`)} ${re(`^.*/${hfsFoldedName(basename4(worktreesRoot))}$`)})`,
+      re(`^${w}/[^/]+$`),
+      `(require-all ${re(`^${w}/[^/]+/[^/]+$`)} ${re(`^.*/${hfsFoldedName("config")}$`)})`,
+      `(require-all ${re(`^${w}/[^/]+/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
+      `(require-all ${re(`^${w}/[^/]+/`)} ${re(hooksUnder(`${worktreesRoot}/x`))})`,
+      `(require-all ${re(`^${w}/[^/]+/modules/.`)} ${moduleGit.flatMap((tree) => tree.dirs ?? []).filter((d) => d.startsWith(`${worktreesRoot}/`)).map((d) => `(require-not ${re(`^${sbplEscape(d)}(/|$)`)})`).join(" ")})`,
+      `(require-all ${re(`^${w}/[^/]+/[^/]+$`)} ${re(`^.*/${hfsFoldedName("modules")}$`)})`
+    ];
+  })() : [];
   return [
     `(require-all (subpath ${sbplString(root)}) ${re(`^.*/${hfsFoldedName(".agenthub")}(/|$)`)})`,
     re(`^.*/${git}$`),
     re(`^.*/${git}/${hfsFoldedName("config")}$`),
+    `(require-all ${re(`^.*/${git}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
     re(`^.*/${git}/${hfsFoldedName("hooks")}(/|$)`),
     `(require-all ${re(`^.*/${git}/.*$`)} ${re(`^.*/${hfsFoldedName("commondir")}$`)})`,
     ...modules,
+    ...siblings,
     ...external
   ];
 }
@@ -5842,12 +5913,16 @@ function denyRegexes(root, extra = [], withNames = true) {
     ...extra.filter(Boolean).map((e) => `^${sbplEscape(root)}/.*${sbplEscape(e)}`)
   ].map((re) => `(regex ${sbplString(re)})`);
 }
-var sbplEscape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), sbplString = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`, HFS_IGNORABLE_POINTS, HFS_IGNORABLE, hfsFoldedName = (name) => `${HFS_IGNORABLE}*${[...name].map((c) => sbplEscape(c)).join(`${HFS_IGNORABLE}*`)}${HFS_IGNORABLE}*`;
+var sbplEscape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), sbplString = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`, HFS_IGNORABLE_POINTS, HFS_IGNORABLE, hfsFoldedName = (name) => `${HFS_IGNORABLE}*${[...name].map((c) => sbplEscape(c)).join(`${HFS_IGNORABLE}*`)}${HFS_IGNORABLE}*`, CONFIG_WORKTREE_NAME, MAX_ANCHOR_DEPTH = 80, hooksUnder = (parent) => {
+  const depth = parent.split("/").filter(Boolean).length;
+  return depth > MAX_ANCHOR_DEPTH ? `^.*/${hfsFoldedName("hooks")}(/|$)` : `^${"/[^/]+".repeat(depth)}/${hfsFoldedName("hooks")}(/|$)`;
+};
 var init_deny = __esm(() => {
   init_platform();
   init_platform();
   HFS_IGNORABLE_POINTS = ["\u200C", "\u200D", "\u200E", "\u200F", "\u202A", "\u202B", "\u202C", "\u202D", "\u202E", "\u206A", "\u206B", "\u206C", "\u206D", "\u206E", "\u206F", "\uFEFF"];
   HFS_IGNORABLE = `(${HFS_IGNORABLE_POINTS.join("|")})`;
+  CONFIG_WORKTREE_NAME = [`^.*/${hfsFoldedName("config")}\\.[^/]*$`, `^.*/[^/]*${hfsFoldedName("worktree")}$`];
 });
 
 // src/local/sandbox.ts
@@ -5871,39 +5946,70 @@ function externalGitDirs(root) {
 `).map((d) => resolve9(root, d));
   return [...new Set(dirs)].filter((d) => !d.startsWith(`${root}/`));
 }
-function moduleGitDirs(root) {
+function worktreesRoot(root) {
   const out = memoryGitSync(["-C", root, "rev-parse", "--git-common-dir"], { encoding: "utf8" });
+  return out.status === 0 && out.stdout.trim() ? join12(resolve9(root, out.stdout.trim()), "worktrees") : undefined;
+}
+function moduleGitDirs(root) {
+  const out = memoryGitSync(["-C", root, "rev-parse", "--git-common-dir", "--absolute-git-dir"], { encoding: "utf8" });
   if (out.status !== 0)
-    return;
-  const modulesRoot = join12(resolve9(root, out.stdout.trim()), "modules");
-  const dirs = [];
-  const walk = (dir, depth) => {
-    if (depth > 8)
-      return;
-    let entries;
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
+    return [];
+  const [commonRaw, ownRaw] = out.stdout.trim().split(`
+`);
+  if (!commonRaw || !ownRaw)
+    return [];
+  const common = resolve9(root, commonRaw), own = resolve9(root, ownRaw);
+  const roots = new Set([join12(common, "modules"), join12(own, "modules")]);
+  try {
+    for (const e of readdirSync(join12(common, "worktrees"), { withFileTypes: true })) {
+      if (!e.isDirectory())
+        continue;
+      const modules = join12(common, "worktrees", e.name, "modules");
+      if (existsSync6(modules))
+        roots.add(modules);
     }
-    const names = new Set(entries.map((e) => e.name));
-    if (names.has("HEAD") && names.has("config")) {
-      dirs.push(dir);
-      const nested = join12(dir, "modules");
-      if (names.has("modules"))
-        walk(nested, depth + 1);
-      return;
+  } catch {}
+  const trees = [];
+  const tree = (modulesRoot, nesting) => {
+    const dirs = [];
+    const walk = (dir, depth) => {
+      if (depth > 8)
+        return;
+      let entries;
+      try {
+        entries = readdirSync(dir, { withFileTypes: true });
+      } catch {
+        return;
+      }
+      const names = new Set(entries.map((e) => e.name));
+      if (names.has("HEAD") && names.has("config")) {
+        dirs.push(dir);
+        return;
+      }
+      for (const e of entries)
+        if (e.isDirectory())
+          walk(join12(dir, e.name), depth + 1);
+    };
+    walk(modulesRoot, 0);
+    const found = nesting >= MODULE_DEPTH ? [] : dirs;
+    const entries = new Set([modulesRoot]);
+    for (const d of found)
+      for (let p = d;p.length > modulesRoot.length; p = dirname9(p))
+        entries.add(p);
+    trees.push({ root: modulesRoot, entries: [...entries], dirs: found });
+    for (const d of found) {
+      tree(join12(d, "modules"), nesting + 1);
+      try {
+        for (const e of readdirSync(join12(d, "worktrees"), { withFileTypes: true })) {
+          if (e.isDirectory() && existsSync6(join12(d, "worktrees", e.name, "modules")))
+            tree(join12(d, "worktrees", e.name, "modules"), nesting + 1);
+        }
+      } catch {}
     }
-    for (const e of entries)
-      if (e.isDirectory())
-        walk(join12(dir, e.name), depth + 1);
   };
-  walk(modulesRoot, 0);
-  const entries = new Set([modulesRoot]);
-  for (const d of dirs)
-    for (let p = d;p.length > modulesRoot.length; p = dirname9(p))
-      entries.add(p);
-  return { root: modulesRoot, entries: [...entries] };
+  for (const modulesRoot of roots)
+    tree(modulesRoot, 0);
+  return trees;
 }
 function profile(cwd, network, readAllow = [], deny = [], readOnly = []) {
   const home = homedir4();
@@ -5911,6 +6017,7 @@ function profile(cwd, network, readAllow = [], deny = [], readOnly = []) {
   const root = realPath(cwd);
   const gitDirs = externalGitDirs(root);
   const moduleGit = moduleGitDirs(root);
+  const worktrees = worktreesRoot(root);
   const creds = [".ssh", ".aws", ".gnupg", ".config/gh", ".config/gcloud", ".kube", ".docker", ".netrc", ".npmrc", ".omniroute", ".claude", ".codex", ".kimi-code", "Library/Keychains"];
   const dev = developerDir();
   const readable = [root, ...HOME_READABLE.map((p) => join12(home, p)), ...readAllow.map(inHome), ...gitDirs, ...dev ? [dev] : []];
@@ -5937,7 +6044,7 @@ function profile(cwd, network, readAllow = [], deny = [], readOnly = []) {
     ...start,
     "(deny file-write*)",
     ...readOnly.length ? ['(allow file-write* (literal "/dev/null"))'] : [`(allow file-write* (subpath ${q(root)}) (regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`],
-    `(deny file-write* ${hubWriteRegexes(root, gitDirs, moduleGit).join(" ")})`,
+    `(deny file-write* ${hubWriteRegexes(root, gitDirs, moduleGit, worktrees).join(" ")})`,
     `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join12(home, c))})`).join(" ")})`,
     `(deny file-read* file-write* ${denyRegexes(root, deny).join(" ")})`,
     ...network ? [`(allow file-read* ${CA_BUNDLES.map((p) => `(literal ${q(p)})`).join(" ")} (regex ${q("/certifi/cacert\\.pem$")}))`, `(deny file-read* file-write* ${places})`] : []
@@ -6012,7 +6119,7 @@ function proxyEnv(network) {
   const url = `http://127.0.0.1:${network.proxyPort}`;
   return { HTTPS_PROXY: url, https_proxy: url, HTTP_PROXY: url, http_proxy: url, ALL_PROXY: url, all_proxy: url, NO_PROXY: "", no_proxy: "" };
 }
-var SANDBOX_EXEC = "/usr/bin/sandbox-exec", OUTPUT_CAP = 20000, sandboxAvailable = () => process.platform === "darwin" && existsSync6(SANDBOX_EXEC), q, HOME_READABLE, CA_BUNDLES, SYSTEM_READABLE, MACH_SERVICES, NETWORK_MACH_SERVICES, PROXY_MACH_SERVICES;
+var SANDBOX_EXEC = "/usr/bin/sandbox-exec", OUTPUT_CAP = 20000, sandboxAvailable = () => process.platform === "darwin" && existsSync6(SANDBOX_EXEC), q, HOME_READABLE, CA_BUNDLES, MODULE_DEPTH = 8, SYSTEM_READABLE, MACH_SERVICES, NETWORK_MACH_SERVICES, PROXY_MACH_SERVICES;
 var init_sandbox = __esm(() => {
   init_project();
   init_git();
@@ -6154,9 +6261,26 @@ ${preview(content)}`, "write", ctx.signal, file, undefined, String(a.path), a),
           return "error: empty command";
         if (command.length > 4000)
           return "error: command longer than 4000 characters; put it in a script file with write, then run that";
-        const refused = approvalError(await ctx.permit(`bash: ${command}`, "bash", ctx.signal, undefined, undefined, undefined, a), "error: the user did not approve this command");
-        if (refused)
-          return refused;
+        const input = Object.freeze({ ...a, command });
+        for (let attempt = 0;; attempt++) {
+          const refused = approvalError(await ctx.permit(`bash: ${command}`, "bash", ctx.signal, undefined, undefined, undefined, input, attempt ? { forceAsk: true } : undefined), "error: the user did not approve this command");
+          if (refused)
+            return refused;
+          if (ctx.signal?.aborted)
+            return "error: turn cancelled before shell execution";
+          let check = "valid";
+          try {
+            check = ctx.shellExecutionCheck?.(input) ?? "valid";
+          } catch {
+            check = "ask";
+          }
+          if (check === "aborted" || ctx.signal?.aborted)
+            return "error: turn cancelled before shell execution";
+          if (check === "valid")
+            break;
+          if (attempt)
+            return "error: read-only shell proof remained unstable; no command was executed";
+        }
         const res = await sandboxedExec(["/bin/bash", "-c", command], { cwd: ctx.cwd, profile: ctx.sandboxProfile, readOnlyData: !!ctx.readOnly?.length, timeoutMs: (Number(a.timeout_s) || 120) * 1000, ...ctx.sandboxEnv ? { env: ctx.sandboxEnv } : {}, ...ctx.signal ? { signal: ctx.signal } : {} });
         try {
           ctx.onProcessExit?.(res.code);
@@ -6220,7 +6344,7 @@ var init_tools = __esm(() => {
     fn("read", "Read a text file inside the project. Returns numbered lines.", { path: str, offset: { type: "integer", minimum: 1 }, limit: { type: "integer", minimum: 1 } }, ["path"]),
     fn("write", "Create or overwrite a file inside the project. Needs the user's approval.", { path: str, content: str }, ["path", "content"]),
     fn("edit", "Replace one exact, unique occurrence of `old` with `new` in a file. Needs the user's approval.", { path: str, old: str, new: str }, ["path", "old", "new"]),
-    fn("bash", "Run a shell command in the project directory, sandboxed: no writes outside the project, no credential reads, no network unless the hub enables it. Needs the user's approval.", { command: str, timeout_s: { type: "integer", minimum: 1, maximum: 600 } }, ["command"]),
+    fn("bash", "Run a shell command in the project directory, sandboxed: no writes outside the project, no credential reads, no network unless the hub enables it. Follows hub permission policy: proven bounded read-only commands may run automatically in ask-when-needed; other commands ask.", { command: str, timeout_s: { type: "integer", minimum: 1, maximum: 600 } }, ["command"]),
     fn("git", "Run git in the project. status, diff, log, show, ls-files, blame, rev-parse run freely; add, commit, restore, checkout, switch, stash, mv, rm, branch, merge, rebase, cherry-pick, revert, tag need approval; everything else (push, fetch, config, remote ...) is refused.", { args: { type: "array", items: str, minItems: 1 } }, ["args"]),
     fn("hub_send", "Send a message to the other agents now, before your turn ends. Conclusions only. Your final answer is shared anyway; use this for something that cannot wait.", { text: str, to: { type: "array", items: str } }, ["text"])
   ];
@@ -6252,6 +6376,54 @@ import { randomUUID as randomUUID4 } from "crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync9 } from "fs";
 import { join as join14, resolve as resolve11 } from "path";
 import { spawn as spawn9 } from "child_process";
+function piVersionAsync(command, cwd, timeoutMs = 1e4) {
+  const [bin, ...prefix] = command;
+  if (!bin)
+    return Promise.resolve(assessVersion("pi", undefined));
+  return new Promise((resolve) => {
+    let proc;
+    try {
+      proc = spawn9(bin, [...prefix, "--version"], { cwd, env: peerChildEnv("pi"), detached: true, stdio: ["ignore", "pipe", "ignore"] });
+    } catch {
+      resolve(assessVersion("pi", undefined));
+      return;
+    }
+    let output = "", bytes = 0, done = false;
+    const finish = async (code) => {
+      if (done)
+        return;
+      done = true;
+      clearTimeout(timer);
+      try {
+        await stopOwnedProcess(proc, { group: true });
+      } catch {
+        resolve(assessVersion("pi", undefined));
+        return;
+      }
+      resolve(assessVersion("pi", code === 0 && bytes <= 64 * 1024 ? COMPAT.pi.parse(output) : undefined));
+    };
+    const timer = setTimeout(() => {
+      finish(null);
+    }, timeoutMs);
+    proc.once("spawn", () => trackGroup(proc));
+    proc.stdout.on("data", (chunk) => {
+      if (done)
+        return;
+      bytes += chunk.length;
+      if (bytes > 64 * 1024) {
+        finish(null);
+        return;
+      }
+      output += chunk.toString("utf8");
+    });
+    proc.once("error", () => {
+      finish(null);
+    });
+    proc.once("close", (code) => {
+      finish(code);
+    });
+  });
+}
 function ownerStillAlive(pid, signature) {
   const current = processSignature(pid);
   if (current !== undefined)
@@ -6263,11 +6435,12 @@ function ownerStillAlive(pid, signature) {
     return false;
   }
 }
-var PiToolSettlementFailure, PiPromptNotStarted, PiPromptUncertain, TERMINAL_OWNER_MAX_AGE_MS = 1000, PiPeer;
+var PiToolSettlementFailure, PiPromptNotStarted, PiPromptUncertain, PiVersionRefusal, TERMINAL_OWNER_MAX_AGE_MS = 1000, PiPeer;
 var init_pi = __esm(() => {
   init_launch();
   init_envelope();
   init_child_process();
+  init_compat();
   init_process_signature();
   init_session();
   init_tools();
@@ -6282,8 +6455,14 @@ var init_pi = __esm(() => {
   };
   PiPromptUncertain = class PiPromptUncertain extends Error {
   };
+  PiVersionRefusal = class PiVersionRefusal extends Error {
+    constructor(verdict) {
+      super(verdict.reason);
+    }
+  };
   PiPeer = class PiPeer extends BasePeer {
     opts;
+    preflight;
     hubNative = true;
     proc;
     server;
@@ -6350,9 +6529,10 @@ var init_pi = __esm(() => {
     tuiCommands = new Map;
     tuiQueue = [];
     tuiWaiters = [];
-    constructor(id, opts) {
+    constructor(id, opts, preflight) {
       super(id, opts.watchdogMs);
       this.opts = opts;
+      this.preflight = preflight;
     }
     get tuiLaunch() {
       return this._tuiLaunch;
@@ -6598,6 +6778,8 @@ var init_pi = __esm(() => {
       return Response.json({ decisions, ...reservation ? { reservation } : {} });
     }
     async startImpl() {
+      if (this.preflight)
+        await this.preflight();
       this.terminalOwnerObservation = undefined;
       this.stopping = false;
       this.rosterDetached = false;
@@ -10017,7 +10199,7 @@ var init_hub_tools = __esm(() => {
     tool("hub_release_list", "Read public release scope and planned/actual dates for phased planning. Configured planners only.", {}),
     tool("hub_task_propose", "Put a piece of work on the shared task board. The hub assigns an owner by class (routing.toml) unless you name one. Classes: plan, implement, bulk_edit, test, review, summarize, triage. Name the class when you know it; without one the hub tries to pick it. Name yourself as owner to claim work nobody assigned you: it starts in progress. Put the paths the work touches in refs, set refs.repo for work in another repository, and when you claim work, a plan; the hub says when they overlap another open task.", { title: str2, class: { type: "string", enum: ["plan", "implement", "bulk_edit", "test", "review", "summarize", "triage"] }, detail: str2, role: { type: "string", description: "catalog role id for this task class; guidance only, no routing or authority change" }, refs, plan, owner: { type: "string", description: "peer id; yours to claim the work, omit to let the hub route it. With after, the owner is reserved: offered the task first once it is ready" }, after: { type: "array", items: { type: "integer" }, description: "ids of tasks that must be approved first; until then this one waits, offered to nobody, and cannot be claimed" }, backlog: { type: "boolean", description: "stage unoffered work; owner is only a reservation, even when naming yourself" }, urgent: { type: "boolean", description: "hand it over even when its owner is paused for quota only briefly" }, goal: { type: "string", description: "id of this project's long-term task (ahub goal list) the work is part of" } }, ["title"]),
     tool("hub_task_accept", "Take a task that was assigned to you, with your plan for it. Set refs.repo for work in another repository; acceptance may correct only that repository metadata.", { id, plan: acceptPlan, refs: { ...refs, properties: { repo: refs.properties.repo } } }, ["id"]),
-    tool("hub_task_cancel", "Cancel unaccepted proposed/backlog work you proposed as its configured planner; accepted work is person-only. Keeps history and does not stop a native turn or delete files.", { id, reason: str2, superseded_by: str2, revision: { type: "integer", minimum: 0 } }, ["id", "reason"]),
+    tool("hub_task_cancel", "Cancel proposed/backlog work you proposed as its configured planner, including work an owner accepted and then declined while it has no execution, branch, commit or PR evidence; work with any such evidence is person-only. Keeps history and does not stop a native turn or delete files.", { id, reason: str2, superseded_by: str2, revision: { type: "integer", minimum: 0 } }, ["id", "reason"]),
     tool("hub_task_decline", "Pass on a task assigned to you; the hub offers it to the next peer. A plain decline is a lasting refusal: you are never offered this task again. Pass capacity: true when you only have no room right now: you are skipped for this move only, and a later reroute or planner pull may offer it to you again.", { id, reason: str2, capacity: { type: "boolean" } }, ["id"]),
     tool("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs; no duplicate hub_send chat is needed. When the project configures a check for its class, the hub runs it first and the result comes as a task message: a failed check keeps the task with you.", { id, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs, deliverables: deliverablesSchema }, ["id", "summary"]),
     tool("hub_sdlc_record", "Record artifact ids or claimed local checks on your task. This grants no authority or external-check evidence. Only its owner/reviewer or the person may record; only its reviewer/person may name a reviewed head or phase checklist. Phase evidence refs are content hashes, not external verification.", { id, receipt: { type: "object", properties: { deliverables: deliverablesSchema, stage: { type: "string", enum: ["spec", "plan", "implement", "review", "verify", "merge", "release"] }, repo: str2, issue: id, pr: id, localHead: str2, localResult: { type: "string", enum: ["passed", "failed", "unknown"] }, reviewedHead: str2, phase: { type: "object", properties: { id: str2, head: str2, tasks: { type: "array", maxItems: 64, items: { type: "object", properties: { id, after: { type: "array", maxItems: 16, items: id } }, required: ["id", "after"], additionalProperties: false } }, criteria: { type: "array", maxItems: 32, items: { type: "object", properties: { id: str2, required: { type: "boolean" }, result: { type: "string", enum: ["verified", "failed", "unverified"] }, refs: { type: "array", maxItems: 8, items: str2 } }, required: ["id", "required", "result", "refs"], additionalProperties: false } } }, required: ["id", "tasks", "criteria"], additionalProperties: false } }, additionalProperties: false } }, ["id", "receipt"]),
@@ -10041,7 +10223,7 @@ var init_hub_tools = __esm(() => {
   TASK_TOOL_NAMES = new Set(TASK_TOOLS.map((t) => t.name));
   CONDUCTOR_TOOLS = [
     tool("hub_status", "Inspect public team state, holds, quota windows, task counts and pending approval peer/tool/age. Only the configured conductor may use this tool.", {}),
-    tool("hub_task_show", "Read a task's public view and history, its done summary and check result included. PII tasks remain stubs. Only the conductor and the task's current owner and reviewer may use this tool.", { id }, ["id"]),
+    tool("hub_task_show", "Read a task's public view and history, its done summary and check result included. PII tasks remain stubs. Only the conductor, the configured planner and the task's current owner and reviewer may use this tool.", { id }, ["id"]),
     tool("hub_task_assign", "Name an owner (default role) or reviewer. Only the conductor may name a reviewer through this tool. A proposer may redirect an unaccepted proposed task's owner; a task that still waits reserves that owner. Pull-only peers receive work when named while attached or when they claim it; a peer that cannot take the task is refused with the reason, and the task is unchanged. With an explicit capabilities list, the conductor needs assign capability for either role, the proposer only to give ownership to another peer.", { id, peer: str2, role: { type: "string", enum: ["owner", "reviewer"] } }, ["id", "peer"]),
     tool("hub_task_escalate", "Escalate a task through the normal task flow, as the conductor. Requires assign capability when explicitly listed.", { id }, ["id"]),
     tool("hub_peer_start", "Start local, kimi, qwen, jcode, pi, claude or codex in the start mode a person set for it; you cannot choose the mode. A headless peer starts at once. A TUI peer (claude, and pi and codex by default) opens in a terminal with a fixed command; when the hub cannot open a terminal the call fails with the command for the person to run.", { peer: { type: "string", enum: CONDUCTOR_START_PEERS } }, ["peer"]),
@@ -10367,11 +10549,12 @@ var init_local_worker = __esm(() => {
       return `(stopped after ${maxSteps} steps) ${progress.last}`.trim();
     }
     toolContext(envs, turnSignal, pii, reply) {
+      const executionGeneration = this.turn;
       return {
         cwd: this.opts.cwd,
         deny: this.opts.tools.deny,
         readOnly: this.opts.tools.readOnly,
-        permit: async (title, tool, _signal, canonicalTarget, _observe, originalPath, input) => {
+        permit: async (title, tool, _signal, canonicalTarget, _observe, originalPath, input, policy) => {
           if (turnSignal.aborted)
             return "aborted";
           const generation = this.turn;
@@ -10400,7 +10583,7 @@ var init_local_worker = __esm(() => {
             };
             const onAbort = () => finish("aborted");
             turnSignal.addEventListener("abort", onAbort, { once: true });
-            this.opts.tools.permit(title, tool, turnSignal, canonicalTarget, observe, originalPath, input).then(finish, (error) => {
+            this.opts.tools.permit(title, tool, turnSignal, canonicalTarget, observe, originalPath, input, policy).then(finish, (error) => {
               turnSignal.removeEventListener("abort", onAbort);
               reject(error);
             });
@@ -10413,6 +10596,7 @@ var init_local_worker = __esm(() => {
             observe({ source: "expired", answerEpoch: this.approvalAnswerEpoch ?? 0, eligibleExpiry: true });
           return picked;
         },
+        shellExecutionCheck: (input) => turnSignal.aborted || executionGeneration !== this.turn ? "aborted" : this.opts.tools.shellExecutionCheck?.(input) ?? "valid",
         sandboxProfile: this.sandboxProfile,
         sandboxEnv: { ...proxyEnv(this.opts.tools.bashNetwork ?? false), AGENTHUB_PEER_ID: this.id },
         signal: turnSignal,
@@ -10737,7 +10921,7 @@ import { randomUUID as randomUUID8 } from "crypto";
 import { lstatSync as lstatSync11, mkdtempSync as mkdtempSync5, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
 import { join as join17 } from "path";
-function claudeImplementerArgs(turn, mcp, settings, prompt) {
+function claudeImplementerArgs(turn, mcp, settings, prompt, model) {
   return [
     "-p",
     "--output-format",
@@ -10753,6 +10937,7 @@ function claudeImplementerArgs(turn, mcp, settings, prompt) {
     "",
     "--settings",
     settings,
+    ...model ? ["--model", model] : [],
     "--permission-mode",
     "default",
     "--permission-prompts",
@@ -11015,7 +11200,7 @@ var init_claude_implementer = __esm(() => {
           const child = new OwnedPrintChild({
             peer: this.id,
             command: this.command,
-            args: claudeImplementerArgs(turn, mcp, settings, this.options.systemPrompt),
+            args: claudeImplementerArgs(turn, mcp, settings, this.options.systemPrompt, this.options.model),
             cwd: this.options.cwd,
             input: group.envs.map(frame).join(`
 
@@ -11147,7 +11332,14 @@ function createPi(ctx) {
   if (ctx.permission === "read-only")
     throw new Error("Pi has no verified read-only permission mapping");
   init_pi();
-  return new PiPeer(ctx.instance, ctx.daemon.pi);
+  const options = ctx.daemon.pi;
+  return new PiPeer(ctx.instance, options, async () => {
+    const verdict = await piVersionAsync(options.cmd ?? ["pi"], options.cwd);
+    if (!verdict.ok)
+      throw new PiVersionRefusal(verdict);
+    if (verdict.note)
+      options.log?.(verdict.note);
+  });
 }
 function createLocal(ctx) {
   if (!("local" in ctx.daemon))
@@ -11254,9 +11446,9 @@ var init_reviewer_variants = __esm(() => {
   init_kimi_review();
   init_native_factories();
   init_native_display();
-  codexVariant = reviewerVariant("codex", "Codex reviewer", { backend: codexReviewerBackend, defaultPool: true, declaration: "explicit" }, CODEX_DISPLAY);
+  codexVariant = reviewerVariant("codex", "Codex reviewer", { backend: codexReviewerBackend, defaultPool: true, declaration: "explicit", scope: "code" }, CODEX_DISPLAY);
   CODEX_REVIEWER_VARIANT = { ...codexVariant, start: { ...codexVariant.start, create: createCodexReviewer } };
-  KIMI_REVIEWER_VARIANT = reviewerVariant("kimi", "Kimi reviewer", { backend: kimiReviewerBackend, defaultPool: true, declaration: "explicit" }, KIMI_DISPLAY);
+  KIMI_REVIEWER_VARIANT = reviewerVariant("kimi", "Kimi reviewer", { backend: kimiReviewerBackend, defaultPool: true, declaration: "explicit", scope: "code" }, KIMI_DISPLAY);
   AGY_REVIEWER_VARIANT = {
     ...reviewerVariant("agy", "agy reviewer", { defaultPool: false, declaration: "automatic", unavailable: "agy is an implementer peer (#485)" }, { palette: { fg: "#6558a6", bg: "#f1effa" } }),
     optional: true
@@ -12704,7 +12896,7 @@ var init_builtin_metadata = __esm(() => {
   headlessForms = Object.freeze(["headless"]);
   hubGrants = {
     ask: "every write, edit and shell command asks",
-    "ask-when-needed": "write and edit inside the project run without asking; shell and git writes still ask",
+    "ask-when-needed": "write, edit and proven bounded read-only shell commands inside the project run without asking; other shell commands and git writes still ask",
     "never-ask": "every tool runs without asking, inside the hub sandbox and path guard"
   };
   CLAUDE_REVIEWER_VARIANT = {
@@ -12741,8 +12933,8 @@ var init_builtin_metadata = __esm(() => {
     trust: { onPrem: false, hubSandboxed: false },
     start: { create: createClaudeImplementer, daemonPort: "claude-implementer", forms: headlessForms, defaultForm: "headless", conductorStartable: true, hubSwitches: [], ownedFlags: [] },
     identity: { mcp: "env", currentChild: true },
-    instances: { mode: "headless", roles: ["implementer", "verifier"] },
-    permission: { grants: { ask: "every write, edit and shell command asks", "ask-when-needed": "file tools inside the owned worktree may run automatically; shell and protected paths ask" } },
+    instances: { mode: "headless", roles: ["implementer", "verifier"], modelSelect: true },
+    permission: { grants: { ask: "every write, edit and shell command asks", "ask-when-needed": "file tools, proven read-only shell commands and bound task commands inside the owned worktree may run automatically; protected paths and other commands ask" } },
     session: { idField: "sessionId", currentId: sessionId("sessionId"), freshOnRestore: false, launchKind: "claude-implementer", crashPlan: () => ({ resume: {}, how: "Claude implementer resumes its recorded per-task sessions" }) },
     turnEnd: "adapter",
     budget: { account: "claude" },
@@ -13662,7 +13854,8 @@ function assertNativeCapabilityScope(definition) {
     ["hooks.factsHook", declared(definition.hooks, "factsHook")],
     ["cli.entry", declared(definition.cli, "entry")],
     ["cli.preview", declared(definition.cli, "preview")],
-    ["cli.usage", declared(definition.cli, "usage")]
+    ["cli.usage", declared(definition.cli, "usage")],
+    ["instances.modelSelect", declared(definition.instances, "modelSelect")]
   ];
   const field = restricted.find(([, present]) => present)?.[0];
   if (field)
@@ -14087,6 +14280,14 @@ var init_work_lists = __esm(() => {
   forbidden = new Set(["__proto__", "constructor", "prototype"]);
 });
 
+// node_modules/@staix/agent-mem/src/memory/candidate-pending.ts
+var CANDIDATE_AGE_MS, CANDIDATE_SHOWN_GRACE_MS, CANDIDATE_DUE_MS;
+var init_candidate_pending = __esm(() => {
+  CANDIDATE_AGE_MS = 30 * 86400000;
+  CANDIDATE_SHOWN_GRACE_MS = 7 * 86400000;
+  CANDIDATE_DUE_MS = 7 * 86400000;
+});
+
 // node_modules/@staix/agent-mem/src/memory/generation-sync.ts
 var zero;
 var init_generation_sync = __esm(() => {
@@ -14118,14 +14319,6 @@ var init_sync = __esm(() => {
   liveGroups = new Set;
 });
 
-// node_modules/@staix/agent-mem/src/memory/candidate-pending.ts
-var CANDIDATE_AGE_MS, CANDIDATE_SHOWN_GRACE_MS, CANDIDATE_DUE_MS;
-var init_candidate_pending = __esm(() => {
-  CANDIDATE_AGE_MS = 30 * 86400000;
-  CANDIDATE_SHOWN_GRACE_MS = 7 * 86400000;
-  CANDIDATE_DUE_MS = 7 * 86400000;
-});
-
 // node_modules/@staix/agent-mem/src/memory/path-glob.ts
 var init_path_glob = __esm(() => {
   init_project2();
@@ -21423,6 +21616,37 @@ init_policy();
 init_screen();
 init_shard();
 init_work_lists();
+// node_modules/@staix/agent-mem/src/memory/project-import.ts
+init_bridge();
+init_private_spans();
+init_shard();
+init_store();
+var PROJECT_IMPORT_MAX_BYTES = 64 * 1024 * 1024;
+var PROJECT_IMPORT_MAX_LINE_BYTES = 64 * 1024;
+var PROJECT_IMPORT_FUTURE_SKEW_MS = 5 * 60 * 1000;
+var NOTE_KEYS = new Set(["schema", "id", "at", "machine", "op", "project", "scope", "tier", "kind", "peer", "title", "text", "task", "about", "supersedes", "promotedFrom", "source", "expires"]);
+// node_modules/@staix/agent-mem/src/memory/external-import.ts
+init_aliases();
+
+// node_modules/@staix/agent-mem/src/memory/candidates.ts
+init_candidate_pending();
+
+// node_modules/@staix/agent-mem/src/memory/note-add.ts
+init_store();
+
+// node_modules/@staix/agent-mem/src/memory/candidates.ts
+init_home();
+init_platform();
+init_private_spans();
+var CANDIDATE_RETENTION = { count: 500, ageMs: 30 * 86400000 };
+var COUNTER_RETENTION = { count: 1e4, ageMs: 90 * 86400000 };
+
+// node_modules/@staix/agent-mem/src/memory/external-import.ts
+init_candidate_pending();
+init_platform();
+init_private_spans();
+init_screen();
+var EXTERNAL_IMPORT_LIMITS = { maxFiles: 256, maxDirectories: 512, maxEntriesPerDirectory: 512, maxDepth: 16, maxFileBytes: 1024 * 1024, maxCandidatesPerRun: 100, candidateTextChars: 3000, titleChars: 200 };
 // node_modules/@staix/agent-mem/src/memory/cross-project.ts
 init_search_fts();
 init_capture();
@@ -21441,6 +21665,11 @@ init_platform();
 init_store();
 init_shard();
 init_work_lists();
+init_capture();
+init_capture_input();
+init_config2();
+init_policy();
+init_private_spans();
 
 // node_modules/@staix/agent-mem/src/index.ts
 init_project2();
@@ -21452,22 +21681,10 @@ init_store();
 init_sync();
 init_project2();
 var AMEM_NAMES = { memory: "amem", goal: "amem goal" };
-var memoryUsage = (name = AMEM_NAMES.memory) => `usage: ${name} [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> [--history] [--as-of <UTC>] | show <id> [--history] [--as-of <UTC>] | graph <id|node> [--hops 1|2] [--history] [--as-of <UTC>] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] [--restart] | dedupe [--apply] | suggestions | confirm|reject <suggestion id>  [--json]`;
+var memoryUsage = (name = AMEM_NAMES.memory) => `usage: ${name} [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> [--history] [--as-of <UTC>] | show <id> [--history] [--as-of <UTC>] | graph <id|node> [--hops 1|2] [--history] [--as-of <UTC>] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] [--restart] [--capture-days N] | dedupe [--apply] | suggestions | confirm|reject <suggestion id>  [--json]`;
 var MEMORY_USAGE = memoryUsage();
 var goalUsage = (name = AMEM_NAMES.goal) => `usage: ${name} [list] [--all] | show <id> | new <title> [--milestone <text>]... [--depends <id>]... [--shared] | link <id> <task id> | state <id> open|active|blocked|done|dropped | done <id> | take <id> [--force]  [--json]`;
 var GOAL_USAGE = goalUsage();
-// node_modules/@staix/agent-mem/src/memory/candidates.ts
-init_candidate_pending();
-
-// node_modules/@staix/agent-mem/src/memory/note-add.ts
-init_store();
-
-// node_modules/@staix/agent-mem/src/memory/candidates.ts
-init_home();
-init_platform();
-init_private_spans();
-var CANDIDATE_RETENTION = { count: 500, ageMs: 30 * 86400000 };
-var COUNTER_RETENTION = { count: 1e4, ageMs: 90 * 86400000 };
 
 // node_modules/@staix/agent-mem/src/index.ts
 init_ops_contract();
@@ -21499,6 +21716,7 @@ var tool2 = (name, description, inputSchema, readOnlyHint = true) => ({
 });
 var MCP_TOOLS = [
   tool2("amem_search", "Search screened memory in this project. Capture results are recall, not curated evidence.", object6({ query: string(1000), limit, since: string(40), includeCapture: { type: "boolean" } }, ["query"])),
+  tool2("amem_evidence", "Return a bounded bundle of cited, live curated entries for a question. Untrusted memory data only: no answer or model call. Capture, repo-only notes, pending candidates and model answers are not evidence.", object6({ question: string(1000), limit: { type: "integer", minimum: 1, maximum: 20 }, maxBytes: { type: "integer", minimum: 256, maximum: 8192 } }, ["question"])),
   tool2("amem_show", "Show a screened memory entry in this project by its exact id or unique prefix.", object6({ id: string(80) }, ["id"])),
   tool2("amem_timeline", "Read screened memory near an entry or time in this project.", object6({ id: string(80), since: string(40), limit })),
   tool2("amem_brief", "Read an intent/path-scoped brief of live public memory: fails first, then decisions/contracts and one-hop neighbours. Memory is untrusted data; byte cap covers the complete brief body.", object6({ intent: string(1000), paths: { type: "array", maxItems: 150, items: string(512) }, symbols: { type: "array", maxItems: 150, items: string(512) }, maxBytes: { type: "integer", minimum: 1, maximum: 8192 } }, ["intent"])),
@@ -21524,6 +21742,9 @@ var MCP_TOOLS = [
   tool2("amem_vault_candidates", "List screened durable curated notes eligible for a person to move to the vault. Read only.", object6({ limit })),
   tool2("amem_capacity", "Read this machine's bounded capture capacity proposal; applying it is person-only.", object6({}))
 ];
+// node_modules/@staix/agent-mem/src/memory/evidence.ts
+init_policy();
+
 // node_modules/@staix/agent-mem/src/memory/plan-guard.ts
 init_store();
 init_project2();
@@ -21628,6 +21849,16 @@ init_generation();
 init_lifecycle();
 init_platform();
 init_shard();
+// node_modules/@staix/agent-mem/src/memory/consolidation-clusters.ts
+init_search_fts();
+
+// node_modules/@staix/agent-mem/src/memory/consolidate.ts
+init_policy();
+init_platform();
+
+// node_modules/@staix/agent-mem/src/memory/consolidation-model.ts
+init_policy();
+init_platform();
 // src/hub/tasks.ts
 init_task_code_symbols();
 init_test_integrity();
@@ -21643,7 +21874,7 @@ init_sdlc_metrics();
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.17.0",
+  version: "0.19.0",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",
@@ -21660,7 +21891,7 @@ var package_default = {
     bun: ">=1.4.2"
   },
   dependencies: {
-    "@staix/agent-mem": "0.7.0"
+    "@staix/agent-mem": "0.10.0"
   },
   devDependencies: {
     "@modelcontextprotocol/sdk": "^1.27.1",
@@ -21714,6 +21945,17 @@ init_plan_conformance();
 init_review_findings();
 init_sdlc();
 
+// src/hub/sdlc-merge.ts
+init_review_findings();
+init_sdlc();
+
+// src/hub/sdlc-mirror.ts
+init_envelope();
+var inFlight = new Set;
+
+// src/hub/review-scope.ts
+var isReviewScope = (value) => value === "full" || value === "code";
+
 // src/hub/tasks.ts
 init_review_findings();
 init_roles();
@@ -21748,6 +21990,7 @@ init_project();
 
 // src/hub/task-repository.ts
 init_git();
+init_host_executable();
 init_project();
 init_spec_read();
 var GIT_MAX_BYTES = 16 * 1024;
@@ -21854,7 +22097,8 @@ function validateInstances(raw, catalog) {
     const path = `instances.${id}`, entry = fields2(descriptor.value, path);
     const declaredKind = entry.kind?.value;
     const jcodeFields = typeof declaredKind === "string" && resolve(declaredKind)?.instances?.nativeHome === true;
-    if (Object.keys(entry).some((key) => !["kind", "roles", "start_mode", "permission_mode", "worktree", "review_mode", "readOnly", ...jcodeFields ? JCODE_FIELDS : []].includes(key)))
+    const modelSelect = typeof declaredKind === "string" && resolve(declaredKind)?.headlessVariant?.instances?.modelSelect === true;
+    if (Object.keys(entry).some((key) => !["kind", "roles", "start_mode", "permission_mode", "worktree", "review_mode", "readOnly", "review_scope", ...jcodeFields ? JCODE_FIELDS : [], ...modelSelect ? ["model"] : []].includes(key)))
       return fail4(path, "unsupported field");
     const kind = entry.kind?.value;
     if (typeof kind !== "string")
@@ -21929,6 +22173,21 @@ function validateInstances(raw, catalog) {
         return fail4("instances", `at most ${MAX_JCODE_INSTANCES} extra Jcode instances are supported per project`);
       Object.assign(value, jcodeInstanceFields(entry, path));
     }
+    if (entry.model && modelSelect) {
+      if (!headlessWriter)
+        return fail4(`${path}.model`, "only a headless implementer takes a model");
+      const word = entry.model.value;
+      if (typeof word !== "string" || !NATIVE_WORD.test(word))
+        return fail4(`${path}.model`, "must be one bounded printable word without spaces");
+      value.model = word;
+    }
+    if (entry.review_scope) {
+      if (!freshReviewer)
+        return fail4(`${path}.review_scope`, "only a fresh reviewer instance has a review scope");
+      if (!isReviewScope(entry.review_scope.value))
+        return fail4(`${path}.review_scope`, 'must be "code" or "full"');
+      value.review_scope = entry.review_scope.value;
+    }
     if (entry.readOnly)
       value.readOnly = entry.readOnly.value;
     if (entry.roles) {
@@ -30723,8 +30982,15 @@ async function callTool(req) {
     if (typeof args?.tool_name !== "string" || !/^[A-Za-z][A-Za-z0-9_.:/-]{0,127}$/.test(args.tool_name) || !args.input || typeof args.input !== "object" || Array.isArray(args.input) || typeof args.tool_use_id !== "string" || !args.tool_use_id.length || args.tool_use_id.length > 256)
       return deny("invalid native permission request");
     try {
-      const res = await hub.request({ t: "permission_request", tool: args?.tool_name, input: args?.input }, 3605000);
-      return res.ok === true && res.behavior === "allow" ? text5(JSON.stringify({ behavior: "allow", updatedInput: args?.input })) : deny(typeof res.message === "string" ? res.message : "permission denied");
+      const res = await hub.request({ t: "permission_request", tool: args?.tool_name, input: args?.input, wrapperProtocol: 1 }, 3605000);
+      if (res.ok !== true || res.behavior !== "allow")
+        return deny(typeof res.message === "string" ? res.message : "permission denied");
+      if (res.wrapperProtocol !== undefined && res.wrapperProtocol !== 1)
+        return deny("unsupported host execution response");
+      const updated = res.wrapperProtocol === 1 ? res.updatedInput : undefined;
+      if (res.wrapperProtocol === 1 && (args.tool_name !== "Bash" || !updated || typeof updated !== "object" || Array.isArray(updated) || typeof updated.command !== "string"))
+        return deny("invalid host execution response");
+      return text5(JSON.stringify({ behavior: "allow", updatedInput: updated ?? args?.input }));
     } catch {
       return deny("hub permission unavailable");
     }