@staix/agent-hub 0.18.0 → 0.19.0

package/plugins/agent-hub/server.js

@@ -68,7 +68,10 @@ function realPath(path) {
 }
 function isDenied(path, extra = []) {
   const norm = path.split(sep).join("/");
-  return DENY_SEGMENTS.some((s) => hasSegment(norm, s)) || DENY_NAMES.some((re) => new RegExp(re).test(basename(norm))) || extra.some((e) => e && norm.includes(e));
+  if (DENY_SEGMENTS.some((s) => hasSegment(norm, s)))
+    return true;
+  const name = basename(norm);
+  return DENY_NAMES.some((re) => (denyNamePatterns.get(re) ?? new RegExp(re)).test(name)) || extra.some((e) => e && norm.includes(e));
 }
 function memoryGitEnv(env = process.env, options = {}) {
   const result = { ...env, GIT_TERMINAL_PROMPT: "0" };
@@ -118,11 +121,12 @@ var require2, processes, childProcess = () => processes ??= require2("node:child
     const parent = dirname(absolute);
     return parent === absolute ? absolute : join(canonical(parent), basename(absolute));
   }
-}, DENY_SEGMENTS, DENY_NAMES, hasSegment = (rel, seg) => `/${rel}/`.includes(`/${seg}/`), SAFE_CONFIG, CREDENTIAL_KEYS, memoryGitArgv = (args, opts = {}) => ["git", "--no-pager", ...SAFE_CONFIG.filter((c) => !opts.credentials || !CREDENTIAL_KEYS.has(c)).flatMap((c) => ["-c", c]), ...args], ambientGitTimeout;
+}, DENY_SEGMENTS, DENY_NAMES, denyNamePatterns, hasSegment = (rel, seg) => `/${rel}/`.includes(`/${seg}/`), SAFE_CONFIG, CREDENTIAL_KEYS, memoryGitArgv = (args, opts = {}) => ["git", "--no-pager", ...SAFE_CONFIG.filter((c) => !opts.credentials || !CREDENTIAL_KEYS.has(c)).flatMap((c) => ["-c", c]), ...args], ambientGitTimeout;
 var init_platform = __esm(() => {
   require2 = createRequire(import.meta.url);
   DENY_SEGMENTS = [".maru/secrets", ".agenthub/state", ".agenthub/archive"];
   DENY_NAMES = ["^\\.env", "\\.pem$", "\\.key$", "^id_rsa", "^id_ed25519", "^credentials(\\.|$)", "^auth\\.json$", "^\\.netrc$", "^\\.npmrc$", "^\\.pypirc$"];
+  denyNamePatterns = new Map(DENY_NAMES.map((source) => [source, new RegExp(source)]));
   SAFE_CONFIG = ["core.fsmonitor=false", "core.hooksPath=/dev/null", "diff.external=", "core.pager=cat", "credential.helper=", "core.askpass="];
   CREDENTIAL_KEYS = new Set(["credential.helper=", "core.askpass="]);
 });
@@ -291,13 +295,24 @@ var plain = (text) => text.length <= 64 && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/
 var init_compat = __esm(() => {
   init_project();
   COMPAT = {
+    pi: {
+      label: "Pi",
+      verified: ["1.4.0"],
+      gate: "contract",
+      probe: ["pi", "--version"],
+      config: "pi.cmd",
+      parse: (out) => plain(out.trim()),
+      trustNote: "The model-free extension load, RPC session identity and managed tool receipt path were checked on 1.4.0. Permissions remain host-owned; account-backed inference and another version's extension contract are unverified.",
+      receipt: "docs/verification/2026-10-26-pi-140-compat.md"
+    },
     "claude-implementer": {
       label: "Claude headless implementer",
-      verified: ["2.1.309"],
+      verified: ["2.1.309", "2.1.310"],
       gate: "contract",
       probe: ["claude", "--version"],
       parse: (out) => plain(out.trim().replace(/ \(Claude Code\)$/, "")),
-      trustNote: "The native prompt-tool allow, deny, MCP error/disconnect and hook-failure fallthrough have an isolated receipt. No dontAsk/bypass fallback exists; another version's permission behavior is unverified."
+      trustNote: "The native prompt-tool transport and host-wrapper rewrite, environment isolation and replay contract have isolated receipts. No dontAsk/bypass fallback exists; another version's permission or rewrite behavior is unverified.",
+      receipt: "docs/verification/2026-10-26-headless-claude-shell-context.md"
     },
     "codex-review": {
       label: "Codex reviewer (codex-cli)",
@@ -306,19 +321,21 @@ var init_compat = __esm(() => {
       probe: ["codex", "--version"],
       config: "codex_bin",
       parse: (out) => plain(out.trim().replace(/^codex-cli /, "")),
-      trustNote: "Every launch still proves the MCP inventory, Apps/plugins/hooks disabled, sandbox read/write denial and the binary fence; a failed leg still refuses. Trust covers only the source-level claims those probes cannot see (docs/verification/2026-10-19-reviewer-isolation.md)."
+      trustNote: "Every launch still proves the MCP inventory, Apps/plugins/hooks disabled, sandbox read/write denial and the binary fence; a failed leg still refuses. Trust covers only the source-level claims those probes cannot see (docs/verification/2026-10-19-reviewer-isolation.md).",
+      receipt: "docs/verification/2026-10-24-codex-0164-reviewer-isolation.md"
     },
     "kimi-review": {
       label: "Kimi reviewer (kimi-code)",
-      verified: ["2.2.0", "2.3.0", "2.3.1"],
+      verified: ["2.2.0", "2.3.0", "2.3.1", "2.3.2"],
       gate: "isolation",
       probe: ["kimi", "--version"],
       parse: (out) => plain(out.trim()),
-      trustNote: "Every launch still builds the private config, exact two-tool agent file and task-bound MCP; the native tool allowlist behaviour of an untested version is not re-proven."
+      trustNote: "Every launch still builds the private config, exact two-tool agent file and task-bound MCP; the native tool allowlist behaviour of an untested version is not re-proven.",
+      receipt: "docs/verification/2026-10-26-kimi-232-reviewer-compat.md"
     },
     jcode: {
       label: "Jcode",
-      verified: ["0.98.1", "0.99.0"],
+      verified: ["0.98.1", "0.99.0", "0.99.1"],
       line: { min: "0.98.0", below: "1.0.0" },
       gate: "contract",
       probe: ["jcode", "--quiet", "version", "--json"],
@@ -331,25 +348,28 @@ var init_compat = __esm(() => {
           return;
         }
       },
-      trustNote: "The ACP, serve and MCP contract was verified on 0.98.1 and steering on 0.99.0; an untested version may change them."
+      trustNote: "The ACP, serve and MCP contract was verified on 0.98.1 and 0.99.1 and steering on 0.99.0 and 0.99.1; an untested version may change them.",
+      receipt: "docs/verification/2026-10-26-jcode-0.99.1.md"
     },
     agy: {
       label: "agy",
-      verified: ["1.4.2"],
+      verified: ["1.4.2", "1.4.7"],
       line: { min: "1.4.0", below: "1.5.0" },
       gate: "contract",
       probe: ["agy", "--version"],
       parse: (out) => plain(out.trim()),
-      trustNote: "Only 1.4.2 is T0-verified; the plugin MCP and hook contract of another version is unverified."
+      trustNote: "Only 1.4.2 and 1.4.7 are T0-verified; the plugin MCP and hook contract of another version is unverified.",
+      receipt: "docs/verification/2026-10-26-agy-1.4.7.md"
     },
     qwen: {
       label: "Qwen Code",
-      verified: ["0.25.0", "0.26.0"],
+      verified: ["0.25.0", "0.26.0", "0.26.1"],
       gate: "contract",
       probe: ["qwen", "--version"],
       config: "qwen_cmd",
       parse: (out) => plain(out.trim()),
-      trustNote: "Native ACP identity and mode ids have dated receipts; 0.26.0 permission callbacks were checked without inference. Another version may change those contracts."
+      trustNote: "Native ACP identity, mode ids and permission callbacks were re-checked without inference on 0.26.1; its two ACP fixes were judged not to change the hub contract. Another version may change those contracts.",
+      receipt: "docs/verification/2026-10-26-qwen-0261-acp.md"
     },
     "qwen-dual": {
       label: "Qwen Code dual-output TUI",
@@ -358,7 +378,8 @@ var init_compat = __esm(() => {
       probe: ["qwen", "--version"],
       config: "qwen_cmd",
       parse: (out) => plain(out.trim()),
-      trustNote: "The dual-output file contract (submit and confirmation_response input, user/assistant/stream_event/control events, session_start identity) was verified on 0.26.1 only. A hub deny ends the turn without any Qwen event, and no external stop of a running turn exists; another version may change either."
+      trustNote: "The dual-output file contract (submit and confirmation_response input, user/assistant/stream_event/control events, session_start identity) was verified on 0.26.1 only. A hub deny ends the turn without any Qwen event, and no external stop of a running turn exists; another version may change either.",
+      receipt: "docs/verification/2026-10-25-qwen-dual-output-t0.md"
     }
   };
   MAX_BYTES = 64 * 1024;
@@ -4819,7 +4840,10 @@ function qwenDualNamesStateDir(input, stateDir) {
   };
   return seen(input, 0);
 }
-var SUBMIT_CAP, READ_CAP, ANSWERED_CAP = 256, QWEN_STALLED_NOTE = "stalled: Qwen has said nothing for a while; the hub cannot stop a Qwen turn, press Esc in the Qwen terminal", QWEN_DETACHED_NOTE = "detached: the hub cannot read Qwen's event file; Qwen keeps working in its terminal and the hub reattaches when the file is readable again", DIR = "qwen-dual", QwenDualPeer;
+function isQwenTaskNotification(text) {
+  return text.length <= NOTIFICATION_CAP && QWEN_TASK_NOTIFICATIONS.test(text);
+}
+var SUBMIT_CAP, READ_CAP, ANSWERED_CAP = 256, QWEN_STALLED_NOTE = "stalled: Qwen has said nothing for a while; the hub cannot stop a Qwen turn, press Esc in the Qwen terminal", QWEN_DETACHED_NOTE = "detached: the hub cannot read Qwen's event file; Qwen keeps working in its terminal and the hub reattaches when the file is readable again", DIR = "qwen-dual", NOTIFICATION, QWEN_TASK_NOTIFICATIONS, NOTIFICATION_CAP, QwenDualPeer;
 var init_qwen_dual = __esm(() => {
   init_envelope();
   init_child_process();
@@ -4828,6 +4852,9 @@ var init_qwen_dual = __esm(() => {
   init_qwen_native();
   SUBMIT_CAP = 256 * 1024;
   READ_CAP = 1024 * 1024;
+  NOTIFICATION = String.raw`<task-notification>\n<task-id>bg_[0-9a-f]{4,32}<\/task-id>\n<kind>[a-z_-]{1,32}<\/kind>\n<status>[a-z_-]{1,32}<\/status>\n(?:(?!<task-notification>|<\/task-notification>)[\s\S])*<\/task-notification>`;
+  QWEN_TASK_NOTIFICATIONS = new RegExp(`^${NOTIFICATION}(?:\\n\\n${NOTIFICATION})*$`);
+  NOTIFICATION_CAP = 64 * 1024;
   QwenDualPeer = class QwenDualPeer extends BasePeer {
     opts;
     permissionModeState = "unmanaged";
@@ -5276,6 +5303,13 @@ ${text}`;
       if (!this.stopping && !this.detached && this.state === "offline")
         this.setState("idle");
     }
+    isNotificationEvent(event) {
+      const content = event.message?.content;
+      if (!Array.isArray(content) || content.length !== 1)
+        return false;
+      const block = content[0];
+      return !!block && typeof block === "object" && block.type === "text" && typeof block.text === "string" && isQwenTaskNotification(block.text);
+    }
     promptText(event) {
       const content = event.message?.content;
       if (typeof content === "string")
@@ -5286,6 +5320,8 @@ ${text}`;
       return blocks.length ? blocks.map((block) => block.text).join("") : undefined;
     }
     onUser(event) {
+      if (this.isNotificationEvent(event))
+        return;
       const text = this.promptText(event);
       if (text === undefined)
         return;
@@ -5808,26 +5844,61 @@ var init_path_policy = __esm(() => {
 
 // src/local/deny.ts
 import { basename as basename4, dirname as dirname8 } from "path";
-function hubWriteRegexes(root, gitDirs = [], moduleGit) {
+function hubWriteRegexes(root, gitDirs = [], moduleGit = [], worktreesRoot) {
   const git = hfsFoldedName(".git");
   const re = (s) => `(regex ${sbplString(s)})`;
   const external = gitDirs.flatMap((d) => [
     `(require-all ${re(`^${sbplEscape(d)}/[^/]+$`)} ${re(`^.*/(${hfsFoldedName("config")}|${hfsFoldedName("hooks")})$`)})`,
+    `(require-all ${re(`^${sbplEscape(d)}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
     `(subpath ${sbplString(`${d}/hooks`)})`,
     `(require-all (subpath ${sbplString(d)}) ${re(`^.*/${hfsFoldedName("commondir")}$`)})`
   ]);
-  const modules = moduleGit ? [
-    `(require-all ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?${hfsFoldedName("config")}$`)} (require-not ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?(refs|logs)/`)}))`,
-    `(require-all ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?${hfsFoldedName("hooks")}(/|$)`)} (require-not ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?(refs|logs)/`)}))`,
-    ...moduleGit.entries.map((d) => re(`^${sbplEscape(dirname8(d))}/${hfsFoldedName(basename4(d))}$`))
-  ] : [];
+  const allDirs = moduleGit.flatMap((tree) => tree.dirs ?? []);
+  const modules = moduleGit.flatMap((tree) => {
+    const root = sbplEscape(tree.root);
+    const found = tree.dirs ?? [];
+    const inside = found.map((d) => `(require-not ${re(`^${sbplEscape(d)}(/|$)`)})`).join(" ");
+    const anchored = found.flatMap((d) => {
+      const dir = sbplEscape(d);
+      return [
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${re(`^.*/${hfsFoldedName("config")}$`)})`,
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
+        `(require-all ${re(`^${dir}/`)} ${re(hooksUnder(d))})`,
+        `(require-all ${re(`^${dir}/worktrees/[^/]+/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${re(`^.*/${hfsFoldedName("worktrees")}$`)})`,
+        re(`^${dir}/worktrees/[^/]+$`),
+        `(require-all ${re(`^${dir}/[^/]+$`)} ${re(`^.*/${hfsFoldedName("hooks")}$`)})`,
+        `(require-all ${re(`^${dir}/worktrees/[^/]+/modules/.`)} ${allDirs.filter((f) => f.startsWith(`${d}/worktrees/`)).map((f) => `(require-not ${re(`^${sbplEscape(f)}(/|$)`)})`).join(" ")})`,
+        `(require-all ${re(`^${dir}/worktrees/[^/]+/[^/]+$`)} ${re(`^.*/${hfsFoldedName("modules")}$`)})`
+      ];
+    });
+    return [
+      `(require-all ${re(`^${root}/.`)} ${inside})`,
+      ...anchored,
+      ...tree.entries.map((d) => `(require-all ${re(`^${sbplEscape(dirname8(d))}/[^/]+$`)} ${re(`^.*/${hfsFoldedName(basename4(d))}$`)})`)
+    ];
+  });
+  const siblings = worktreesRoot ? (() => {
+    const w = sbplEscape(worktreesRoot);
+    return [
+      `(require-all ${re(`^${sbplEscape(dirname8(worktreesRoot))}/[^/]+$`)} ${re(`^.*/${hfsFoldedName(basename4(worktreesRoot))}$`)})`,
+      re(`^${w}/[^/]+$`),
+      `(require-all ${re(`^${w}/[^/]+/[^/]+$`)} ${re(`^.*/${hfsFoldedName("config")}$`)})`,
+      `(require-all ${re(`^${w}/[^/]+/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
+      `(require-all ${re(`^${w}/[^/]+/`)} ${re(hooksUnder(`${worktreesRoot}/x`))})`,
+      `(require-all ${re(`^${w}/[^/]+/modules/.`)} ${moduleGit.flatMap((tree) => tree.dirs ?? []).filter((d) => d.startsWith(`${worktreesRoot}/`)).map((d) => `(require-not ${re(`^${sbplEscape(d)}(/|$)`)})`).join(" ")})`,
+      `(require-all ${re(`^${w}/[^/]+/[^/]+$`)} ${re(`^.*/${hfsFoldedName("modules")}$`)})`
+    ];
+  })() : [];
   return [
     `(require-all (subpath ${sbplString(root)}) ${re(`^.*/${hfsFoldedName(".agenthub")}(/|$)`)})`,
     re(`^.*/${git}$`),
     re(`^.*/${git}/${hfsFoldedName("config")}$`),
+    `(require-all ${re(`^.*/${git}/[^/]+$`)} ${CONFIG_WORKTREE_NAME.map(re).join(" ")})`,
     re(`^.*/${git}/${hfsFoldedName("hooks")}(/|$)`),
     `(require-all ${re(`^.*/${git}/.*$`)} ${re(`^.*/${hfsFoldedName("commondir")}$`)})`,
     ...modules,
+    ...siblings,
     ...external
   ];
 }
@@ -5842,12 +5913,16 @@ function denyRegexes(root, extra = [], withNames = true) {
     ...extra.filter(Boolean).map((e) => `^${sbplEscape(root)}/.*${sbplEscape(e)}`)
   ].map((re) => `(regex ${sbplString(re)})`);
 }
-var sbplEscape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), sbplString = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`, HFS_IGNORABLE_POINTS, HFS_IGNORABLE, hfsFoldedName = (name) => `${HFS_IGNORABLE}*${[...name].map((c) => sbplEscape(c)).join(`${HFS_IGNORABLE}*`)}${HFS_IGNORABLE}*`;
+var sbplEscape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), sbplString = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`, HFS_IGNORABLE_POINTS, HFS_IGNORABLE, hfsFoldedName = (name) => `${HFS_IGNORABLE}*${[...name].map((c) => sbplEscape(c)).join(`${HFS_IGNORABLE}*`)}${HFS_IGNORABLE}*`, CONFIG_WORKTREE_NAME, MAX_ANCHOR_DEPTH = 80, hooksUnder = (parent) => {
+  const depth = parent.split("/").filter(Boolean).length;
+  return depth > MAX_ANCHOR_DEPTH ? `^.*/${hfsFoldedName("hooks")}(/|$)` : `^${"/[^/]+".repeat(depth)}/${hfsFoldedName("hooks")}(/|$)`;
+};
 var init_deny = __esm(() => {
   init_platform();
   init_platform();
   HFS_IGNORABLE_POINTS = ["\u200C", "\u200D", "\u200E", "\u200F", "\u202A", "\u202B", "\u202C", "\u202D", "\u202E", "\u206A", "\u206B", "\u206C", "\u206D", "\u206E", "\u206F", "\uFEFF"];
   HFS_IGNORABLE = `(${HFS_IGNORABLE_POINTS.join("|")})`;
+  CONFIG_WORKTREE_NAME = [`^.*/${hfsFoldedName("config")}\\.[^/]*$`, `^.*/[^/]*${hfsFoldedName("worktree")}$`];
 });
 
 // src/local/sandbox.ts
@@ -5871,39 +5946,70 @@ function externalGitDirs(root) {
 `).map((d) => resolve9(root, d));
   return [...new Set(dirs)].filter((d) => !d.startsWith(`${root}/`));
 }
-function moduleGitDirs(root) {
+function worktreesRoot(root) {
   const out = memoryGitSync(["-C", root, "rev-parse", "--git-common-dir"], { encoding: "utf8" });
+  return out.status === 0 && out.stdout.trim() ? join12(resolve9(root, out.stdout.trim()), "worktrees") : undefined;
+}
+function moduleGitDirs(root) {
+  const out = memoryGitSync(["-C", root, "rev-parse", "--git-common-dir", "--absolute-git-dir"], { encoding: "utf8" });
   if (out.status !== 0)
-    return;
-  const modulesRoot = join12(resolve9(root, out.stdout.trim()), "modules");
-  const dirs = [];
-  const walk = (dir, depth) => {
-    if (depth > 8)
-      return;
-    let entries;
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
+    return [];
+  const [commonRaw, ownRaw] = out.stdout.trim().split(`
+`);
+  if (!commonRaw || !ownRaw)
+    return [];
+  const common = resolve9(root, commonRaw), own = resolve9(root, ownRaw);
+  const roots = new Set([join12(common, "modules"), join12(own, "modules")]);
+  try {
+    for (const e of readdirSync(join12(common, "worktrees"), { withFileTypes: true })) {
+      if (!e.isDirectory())
+        continue;
+      const modules = join12(common, "worktrees", e.name, "modules");
+      if (existsSync6(modules))
+        roots.add(modules);
     }
-    const names = new Set(entries.map((e) => e.name));
-    if (names.has("HEAD") && names.has("config")) {
-      dirs.push(dir);
-      const nested = join12(dir, "modules");
-      if (names.has("modules"))
-        walk(nested, depth + 1);
-      return;
+  } catch {}
+  const trees = [];
+  const tree = (modulesRoot, nesting) => {
+    const dirs = [];
+    const walk = (dir, depth) => {
+      if (depth > 8)
+        return;
+      let entries;
+      try {
+        entries = readdirSync(dir, { withFileTypes: true });
+      } catch {
+        return;
+      }
+      const names = new Set(entries.map((e) => e.name));
+      if (names.has("HEAD") && names.has("config")) {
+        dirs.push(dir);
+        return;
+      }
+      for (const e of entries)
+        if (e.isDirectory())
+          walk(join12(dir, e.name), depth + 1);
+    };
+    walk(modulesRoot, 0);
+    const found = nesting >= MODULE_DEPTH ? [] : dirs;
+    const entries = new Set([modulesRoot]);
+    for (const d of found)
+      for (let p = d;p.length > modulesRoot.length; p = dirname9(p))
+        entries.add(p);
+    trees.push({ root: modulesRoot, entries: [...entries], dirs: found });
+    for (const d of found) {
+      tree(join12(d, "modules"), nesting + 1);
+      try {
+        for (const e of readdirSync(join12(d, "worktrees"), { withFileTypes: true })) {
+          if (e.isDirectory() && existsSync6(join12(d, "worktrees", e.name, "modules")))
+            tree(join12(d, "worktrees", e.name, "modules"), nesting + 1);
+        }
+      } catch {}
     }
-    for (const e of entries)
-      if (e.isDirectory())
-        walk(join12(dir, e.name), depth + 1);
   };
-  walk(modulesRoot, 0);
-  const entries = new Set([modulesRoot]);
-  for (const d of dirs)
-    for (let p = d;p.length > modulesRoot.length; p = dirname9(p))
-      entries.add(p);
-  return { root: modulesRoot, entries: [...entries] };
+  for (const modulesRoot of roots)
+    tree(modulesRoot, 0);
+  return trees;
 }
 function profile(cwd, network, readAllow = [], deny = [], readOnly = []) {
   const home = homedir4();
@@ -5911,6 +6017,7 @@ function profile(cwd, network, readAllow = [], deny = [], readOnly = []) {
   const root = realPath(cwd);
   const gitDirs = externalGitDirs(root);
   const moduleGit = moduleGitDirs(root);
+  const worktrees = worktreesRoot(root);
   const creds = [".ssh", ".aws", ".gnupg", ".config/gh", ".config/gcloud", ".kube", ".docker", ".netrc", ".npmrc", ".omniroute", ".claude", ".codex", ".kimi-code", "Library/Keychains"];
   const dev = developerDir();
   const readable = [root, ...HOME_READABLE.map((p) => join12(home, p)), ...readAllow.map(inHome), ...gitDirs, ...dev ? [dev] : []];
@@ -5937,7 +6044,7 @@ function profile(cwd, network, readAllow = [], deny = [], readOnly = []) {
     ...start,
     "(deny file-write*)",
     ...readOnly.length ? ['(allow file-write* (literal "/dev/null"))'] : [`(allow file-write* (subpath ${q(root)}) (regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`],
-    `(deny file-write* ${hubWriteRegexes(root, gitDirs, moduleGit).join(" ")})`,
+    `(deny file-write* ${hubWriteRegexes(root, gitDirs, moduleGit, worktrees).join(" ")})`,
     `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join12(home, c))})`).join(" ")})`,
     `(deny file-read* file-write* ${denyRegexes(root, deny).join(" ")})`,
     ...network ? [`(allow file-read* ${CA_BUNDLES.map((p) => `(literal ${q(p)})`).join(" ")} (regex ${q("/certifi/cacert\\.pem$")}))`, `(deny file-read* file-write* ${places})`] : []
@@ -6012,7 +6119,7 @@ function proxyEnv(network) {
   const url = `http://127.0.0.1:${network.proxyPort}`;
   return { HTTPS_PROXY: url, https_proxy: url, HTTP_PROXY: url, http_proxy: url, ALL_PROXY: url, all_proxy: url, NO_PROXY: "", no_proxy: "" };
 }
-var SANDBOX_EXEC = "/usr/bin/sandbox-exec", OUTPUT_CAP = 20000, sandboxAvailable = () => process.platform === "darwin" && existsSync6(SANDBOX_EXEC), q, HOME_READABLE, CA_BUNDLES, SYSTEM_READABLE, MACH_SERVICES, NETWORK_MACH_SERVICES, PROXY_MACH_SERVICES;
+var SANDBOX_EXEC = "/usr/bin/sandbox-exec", OUTPUT_CAP = 20000, sandboxAvailable = () => process.platform === "darwin" && existsSync6(SANDBOX_EXEC), q, HOME_READABLE, CA_BUNDLES, MODULE_DEPTH = 8, SYSTEM_READABLE, MACH_SERVICES, NETWORK_MACH_SERVICES, PROXY_MACH_SERVICES;
 var init_sandbox = __esm(() => {
   init_project();
   init_git();
@@ -6269,6 +6376,54 @@ import { randomUUID as randomUUID4 } from "crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync9 } from "fs";
 import { join as join14, resolve as resolve11 } from "path";
 import { spawn as spawn9 } from "child_process";
+function piVersionAsync(command, cwd, timeoutMs = 1e4) {
+  const [bin, ...prefix] = command;
+  if (!bin)
+    return Promise.resolve(assessVersion("pi", undefined));
+  return new Promise((resolve) => {
+    let proc;
+    try {
+      proc = spawn9(bin, [...prefix, "--version"], { cwd, env: peerChildEnv("pi"), detached: true, stdio: ["ignore", "pipe", "ignore"] });
+    } catch {
+      resolve(assessVersion("pi", undefined));
+      return;
+    }
+    let output = "", bytes = 0, done = false;
+    const finish = async (code) => {
+      if (done)
+        return;
+      done = true;
+      clearTimeout(timer);
+      try {
+        await stopOwnedProcess(proc, { group: true });
+      } catch {
+        resolve(assessVersion("pi", undefined));
+        return;
+      }
+      resolve(assessVersion("pi", code === 0 && bytes <= 64 * 1024 ? COMPAT.pi.parse(output) : undefined));
+    };
+    const timer = setTimeout(() => {
+      finish(null);
+    }, timeoutMs);
+    proc.once("spawn", () => trackGroup(proc));
+    proc.stdout.on("data", (chunk) => {
+      if (done)
+        return;
+      bytes += chunk.length;
+      if (bytes > 64 * 1024) {
+        finish(null);
+        return;
+      }
+      output += chunk.toString("utf8");
+    });
+    proc.once("error", () => {
+      finish(null);
+    });
+    proc.once("close", (code) => {
+      finish(code);
+    });
+  });
+}
 function ownerStillAlive(pid, signature) {
   const current = processSignature(pid);
   if (current !== undefined)
@@ -6280,11 +6435,12 @@ function ownerStillAlive(pid, signature) {
     return false;
   }
 }
-var PiToolSettlementFailure, PiPromptNotStarted, PiPromptUncertain, TERMINAL_OWNER_MAX_AGE_MS = 1000, PiPeer;
+var PiToolSettlementFailure, PiPromptNotStarted, PiPromptUncertain, PiVersionRefusal, TERMINAL_OWNER_MAX_AGE_MS = 1000, PiPeer;
 var init_pi = __esm(() => {
   init_launch();
   init_envelope();
   init_child_process();
+  init_compat();
   init_process_signature();
   init_session();
   init_tools();
@@ -6299,8 +6455,14 @@ var init_pi = __esm(() => {
   };
   PiPromptUncertain = class PiPromptUncertain extends Error {
   };
+  PiVersionRefusal = class PiVersionRefusal extends Error {
+    constructor(verdict) {
+      super(verdict.reason);
+    }
+  };
   PiPeer = class PiPeer extends BasePeer {
     opts;
+    preflight;
     hubNative = true;
     proc;
     server;
@@ -6367,9 +6529,10 @@ var init_pi = __esm(() => {
     tuiCommands = new Map;
     tuiQueue = [];
     tuiWaiters = [];
-    constructor(id, opts) {
+    constructor(id, opts, preflight) {
       super(id, opts.watchdogMs);
       this.opts = opts;
+      this.preflight = preflight;
     }
     get tuiLaunch() {
       return this._tuiLaunch;
@@ -6615,6 +6778,8 @@ var init_pi = __esm(() => {
       return Response.json({ decisions, ...reservation ? { reservation } : {} });
     }
     async startImpl() {
+      if (this.preflight)
+        await this.preflight();
       this.terminalOwnerObservation = undefined;
       this.stopping = false;
       this.rosterDetached = false;
@@ -10756,7 +10921,7 @@ import { randomUUID as randomUUID8 } from "crypto";
 import { lstatSync as lstatSync11, mkdtempSync as mkdtempSync5, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
 import { join as join17 } from "path";
-function claudeImplementerArgs(turn, mcp, settings, prompt) {
+function claudeImplementerArgs(turn, mcp, settings, prompt, model) {
   return [
     "-p",
     "--output-format",
@@ -10772,6 +10937,7 @@ function claudeImplementerArgs(turn, mcp, settings, prompt) {
     "",
     "--settings",
     settings,
+    ...model ? ["--model", model] : [],
     "--permission-mode",
     "default",
     "--permission-prompts",
@@ -11034,7 +11200,7 @@ var init_claude_implementer = __esm(() => {
           const child = new OwnedPrintChild({
             peer: this.id,
             command: this.command,
-            args: claudeImplementerArgs(turn, mcp, settings, this.options.systemPrompt),
+            args: claudeImplementerArgs(turn, mcp, settings, this.options.systemPrompt, this.options.model),
             cwd: this.options.cwd,
             input: group.envs.map(frame).join(`
 
@@ -11166,7 +11332,14 @@ function createPi(ctx) {
   if (ctx.permission === "read-only")
     throw new Error("Pi has no verified read-only permission mapping");
   init_pi();
-  return new PiPeer(ctx.instance, ctx.daemon.pi);
+  const options = ctx.daemon.pi;
+  return new PiPeer(ctx.instance, options, async () => {
+    const verdict = await piVersionAsync(options.cmd ?? ["pi"], options.cwd);
+    if (!verdict.ok)
+      throw new PiVersionRefusal(verdict);
+    if (verdict.note)
+      options.log?.(verdict.note);
+  });
 }
 function createLocal(ctx) {
   if (!("local" in ctx.daemon))
@@ -11273,9 +11446,9 @@ var init_reviewer_variants = __esm(() => {
   init_kimi_review();
   init_native_factories();
   init_native_display();
-  codexVariant = reviewerVariant("codex", "Codex reviewer", { backend: codexReviewerBackend, defaultPool: true, declaration: "explicit" }, CODEX_DISPLAY);
+  codexVariant = reviewerVariant("codex", "Codex reviewer", { backend: codexReviewerBackend, defaultPool: true, declaration: "explicit", scope: "code" }, CODEX_DISPLAY);
   CODEX_REVIEWER_VARIANT = { ...codexVariant, start: { ...codexVariant.start, create: createCodexReviewer } };
-  KIMI_REVIEWER_VARIANT = reviewerVariant("kimi", "Kimi reviewer", { backend: kimiReviewerBackend, defaultPool: true, declaration: "explicit" }, KIMI_DISPLAY);
+  KIMI_REVIEWER_VARIANT = reviewerVariant("kimi", "Kimi reviewer", { backend: kimiReviewerBackend, defaultPool: true, declaration: "explicit", scope: "code" }, KIMI_DISPLAY);
   AGY_REVIEWER_VARIANT = {
     ...reviewerVariant("agy", "agy reviewer", { defaultPool: false, declaration: "automatic", unavailable: "agy is an implementer peer (#485)" }, { palette: { fg: "#6558a6", bg: "#f1effa" } }),
     optional: true
@@ -12760,8 +12933,8 @@ var init_builtin_metadata = __esm(() => {
     trust: { onPrem: false, hubSandboxed: false },
     start: { create: createClaudeImplementer, daemonPort: "claude-implementer", forms: headlessForms, defaultForm: "headless", conductorStartable: true, hubSwitches: [], ownedFlags: [] },
     identity: { mcp: "env", currentChild: true },
-    instances: { mode: "headless", roles: ["implementer", "verifier"] },
-    permission: { grants: { ask: "every write, edit and shell command asks", "ask-when-needed": "file tools inside the owned worktree may run automatically; shell and protected paths ask" } },
+    instances: { mode: "headless", roles: ["implementer", "verifier"], modelSelect: true },
+    permission: { grants: { ask: "every write, edit and shell command asks", "ask-when-needed": "file tools, proven read-only shell commands and bound task commands inside the owned worktree may run automatically; protected paths and other commands ask" } },
     session: { idField: "sessionId", currentId: sessionId("sessionId"), freshOnRestore: false, launchKind: "claude-implementer", crashPlan: () => ({ resume: {}, how: "Claude implementer resumes its recorded per-task sessions" }) },
     turnEnd: "adapter",
     budget: { account: "claude" },
@@ -13681,7 +13854,8 @@ function assertNativeCapabilityScope(definition) {
     ["hooks.factsHook", declared(definition.hooks, "factsHook")],
     ["cli.entry", declared(definition.cli, "entry")],
     ["cli.preview", declared(definition.cli, "preview")],
-    ["cli.usage", declared(definition.cli, "usage")]
+    ["cli.usage", declared(definition.cli, "usage")],
+    ["instances.modelSelect", declared(definition.instances, "modelSelect")]
   ];
   const field = restricted.find(([, present]) => present)?.[0];
   if (field)
@@ -21491,6 +21665,11 @@ init_platform();
 init_store();
 init_shard();
 init_work_lists();
+init_capture();
+init_capture_input();
+init_config2();
+init_policy();
+init_private_spans();
 
 // node_modules/@staix/agent-mem/src/index.ts
 init_project2();
@@ -21502,7 +21681,7 @@ init_store();
 init_sync();
 init_project2();
 var AMEM_NAMES = { memory: "amem", goal: "amem goal" };
-var memoryUsage = (name = AMEM_NAMES.memory) => `usage: ${name} [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> [--history] [--as-of <UTC>] | show <id> [--history] [--as-of <UTC>] | graph <id|node> [--hops 1|2] [--history] [--as-of <UTC>] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] [--restart] | dedupe [--apply] | suggestions | confirm|reject <suggestion id>  [--json]`;
+var memoryUsage = (name = AMEM_NAMES.memory) => `usage: ${name} [list] [--tier short|long] [--kind <kind>] [--peer <p>] [--machine <id>] [--since <iso>] [--limit N] | search <words> [--history] [--as-of <UTC>] | show <id> [--history] [--as-of <UTC>] | graph <id|node> [--hops 1|2] [--history] [--as-of <UTC>] | promote|demote|forget <id> | supersede <old> <new> | rebuild | sync [--remote <url>] | machine [--label <name>] | import claude-mem [--db <path>] [--limit N] [--restart] [--capture-days N] | dedupe [--apply] | suggestions | confirm|reject <suggestion id>  [--json]`;
 var MEMORY_USAGE = memoryUsage();
 var goalUsage = (name = AMEM_NAMES.goal) => `usage: ${name} [list] [--all] | show <id> | new <title> [--milestone <text>]... [--depends <id>]... [--shared] | link <id> <task id> | state <id> open|active|blocked|done|dropped | done <id> | take <id> [--force]  [--json]`;
 var GOAL_USAGE = goalUsage();
@@ -21695,7 +21874,7 @@ init_sdlc_metrics();
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.18.0",
+  version: "0.19.0",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",
@@ -21712,7 +21891,7 @@ var package_default = {
     bun: ">=1.4.2"
   },
   dependencies: {
-    "@staix/agent-mem": "0.8.0"
+    "@staix/agent-mem": "0.10.0"
   },
   devDependencies: {
     "@modelcontextprotocol/sdk": "^1.27.1",
@@ -21774,6 +21953,9 @@ init_sdlc();
 init_envelope();
 var inFlight = new Set;
 
+// src/hub/review-scope.ts
+var isReviewScope = (value) => value === "full" || value === "code";
+
 // src/hub/tasks.ts
 init_review_findings();
 init_roles();
@@ -21915,7 +22097,8 @@ function validateInstances(raw, catalog) {
     const path = `instances.${id}`, entry = fields2(descriptor.value, path);
     const declaredKind = entry.kind?.value;
     const jcodeFields = typeof declaredKind === "string" && resolve(declaredKind)?.instances?.nativeHome === true;
-    if (Object.keys(entry).some((key) => !["kind", "roles", "start_mode", "permission_mode", "worktree", "review_mode", "readOnly", ...jcodeFields ? JCODE_FIELDS : []].includes(key)))
+    const modelSelect = typeof declaredKind === "string" && resolve(declaredKind)?.headlessVariant?.instances?.modelSelect === true;
+    if (Object.keys(entry).some((key) => !["kind", "roles", "start_mode", "permission_mode", "worktree", "review_mode", "readOnly", "review_scope", ...jcodeFields ? JCODE_FIELDS : [], ...modelSelect ? ["model"] : []].includes(key)))
       return fail4(path, "unsupported field");
     const kind = entry.kind?.value;
     if (typeof kind !== "string")
@@ -21990,6 +22173,21 @@ function validateInstances(raw, catalog) {
         return fail4("instances", `at most ${MAX_JCODE_INSTANCES} extra Jcode instances are supported per project`);
       Object.assign(value, jcodeInstanceFields(entry, path));
     }
+    if (entry.model && modelSelect) {
+      if (!headlessWriter)
+        return fail4(`${path}.model`, "only a headless implementer takes a model");
+      const word = entry.model.value;
+      if (typeof word !== "string" || !NATIVE_WORD.test(word))
+        return fail4(`${path}.model`, "must be one bounded printable word without spaces");
+      value.model = word;
+    }
+    if (entry.review_scope) {
+      if (!freshReviewer)
+        return fail4(`${path}.review_scope`, "only a fresh reviewer instance has a review scope");
+      if (!isReviewScope(entry.review_scope.value))
+        return fail4(`${path}.review_scope`, 'must be "code" or "full"');
+      value.review_scope = entry.review_scope.value;
+    }
     if (entry.readOnly)
       value.readOnly = entry.readOnly.value;
     if (entry.roles) {
@@ -30784,8 +30982,15 @@ async function callTool(req) {
     if (typeof args?.tool_name !== "string" || !/^[A-Za-z][A-Za-z0-9_.:/-]{0,127}$/.test(args.tool_name) || !args.input || typeof args.input !== "object" || Array.isArray(args.input) || typeof args.tool_use_id !== "string" || !args.tool_use_id.length || args.tool_use_id.length > 256)
       return deny("invalid native permission request");
     try {
-      const res = await hub.request({ t: "permission_request", tool: args?.tool_name, input: args?.input }, 3605000);
-      return res.ok === true && res.behavior === "allow" ? text5(JSON.stringify({ behavior: "allow", updatedInput: args?.input })) : deny(typeof res.message === "string" ? res.message : "permission denied");
+      const res = await hub.request({ t: "permission_request", tool: args?.tool_name, input: args?.input, wrapperProtocol: 1 }, 3605000);
+      if (res.ok !== true || res.behavior !== "allow")
+        return deny(typeof res.message === "string" ? res.message : "permission denied");
+      if (res.wrapperProtocol !== undefined && res.wrapperProtocol !== 1)
+        return deny("unsupported host execution response");
+      const updated = res.wrapperProtocol === 1 ? res.updatedInput : undefined;
+      if (res.wrapperProtocol === 1 && (args.tool_name !== "Bash" || !updated || typeof updated !== "object" || Array.isArray(updated) || typeof updated.command !== "string"))
+        return deny("invalid host execution response");
+      return text5(JSON.stringify({ behavior: "allow", updatedInput: updated ?? args?.input }));
     } catch {
       return deny("hub permission unavailable");
     }