@staix/agent-hub 0.20.0 → 0.21.0

package/docs/verification/claude-implementer-permission-triage.ts

@@ -0,0 +1,160 @@
+/** #544 opt-in diagnostic producer. It characterizes deliberate permission-push omission outside the regression suite. No installed Claude binary, account or model provider is used. */
+import { expect, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { COMPAT, assessVersion, trustFile, writeTrust } from "../../src/adapters/compat.ts";
+import { startDaemon, loadConfig } from "../../src/hub/daemon.ts";
+import { ControlClient } from "../../src/hub/control-client.ts";
+import { hubGitEnv, hubGitSync } from "../../src/hub/git.ts";
+import { hostExecutable } from "../../src/hub/host-executable.ts";
+import { realPath } from "../../src/hub/project.ts";
+import { shellQuote } from "../../src/cli/shell-quote.ts";
+import { taskShellCommand } from "../../src/hub/task-shell-command.ts";
+import { sandboxAvailable } from "../../src/local/sandbox.ts";
+import { runConsole, type ConsoleTerminal } from "../../src/cli/console.ts";
+
+// Keep testing the trusted-but-unverified path if a later native receipt verifies 2.1.312.
+const VERSION = COMPAT["claude-implementer"].verified.includes("2.1.312") ? "9999.0.0" : "2.1.312";
+const REPO_ROOT = resolve(import.meta.dir, "../..");
+const COMMAND = "bun test test/ci-watch.test.ts";
+async function until(check: () => boolean, label: string): Promise<void> {
+  for (let n = 0; n < 400 && !check(); n++) await new Promise<void>(done => setImmediate(done));
+  expect(check(), label).toBe(true);
+}
+async function withDeadline<T>(promise: Promise<T>, label: string): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(`triage barrier timed out: ${label}`)), 5000);
+    promise.then(value => { clearTimeout(timer); resolve(value); }, error => { clearTimeout(timer); reject(error); });
+  });
+}
+function deferred<T>() { let resolve!: (value: T) => void; const promise = new Promise<T>(done => { resolve = done; }); return { promise, resolve }; }
+async function fixture() {
+  const root = realPath(mkdtempSync(join(tmpdir(), "ahub-544-"))), hostBin = realPath(mkdtempSync(join(tmpdir(), "ahub-544-host-bin-")));
+  const peer = "claude-triage", tree = join(root, ".worktrees", peer), home = join(root, "home"), bin = join(root, "bin"), stateDir = join(root, ".agenthub", "state"), callFile = join(root, "fake-call.json");
+  const keys = ["HOME", "CLAUDE_CONFIG_DIR", "AGENTHUB_HOME", "AMEM_HOME", "PATH"] as const;
+  const previous = Object.fromEntries(keys.map(key => [key, process.env[key]]));
+  const clients: ControlClient[] = []; let daemon: Awaited<ReturnType<typeof startDaemon>> | undefined;
+  const close = async () => {
+    for (const client of clients) client.close();
+    await daemon?.stop();
+    for (const key of keys) { if (previous[key] === undefined) delete process.env[key]; else process.env[key] = previous[key]; }
+    rmSync(root, { recursive: true, force: true }); rmSync(hostBin, { recursive: true, force: true });
+  };
+  try {
+    mkdirSync(home); mkdirSync(bin); mkdirSync(stateDir, { recursive: true });
+    const git = hostExecutable("git", root, previous.PATH ?? "/usr/bin:/bin");
+    writeFileSync(join(hostBin, "git"), `#!/bin/sh\nexport GIT_CONFIG_SYSTEM=/dev/null\nexport GIT_CONFIG_GLOBAL=/dev/null\nexec ${shellQuote(git)} "$@"\n`, { mode: 0o700 });
+    const env = hubGitEnv({ ...process.env, HOME: home, PATH: `${hostBin}:${previous.PATH ?? "/usr/bin:/bin"}` }, { repositoryIsolation: true });
+    for (const args of [["init", "-q"], ["-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid", "commit", "--allow-empty", "-qm", "triage fixture"], ["worktree", "add", "-qb", "triage/worker", tree], ["remote", "add", "origin", "https://github.com/fixture/triage.git"]]) expect(hubGitSync(["-C", root, ...args], { encoding: "utf8", env }).status).toBe(0);
+    mkdirSync(join(tree, "test")); writeFileSync(join(tree, "test", "ci-watch.test.ts"), 'throw new Error("fixture command must not execute");\n');
+    writeFileSync(join(bin, "claude"), `#!${process.execPath}\nimport{writeFileSync,renameSync}from"node:fs";\nif(process.argv.includes("--version")){console.log(${JSON.stringify(VERSION + " (Claude Code)")});process.exit(0)}\nawait new Response(Bun.stdin.stream()).text();\nwriteFileSync(${JSON.stringify(callFile + ".tmp")},JSON.stringify({args:process.argv.slice(2),launchId:process.env.AGENTHUB_LAUNCH_ID,peer:process.env.AGENTHUB_PEER_ID}));renameSync(${JSON.stringify(callFile + ".tmp")},${JSON.stringify(callFile)});\nsetInterval(()=>{},1000);\n`, { mode: 0o700 });
+    Object.assign(process.env, { HOME: home, CLAUDE_CONFIG_DIR: join(home, "claude"), AGENTHUB_HOME: join(home, "hub"), AMEM_HOME: join(home, "memory"), PATH: `${bin}:${hostBin}:${previous.PATH ?? "/usr/bin:/bin"}` });
+    writeTrust("claude-implementer", VERSION, false, trustFile(join(home, "hub")));
+    writeFileSync(join(root, ".agenthub", "config.local.json"), JSON.stringify({ instances: { [peer]: { kind: "claude", roles: ["implementer"], start_mode: "headless", worktree: `.worktrees/${peer}`, permission_mode: "ask-when-needed" } }, roles: { [peer]: ["implementer"] }, roster: { [peer]: true }, memory: { enabled: false, native: false }, inference: { enabled: false }, mlx: { enabled: false }, snapshots: { enabled: false }, pi: { enabled: false, auto_start: false }, task_sweep: { enabled: false }, batch_ms: 0 }));
+    daemon = await startDaemon({ cwd: root, stateDir, config: loadConfig(root), controlPort: 0, codexAppPort: 0, codexProxyPort: 0, permissionTimeoutMs: 4000, agentDrift: false, shellDefaultBranchProbe: async () => "main" });
+    const person = await ControlClient.connect(stateDir, { role: "console", projectRoot: root }); clients.push(person);
+    const instanceId = (await person.request({ t: "status" })).status.instanceId;
+    expect(await person.request({ t: "start", peer })).toMatchObject({ ok: true, executionCwd: tree });
+    const proposed = await person.request({ t: "task", op: "hub_task_propose", args: { title: "isolated permission triage", class: "test", owner: peer } });
+    expect(proposed.ok).toBe(true); const task = Number(String(proposed.text).match(/task #(\d+)/)?.[1]); expect(task).toBeGreaterThan(0);
+    // The fake records before idling. This waits for its consumed stdin, never an installed native process.
+    for (let n = 0; n < 300 && !existsSync(callFile); n++) await Bun.sleep(5);
+    expect(existsSync(callFile)).toBe(true);
+    const call = JSON.parse(readFileSync(callFile, "utf8")) as { args: string[]; launchId: string; peer: string };
+    const tools = await ControlClient.connect(stateDir, { role: "tools", peer, launchId: call.launchId, projectRoot: root }); clients.push(tools);
+    expect(await tools.request({ t: "task", op: "hub_task_accept", args: { id: task } })).toMatchObject({ ok: true });
+    const connectPerson = async () => { const client = await ControlClient.connect(stateDir, { role: "console", projectRoot: root }); clients.push(client); return client; };
+    return { root, home, peer, tree, stateDir, person, tools, call, instanceId, close, connectPerson };
+  } catch (error) { await close(); throw error; }
+}
+
+const permissionPush = (client: ControlClient) => {
+  const pending = deferred<any>(), closed = deferred<any>(), pushes: any[] = [];
+  client.onPush = message => { pushes.push(message); if (message.t === "permission") pending.resolve(message); if (message.t === "permission_closed") closed.resolve(message); };
+  client.send({ t: "tail" });
+  return { pending: () => withDeadline(pending.promise, "permission push"), closed: () => withDeadline(closed.promise, "permission closure"), pushes };
+};
+
+// This proves host policy using a fake native and never redeems the issued shell ticket.
+test("#544 trusted unverified admission does not itself disable the closed host-wrapper permission path", async () => {
+  expect(assessVersion("claude-implementer", VERSION, [])).toMatchObject({ ok: false, state: "refused" });
+  expect(assessVersion("claude-implementer", VERSION, [{ id: "claude-implementer", version: VERSION, at: 1 }])).toMatchObject({ ok: true, state: "trusted" });
+  expect(taskShellCommand(COMMAND, { branch: "triage/worker", defaultBranch: "main" })?.kind).toBe("test");
+  const f = await fixture();
+  try {
+    expect(f.call.args[f.call.args.indexOf("--permission-mode") + 1]).toBe("default");
+    expect(f.call.args[f.call.args.indexOf("--permission-prompt-tool") + 1]).toBe("mcp__agent-hub__hub_permission_request");
+    expect(f.call.args).not.toContain("bypassPermissions"); expect(f.call.args).not.toContain("dontAsk");
+    const answer = await f.tools.request({ t: "permission_request", tool: "Bash", input: { command: COMMAND }, wrapperProtocol: 1 });
+    if (sandboxAvailable()) {
+      expect(answer).toMatchObject({ ok: true, behavior: "allow", wrapperProtocol: 1 });
+      expect(answer.updatedInput.command).not.toBe(COMMAND);
+    } else {
+      expect(answer).toMatchObject({ ok: true, behavior: "deny", message: "no person answered" });
+      expect(answer.updatedInput).toBeUndefined();
+    }
+  } finally { await f.close(); }
+}, 20_000);
+
+test("#544 real daemon pending approvals are pushed, replayed to a fresh console, then withdrawn on timeout", async () => {
+  const f = await fixture();
+  try {
+    const live = permissionPush(f.person);
+    const answer = f.tools.request({ t: "permission_request", tool: "Bash", input: { command: "pwd && pwd" }, wrapperProtocol: 1 }); void answer.catch(() => {});
+    const request = await live.pending();
+    expect(request).toMatchObject({ peer: f.peer, options: [{ optionId: "allow", name: "Allow once", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] });
+    expect((await f.person.request({ t: "ui_snapshot" })).permissions).toContainEqual(expect.objectContaining({ id: request.id, peer: f.peer }));
+    expect((await f.person.request({ t: "status" })).status.attentionItems).toContainEqual(expect.objectContaining({ kind: "approval", id: request.id, peer: f.peer, level: "act" }));
+    const late = await f.connectPerson(), replay = permissionPush(late);
+    expect((await replay.pending()).id).toBe(request.id);
+    expect(await answer).toMatchObject({ ok: true, behavior: "deny", message: "no person answered" });
+    expect(await live.closed()).toMatchObject({ id: request.id, outcome: "cancelled", reason: "expired" });
+    expect((await f.person.request({ t: "ui_snapshot" })).permissions).toEqual([]);
+    expect((await f.person.request({ t: "status" })).status.attentionItems.filter((item: { kind: string }) => item.kind === "approval")).toEqual([]);
+  } finally { await f.close(); }
+}, 20_000);
+
+test("#544 missing native tool_use_id denies in the production MCP channel before any daemon approval", async () => {
+  const f = await fixture(), observed = permissionPush(f.person); let client: Client | undefined;
+  try {
+    await f.person.request({ t: "status" }); // Same socket barrier: tail is registered before the test calls MCP.
+    const env = Object.fromEntries(Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined && !entry[0].startsWith("AGENTHUB_") && !["CLAUDECODE", "CLAUDE_CODE_SESSION_ID"].includes(entry[0])));
+    Object.assign(env, { HOME: f.home, CLAUDE_CONFIG_DIR: join(f.home, "claude"), AGENTHUB_HOME: join(f.home, "hub"), AMEM_HOME: join(f.home, "memory"), AGENTHUB_MODE: "tools", AGENTHUB_PERMISSION_TOOL: "1", AGENTHUB_PEER_ID: f.peer, AGENTHUB_PROJECT_DIR: f.root, AGENTHUB_STATE_DIR: f.stateDir, AGENTHUB_INSTANCE_ID: f.instanceId, AGENTHUB_LAUNCH_ID: f.call.launchId });
+    const transport = new StdioClientTransport({ command: process.execPath, args: [join(REPO_ROOT, "src", "adapters", "claude-channel.ts")], cwd: f.tree, env, stderr: "pipe" });
+    let diagnostics = ""; transport.stderr?.on("data", chunk => { diagnostics = (diagnostics + String(chunk)).slice(-16384); });
+    client = new Client({ name: "permission-triage-fixture", version: "1" }); await client.connect(transport);
+    for (let n = 0; n < 300 && !diagnostics.includes(`connected to hub as "${f.peer}"`); n++) await Bun.sleep(5);
+    expect(diagnostics).toContain(`connected to hub as "${f.peer}"`);
+    const schema = (await client.listTools()).tools.find(tool => tool.name === "hub_permission_request")!.inputSchema;
+    expect(schema.required).toEqual(["tool_name", "input", "tool_use_id"]);
+    const result = await client.callTool({ name: "hub_permission_request", arguments: { tool_name: "Bash", input: { command: COMMAND } } });
+    const content = result.content as { type: string; text?: string }[];
+    expect(JSON.parse(content.filter(row => row.type === "text").map(row => row.text).join("\n"))).toEqual({ behavior: "deny", message: "invalid native permission request" });
+    expect(observed.pushes.filter(message => message.t === "permission")).toEqual([]);
+    expect((await f.person.request({ t: "ui_snapshot" })).permissions).toEqual([]);
+    expect((await f.person.request({ t: "status" })).status.attentionItems.filter((item: { kind: string }) => item.kind === "approval")).toEqual([]);
+  } finally { await client?.close(); await f.close(); }
+}, 20_000);
+
+// Deliberately dropped push: this proves the UI's current information-source boundary,
+// not that a real WebSocket lost a message in the reported incident.
+test("#544 console status refresh alone cannot reconstruct a missed permission push, while a later push renders", async () => {
+  const root = mkdtempSync(join(tmpdir(), "ahub-544-console-")), output: string[] = [];
+  const id = "triage-approval", expiresAt = Date.now() + 60_000;
+  let input = (_text: string) => {}, signal = () => {}, statusReads = 0;
+  const terminal: ConsoleTerminal = { columns: 120, rows: 30, isTTY: true, write: text => { output.push(text); }, raw: () => {}, onData: listener => { input = listener; return () => {}; }, onResize: () => () => {}, onSignal: listener => { signal = listener; return () => {}; } };
+  const client = { onPush: (_message: any) => {}, onClose: (_code: number, _reason: string) => {}, send: (_message: any) => {}, close: () => {}, request: async (message: any) => {
+    if (message.t === "status") statusReads++;
+    return { ok: true, status: { peers: {}, attentionItems: [{ kind: "approval", level: "act", id, peer: "claude-triage", until: expiresAt }] }, budget: {}, text: "[]", deliveries: [] };
+  } };
+  const running = runConsole({ client, cwd: root, stateDir: root, terminal, panels: true, noPet: true, color: false });
+  try {
+    await until(() => statusReads >= 1, "initial positive status"); input("2"); await until(() => statusReads >= 2, "refresh after choosing approvals");
+    expect(output.join("")).toContain("0 approvals"); expect(output.join("")).not.toContain("TRIAGE-PENDING-BASH");
+    client.onPush({ t: "permission", id, peer: "claude-triage", title: "TRIAGE-PENDING-BASH", expiresAt, options: [{ optionId: "allow", name: "Allow once", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] });
+    expect(output.join("")).toContain("1 approval"); expect(output.join("")).toContain("TRIAGE-PENDING-BASH");
+  } finally { signal(); await running; rmSync(root, { recursive: true, force: true }); }
+});

package/docs/verification/claude-permission-transport-native.py

@@ -1,13 +1,26 @@
 # Model-free native receipt of the headless Claude permission transport (#843 AC5, task #507).
 # Repeats the case table of 2026-10-23-headless-claude-permissions.md on each installed binary given.
 # Usage: python3 claude-permission-transport-native.py OUTPUT --claude /absolute/claude [--claude ...]
-# No account, no provider, no model: a loopback server answers with a fixed Write tool call, then a completion.
-import argparse, hashlib, http.server, json, os, pathlib, signal, subprocess, threading, time
+# Default: nine Write cases. --tool Bash selects a harmless fixture writer; --rewrite-bash narrows Bash to two replacement cases.
+# No account, no provider, no model: a loopback server supplies the fixed tool call, then a completion.
+import argparse, hashlib, http.server, json, os, pathlib, re, shlex, signal, subprocess, threading, time
+
+def mcp_name(value):
+    if not re.fullmatch(r'[A-Za-z][A-Za-z0-9_-]{0,63}', value):
+        raise argparse.ArgumentTypeError('MCP names must be 1..64 ASCII letters, digits, underscores or hyphens, starting with a letter')
+    return value
+
 
 parser = argparse.ArgumentParser()
 parser.add_argument('output')
 parser.add_argument('--claude', action='append', required=True)
+parser.add_argument('--tool', choices=('Write', 'Bash'), default='Write')
+parser.add_argument('--rewrite-bash', action='store_true', help='Bash only: two allow/deny cases proving native updatedInput command replacement')
+parser.add_argument('--server-name', type=mcp_name, default='fixture')
+parser.add_argument('--permission-tool', type=mcp_name, default='approve')
+parser.add_argument('--require-tool-use-id', action='store_true', help='Advertise the three required production permission fields and reject extra properties')
 args = parser.parse_args()
+if args.rewrite_bash and args.tool != 'Bash': parser.error('--rewrite-bash requires --tool Bash')
 ROOT = pathlib.Path(args.output).resolve()
 ROOT.mkdir(mode=0o700, parents=False, exist_ok=False)
 
@@ -20,13 +33,22 @@ for line in sys.stdin:
     method, rid = q.get('method'), q.get('id')
     if rid is None: continue
     if method == 'initialize':
-        r = {'protocolVersion': '2024-11-05', 'capabilities': {'tools': {}}, 'serverInfo': {'name': 'fixture', 'version': '1'}}
+        r = {'protocolVersion': '2024-11-05', 'capabilities': {'tools': {}}, 'serverInfo': {'name': os.environ.get('SERVER_NAME', 'fixture'), 'version': '1'}}
     elif method == 'tools/list':
-        tools = [] if case == 'missing-tool' else [{'name': 'approve', 'description': 'Person approval fixture', 'inputSchema': {'type': 'object', 'properties': {'tool_name': {'type': 'string'}, 'input': {'type': 'object'}, 'tool_use_id': {'type': 'string'}}, 'required': ['tool_name', 'input']}}]
+        schema = {'type': 'object', 'properties': {'tool_name': {'type': 'string'}, 'input': {'type': 'object'}, 'tool_use_id': {'type': 'string'}}, 'required': ['tool_name', 'input']}
+        if os.environ.get('REQUIRE_TOOL_USE_ID') == '1':
+            schema['required'].append('tool_use_id'); schema['additionalProperties'] = False
+            schema['properties']['tool_name']['maxLength'] = 128; schema['properties']['tool_use_id']['maxLength'] = 256
+        tools = [] if case == 'missing-tool' else [{'name': os.environ.get('PERMISSION_TOOL', 'approve'), 'description': 'Person approval fixture', 'inputSchema': schema}]
         r = {'tools': tools}
     elif method == 'tools/call':
         args = q.get('params', {}).get('arguments', {})
-        with open(os.environ['RECEIPT'], 'a') as f: print(json.dumps({'arguments': args}), file=f)
+        record = {'arguments': args}
+        if os.environ.get('PERMISSION_TOOL') or os.environ.get('REQUIRE_TOOL_USE_ID') == '1': record['tool'] = q.get('params', {}).get('name')
+        rewrite = os.environ.get('REWRITE_COMMAND')
+        if rewrite:
+            record['response'] = {'behavior': 'allow', 'updatedInput': {**args.get('input', {}), 'command': rewrite}}
+        with open(os.environ['RECEIPT'], 'a') as f: print(json.dumps(record), file=f)
         if case == 'pending': time.sleep(120)
         if case == 'disconnect': sys.exit(1)
         if case == 'mcp-error':
@@ -35,7 +57,7 @@ for line in sys.stdin:
         if case in ('deny', 'hook-deny', 'deadline'):
             value = {'behavior': 'deny', 'message': 'no person answered' if case == 'deadline' else 'fixture denied'}
         else:
-            value = {'behavior': 'allow', 'updatedInput': args.get('input', {})}
+            value = record.get('response', {'behavior': 'allow', 'updatedInput': args.get('input', {})})
         r = {'content': [{'type': 'text', 'text': json.dumps(value)}]}
     else:
         r = {}
@@ -58,7 +80,7 @@ class Handler(http.server.BaseHTTPRequestHandler):
         msgs = q.get('messages', [])
         results = sum(1 for m in msgs if isinstance(m.get('content'), list) for x in m['content'] if isinstance(x, dict) and x.get('type') == 'tool_result')
         done = results >= 1
-        content = [{'type': 'text', 'text': 'Fixture finished.'}] if done else [{'type': 'tool_use', 'id': 'toolu_probe_0', 'name': 'Write', 'input': {'file_path': state['target'], 'content': 'probe'}}]
+        content = [{'type': 'text', 'text': 'Fixture finished.'}] if done else [{'type': 'tool_use', 'id': 'toolu_probe_0', 'name': state['tool'], 'input': state['input']}]
         result = {'id': 'msg_probe_%d' % results, 'type': 'message', 'role': 'assistant', 'model': 'claude-sonnet-4-5', 'content': content, 'stop_reason': 'end_turn' if done else 'tool_use', 'stop_sequence': None, 'usage': {'input_tokens': 100, 'output_tokens': 10}}
         if not q.get('stream'):
             self.send_response(200); self.send_header('Content-Type', 'application/json'); self.end_headers(); self.wfile.write(json.dumps(result).encode()); return
@@ -101,7 +123,7 @@ def rows(file):
     return [json.loads(line) for line in file.read_text().splitlines() if line] if file.exists() else []
 
 
-HOOK_FAIL = {'hooks': {'PreToolUse': [{'matcher': 'Write', 'hooks': [{'type': 'command', 'command': 'exit 1'}]}]}}
+HOOK_FAIL = {'hooks': {'PreToolUse': [{'matcher': args.tool, 'hooks': [{'type': 'command', 'command': 'exit 1'}]}]}}
 # case -> (settings, expected native exit, mcp calls, file written, tool_result is_error, external stop expected)
 CASES = {
     'allow':         ({}, 0, 1, True, False, False),
@@ -115,6 +137,7 @@ CASES = {
     'deadline':      ({}, 0, 1, False, True, False),
 }
 
+selected_cases = {case: value for case, value in CASES.items() if not args.rewrite_bash or case in ('allow', 'deny')}
 results = []
 for index, raw in enumerate(args.claude):
     binary = pathlib.Path(raw).resolve()
@@ -124,20 +147,42 @@ for index, raw in enumerate(args.claude):
     v = subprocess.run([str(binary), '--version'], env={'HOME': str(ident), 'CLAUDE_CONFIG_DIR': str(ident / 'config'), 'PATH': '/usr/bin:/bin'}, capture_output=True, text=True, timeout=10)
     assert v.returncode == 0, v
     version = v.stdout.strip().split()[0]
-    for case, (settings, want_exit, want_calls, want_file, want_error, want_stop) in CASES.items():
+    for case, (settings, want_exit, want_calls, want_file, want_error, want_stop) in selected_cases.items():
         d = ROOT / ('%d-%s-%s' % (index, version, case)); d.mkdir()
         home = d / 'home'; home.mkdir(); work = d / 'work'; work.mkdir(); work = work.resolve()
         target = work / 'probe.txt'
         out = {'version': version, 'binarySha256': digest, 'case': case}
+        if args.tool != 'Write': out.update(tool=args.tool, rewriteBash=args.rewrite_bash)
+        if args.server_name != 'fixture' or args.permission_tool != 'approve' or args.require_tool_use_id: out.update(serverName=args.server_name, permissionTool=args.permission_tool, requireToolUseId=args.require_tool_use_id)
         srv = native = None
         try:
+            harmless = 'printf %s probe > ' + shlex.quote(str(target))
+            tool_input = {'file_path': str(target), 'content': 'probe'} if args.tool == 'Write' else {'command': 'bun test test/ci-watch.test.ts' if args.rewrite_bash else harmless}
+            settings = dict(settings)
+            if args.tool == 'Bash': settings['permissions'] = {'ask': ['Bash']}
+            fixture_path = '/usr/bin:/bin'
+            original_marker = work / 'original-command-ran'
+            if args.rewrite_bash:
+                (work / 'test').mkdir()
+                (work / 'test' / 'ci-watch.test.ts').write_text('throw new Error("original command must not execute");\n')
+                (work / 'test' / 'ci-watch.test.ts').chmod(0o600)
+                fixture_bin = d / 'bin'; fixture_bin.mkdir(mode=0o700)
+                fake_bun = fixture_bin / 'bun'
+                fake_bun.write_text('#!/bin/sh\nprintf %s original > ' + shlex.quote(str(original_marker)) + '\nexit 97\n')
+                fake_bun.chmod(0o700)
+                fixture_path = str(fixture_bin.resolve()) + ':' + fixture_path
+            mcp_env = {'CASE': case, 'RECEIPT': str(d / 'mcp.jsonl')}
+            if args.server_name != 'fixture': mcp_env['SERVER_NAME'] = args.server_name
+            if args.permission_tool != 'approve': mcp_env['PERMISSION_TOOL'] = args.permission_tool
+            if args.require_tool_use_id: mcp_env['REQUIRE_TOOL_USE_ID'] = '1'
+            if args.rewrite_bash and case == 'allow': mcp_env['REWRITE_COMMAND'] = harmless
             srv = http.server.ThreadingHTTPServer(('127.0.0.1', 0), Handler)
-            srv.state = {'requests': 0, 'target': str(target), 'tools_file': str(d / 'tools.json')}
+            srv.state = {'requests': 0, 'target': str(target), 'tools_file': str(d / 'tools.json'), 'tool': args.tool, 'input': tool_input}
             threading.Thread(target=srv.serve_forever, daemon=True).start()
-            (d / 'mcp.json').write_text(json.dumps({'mcpServers': {'fixture': {'command': '/usr/bin/python3', 'args': [str(ROOT / 'mcp.py')], 'env': {'CASE': case, 'RECEIPT': str(d / 'mcp.jsonl')}}}}))
+            (d / 'mcp.json').write_text(json.dumps({'mcpServers': {args.server_name: {'command': '/usr/bin/python3', 'args': [str(ROOT / 'mcp.py')], 'env': mcp_env}}}))
             (d / 'settings.json').write_text(json.dumps(settings))
-            env = {'HOME': str(home), 'CLAUDE_CONFIG_DIR': str(home / 'config'), 'PATH': '/usr/bin:/bin', 'ANTHROPIC_BASE_URL': 'http://127.0.0.1:%d' % srv.server_port, 'ANTHROPIC_API_KEY': 'synthetic-probe-not-a-credential', 'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC': '1', 'DISABLE_AUTOUPDATER': '1'}
-            argv = [str(binary), '-p', '--output-format', 'stream-json', '--verbose', '--strict-mcp-config', '--mcp-config', str(d / 'mcp.json'), '--setting-sources', '', '--settings', str(d / 'settings.json'), '--permission-mode', 'default', '--permission-prompts', 'host', '--permission-prompt-tool', 'mcp__fixture__approve', '--model', 'claude-sonnet-4-5', 'Run the fixture write.']
+            env = {'HOME': str(home), 'CLAUDE_CONFIG_DIR': str(home / 'config'), 'PATH': fixture_path, 'ANTHROPIC_BASE_URL': 'http://127.0.0.1:%d' % srv.server_port, 'ANTHROPIC_API_KEY': 'synthetic-probe-not-a-credential', 'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC': '1', 'DISABLE_AUTOUPDATER': '1'}
+            argv = [str(binary), '-p', '--output-format', 'stream-json', '--verbose', '--strict-mcp-config', '--mcp-config', str(d / 'mcp.json'), '--setting-sources', '', '--settings', str(d / 'settings.json'), '--permission-mode', 'default', '--permission-prompts', 'host', '--permission-prompt-tool', 'mcp__%s__%s' % (args.server_name, args.permission_tool), '--model', 'claude-sonnet-4-5', 'Run the fixture write.' if args.tool == 'Write' else 'Run the fixture Bash command.']
             started = time.monotonic()
             native = subprocess.Popen(argv, cwd=work, env=env, stdout=open(d / 'stdout', 'w'), stderr=open(d / 'stderr', 'w'), start_new_session=True)
             stopped_externally = False
@@ -158,7 +203,14 @@ for index, raw in enumerate(args.claude):
             assert len(calls) == want_calls, ('mcp calls', calls)
             if want_calls:
                 call = calls[0]['arguments']
-                assert call['tool_name'] == 'Write' and call['input'] == {'file_path': str(target), 'content': 'probe'} and call['tool_use_id'] == 'toolu_probe_0', call
+                assert call['tool_name'] == args.tool and call['input'] == tool_input and call['tool_use_id'] == 'toolu_probe_0', call
+                if args.permission_tool != 'approve' or args.require_tool_use_id: assert calls[0]['tool'] == args.permission_tool, calls[0]
+                if args.rewrite_bash and case == 'allow':
+                    assert calls[0]['response'] == {'behavior': 'allow', 'updatedInput': {'command': harmless}}, calls[0]
+            if args.rewrite_bash:
+                out['originalCommandExecuted'] = original_marker.exists()
+                assert not original_marker.exists(), 'original bun command executed instead of the rewritten fixture writer'
+                assert tool_input == {'command': 'bun test test/ci-watch.test.ts'}, tool_input
             assert written == want_file, ('file written', written)
             # A successful native tool_result carries no is_error key at all; only a failed one sets it to true.
             if want_error is not None: assert [b.get('is_error') is True for b in tool_results] == [want_error], tool_results
@@ -177,11 +229,16 @@ for index, raw in enumerate(args.claude):
                 out['nativeGroupEmpty'] = empty_group(native.pid)
                 if not out['nativeGroupEmpty']: out.update(passed=False, cleanup='native group not established empty')
             if srv: srv.shutdown()
+            if args.rewrite_bash:
+                out['originalCommandExecuted'] = original_marker.exists()
+                if out['originalCommandExecuted']: out.update(passed=False, error='original bun command executed instead of the rewritten fixture writer')
             out['binaryUnchanged'] = sha(binary) == digest
             if not out['binaryUnchanged']: out.update(passed=False, error='native binary changed during probe')
         results.append(out)
         print(json.dumps(out), flush=True)
 receipt = {'cases': results, 'certified': all(r['passed'] for r in results), 'account': False, 'inference': False}
+if args.tool != 'Write': receipt.update(tool=args.tool, rewriteBash=args.rewrite_bash)
+if args.server_name != 'fixture' or args.permission_tool != 'approve' or args.require_tool_use_id: receipt.update(serverName=args.server_name, permissionTool=args.permission_tool, requireToolUseId=args.require_tool_use_id)
 (ROOT / 'receipt.json').write_text(json.dumps(receipt, indent=2))
 print(json.dumps({'receipt': str(ROOT / 'receipt.json'), 'certified': receipt['certified']}), flush=True)
 raise SystemExit(0 if receipt['certified'] else 1)

package/docs/verification/profiles/YYYY-MM-DD-research.md

@@ -25,7 +25,7 @@ Copy only emitted counts and anonymous task/claim slots. These placeholders rema
 - Missing check keys per run: unknown
 - Section-overlap notices and confirmed section edits: unknown
 
-Task-check history alone does not prove checks.fact_check ran. A model label or task approval alone does not prove a person verdict or agreement. Preserve every emitted null.
+Task-check history alone does not prove checks.fact_check ran; only entries that carry the hub's own `checkKey` do (#901), and an older keyless entry makes the group unknown. A model label or task approval alone does not prove a person verdict or agreement; a verdict is the person's `ahub task claim` entry, and agreement needs the model's own verdict entered with it. Preserve every emitted null.
 
 ## Verification verdicts
 

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -81,7 +81,7 @@
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -93,7 +93,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -117,7 +117,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -132,7 +132,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -205,7 +205,7 @@
       ]
     },
     "docs/agent-notes/local-worker.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "aeeaeb048860316dd4e08d84a658519ed6c0ad24",
       "paths": [
         "src/adapters/local-worker.ts",
         "src/local/",
@@ -217,7 +217,7 @@
       ]
     },
     "docs/agent-notes/models.md": {
-      "verifiedAgainst": "af22ee0dd9c6a1f4a5c5fc3f10fbfe4875350c1e",
+      "verifiedAgainst": "aeeaeb048860316dd4e08d84a658519ed6c0ad24",
       "paths": [
         "src/models/",
         "src/hub/inference.ts",
@@ -225,7 +225,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -264,7 +264,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -292,7 +292,7 @@
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "a9e2970da94d65cf5473bd9d3ddbe6193b9c3454",
+      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",
@@ -301,7 +301,7 @@
       ]
     },
     "src/cli/help.ts": {
-      "verifiedAgainst": "bc8a7f25f5ca93563bf1d43aca374b0c85560356",
+      "verifiedAgainst": "aeeaeb048860316dd4e08d84a658519ed6c0ad24",
       "paths": [
         "src/cli/main.ts",
         "src/cli/launch.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",
@@ -17,7 +17,7 @@
     "bun": ">=1.4.2"
   },
   "dependencies": {
-    "@staix/agent-mem": "0.11.0"
+    "@staix/agent-mem": "0.13.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",