@staix/agent-hub 0.20.0 → 0.22.0

package/src/cli/conductor-recovery.ts

@@ -0,0 +1,142 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { ControlClient, readControl } from "../hub/control-client.ts";
+import { loadConfig, type HubConfig } from "../hub/daemon.ts";
+import { captureRecoveryPolicy, readRecoveryPolicyInputs, type RecoveryPolicyInputs } from "../hub/recovery-policy.ts";
+import { authorizeConductorRecovery, assertConductorRecovery, retireConductorRecovery, RecoveryAuthorityError, type ConductorRecoveryBinding } from "../hub/recovery-authority.ts";
+import { operationPath } from "../hub/recovery-store.ts";
+import { readRestartSnapshot } from "../hub/restart.ts";
+import { processLiveness } from "../pi/process-signature.ts";
+import { packageDigest, recoveryTargetDigest } from "./recovery-package.ts";
+import type { Project } from "../hub/registry.ts";
+import { planFingerprint, registeredProjects, type RecoveryOperation, type UpgradePlan } from "./upgrade.ts";
+import { realPath } from "../hub/project.ts";
+
+function unavailable(): never { throw new RecoveryAuthorityError(); }
+function validateConductorOperation(op: RecoveryOperation): void {
+  try {
+    const { fingerprint, ...body } = op.plan;
+    if (op.schema !== 1 || !["restart", "upgrade"].includes(op.plan.kind) || planFingerprint(body) !== fingerprint || !op.plan.projects.length
+      || op.plan.projects.length > 128 || new Set(op.plan.projects.map(row => row.project.id)).size !== op.plan.projects.length) unavailable();
+  } catch { unavailable(); }
+}
+export function conductorRecoveryBinding(op: RecoveryOperation, project: Pick<Project, "root" | "id" | "stateDir">, peer: string,
+  captured?: { config: HubConfig; inputs: RecoveryPolicyInputs }): ConductorRecoveryBinding {
+  validateConductorOperation(op);
+  const planned = op.plan.projects.find(row => row.project.id === project.id);
+  if (!planned?.source.instanceId || op.plan.projects.some(row => row.terminals.length > 0) || !op.targetRoot || !op.targetDigest || !op.targetFeatures?.includes("conductor_recovery") || op.disposition || op.audit?.length || op.freshOverride) unavailable();
+  const inputs = captured?.inputs ?? readRecoveryPolicyInputs(project.root, op.conductorRoutingDefaults?.[project.id]);
+  const candidate = captured?.config ?? loadConfig(project.root, inputs.layers, inputs.routing.retired ?? [], []);
+  const policy = captureRecoveryPolicy(project, peer, candidate, inputs);
+  return { schema: 1, operationId: op.id, peer, kind: op.plan.kind, projectId: project.id, projectRoot: project.root, stateDir: project.stateDir,
+    sourceInstanceId: planned.source.instanceId, targetRoot: op.targetRoot, targetDigest: op.targetDigest, planFingerprint: op.plan.fingerprint, ...policy };
+}
+export async function conductorRecoveryRequest(project: Project, peer: string, message: Record<string, unknown>): Promise<any> {
+  let client: ControlClient | undefined;
+  try {
+    const descriptor = readControl(project.stateDir);
+    if (!descriptor?.instanceId || !descriptor.features?.includes("conductor_recovery")) unavailable();
+    client = await ControlClient.connect(project.stateDir, { role: "tools", peer, projectId: project.id, projectRoot: project.root, instanceId: descriptor.instanceId });
+    if (!client.features.includes("conductor_recovery")) unavailable();
+    const result = await client.request(message, 30_000);
+    if (result.ok !== true) unavailable();
+    return result;
+  } catch { unavailable(); }
+  finally { client?.close(); }
+}
+/** No hold, lock, staging or package effect precedes proof in every affected project. */
+export async function preflightConductorRecovery(plan: Pick<UpgradePlan, "projects" | "kind">, peer: string): Promise<Record<string, string>> {
+  const defaults: Record<string, string> = {};
+  if (!Array.isArray(plan.projects) || !plan.projects.length || plan.projects.some(row => !Array.isArray(row.terminals) || row.terminals.length > 0)) unavailable();
+  for (const row of plan.projects) {
+    const result = await conductorRecoveryRequest(row.project, peer, { t: "recovery_authority", op: "authorize", command: plan.kind });
+    if (row.source.instanceId && result.instanceId !== row.source.instanceId) unavailable();
+    if (result.routingDefault !== undefined) {
+      if (typeof result.routingDefault !== "string" || Buffer.byteLength(result.routingDefault) > 1024 * 1024) unavailable();
+      defaults[row.project.id] = result.routingDefault;
+    }
+  }
+  return defaults;
+}
+/** This is called only before the new public receipt exists; resume can never mint a grant. */
+export async function issueConductorOperation(op: RecoveryOperation, peer: string): Promise<void> {
+  if (existsSync(operationPath(op.id))) unavailable();
+  await preflightConductorRecovery(op.plan, peer);
+  for (const row of op.plan.projects) {
+    const binding = conductorRecoveryBinding(op, row.project, peer);
+    await conductorRecoveryRequest(row.project, peer, { t: "recovery_authority", op: "issue", binding, plan: op.plan });
+  }
+  // A positive transport reply is not a source-issued grant. Prove every durable record before the public lock.
+  await authorizeConductorOperation(op, peer);
+}
+function localAuthority(op: RecoveryOperation, project: Project, peer: string) {
+  try {
+  const expected = conductorRecoveryBinding(op, project, peer);
+  if (packageDigest(op.sourceRoot, { ownDependencies: true }) !== op.plan.sourceDigest || recoveryTargetDigest(op.plan.kind, expected.targetRoot) !== expected.targetDigest) unavailable();
+  return authorizeConductorRecovery(project.stateDir, expected, () => {
+    try { return JSON.stringify(conductorRecoveryBinding(op, project, peer)) === JSON.stringify(expected); } catch { return false; }
+  });
+  } catch { unavailable(); }
+}
+/** Synchronous fence for the already authenticated private bootstrap's local effect boundaries. */
+export function assertConductorOperationLocal(op: RecoveryOperation, peer: string): void {
+  validateConductorOperation(op);
+  for (const row of op.plan.projects) assertConductorRecovery(localAuthority(op, row.project, peer));
+}
+export async function authorizeConductorOperation(op: RecoveryOperation, peer: string): Promise<void> {
+  validateConductorOperation(op);
+  const proofs = [];
+  for (const row of op.plan.projects) {
+    const proof = localAuthority(op, row.project, peer);
+    proofs.push(proof);
+    const descriptor = readControl(row.project.stateDir);
+    if (descriptor) {
+      if (!descriptor.pid || !descriptor.pidSignature) unavailable();
+      const live = processLiveness(descriptor.pid, descriptor.pidSignature);
+      if (live !== "gone") {
+        if (live !== "live") unavailable();
+        await conductorRecoveryRequest(row.project, peer, { t: "recovery_authority", op: "verify", binding: proof.binding });
+      } else requireConductorCheckpoint(op, row.project);
+    } else requireConductorCheckpoint(op, row.project);
+    assertConductorRecovery(proof);
+  }
+  // A can change while B answers: every project is checked again after the last await.
+  for (const proof of proofs) assertConductorRecovery(proof);
+}
+export async function requireOwnedConductorTarget(op: RecoveryOperation, project: Project, peer: string): Promise<void> {
+  const binding = conductorRecoveryBinding(op, project, peer);
+  const result = await conductorRecoveryRequest(project, peer, { t: "recovery_authority", op: "verify", binding });
+  if (result.target !== true || result.operationId !== op.id || !["restored", "released"].includes(result.phase)) unavailable();
+}
+export function requireConductorCheckpoint(op: RecoveryOperation, project: Project): void {
+  try {
+    const snapshot = readRestartSnapshot(project.stateDir, { projectRoot: project.root, projectId: project.id, operationId: op.id });
+    if (!snapshot || snapshot.operationId !== op.id || snapshot.sourceInstanceId !== op.plan.projects.find(row => row.project.id === project.id)?.source.instanceId) unavailable();
+  } catch { unavailable(); }
+}
+export function retireConductorOperation(op: RecoveryOperation, peer: string): void {
+  if (op.phase !== "completed" && op.phase !== "cancelled") unavailable();
+  for (const row of op.plan.projects) retireConductorRecovery(localAuthority(op, row.project, peer));
+}
+/** Private launcher continuation, only the reviewed target and a captured effect, never arbitrary console argv. */
+export async function authorizeConductorLaunch(op: RecoveryOperation, peer: string, root: string, targetRoot: string, command: string, args: readonly string[]): Promise<void> {
+  if (!["pending", "running", "blocked"].includes(op.phase)) unavailable();
+  await authorizeConductorOperation(op, peer);
+  if (!op.targetRoot || realPath(targetRoot) !== realPath(op.targetRoot)) unavailable();
+  const planned = op.plan.projects.find(row => row.project.root === root);
+  if (!planned) unavailable();
+  if ((command === "up" || command === "daemon") && args.length === 0) {
+    const descriptor = readControl(planned.project.stateDir);
+    if (descriptor && processLiveness(descriptor.pid, descriptor.pidSignature) !== "gone") unavailable();
+    const claim = registeredProjects().find(row => row.id === planned.project.id);
+    if (!claim || claim.root !== root || claim.stateDir !== planned.project.stateDir
+      || claim.pid !== null && processLiveness(claim.pid, claim.pidSignature) !== "gone"
+      || claim.pid === null && claim.instanceId !== null) unavailable();
+    requireConductorCheckpoint(op, planned.project); return;
+  }
+  if (command === "setup" && op.plan.kind === "upgrade" && args.length === 1 && args[0] === "--yes") {
+    for (const row of op.plan.projects) await requireOwnedConductorTarget(op, row.project, peer);
+    await authorizeConductorOperation(op, peer); return;
+  }
+  unavailable();
+}

package/src/cli/configured-acp-entry.ts

@@ -1,12 +1,14 @@
 import type { ProjectAdapterCatalog } from "../adapters/registry.ts";
+import { externalInstanceCatalog, type ExternalInstanceCatalog } from "../adapters/external-metadata.ts";
+import type { DeclaredExternalInstance } from "../hub/instance-config.ts";
 import type { InstancesConfig } from "../hub/instances.ts";
 import { requireActiveInstance, requirePeerInstances } from "./launch.ts";
 import { configuredAcpPreview } from "./preview.ts";
 
 export interface ConfiguredAcpSelection { peer: string; mode: "headless"; sessionId?: string; preview: boolean }
-export function parseConfiguredAcpArguments(kind: string, raw: readonly string[], catalog: ProjectAdapterCatalog, instances?: InstancesConfig): ConfiguredAcpSelection {
+export function parseConfiguredAcpArguments(kind: string, raw: readonly string[], catalog: ProjectAdapterCatalog, instances?: InstancesConfig, declaredExternalInstances: readonly DeclaredExternalInstance[] = []): ConfiguredAcpSelection {
   const definition = catalog.definitionOf(kind);
-  if (!definition?.permission.genericAcp) throw new Error("unknown configured ACP kind");
+  if (!definition?.permission.genericAcp && !declaredExternalInstances.some(row => row.kind === kind)) throw new Error("unknown configured ACP kind");
   const values = new Map<string, string>();
   let preview = false;
   for (let index = 0; index < raw.length; index++) {
@@ -20,21 +22,35 @@ export function parseConfiguredAcpArguments(kind: string, raw: readonly string[]
   }
   if (values.has("--mode") && values.get("--mode") !== "headless") throw new Error("configured ACP supports headless only");
   const peer = values.get("--as") ?? kind;
-  if (values.has("--as") && (!instances || !Object.hasOwn(instances, peer) || instances[peer]?.kind !== kind || !catalog.definitionOf(peer, instances))) throw new Error("--as must name a declared instance of this configured kind");
+  const executable = !!instances && Object.hasOwn(instances, peer) && instances[peer]?.kind === kind && !!catalog.definitionOf(peer, instances);
+  const declaredOnly = declaredExternalInstances.some(row => row.id === peer && row.kind === kind && row.availability === "declared-unknown" && row.refusalCode === "catalog-unavailable");
+  // Inert declarations select a preview or request id only; live daemon admission remains mandatory.
+  if (values.has("--as") && !executable && !declaredOnly) throw new Error("--as must name a declared instance of this configured kind");
   return { peer, mode: "headless", ...(values.has("--session-id") ? { sessionId: values.get("--session-id")! } : {}), preview };
 }
 export interface ConfiguredAcpControl {
   features: readonly string[];
+  readonly instanceId?: string;
+  readonly isOpen?: boolean;
+  readExternalInstanceCatalog?(projectRoot: string): Promise<ExternalInstanceCatalog>;
   request(message: Record<string, unknown>, timeout?: number): Promise<any>;
   close(): void;
 }
-export async function requireActiveConfiguredAcp(hub: ConfiguredAcpControl, kind: string, peer: string, warn?: (text: string) => void): Promise<void> {
+export async function requireActiveConfiguredAcp(hub: ConfiguredAcpControl, kind: string, peer: string, warn?: (text: string) => void, external?: { projectRoot: string }): Promise<void> {
   if (!hub.features.includes("configured_acp")) throw new Error("running hub lacks configured_acp; upgrade and restart it first");
   if (peer !== kind) requirePeerInstances(hub.features);
+  const epoch = hub.instanceId;
+  if (external && (!epoch || hub.isOpen !== true || !hub.readExternalInstanceCatalog || !["external_adapter_instances", "external_adapter_modules", "peer_instances"].every(feature => hub.features.includes(feature)))) throw new Error("running hub lacks a live external instance catalog");
   const reply = await hub.request({ t: "status" });
   const active = reply.status?.configuredAdapters;
   if (!Array.isArray(active) || !active.includes(kind)) throw new Error(`running hub has not loaded ${kind}; restart it after declaring the adapter`);
   if (peer !== kind) requireActiveInstance(reply.status, peer);
+  if (external) {
+    const observed = externalInstanceCatalog(await hub.readExternalInstanceCatalog!(external.projectRoot));
+    const row = observed.instances.find(row => row.id === peer);
+    if (hub.isOpen !== true || hub.instanceId !== epoch || reply.status?.instanceId !== epoch || reply.status?.cwd !== external.projectRoot
+      || observed.epoch !== epoch || observed.projectRoot !== external.projectRoot || !row || row.kind !== kind || !["ready", "offline"].includes(row.availability)) throw new Error("external instance is not bound to the current live catalog");
+  }
   const namespace = `adapters.${kind}`;
   const retained = [reply.status?.retainedConfig, reply.status?.pendingRestart].some(rows => Array.isArray(rows) && rows.some(row => {
     const key = row && typeof row === "object" ? row.key : undefined;
@@ -44,13 +60,17 @@ export async function requireActiveConfiguredAcp(hub: ConfiguredAcpControl, kind
 }
 export async function runConfiguredAcpEntry(context: {
   kind: string; raw: readonly string[]; catalog: ProjectAdapterCatalog; instances?: InstancesConfig;
+  declaredExternalInstances?: readonly DeclaredExternalInstance[]; projectRoot?: string;
   connect(): Promise<ConfiguredAcpControl>; print(text: string): void; operationId?: string;
 }): Promise<void> {
-  const selected = parseConfiguredAcpArguments(context.kind, context.raw, context.catalog, context.instances);
+  const selected = parseConfiguredAcpArguments(context.kind, context.raw, context.catalog, context.instances, context.declaredExternalInstances);
   if (selected.preview) { context.print(JSON.stringify(configuredAcpPreview(context.kind, selected.peer, selected.sessionId !== undefined), null, 2)); return; }
   const hub = await context.connect();
   try {
-    await requireActiveConfiguredAcp(hub, context.kind, selected.peer, context.print);
+    const external = selected.peer !== context.kind && (context.declaredExternalInstances?.some(row => row.id === selected.peer && row.kind === context.kind)
+      || context.catalog.externalDefinitions.some(definition => definition.kind === context.kind));
+    if (external && !context.projectRoot) throw new Error("external instance start requires the canonical project root");
+    await requireActiveConfiguredAcp(hub, context.kind, selected.peer, context.print, external ? { projectRoot: context.projectRoot! } : undefined);
     const reply = await hub.request({ t: "start", peer: selected.peer, args: { mode: "headless", ...(selected.sessionId ? { sessionId: selected.sessionId } : {}) }, ...(context.operationId ? { operationId: context.operationId } : {}) }, 70_000);
     if (!reply.ok) throw new Error(typeof reply.error === "string" ? reply.error : "configured ACP start refused");
     context.print(reply.already ? `${selected.peer} is already attached` : `${selected.peer} attached (headless); use ahub say @${selected.peer} and the console for approvals`);

package/src/cli/console-state.ts

@@ -6,12 +6,15 @@ import { PLANNER_PEERS, definitionOf, nativeStreamTone, createProjectAdapterCata
 import { taskProgress } from "../ui/task-progress.ts";
 import type { ProgressStage } from "../ui/task-progress.ts";
 import { sanitize } from "../hub/envelope.ts";
+import { DOING_STUB } from "../hub/peer-doing.ts";
 import type { SettingRow, SettingValue } from "../hub/settings.ts";
 import { symbolFields, overlapFields } from "./console-symbols.ts";
 import { choicePrompt, reviewChoiceFor, reviewHint, reviewRefusal, verdictGuide, verdictInput, type ReviewChoice, type Verdict } from "./console-review.ts";
 import { configFormPrompt, reduceConfigForm, type ConfigEditBody, type ConfigForm } from "./console-config.ts";
 import { windowKind } from "../hub/window-kind.ts";
+import { ownerIsolationText, taskHolderText } from "./role-holders.ts";
 import { USAGE_DROP, USAGE_HEAD, usageCells, usageDetail, usagePeers, usageTaskLines, type UsageState } from "./console-usage.ts";
+import type { RoomStatusView } from "../rooms/status.ts";
 
 export interface Approval {
   id: string; peer: string; title: string; expiresAt: number;
@@ -55,6 +58,8 @@ export interface ConsoleState {
   taskSelection?: number; queueSelection?: string;
   /** #683 U3: the Usage panel (7): what the `usage` op last answered, and the task that was selected in Tasks when the panel was opened. */
   usage?: UsageState; usageTask?: number;
+  /** Absent on older hubs, null when the current hub cannot report room status. */
+  rooms?: RoomStatusView[] | null; roomSelection?: string;
   actionLock?: { prefix: string[]; id: string; revision: number; state: string; owner?: string; reserved?: string; reviewer?: string; waiting?: boolean; syntax?: "planning" | "ownerless-return"; revisionField?: "planningRevision" | "flowRevision" };
   confirm?: { type: "permission"; id: string; option: string; peer: string } | { type: "command"; args: string[]; prompt?: string; lock?: ConsoleState["actionLock"] } | { type: "permission_default"; peer: string; source: string };
   optionChoice?: string;
@@ -66,6 +71,7 @@ export interface ConsoleState {
   permissionDefaults: PermissionDefault[];
   permissionDefaultsHandled: string[];
 }
+const roomsVisible = (s: Pick<ConsoleState, "rooms">) => s.rooms === null || Array.isArray(s.rooms) && s.rooms.length > 0;
 /** A detail view: text as the stream shows it, or labeled fields. */
 export type Detail = string | Record<string, unknown>;
 export type ConsoleEffect = { type: "exit" } | { type: "permit"; id: string; option?: string } |
@@ -330,7 +336,8 @@ function fieldLines(fields: [string, unknown][], columns: number, now: number):
  * raw observation and `symbolOverlaps` is the hub pair projection; formatted blocks replace both raw fields.
  */
 function taskFields(detail: Record<string, unknown>): [string, unknown][] {
-  const fields = Object.entries(detail).filter(([key]) => key !== "codeSymbols" && key !== "symbolOverlaps");
+  const fields = Object.entries(detail).filter(([key]) => !["codeSymbols", "symbolOverlaps", "plannerReason", "reviewerReason", "ownerReason", "sameFamilyFallback"].includes(key))
+    .map(([key, value]): [string, unknown] => [key, key === "planner" || key === "owner" || key === "reviewer" ? taskHolderText(detail, key) : value]);
   const block = [...symbolFields(detail), ...overlapFields(detail)];
   if (!block.length) return fields;
   const at = fields.findIndex(([key]) => key === "plan");
@@ -353,7 +360,8 @@ export function budgetFields(budget: any, now: number): [string, unknown][] {
 function peerDetailRow(s: ConsoleState, row: any): Record<string, unknown> {
   const wip = s.taskWip?.[row.id];
   const split = wip && [wip.active, wip.reviewWait, wip.reserved].every(n => Number.isSafeInteger(n)) ? `${wip.wip} of ${wip.wipLimit}: active ${wip.active}, review-wait ${wip.reviewWait}, reserved ${wip.reserved}` : undefined;
-  return { ...row, ...(split ? { "planner WIP": split } : {}) };
+  const isolation = ownerIsolationText(row.ownerIsolation, row.ownerIsolationNote);
+  return { ...row, ...(isolation ? { ownerIsolation: isolation } : {}), ...(split ? { "planner WIP": split } : {}) };
 }
 const detailLines = (detail: Detail, columns: number, now: number, task = false): Span[][] => {
   if (typeof detail === "string") return wrap(detail, columns).map(text => [span(text)]);
@@ -397,9 +405,9 @@ const KEYS: [string, string[]][] = [
   ["Usage", ["7 Usage panel", "Enter view a peer", "tokens today/7d/lifetime with sources", "task from Tasks (3)"]],
 ];
 /** The `?` key table: one group per panel, its keys kept whole and packed into the width after the group column. */
-export function keyTable(columns: number, attention = false, characters = false): Span[][] {
+export function keyTable(columns: number, attention = false, characters = false, roomsAvailable = false): Span[][] {
   const lines: Span[][] = []; const pad = 12;
-  for (const [group, items] of [...KEYS, ...(attention ? [[characters ? "Pet" : "Attention", ["n next need", characters ? "P next character/off" : "P STAI/off"]] as [string, string[]]] : [])]) {
+  for (const [group, items] of [...KEYS, ...(roomsAvailable ? [["Rooms", ["8 Rooms panel (read only)", "j/k move", "Enter details"]] as [string, string[]]] : []), ...(attention ? [[characters ? "Pet" : "Attention", ["n next need", characters ? "P next character/off" : "P STAI/off"]] as [string, string[]]] : [])]) {
     let text = ""; let head = group;
     const flush = () => { lines.push([span(head.padEnd(pad), head ? "info" : undefined), span(text)]); head = ""; text = ""; };
     for (const item of items) { if (text && pad + Bun.stringWidth(`${text}   ${item}`) > columns) flush(); text = text ? `${text}   ${item}` : item; }
@@ -449,6 +457,7 @@ export function commandNeedsConfirmation(args: string[]): boolean {
 }
 export function panelRows(s: ConsoleState): any[] {
   if (s.panel === 1) return Object.entries(s.peers).map(([id, peer]) => ({ id, ...peer, budget: s.budget[id] }));
+  if (s.panel === 8) return s.rooms ?? [];
   if (s.panel === 2) return s.approvals;
   if (s.panel === 3) {
     if (s.backlogView) return s.tasks.filter(t => t.state === "backlog").sort((a, b) => (a.rank ?? Number.MAX_SAFE_INTEGER) - (b.rank ?? Number.MAX_SAFE_INTEGER) || a.id - b.id);
@@ -475,6 +484,7 @@ const selection = (s: ConsoleState) => {
   if (s.panel === 2) return s.approvals.findIndex(a => a.id === s.approvalId);
   if (s.panel === 3 && s.taskSelection !== undefined) return panelRows(s).findIndex(row => row.id === s.taskSelection);
   if (s.panel === 4 && s.queueSelection !== undefined) return panelRows(s).findIndex(row => row.id === s.queueSelection);
+  if (s.panel === 8 && s.roomSelection !== undefined) return panelRows(s).findIndex(row => row.name === s.roomSelection);
   return s.selection;
 };
 export const selectedPanelRow = (s: ConsoleState): any | undefined => panelRows(s)[selection(s)];
@@ -482,6 +492,7 @@ export function captureConsoleSelection(s: ConsoleState, byIndex = false): void
   const row = byIndex ? panelRows(s)[s.selection] : selectedPanelRow(s);
   if (s.panel === 3 && row) s.taskSelection = Number(row.id);
   if (s.panel === 4 && row) s.queueSelection = String(row.id);
+  if (s.panel === 8 && row) s.roomSelection = String(row.name);
 }
 const commandFlag = (args: string[], name: string) => { const at = args.indexOf(name); return at < 0 ? undefined : args[at + 1]; };
 function validateLockedCommand(lock: NonNullable<ConsoleState["actionLock"]>, args: string[]): void {
@@ -704,8 +715,9 @@ export function reduceConsole(state: ConsoleState, key: string, now = Date.now()
     // The task selected in Tasks is the one the Usage panel shows; switchPanel clears that selection, so it is read first (#683 U3).
     // With no valid selected row (an empty Tasks panel) the old task is cleared, never kept: the panel must not show a task that is no longer the selection.
     if (panel === 7 && s.panel === 3) { const task = selectedPanelRow(s); s.usageTask = task && Number.isSafeInteger(Number(task.id)) && Number(task.id) > 0 ? Number(task.id) : undefined; }
-    s.panel = panel; s.selection = panel === 5 ? newestEvent(s) : 0; s.taskSelection = undefined; s.queueSelection = undefined; s.detail = undefined; s.requestDetail = undefined; return done(); };
+    s.panel = panel; s.selection = panel === 5 ? newestEvent(s) : 0; s.taskSelection = undefined; s.queueSelection = undefined; s.roomSelection = undefined; s.detail = undefined; s.requestDetail = undefined; return done(); };
   if (s.mode === "panels" && /^[1-7]$/.test(key) && !s.optionChoice) return switchPanel(Number(key));
+  if (s.mode === "panels" && key === "8" && !s.optionChoice && roomsVisible(s)) return switchPanel(8);
   // Right and Left are the digit of the next or previous tab, wrapping at both ends (#309); the same guards as the
   // digits apply (the confirm, mode-choice, key-table and editing branches above returned already).
   if (s.mode === "panels" && (key === "\x1b[C" || key === "\x1b[D") && !s.optionChoice) return switchPanel(s.panel >= 6 ? key === "\x1b[C" ? 1 : 5 : (s.panel + (key === "\x1b[C" ? 0 : 3)) % 5 + 1);
@@ -801,6 +813,7 @@ export function reduceConsole(state: ConsoleState, key: string, now = Date.now()
     if (s.panel === 3 || s.panel === 4) effects.push({ type: "show", panel: s.panel, id: String(row.id) });
     else if (s.panel === 2) { s.requestDetail = row.id; s.detailOffset = 0; } // the row is the selected request
     else if (s.panel === 7) { s.detail = { usagePeer: row.id }; s.detailOffset = 0; } // rendered live from s.usage, so a refresh updates it
+    else if (s.panel === 8) { s.roomSelection = row.name; s.detail = { roomName: row.name }; s.detailOffset = 0; }
     else { s.detail = s.panel === 5 ? String(row.text) : s.panel === 1 ? peerDetailRow(s, row) : { ...row }; s.detailOffset = 0; }
     return done();
   }
@@ -892,12 +905,13 @@ export function activeNotice(s: Pick<ConsoleState, "notice" | "noticeAt">, now =
   return !!s.notice && now - (s.noticeAt ?? now) < NOTICE_MS;
 }
 export const TABLES: Record<number, string[]> = {
-  1: ["PEER", "STATE", "LINK", "Q", "!", "WIP", "REVIEW", "PAUSE", "QUOTA", "MODEL"],
+  1: ["PEER", "STATE", "LINK", "Q", "!", "WIP", "REVIEW", "PAUSE", "QUOTA", "MODEL", "DOING"],
   2: ["ID", "PEER", "LEFT", "TITLE"],
   3: ["ID", "STATE", "OWNER", "REVIEWER", "CLASS", "AGE", "TITLE", "STAGE"],
   4: ["ID", "PEER", "STATE", "REV", "AGE"],
   6: ["GROUP", "KEY", "VALUE", "SOURCE", "APPLIES"],
   7: USAGE_HEAD,
+  8: ["ROOM", "LINK", "MEMBERS", "REMOTE"],
 };
 const showPermissionModes = (s: ConsoleState) => Object.values(s.peers).some(peer => peer.permissionMode && peer.permissionMode !== "ask");
 const count = (n: unknown) => typeof n === "number" && n ? String(n) : "-";
@@ -906,6 +920,9 @@ const waitingDeps = (s: ConsoleState, row: any): number[] => (row.deps ?? []).fi
 /** One span per column of a panel row; zero counters and unknown values read `-`. */
 export function cells(s: ConsoleState, row: any, selected: boolean, now: number, stages?: Map<number, ProgressStage>): Span[] {
   const id = (text: unknown, tone: Tone | undefined) => span(text, tone && (selected ? "strong" : tone));
+  if (s.panel === 8) return [id(row.name, "info"), span(row.link ?? "unknown", row.link ? stateTone(row.link) : "muted"),
+    span(row.memberCount === null ? "unknown" : String(row.memberCount), row.memberCount === null ? "muted" : undefined),
+    span(row.remotePeers === null ? "unknown" : String(row.remotePeers.length), row.remotePeers === null ? "muted" : undefined)];
   if (s.panel === 1) {
     const b = s.budget[row.id];
     const wip = s.taskWip?.[row.id];
@@ -919,7 +936,8 @@ export function cells(s: ConsoleState, row: any, selected: boolean, now: number,
       span(wip ? `${wip.wip}/${wip.wipLimit}` : "-", wip && wip.wip >= wip.wipLimit ? "attention" : undefined),
       span(count(row.needsReview), row.needsReview ? "failure" : undefined), span(paused, paused === "-" ? undefined : "attention"),
       span(b?.windows?.length ? b.windows.map((w: any) => `${w.id} ${Math.round(w.used * 100)}%${typeof w.resetsAt === "number" ? ` ${relative(w.resetsAt, now)}` : ""}`).join(", ") : "-"),
-      span(row.servedBy ?? row.requestedModel ?? "-")];
+      span(row.servedBy ?? row.requestedModel ?? "-"),
+      span(typeof row.doing?.text === "string" && row.doing.text ? row.doing.text : "-", row.doing?.text === DOING_STUB ? "muted" : undefined)]; // #878: screened by the hub
   }
   if (s.panel === 7) {
     const text = usageCells(s.usage, row.id, s.budget[row.id], at => relative(at, now));
@@ -947,6 +965,21 @@ export function cells(s: ConsoleState, row: any, selected: boolean, now: number,
   // stream. Colour off concatenates to the same bytes.
   return [...streamTokens((header ?? "").replace(/\t/g, " "), row.tone, row.kind), ...(body.length ? [span("\n" + body.join("\n"))] : [])];
 }
+
+function roomDetail(row: RoomStatusView): Record<string, unknown> {
+  const relays = row.relays;
+  let since = "unknown";
+  if (relays) try { const date = new Date(relays.since); if (Number.isFinite(date.getTime())) since = date.toISOString(); } catch { /* keep unknown */ }
+  const count = (value: number | null | undefined) => typeof value === "number" ? String(value) : "unknown";
+  return {
+    room: row.name, "room id": row.room, "link state": row.link ?? "unknown", owner: row.owner, "local member": row.member,
+    "member count": count(row.memberCount),
+    "remote peers": row.remotePeers === null ? "unknown" : row.remotePeers.length ? row.remotePeers.map(peer => `${peer.id} (${peer.state})`) : "0",
+    "counter scope": `since daemon start: ${since}`,
+    "out handoff": count(relays?.outbound), "in admitted": count(relays?.inbound), withheld: count(relays?.withheld),
+  };
+}
+
 /**
  * A header row, then the rows, each column starting at the same place on every row: two spaces apart, as wide as its
  * widest cell or header (Bun.stringWidth, at most a third of the width, wider cells cut with the marker); the last column
@@ -975,10 +1008,10 @@ export function table(head: string[], rows: Span[][], columns: number, explicitW
   }));
 }
 /** Keep the status/quota columns visible instead of clipping them behind optional peer metadata. */
-function optionalTable(head: string[], rows: Span[][], columns: number, drop = ["MODEL", "WIP", "PAUSE", "REVIEW", "LINK", "Q", "!", "MODE"]): Span[][] {
+function optionalTable(head: string[], rows: Span[][], columns: number, drop = ["DOING", "MODEL", "WIP", "PAUSE", "REVIEW", "LINK", "Q", "!", "MODE"]): Span[][] {
   const cap = Math.max(24, Math.floor(columns / 3));
   const widths = head.map((name, i) => Math.min(cap, rows.reduce((max, row) => Math.max(max, Bun.stringWidth(flat(row[i]?.text ?? ""))), name.length)));
-  const keep = head.map((_, i) => i);
+  const keep = head.map((_, i) => i).filter(i => head[i] !== "DOING" || rows.some(row => row[i]?.text !== "-")); // #878: shown once a peer has one
   const total = () => keep.reduce((sum, i) => sum + widths[i]!, 0) + 2 * (keep.length - 1);
   for (const name of drop) {
     if (total() <= columns - 2) break;
@@ -1033,16 +1066,17 @@ function hint(s: ConsoleState, columns: number): string {
   const compact = text.replace("m permission mode", "m mode").replace("w WIP limit", "w WIP").replace("j/k move", "j/k").replace(": command", ": cmd");
   return Bun.stringWidth(compact) > columns ? compact.replace("Enter view", "Enter") : compact;
 }
-/** The project, then the tabs: the active one in brackets, pending approvals and held deliveries counted. */
+/** The project, then the tabs: Rooms appears only when the hub reports room metadata. */
 function header(s: ConsoleState, columns: number): Span[] {
   const counts = [0, s.approvals.length, 0, s.queue.filter(q => q.state === "needs_review").length, 0];
   const project = s.project ?? "agent-hub";
-  // Seven tabs fill an 80-column line, which would squeeze the project name out: below that, one space before a tab instead of two (#683 U3).
+  // The tabs can fill an 80-column line, which would squeeze the project name out: below that, one space before a tab instead of two (#683 U3).
   const build = (lead: string) => {
     const tabs: Span[] = [];
-    for (const [i, name] of ["Peers", "Approvals", "Tasks", "Queue", "Events", "Settings", "Usage"].entries()) {
-      const active = i + 1 === s.panel; const tone = active ? "strong" : "info";
-      tabs.push(span(active ? lead.slice(1) + "[" : lead, tone), span(`${i + 1} ${name}`, tone));
+    const names = ["Peers", "Approvals", "Tasks", "Queue", "Events", "Settings", "Usage", ...(roomsVisible(s) ? ["Rooms"] : [])];
+    for (const [i, name] of names.entries()) {
+      const number = i === 7 ? 8 : i + 1, active = number === s.panel, tone = active ? "strong" : "info";
+      tabs.push(span(active ? lead.slice(1) + "[" : lead, tone), span(`${number} ${name}`, tone));
       if (counts[i]) tabs.push(span(` ${counts[i]}`, i === 1 ? "attention" : "failure"));
       tabs.push(span(active ? "]" : " ", tone));
     }
@@ -1152,10 +1186,13 @@ export function renderConsoleLines(s: ConsoleState, columns: number, rows = 24,
     const definition: [string, unknown][] = row ? [["type", row.type], ...(row.min !== undefined || row.max !== undefined ? [["range", `${row.min ?? "-"}..${row.max ?? "-"}`] as [string, unknown]] : []), ["risk", row.risk], ["applies", row.applies]] : [];
     lines.push(...fieldLines([["setting", edit.key ?? s.settingsUndo ?? "last write"], ...definition, ["preview", (edit.lines ?? []).join("\n")], ["decision", "Esc cancels; saving needs a reason and explicit y"]], columns, now).flat());
   }
-  else if (s.help) lines.push(...keyTable(columns, !!s.petEnabled || !!s.petChoices?.length, !!s.petChoices?.length));
+  else if (s.help) lines.push(...keyTable(columns, !!s.petEnabled || !!s.petChoices?.length, !!s.petChoices?.length, roomsVisible(s)));
   else if (s.detail !== undefined || (s.requestDetail && permission)) {
     const usagePeer = s.panel === 7 && s.detail && typeof s.detail === "object" ? (s.detail as { usagePeer?: unknown }).usagePeer : undefined;
-    const detail = typeof usagePeer === "string" ? fieldLines(Object.entries(usageDetail(s.usage, usagePeer, s.budget[usagePeer], at => relative(at, now))), columns, now).flat()
+    const roomName = s.panel === 8 && s.detail && typeof s.detail === "object" ? (s.detail as { roomName?: unknown }).roomName : undefined;
+    const room = typeof roomName === "string" && Array.isArray(s.rooms) ? s.rooms.find(row => row.name === roomName) : undefined;
+      const detail = typeof usagePeer === "string" ? fieldLines(Object.entries(usageDetail(s.usage, usagePeer, s.budget[usagePeer], at => relative(at, now))), columns, now).flat()
+      : typeof roomName === "string" ? detailLines(room ? roomDetail(room) : { room: roomName, status: "unavailable" }, columns, now)
       : s.detail !== undefined ? detailLines(s.detail, columns, now, s.panel === 3) : fieldLines(approvalFields(permission!), columns, now).flat();
     lines.push(...detail.slice(Math.min(s.detailOffset, Math.max(0, detail.length - height))));
   }
@@ -1172,7 +1209,10 @@ export function renderConsoleLines(s: ConsoleState, columns: number, rows = 24,
     let taskLines = s.panel === 7 ? usageTaskLines(s.usage, s.usageTask) : [];
     const taskRoom = Math.max(1, Math.floor(height / 2));
     if (taskLines.length > taskRoom) taskLines = [...taskLines.slice(0, taskRoom - 1), { text: `  ... ${taskLines.length - taskRoom + 1} more`, tone: "muted" as const }];
-    const capacity = Math.max(1, s.panel === 2 ? Math.min(Math.floor(height / 2) - 1, height - 3 - tail.length) : s.panel === 7 ? height - 2 - taskLines.length : height - (s.panel === 3 ? 2 : 1)); const start = Math.max(0, at - capacity + 1);
+    const selectedTask = s.panel === 3 ? data[at] : undefined;
+    const holders = selectedTask && (selectedTask.planner !== undefined || selectedTask.plannerReason !== undefined)
+      ? fieldLines((["planner", "owner", "reviewer"] as const).map((role): [string, unknown] => [role, taskHolderText(selectedTask, role)]), columns, now).flat() : [];
+    const capacity = Math.max(1, s.panel === 2 ? Math.min(Math.floor(height / 2) - 1, height - 3 - tail.length) : s.panel === 7 ? height - 2 - taskLines.length : height - (s.panel === 3 ? 2 + holders.length : 1)); const start = Math.max(0, at - capacity + 1);
     const stages = new Map(progress.stages.map(stage => [stage.id, stage]));
     const cellRows = head ? data.map((row, i) => cells(s, row, i === at, now, stages)) : [];
     const rowsOf = head ? s.panel === 7 ? optionalTable(head, cellRows, columns, USAGE_DROP) : s.panel === 1 ? optionalTable(head, cellRows, columns) : s.panel === 3 && s.backlogView ? optionalTable(head, cellRows, columns, ["AGE", "CLASS", "DEPS", "PRI"]) : table(head, cellRows, columns) : undefined;
@@ -1191,6 +1231,7 @@ export function renderConsoleLines(s: ConsoleState, columns: number, rows = 24,
         : `usage through ${s.usage.at ? relative(s.usage.at, now) : "now"}: today is the UTC day, 7d the last seven UTC days`;
       lines.push(fitLine([span(note, s.usage?.problem ? "failure" : !s.usage?.life || s.usage.behind ? "attention" : "info")], columns));
     }
+    if (s.panel === 8 && s.rooms === null) lines.push(fitLine([span("Room status unavailable", "attention")], columns));
     if (s.panel === 3 && s.backlogView) {
       lines.push(fitLine([span(s.tasksKnown === false ? "backlog loading..." : `backlog ${data.length}`, s.tasksKnown === false ? "attention" : "info")], columns));
     } else if (s.panel === 3) {
@@ -1211,6 +1252,7 @@ export function renderConsoleLines(s: ConsoleState, columns: number, rows = 24,
       lines.push(fitLine([span(selected ? "> " : "  ", selected ? "strong" : undefined), ...(rowsOf?.[i + 1] ?? cells(s, data[i], selected, now))], columns));
     }
     if (!data.length) lines.push([span("  (empty)")]);
+    if (holders.length) lines.push(...holders);
     if (s.panel === 7) for (const line of taskLines) lines.push(fitLine([span("  " + line.text, line.tone)], columns));
     if (title.length) {
       const room = Math.max(1, height - lines.length - 1 - tail.length);

package/src/cli/console.ts

@@ -13,6 +13,7 @@ import { loadPetConfig } from "./pet-config.ts";
 import { CHARACTER_IDS, petGlyphs, petSize } from "../pet/frame.ts";
 import { activeNotice, consoleFooterRows } from "./console-state.ts";
 import { characterAttentionLine } from "./attention.ts";
+import { projectRoomStatus } from "../rooms/status.ts";
 
 export interface ConsoleTerminal {
   columns: number; rows: number; isTTY: boolean; isRaw?: boolean;
@@ -218,7 +219,21 @@ export async function runConsole(options: ConsoleOptions): Promise<void> {
       if (status.status && status.ok !== false) state.pendingRestart = Array.isArray(status.status.pendingRestart) ? status.status.pendingRestart : [];
       if (status.status && status.ok !== false) state.retainedConfig = Array.isArray(status.status.retainedConfig) ? status.status.retainedConfig : [];
       if (status.status) state.features = Array.isArray(status.status.features) ? status.status.features : [];
-      if (status.status?.peers) state.peers = Object.fromEntries(Object.entries(status.status.peers).map(([peer, value]) => [peer, { ...(value as object), ...status.status.roleInfo?.[peer] }]));
+      if (status.status && status.ok !== false) {
+        const rooms = status.status.rooms;
+        state.rooms = rooms === undefined ? undefined : rooms === null ? null : Array.isArray(rooms) ? projectRoomStatus(rooms).sort((a, b) => a.name.localeCompare(b.name)) : null;
+        if (state.rooms === undefined || Array.isArray(state.rooms) && state.rooms.length === 0) {
+          if (state.panel === 8) { state.panel = 1; state.selection = 0; state.roomSelection = undefined; state.detail = undefined; state.detailOffset = 0; }
+        } else if (state.panel === 8) {
+          if (state.rooms === null) { state.roomSelection = undefined; state.selection = 0; state.detail = undefined; state.detailOffset = 0; }
+          else if (!state.roomSelection || !state.rooms.some(room => room.name === state.roomSelection)) {
+            state.roomSelection = state.rooms[0]?.name; state.selection = 0; state.detail = undefined; state.detailOffset = 0;
+          }
+        }
+      }
+      if (status.status?.peers) state.peers = Object.fromEntries(Object.entries(status.status.peers).map(([peer, value]) => [peer, { ...(value as object), ...status.status.roleInfo?.[peer],
+        ...(typeof status.status.ownerIsolation?.[peer] === "boolean" ? { ownerIsolation: status.status.ownerIsolation[peer] } : {}),
+        ...(typeof status.status.ownerIsolationNotes?.[peer] === "string" ? { ownerIsolationNote: status.status.ownerIsolationNotes[peer] } : {}) }]));
       if (status.status && status.ok !== false) {
         state.taskWip = status.status.taskWip ?? {};
         state.attentionFacts = attentionFacts(status.status.attentionItems);
@@ -330,7 +345,7 @@ export async function runConsole(options: ConsoleOptions): Promise<void> {
       if (!action.option) stream({ text: `  ! denial requested for permission ${action.id}`, kind: "permission", tone: "failure" });
       return;
     }
-    if (action.type === "keys") return stream({ text: keyTable(columns, !!state.petEnabled || !!state.petChoices?.length, !!state.petChoices?.length).map(line => paint(line, false)).join("\n"), kind: "console" }, false);
+    if (action.type === "keys") return stream({ text: keyTable(columns, !!state.petEnabled || !!state.petChoices?.length, !!state.petChoices?.length, state.rooms === null || Array.isArray(state.rooms) && state.rooms.length > 0).map(line => paint(line, false)).join("\n"), kind: "console" }, false);
     if (action.type === "print") return stream({ text: action.text, kind: action.kind, ...(action.tone ? { tone: action.tone } : {}) }, false);
     if (action.type === "show") {
       const result = await client.request(action.panel === 3 ? { t: "task", op: "task_show", args: { id: action.id } } : { t: "queue", op: "show", id: action.id }, 3000);

package/src/cli/facts-hook.ts

@@ -94,7 +94,9 @@ export async function factsHook(stdin: string, stateDir: string, peer: string, t
     // A present value that is not an empty list asks, even when malformed: the hook never turns an unreadable classification into an allow.
     const classed = res.actionClasses !== undefined && !(Array.isArray(res.actionClasses) && res.actionClasses.length === 0);
     const classNames = Array.isArray(res.actionClasses) ? res.actionClasses.filter((key: unknown): key is string => typeof key === "string" && /^[a-z-]{1,32}$/.test(key)) : [];
-    const allow = !classed && input.hook_event_name === "PreToolUse" && (permission === "never-ask" || permission === "ask-when-needed" && fileTool);
+    // The daemon supplies this ceiling from the authenticated instance's flow roles, never a peer-id spelling.
+    const mayGrant = !Object.hasOwn(res, "mutationGrants") || res.mutationGrants === true || ["Read", "LS", "Glob", "Grep"].includes(String(input.tool_name));
+    const allow = mayGrant && !classed && input.hook_event_name === "PreToolUse" && (permission === "never-ask" || permission === "ask-when-needed" && fileTool);
     const text = typeof res.text === "string" && res.text ? res.text : undefined;
     if (!allow && !classed && !text) return undefined;
     return JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", ...(text ? { additionalContext: text } : {}), ...(classed ? { permissionDecision: "ask", permissionDecisionReason: `agent-hub always-ask${classNames.length ? `: ${classNames.join(", ")}` : ""}` } : allow ? { permissionDecision: "allow" } : {}) } });