@staix/agent-hub 0.23.0 → 0.23.1

package/docs/verification/2026-10-31-qwen-0264-acp.md

@@ -0,0 +1,57 @@
+# Qwen Code 0.26.4 ACP receipt
+
+Date: 2026-10-31. Scope: issue #888, task 578, `qwen` row only. This repeats the [0.26.1 ACP receipt](2026-10-26-qwen-0261-acp.md) using a private npm prefix, isolated HOME and fixed synthetic configuration. No account, real credential, provider inference or ACP prompt was used. This receipt does not admit the separate `qwen-dual` contract.
+
+## Artifact and isolation
+
+The published `@qwen-code/qwen-code@0.26.4` was installed under `scratchpad/temp/agent-hub-578/qwen-prefix`, with scratch HOME, cache, temporary directory and separate empty npm user/global config files. The person's global prefix and `~/.qwen` were not installation targets. npm's pending lifecycle script for the optional audio package was read and replayed under the same isolated environment; it completed. No install scripts were disabled to make the probe pass.
+
+| Artifact | Binding |
+| --- | --- |
+| npm release | 0.26.4, `gitHead` and upstream `v0.26.4` tag `715a550cfca0135e00d4015d1ca82a8167e81fff` |
+| npm integrity | `sha512-YeRiUaH3d+JxPiYUS4eGalsKRTuIEUo75JWPWdVBoptdbAH3FJdWbGtjs/syECEUTH5qk0nu8tRb1HMEKn0I2Q==` |
+| `cli-entry.js` SHA-256 | `113efe4104a9fc66f507d34bfd6abbd896ceb77de47f4b468a0825a327fdc6a5` |
+| `chunks/acpAgent-D7OFGHAI.js` SHA-256 | `67d040491bb04e33a2f91df3f142ba09a100333edb1e5f92ed0a84edb1c499b9` |
+| Host | macOS arm64, Node 24.18.1 |
+
+Every native process received a fresh ordinary OS temporary HOME/cwd, private QWEN_HOME/QWEN_RUNTIME_DIR/XDG_CONFIG_HOME, a synthetic API key and `--auth-type openai --model fixture-model --openai-base-url http://127.0.0.1:9/v1 --telemetry=false`. A Node preload denied application network APIs and recorded six blocked startup attempts; none connected through those guarded APIs. A separate reserved-address positive control proved the guard blocks. This is preload evidence, not a kernel network sandbox or a claim about arbitrary native subprocess sockets.
+
+## Native ACP, no prompts
+
+`qwen --acp --bare --advisor off` initialized with protocol version 1 and `agentInfo` name `qwen-code`, title `Qwen Code`, version `0.26.4`. The only offered authentication method was the synthetic OpenAI terminal method. No prompt was sent.
+
+`session/new` succeeded. Available modes were `plan`, `default`, `auto-edit`, `auto` and `yolo`, with current mode `default`. Each transition in `default -> auto-edit -> yolo -> default` returned an acknowledgement. Thus the hub's existing ask/default, ask-when-needed/auto-edit and never-ask/yolo map remains a subset of the native advertised ids; neither `plan` nor `auto` is newly mapped. The session exposed only the fixture model. Additional native mode-update notifications remain outside the hub's mapped protocol.
+
+The native leader exited after its owned group received SIGTERM, and the producer confirmed `groupGone: true`. Six startup network attempts were blocked; the input contained zero model prompts.
+
+## Actual published permission handler
+
+An exports-only scratch copy of the published ACP chunk was placed beside the original inside the private package, preserving its relative imports. The original chunk was not edited. The fixture invoked the actual `SubAgentTracker.createApprovalHandler` with synthetic client/tool/event ports, not a reimplementation or a model-generated tool turn.
+
+- A request carried the fixture session, pending tool-call id, raw input, native MCP tool metadata and permission progress updates.
+- The exact options were `proceed_always_project` and `proceed_always_user` as `allow_always`, `proceed_once` as `allow_once`, and `cancel` as `reject_once`.
+- An offered allow-once response reached `event.respond` as `proceed_once`.
+- A second actual callback with a cancelled outcome reached `event.respond` as `cancel`.
+- The real outcome helper rejected an unoffered option. No permission-fixture network attempt was recorded.
+
+## Source review and boundary
+
+The published npm `gitHead` matches upstream `v0.26.4`; `v0.26.1` remains `b475278c4a300acebe6cfc990a9e1b1d18819bfc`. Release notes for 0.26.2, 0.26.3 and 0.26.4 were read, together with the relevant source regions at both commits. This was a scoped contract review, not a review of every changed file.
+
+- [`SubAgentTracker`](https://github.com/QwenLM/qwen-code/blob/715a550cfca0135e00d4015d1ca82a8167e81fff/packages/cli/src/acp-integration/session/SubAgentTracker.ts#L312) adds subagent identity to emitted progress metadata. The permission request construction and offered-outcome translation remain exercised by the native chunk fixture above.
+- [`acpAgent`](https://github.com/QwenLM/qwen-code/blob/715a550cfca0135e00d4015d1ca82a8167e81fff/packages/cli/src/acp-integration/acpAgent.ts#L6979) still routes mode changes to the selected session. New workflow options, workspace controls and shared fresh-prompt execution are outside the mode ids the hub maps. The idle native mode acknowledgements above are observed; a fresh model prompt through the new chain is not claimed.
+- `DualOutputBridge.ts` and `RemoteInputWatcher.ts` were byte-identical between these tags. That source fact is not native dual-output acceptance; its separate receipt owns that decision.
+
+Every required ACP leg passed. Exactly 0.26.4 may join `COMPAT.qwen.verified`; no intermediate release, compatible range or dual-output version is inferred. A real model-generated permission turn, real login/provider, model behavior, Linux and Intel macOS remain unverified. Host changed-source checks and exact-head CI are separate PR evidence.
+
+## Evidence fingerprints
+
+Producers and result JSONs remain outside git under `scratchpad/temp/agent-hub-578`.
+
+| File | SHA-256 |
+| --- | --- |
+| `qwen-acp-probe.py` | `f36a03010af657f5cc453c4dbfa70ee03014a09d8bf144f6d8c5441de80ccea8` |
+| `qwen-acp-result.json` | `b3a53e394f9234ba8e2c8744e2b892cbbdffe1eac28623d13815efaa7ab7a44d` |
+| `qwen-permission.mjs` | `00d9b68f4a23f3efc84bf657f5c57cea476e36d0469e356b943abb8dcc417587` |
+| `qwen-permission-result.json` | `958a77ea7618e0efd04a78520aadf83654e5b74a0158a05061d0bed4406d7c31` |
+| `deny-network.cjs` | `361148af658dd4b65ed35308622ec99bb882ec5a25fab54581776546f139e892` |

package/docs/verification/2026-10-31-qwen-0264-dual-output.md

@@ -0,0 +1,52 @@
+# Qwen 0.26.4 dual-output attempt, not qualified
+
+Date: 2026-10-31. Scope: issue #888, task 578, the separate `qwen-dual` row. The [ACP receipt](2026-10-31-qwen-0264-acp.md) does not qualify the TUI contract. This attempted the [earlier Q2-Q7 procedure](2026-10-25-qwen-dual-output-t0.md) using fixed OpenAI-compatible loopback responses, no real model, account or credential. Exactly 0.26.1 remains in `COMPAT["qwen-dual"].verified`; 0.26.4 is not admitted.
+
+## Artifact, scope and controls
+
+The candidate is the private-prefix npm `@qwen-code/qwen-code@0.26.4`, upstream tag/gitHead `715a550cfca0135e00d4015d1ca82a8167e81fff`, Node 24.18.1 on macOS arm64. Artifact integrity and entry/chunk hashes are in the ACP receipt. The retained global 0.26.1 executable was used only as a read-only matched control, always with a fresh temporary HOME/cwd and the same producer/flags; no code was injected into that installation. Its `cli-entry.js` SHA-256 `113efe4104a9fc66f507d34bfd6abbd896ceb77de47f4b468a0825a327fdc6a5` matches the earlier receipt.
+
+Each fixture used PTY 120x40, private input/event files, a scratch git project, synthetic OpenAI-compatible key/model, and a loopback server emitting fixed text/tool-use responses. Native shell and stdio-MCP effects were confined to synthetic marker files. Node builtin TCP/DNS/fetch/UDP guards allowed only loopback and fixture-local IPC. Positive controls passed, every launched native Node PID and observed Node child had a preload record, every owned process group was confirmed gone, and temporary roots were removed. These are application-preload and bounded process observations, not a kernel network sandbox or universal subprocess audit.
+
+## Corrected fixture and observed outcomes
+
+The first producer reported Q2/Q4/Q6 failures on both 0.26.4 and matched 0.26.1. Its Q2 error combined two conditions without retaining which failed; its Q4 required bootstrap-leader survival in addition to the original turn-continuation criterion and signalled the entire group; its Q6 stopped at assistant text before the documented message_stop/persistence boundary and selected the first matching fixture marker from provider input. Those results did not establish new-version regressions and were retained.
+
+The second producer kept the required assertions and added causal observations: wait for a native stream delta before the second submit; require final assistant plus following message_stop; wait until the owned session recording contains the final assistant before restart; classify the latest matching fixture marker and retain all marker matches; bind SIGINT to the actual native TUI PID by input-file argv, process group and start identity. It recorded the separate Q2 diagnostics and event chronology. No timeout was increased and no assertion for a separate queued user turn was removed.
+
+| Check | 0.26.4 corrected producer | Matched 0.26.1 control |
+| --- | --- | --- |
+| Q7 version and guard positive control | pass, 0.26.4 | bound separately to installed 0.26.1; not selected in diagnostic run |
+| Q2 second submit becomes a separate user turn after the first completes | **not reproduced** | **not reproduced with the same fixture** |
+| Q3 shell allow/deny, TUI Enter, duplicate reply, read-only control | pass | not selected |
+| Q3 native MCP can_use_tool, exact input and one handler effect after allow, duplicate refused | pass | not selected |
+| Q4 external cancel/SIGINT leaves turn running; person Esc stops it and next turn works | pass, existing ceiling retained | pass |
+| Q5 unread output FIFO does not block the TUI answer | pass | not selected |
+| Q6 resume id, no old-submit replay and prior context present in resumed provider request | pass | pass |
+
+For Q2 the corrected results in both versions report `prematureSecondUser: false` and `userCount: 1`. The one final assistant carries responses to both submitted markers and one completion boundary; the required second distinct user event is absent. This supports a coalescing/steering observation for this held-stream workload, not a new 0.26.4 regression. The earlier receipt's queued-submit observation was not reproduced by this fixture, so this row cannot be called fully verified.
+
+Q3 saw actual shell and `mcp__t0__t0_echo` requests with request id, tool_use_id, exact input and permission_suggestions. Allow and TUI Enter produced the effect and success response; duplicate responses were errors without a second effect. The denied file was absent, the legacy no-event ceiling was observed and a subsequent turn worked. The read-only command ran without approval. MCP execution reached the tiny fixture's handler only after allow and exactly once.
+
+Q4 records an identity-bound native TUI signal, not a promise that the hub may signal a person's terminal. The hub's existing report-only watchdog remains unchanged. Q6 rotated the event file like the production adapter, retained old input bytes without replay and observed the remembered token in the resumed provider request. Model recall quality is unverified because all responses were deterministic fixtures.
+
+## Source review and decision
+
+At 0.26.1 `b475278c4a300acebe6cfc990a9e1b1d18819bfc` and 0.26.4 `715a550cfca0135e00d4015d1ca82a8167e81fff`, `DualOutputBridge.ts` and `RemoteInputWatcher.ts` were byte-identical. The installed UI callback/queue regions also retain direct addMessage and mid-turn steering paths. This is scoped supporting source evidence; the matched native control above determines the attribution limit.
+
+Because Q2 is not established, the conditional task gate does not permit a qwen-dual bump. Only the independently passing ACP and Kimi rows are changed. No TUI adapter, queue, cancellation policy or existing 0.26.1 admission is modified. Resolving this stronger queued-turn workload is separate from declaring a new-version regression.
+
+Real account/provider, inference, model choices/quality, token/quota behavior and non-macOS platforms remain unverified. The evidence includes explicit failed and unselected diagnostic legs; none is relabelled as a pass. Host unit tests/changed gate and exact-head CI are separate PR evidence.
+
+## Evidence fingerprints
+
+Files remain outside git under `scratchpad/temp/agent-hub-578`.
+
+| File | SHA-256 |
+| --- | --- |
+| `qwen-dual-probe.py` | `6111ed0364a498b15d8abbf5353d00ec9289add7dcbc8a57ac0441a2c815af3c` |
+| `qwen-dual-result.json` | `247e7ade2eb001e14b6492cdeb570e6a899b7b83c4873571e5624821d1f0f44b` |
+| `qwen-dual-0261-control-result.json` | `fa47606403a642bda78ea71d810b837c807bc5a36f7b1097ec54c9d7f64d099f` |
+| `qwen-dual-probe-v2.py` | `114c032afce5caef4f59072f0a1730bc78a70788fd49ad17e5ff2f1eef4c947e` |
+| `qwen-dual-v2-0261-control-result.json` | `9b3a9940e43d73c2223d51aec8826053ff24a13b08e1fee4db854d2197053564` |
+| `qwen-dual-v2-0264-result.json` | `15f9b3971f0de3eb48cd6f5735927592b6a20a782641fddb5ca070846b628844` |

package/docs/verification/claude-shell-wrapper-native.py

@@ -68,7 +68,7 @@ results=[]
 for raw_binary in args.claude:
  binary=pathlib.Path(raw_binary).resolve(); identity=ROOT/('identity-'+binary.name); identity.mkdir()
  version=subprocess.run([str(binary),'--version'],env={'HOME':str(identity),'CLAUDE_CONFIG_DIR':str(identity/'config'),'PATH':'/usr/bin:/bin'},capture_output=True,text=True,timeout=10)
- assert version.returncode==0 and version.stdout.strip().split()[0] in ('2.1.309','2.1.310'),(version.returncode,version.stdout)
+ assert version.returncode==0 and version.stdout.strip().split()[0] in ('2.1.309','2.1.310','2.1.314'),(version.returncode,version.stdout)
  label=version.stdout.strip().split()[0]; digest=sha(binary)
  for mode in ('context','normalized'):
   d=ROOT/(label+'-'+mode); d.mkdir(); home=d/'home';home.mkdir(); work=d/"work 'quoted'";work.mkdir();(work/'sub').mkdir()

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
+      "verifiedAgainst": "5b63fa3809f5bee0002d01685abac8b2fadc0cdd",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
+      "verifiedAgainst": "5b63fa3809f5bee0002d01685abac8b2fadc0cdd",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
+      "verifiedAgainst": "5b63fa3809f5bee0002d01685abac8b2fadc0cdd",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
+      "verifiedAgainst": "5b63fa3809f5bee0002d01685abac8b2fadc0cdd",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
+      "verifiedAgainst": "5b63fa3809f5bee0002d01685abac8b2fadc0cdd",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -264,7 +264,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
+      "verifiedAgainst": "5b63fa3809f5bee0002d01685abac8b2fadc0cdd",
       "paths": [
         "test/",
         "scripts/check.sh",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.23.0",
+  "version": "0.23.1",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",
@@ -17,7 +17,7 @@
     "bun": ">=1.4.2"
   },
   "dependencies": {
-    "@staix/agent-mem": "0.13.0"
+    "@staix/agent-mem": "0.14.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.23.0",
+  "version": "0.23.1",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -308,12 +308,12 @@ var init_compat = __esm(() => {
     },
     "claude-implementer": {
       label: "Claude headless implementer",
-      verified: ["2.1.309", "2.1.310"],
+      verified: ["2.1.309", "2.1.310", "2.1.314"],
       gate: "contract",
       probe: ["claude", "--version"],
       parse: (out) => plain(out.trim().replace(/ \(Claude Code\)$/, "")),
       trustNote: "The native prompt-tool transport and host-wrapper rewrite, environment isolation and replay contract have isolated receipts. No dontAsk/bypass fallback exists; another version's permission or rewrite behavior is unverified.",
-      receipt: "docs/verification/2026-10-26-headless-claude-shell-context.md"
+      receipt: "docs/verification/2026-10-31-claude-implementer-2.1.314.md"
     },
     "codex-review": {
       label: "Codex reviewer (codex-cli)",
@@ -323,16 +323,16 @@ var init_compat = __esm(() => {
       config: "codex_bin",
       parse: (out) => plain(out.trim().replace(/^codex-cli /, "")),
       trustNote: "Every launch still proves the MCP inventory, Apps/plugins/hooks disabled, sandbox read/write denial and the binary fence; a failed leg still refuses. Trust covers only the source-level claims those probes cannot see (docs/verification/2026-10-19-reviewer-isolation.md).",
-      receipt: "docs/verification/2026-10-24-codex-0164-reviewer-isolation.md"
+      receipt: "docs/verification/2026-10-31-codex-0166-reviewer-isolation.md"
     },
     "kimi-review": {
       label: "Kimi reviewer (kimi-code)",
-      verified: ["2.2.0", "2.3.0", "2.3.1", "2.3.2"],
+      verified: ["2.2.0", "2.3.0", "2.3.1", "2.3.2", "2.4.1"],
       gate: "isolation",
       probe: ["kimi", "--version"],
       parse: (out) => plain(out.trim()),
       trustNote: "Every launch still builds the private config, exact two-tool agent file and task-bound MCP; the native tool allowlist behaviour of an untested version is not re-proven.",
-      receipt: "docs/verification/2026-10-26-kimi-232-reviewer-compat.md"
+      receipt: "docs/verification/2026-10-31-kimi-241-reviewer-compat.md"
     },
     jcode: {
       label: "Jcode",
@@ -364,13 +364,13 @@ var init_compat = __esm(() => {
     },
     qwen: {
       label: "Qwen Code",
-      verified: ["0.25.0", "0.26.0", "0.26.1"],
+      verified: ["0.25.0", "0.26.0", "0.26.1", "0.26.4"],
       gate: "contract",
       probe: ["qwen", "--version"],
       config: "qwen_cmd",
       parse: (out) => plain(out.trim()),
-      trustNote: "Native ACP identity, mode ids and permission callbacks were re-checked without inference on 0.26.1; its two ACP fixes were judged not to change the hub contract. Another version may change those contracts.",
-      receipt: "docs/verification/2026-10-26-qwen-0261-acp.md"
+      trustNote: "Native ACP identity, mode ids and permission callbacks were re-checked without inference on 0.26.4; real model turns remain unverified. Another version may change those contracts.",
+      receipt: "docs/verification/2026-10-31-qwen-0264-acp.md"
     },
     "qwen-dual": {
       label: "Qwen Code dual-output TUI",
@@ -14838,54 +14838,13 @@ var init_registry = __esm(() => {
   }));
 });
 
-// node_modules/@staix/agent-mem/src/memory/cli-attribution.ts
-import { AsyncLocalStorage } from "async_hooks";
-var scope;
-var init_cli_attribution = __esm(() => {
-  scope = new AsyncLocalStorage;
-});
-
-// node_modules/@staix/agent-mem/src/memory/private-spans.ts
-var init_private_spans = () => {};
-
-// node_modules/@staix/agent-mem/src/memory/screen.ts
-var init_screen = () => {};
-
 // node_modules/@staix/agent-mem/src/memory/mutation.ts
-var init_mutation = () => {};
-
-// node_modules/@staix/agent-mem/src/memory/project.ts
-var init_project2 = __esm(() => {
-  init_platform();
-});
-
-// node_modules/@staix/agent-mem/src/memory/policy.ts
-var MAX_BYTES3, MAX_STRING_BYTES, flags;
-var init_policy = __esm(() => {
-  init_screen();
-  init_platform();
-  init_project2();
-  MAX_BYTES3 = 256 * 1024;
-  MAX_STRING_BYTES = 16 * 1024;
-  flags = new Set(["private", "pii", "privateturn", "isprivate", "ispii"]);
-});
-
-// node_modules/@staix/agent-mem/src/memory/config.ts
-var MAX_CONFIG_BYTES2;
-var init_config2 = __esm(() => {
-  init_policy();
-  MAX_CONFIG_BYTES2 = 64 * 1024;
-});
-
-// node_modules/@staix/agent-mem/src/memory/home.ts
-var init_home = __esm(() => {
+var mutations;
+var init_mutation = __esm(() => {
   init_platform();
-  init_config2();
+  mutations = new WeakMap;
 });
 
-// node_modules/@staix/agent-mem/src/memory/machine.ts
-var init_machine = () => {};
-
 // node_modules/@staix/agent-mem/src/memory/lifecycle-log.ts
 var MAX_LOG_BYTES;
 var init_lifecycle_log = __esm(() => {
@@ -14897,91 +14856,35 @@ var init_aliases = __esm(() => {
   init_lifecycle_log();
 });
 
-// node_modules/@staix/agent-mem/src/memory/generation.ts
-var init_generation = __esm(() => {
-  init_mutation();
-  init_platform();
-});
-
 // node_modules/@staix/agent-mem/src/memory/shard.ts
 var init_shard = __esm(() => {
+  init_public_prune_view();
   init_generation();
   init_aliases();
   init_aliases();
 });
 
-// node_modules/@staix/agent-mem/src/memory/lifecycle.ts
-var init_lifecycle = __esm(() => {
-  init_aliases();
-  init_lifecycle_log();
-  init_shard();
-});
-
-// node_modules/@staix/agent-mem/src/memory/search-score.ts
-function sql(expr, rank) {
-  const get = (part) => sql(part, rank);
-  switch (expr.op) {
-    case "rank":
-      return rank;
-    case "tier":
-      return `CASE tier ${Object.entries(TIER_WEIGHTS).map(([name, value]) => `WHEN '${name}' THEN ${real(value)}`).join(" ")} ELSE ${real(DEFAULT_TIER_WEIGHT)} END`;
-    case "age":
-      return `((julianday(?) - julianday(at)) / ${real(MONTH_DAYS)})`;
-    case "constant":
-      return real(expr.value);
-    case "negative":
-      return `(-(${get(expr.value)}))`;
-    case "reciprocal":
-      return `(1.0 / ${get(expr.value)})`;
-    case "add":
-      return `(${get(expr.left)} + ${get(expr.right)})`;
-    case "multiply":
-      return expr.right.op === "reciprocal" ? `(${get(expr.left)} / ${get(expr.right.value)})` : `(${get(expr.left)} * ${get(expr.right)})`;
-    case "max":
-      return `max(${get(expr.left)}, ${get(expr.right)})`;
-  }
-}
-function rankedScoreSql(rank = "bm25(docs)") {
-  return sql(SCORE, rank);
-}
-var MONTH_DAYS = 30, TIER_WEIGHTS, DEFAULT_TIER_WEIGHT = 0.9, TIER_FACTOR, DENOMINATOR, RECENCY_FACTOR, SCORE, real = (value) => Number.isInteger(value) ? `${value}.0` : String(value);
-var init_search_score = __esm(() => {
-  TIER_WEIGHTS = { long: 1, capture: 0.5 };
-  TIER_FACTOR = { op: "tier" };
-  DENOMINATOR = { op: "add", left: { op: "constant", value: 1 }, right: { op: "max", left: { op: "constant", value: 0 }, right: { op: "age" } } };
-  RECENCY_FACTOR = { op: "reciprocal", value: DENOMINATOR };
-  SCORE = { op: "multiply", left: { op: "multiply", left: { op: "negative", value: { op: "rank" } }, right: TIER_FACTOR }, right: RECENCY_FACTOR };
-});
-
-// node_modules/@staix/agent-mem/src/memory/search-fts.ts
-var SCREENED_SCORE, SCREENED_SUBSTRING_SCORE;
-var init_search_fts = __esm(() => {
-  init_search_score();
-  SCREENED_SCORE = rankedScoreSql();
-  SCREENED_SUBSTRING_SCORE = rankedScoreSql("-1.0");
+// node_modules/@staix/agent-mem/src/memory/public-prune-input-chain.ts
+var PUBLIC_PRUNE_REPLAY_MAX_BYTES;
+var init_public_prune_input_chain = __esm(() => {
+  init_generation();
+  init_platform();
+  PUBLIC_PRUNE_REPLAY_MAX_BYTES = 256 * 1024 * 1024;
 });
 
-// node_modules/@staix/agent-mem/src/memory/capture-input.ts
-var init_capture_input = __esm(() => {
-  init_screen();
+// node_modules/@staix/agent-mem/src/memory/generation.ts
+var init_generation = __esm(() => {
+  init_public_prune_view();
+  init_mutation();
   init_platform();
-  init_private_spans();
+  init_shard();
+  init_public_prune_input_chain();
 });
 
-// node_modules/@staix/agent-mem/src/memory/capture.ts
-var SPOOL_MAX_BYTES;
-var init_capture = __esm(() => {
-  init_screen();
-  init_capture_input();
-  init_capture_input();
-  init_home();
-  init_shard();
-  init_lifecycle();
-  init_machine();
-  init_config2();
-  init_policy();
-  init_search_fts();
-  SPOOL_MAX_BYTES = 256 * 1024;
+// node_modules/@staix/agent-mem/src/memory/public-prune-view.ts
+var init_public_prune_view = __esm(() => {
+  init_generation();
+  init_platform();
 });
 
 // node_modules/@staix/agent-mem/src/memory/ops-contract.ts
@@ -15171,6 +15074,125 @@ var init_shard_bridge = __esm(() => {
   init_bridge();
 });
 
+// node_modules/@staix/agent-mem/src/memory/cli-attribution.ts
+import { AsyncLocalStorage } from "async_hooks";
+var scope;
+var init_cli_attribution = __esm(() => {
+  scope = new AsyncLocalStorage;
+});
+
+// node_modules/@staix/agent-mem/src/memory/private-spans.ts
+var init_private_spans = () => {};
+
+// node_modules/@staix/agent-mem/src/memory/screen.ts
+var init_screen = () => {};
+
+// node_modules/@staix/agent-mem/src/memory/project.ts
+var init_project2 = __esm(() => {
+  init_platform();
+});
+
+// node_modules/@staix/agent-mem/src/memory/policy.ts
+var MAX_BYTES3, MAX_STRING_BYTES, flags;
+var init_policy = __esm(() => {
+  init_screen();
+  init_platform();
+  init_project2();
+  MAX_BYTES3 = 256 * 1024;
+  MAX_STRING_BYTES = 16 * 1024;
+  flags = new Set(["private", "pii", "privateturn", "isprivate", "ispii"]);
+});
+
+// node_modules/@staix/agent-mem/src/memory/config.ts
+var MAX_CONFIG_BYTES2;
+var init_config2 = __esm(() => {
+  init_policy();
+  MAX_CONFIG_BYTES2 = 64 * 1024;
+});
+
+// node_modules/@staix/agent-mem/src/memory/home.ts
+var init_home = __esm(() => {
+  init_platform();
+  init_config2();
+});
+
+// node_modules/@staix/agent-mem/src/memory/machine.ts
+var init_machine = () => {};
+
+// node_modules/@staix/agent-mem/src/memory/lifecycle.ts
+var init_lifecycle = __esm(() => {
+  init_aliases();
+  init_lifecycle_log();
+  init_shard();
+});
+
+// node_modules/@staix/agent-mem/src/memory/search-score.ts
+function sql(expr, rank) {
+  const get = (part) => sql(part, rank);
+  switch (expr.op) {
+    case "rank":
+      return rank;
+    case "tier":
+      return `CASE tier ${Object.entries(TIER_WEIGHTS).map(([name, value]) => `WHEN '${name}' THEN ${real(value)}`).join(" ")} ELSE ${real(DEFAULT_TIER_WEIGHT)} END`;
+    case "age":
+      return `((julianday(?) - julianday(at)) / ${real(MONTH_DAYS)})`;
+    case "constant":
+      return real(expr.value);
+    case "negative":
+      return `(-(${get(expr.value)}))`;
+    case "reciprocal":
+      return `(1.0 / ${get(expr.value)})`;
+    case "add":
+      return `(${get(expr.left)} + ${get(expr.right)})`;
+    case "multiply":
+      return expr.right.op === "reciprocal" ? `(${get(expr.left)} / ${get(expr.right.value)})` : `(${get(expr.left)} * ${get(expr.right)})`;
+    case "max":
+      return `max(${get(expr.left)}, ${get(expr.right)})`;
+  }
+}
+function rankedScoreSql(rank = "bm25(docs)") {
+  return sql(SCORE, rank);
+}
+var MONTH_DAYS = 30, TIER_WEIGHTS, DEFAULT_TIER_WEIGHT = 0.9, TIER_FACTOR, DENOMINATOR, RECENCY_FACTOR, SCORE, real = (value) => Number.isInteger(value) ? `${value}.0` : String(value);
+var init_search_score = __esm(() => {
+  TIER_WEIGHTS = { long: 1, capture: 0.5 };
+  TIER_FACTOR = { op: "tier" };
+  DENOMINATOR = { op: "add", left: { op: "constant", value: 1 }, right: { op: "max", left: { op: "constant", value: 0 }, right: { op: "age" } } };
+  RECENCY_FACTOR = { op: "reciprocal", value: DENOMINATOR };
+  SCORE = { op: "multiply", left: { op: "multiply", left: { op: "negative", value: { op: "rank" } }, right: TIER_FACTOR }, right: RECENCY_FACTOR };
+});
+
+// node_modules/@staix/agent-mem/src/memory/search-fts.ts
+var SCREENED_SCORE, SCREENED_SUBSTRING_SCORE;
+var init_search_fts = __esm(() => {
+  init_search_score();
+  SCREENED_SCORE = rankedScoreSql();
+  SCREENED_SUBSTRING_SCORE = rankedScoreSql("-1.0");
+});
+
+// node_modules/@staix/agent-mem/src/memory/capture-input.ts
+var init_capture_input = __esm(() => {
+  init_screen();
+  init_platform();
+  init_private_spans();
+});
+
+// node_modules/@staix/agent-mem/src/memory/capture.ts
+var SPOOL_MAX_BYTES;
+var init_capture = __esm(() => {
+  init_screen();
+  init_capture_input();
+  init_capture_input();
+  init_home();
+  init_shard();
+  init_lifecycle();
+  init_machine();
+  init_config2();
+  init_policy();
+  init_search_fts();
+  SPOOL_MAX_BYTES = 256 * 1024;
+});
+
 // node_modules/@staix/agent-mem/src/memory/style.ts
 function style(color) {
   return { color, ok: wrap(color, 32, 39), attention: wrap(color, 33, 39), error: wrap(color, 31, 39), dim: wrap(color, 2, 22), bold: wrap(color, 1, 22) };
@@ -15187,8 +15209,46 @@ var init_prune = __esm(() => {
   init_style();
 });
 
+// node_modules/@staix/agent-mem/src/memory/public-prune-witness.ts
+var init_public_prune_witness = __esm(() => {
+  init_generation();
+  init_prune();
+  init_shard_sync_format();
+});
+
+// node_modules/@staix/agent-mem/src/memory/shard-sync-format.ts
+var SHARD_PACK_MAX_BYTES;
+var init_shard_sync_format = __esm(() => {
+  init_bridge();
+  init_generation();
+  init_prune();
+  init_shard();
+  init_public_prune_witness();
+  SHARD_PACK_MAX_BYTES = 1024 * 1024;
+});
+
+// node_modules/@staix/agent-mem/src/memory/public-prune-inputs.ts
+var PUBLIC_PRUNE_GRAPH_MAX_BYTES, OBJECT_MAX, plans, batches;
+var init_public_prune_inputs = __esm(() => {
+  init_generation();
+  init_mutation();
+  init_platform();
+  init_store();
+  init_prune();
+  init_shard_sync_format();
+  init_public_prune_witness();
+  init_public_prune_input_chain();
+  init_public_prune_input_chain();
+  PUBLIC_PRUNE_GRAPH_MAX_BYTES = 80 * 1024 * 1024;
+  OBJECT_MAX = 1024 * 1024 + 64;
+  plans = new WeakMap;
+  batches = new WeakMap;
+});
+
 // node_modules/@staix/agent-mem/src/memory/generation-index.ts
 var init_generation_index = __esm(() => {
+  init_public_prune_inputs();
+  init_public_prune_view();
   init_shard();
   init_shard_bridge();
   init_generation();
@@ -15212,12 +15272,15 @@ var init_reader_lease = __esm(() => {
   init_generation();
   init_mutation();
   init_platform();
+  init_public_prune_view();
   open = new Map;
 });
 
 // node_modules/@staix/agent-mem/src/memory/store.ts
 var DEFAULT_TTL_MS, UNSETTLED_MS, DEFAULT_LEASE_MS, MIGRATION_BOOTSTRAP;
 var init_store = __esm(() => {
+  init_public_prune_view();
+  init_shard_bridge();
   init_cli_attribution();
   init_platform();
   init_private_spans();
@@ -15288,6 +15351,7 @@ var init_sync_screen = __esm(() => {
 // node_modules/@staix/agent-mem/src/memory/sync.ts
 var liveGroups;
 var init_sync = __esm(() => {
+  init_generation();
   init_platform();
   init_mutation();
   init_generation_sync();
@@ -22977,7 +23041,7 @@ init_security_baseline();
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.23.0",
+  version: "0.23.1",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",
@@ -22994,7 +23058,7 @@ var package_default = {
     bun: ">=1.4.2"
   },
   dependencies: {
-    "@staix/agent-mem": "0.13.0"
+    "@staix/agent-mem": "0.14.0"
   },
   devDependencies: {
     "@modelcontextprotocol/sdk": "^1.27.1",