@staix/agent-hub 0.33.0 → 0.34.1

package/docs/verification/2026-11-07-compat-receipt-audit-1248.md

@@ -0,0 +1,256 @@
+# COMPAT receipt audit for CI automation (#1248 T0)
+
+Date: 2026-11-07. Task #761. Receipt pointers were read from `src/adapters/compat.ts` at `3440e7b10dc6b4537d56541774436aa4f7d49a92`. The data source is [manifest.json](../../scripts/compat-receipts/manifest.json). This audit runs no agent CLI, installer, model, TUI or workflow and changes no verified version.
+
+`autoAdmit` means policy eligibility after every required leg and artifact binding passes. It is not an implemented driver or a current pass. Missing work is not-run. One Mac arm64 job can repeat an eligible id's complete procedure, including its portable checks; the Linux category does not require an extra matrix job. Native macOS arm64 qualification is retained; a portable Linux fixture or source comparison does not qualify a Linux-only rerun. Qwen explicitly rejected Linux-only evidence. Optional, explicitly unverified model/TUI follow-ups do not become new admission requirements.
+
+Source comparison can produce hashes and diffs on Linux. Changed security/contract regions still require scoped human review: diff availability alone is never a passing review leg. T1 must report such work as not-run until reviewed.
+
+## Per-id scheduling and eligibility
+
+| COMPAT id | Model-free repeat | Remaining required scope | Installation | autoAdmit |
+| --- | --- | --- | --- | --- |
+| `pi` | Linux host permission/version fixtures; Mac RPC extension, SDK and tool receipts | Mac arm64 native | npm exact | `true` |
+| `claude-implementer` | Mac Write/Bash/rewrite transport and wrapper controls, synthetic provider | Mac arm64 native | npm exact; native-installer receipt boundary | `true` |
+| `codex-review` | Linux source comparison; Mac production metadata and native sandbox controls | Person-authorized model-backed tool call | npm exact | `false` |
+| `kimi-review` | Linux source comparison; Mac private config/broker/native allowlist controls | Mac arm64 native | GitHub asset + SHA-256 | `true` |
+| `jcode` | Linux source comparison; Mac serve/ACP/MCP and fixed-stream steering | Mac arm64 native | GitHub asset + SHA256SUMS | `true` |
+| `agy` | Mac CLI, synthetic MCP/hooks and Seatbelt controls | Interactive TUI/launcher nonce; no public install source | Unavailable | `false` |
+| `qwen` | Mac ACP/permission and install replay; recorded Linux run is additional | Mac arm64 repetition required | npm exact | `true` |
+| `qwen-dual` | Version/file-source checks are partial only | Real gateway model and PTY; OS not recorded | npm exact; historical artifact gap | `false` |
+
+The macOS requirement follows each receipt's native artifact/host boundary; the manifest does not claim those native procedures have passed on Linux. `qwen-dual`'s OS remains unspecified because its current receipt does not name one. `codex-review` stays false even with successful model-free preparation; its separately authorized 0.167.0 model-backed attempt has an unknown outcome. `agy` stays false independently of model-free sublegs because there is no public install source.
+
+## Installation evidence and boundaries
+
+Install methods describe exact future candidate acquisition, with no global installer. npm candidates must bind to their exact-version `dist.integrity`; release candidates must verify the versioned checksum and GitHub asset digest before bounded extraction. Reference hashes in the manifest are observed metadata or receipt bindings, not a new execution result.
+
+- Claude 2.1.319 was observed through the native installer while npm lagged. The exact npm version is now publicly available and its SRI was read without downloading or executing it. That does not equate its tarball with the receipt's native binary SHA.
+- Jcode's receipt identifies an installed release build. The v0.99.1 release API now supplies `jcode-macos-aarch64.tar.gz`, an asset SHA-256 and `SHA256SUMS`; that future acquisition recipe is not retrospective archive-execution proof.
+- Kimi's reference receipt already binds its official macOS arm64 archive to the GitHub digest and sibling checksum.
+- Codex's native binary hashes and qwen-dual's changing fnm global install are not npm SRI evidence. Public exact-version npm metadata was read separately.
+- No npm/GitHub method is invented for agy. Its unavailable install method makes an automated run not-run.
+
+## pi
+
+Current receipt: [2026-11-03-pi-150-compat.md](2026-11-03-pi-150-compat.md). `autoAdmit: true`. The admitted procedure is model-free; real inference and interactive coexistence are explicitly unverified follow-ups.
+
+### Recorded receipt legs
+
+- **native-identity**: `macos-runner`, required, runner OS `macos`. [## Results](2026-11-03-pi-150-compat.md): "Native identity".
+- **cli-rpc-session**: `macos-runner`, required, runner OS `macos`. [## Results](2026-11-03-pi-150-compat.md): "Real CLI extension load and RPC session identity".
+- **sdk-registration**: `macos-runner`, required, runner OS `macos`. [## Results](2026-11-03-pi-150-compat.md): "Installed SDK extension registration".
+- **tool-replay**: `macos-runner`, required, runner OS `macos`. [## Results](2026-11-03-pi-150-compat.md): "Managed tool callback and receipt replay".
+- **failed-tool**: `macos-runner`, required, runner OS `macos`. [## Results](2026-11-03-pi-150-compat.md): "Failed tool result".
+- **zero-provider-requests**: `macos-runner`, required, runner OS `macos`. [## Results](2026-11-03-pi-150-compat.md): "Zero requests reached the loopback provider".
+- **host-permission-modes**: `linux-ci`, required, runner OS `linux, macos`. [## Results](2026-11-03-pi-150-compat.md): "Host permission modes".
+- **version-admission**: `linux-ci`, required, runner OS `linux, macos`. [## Results](2026-11-03-pi-150-compat.md): "Version admission".
+- **isolated-home-cleanup**: `macos-runner`, required, runner OS `macos`. [## Identity and isolation](2026-11-03-pi-150-compat.md): "9551 entries, identical.".
+
+### Explicitly unverified follow-ups
+
+- **real-inference-tools-quota**: `account-or-model`, not required by the current admission receipt. [## Not verified](2026-11-03-pi-150-compat.md): "Account-backed inference, a model-generated tool request".
+- **interactive-coexistence**: `tui-desktop`, not required by the current admission receipt. [## Not verified](2026-11-03-pi-150-compat.md): "interactive TUI coexistence.".
+- **native-linux-intel**: `linux-ci`, not required by the current admission receipt. [## Not verified](2026-11-03-pi-150-compat.md): "Linux and Intel macOS.".
+
+## claude-implementer
+
+Current receipt: [2026-11-06-claude-implementer-2.1.319.md](2026-11-06-claude-implementer-2.1.319.md). `autoAdmit: true`. Permission transport and wrapper controls use a synthetic provider, with no real account or model required.
+
+### Recorded receipt legs
+
+- **write-allow**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Write transport (allow, deny, missing tool, hook deny/allow, MCP error, disconnect, pending, deadline)".
+- **write-deny**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Write transport (allow, deny, missing tool, hook deny/allow, MCP error, disconnect, pending, deadline)".
+- **write-missing-tool**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Write transport (allow, deny, missing tool, hook deny/allow, MCP error, disconnect, pending, deadline)".
+- **write-hook-deny**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Write transport (allow, deny, missing tool, hook deny/allow, MCP error, disconnect, pending, deadline)".
+- **write-hook-allow**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Write transport (allow, deny, missing tool, hook deny/allow, MCP error, disconnect, pending, deadline)".
+- **write-mcp-error**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Write transport (allow, deny, missing tool, hook deny/allow, MCP error, disconnect, pending, deadline)".
+- **write-disconnect**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Write transport (allow, deny, missing tool, hook deny/allow, MCP error, disconnect, pending, deadline)".
+- **write-pending**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Write transport (allow, deny, missing tool, hook deny/allow, MCP error, disconnect, pending, deadline)".
+- **write-deadline**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Write transport (allow, deny, missing tool, hook deny/allow, MCP error, disconnect, pending, deadline)".
+- **bash-allow**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Bash transport, production server and tool names, `tool_use_id` required".
+- **bash-deny**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Bash transport, production server and tool names, `tool_use_id` required".
+- **bash-missing-tool**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Bash transport, production server and tool names, `tool_use_id` required".
+- **bash-hook-deny**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Bash transport, production server and tool names, `tool_use_id` required".
+- **bash-hook-allow**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Bash transport, production server and tool names, `tool_use_id` required".
+- **bash-mcp-error**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Bash transport, production server and tool names, `tool_use_id` required".
+- **bash-disconnect**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Bash transport, production server and tool names, `tool_use_id` required".
+- **bash-pending**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Bash transport, production server and tool names, `tool_use_id` required".
+- **bash-deadline**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Bash transport, production server and tool names, `tool_use_id` required".
+- **bash-rewrite-allow**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Bash `updatedInput` command replacement (allow, deny)".
+- **bash-rewrite-deny**: `macos-runner`, required, runner OS `macos`. [## Runs](2026-11-06-claude-implementer-2.1.319.md): "Bash `updatedInput` command replacement (allow, deny)".
+- **wrapper-cwd**: `macos-runner`, required, runner OS `macos`. [## Native observations](2026-10-26-headless-claude-shell-context.md): "Persistent-shell control reports `sub` twice".
+- **wrapper-root**: `macos-runner`, required, runner OS `macos`. [## Native observations](2026-10-26-headless-claude-shell-context.md): "Fresh rewritten input executes the fixed root".
+- **wrapper-executable**: `macos-runner`, required, runner OS `macos`. [## Native observations](2026-10-26-headless-claude-shell-context.md): "Target identity equals the absolute host-selected executable".
+- **wrapper-poison-env**: `macos-runner`, required, runner OS `macos`. [## Native observations](2026-10-26-headless-claude-shell-context.md): "Injected native GIT_DIR and RIPGREP_CONFIG_PATH are absent".
+- **wrapper-host-env**: `macos-runner`, required, runner OS `macos`. [## Native observations](2026-10-26-headless-claude-shell-context.md): "Target HOME/PATH/TERM and peer identity equal the host fixture values".
+- **wrapper-tmp**: `macos-runner`, required, runner OS `macos`. [## Native observations](2026-10-26-headless-claude-shell-context.md): "Owned TMPDIR replaces native state".
+- **wrapper-replay**: `macos-runner`, required, runner OS `macos`. [## Native observations](2026-10-26-headless-claude-shell-context.md): "Same ticket's second execution returns the fixed refusal".
+- **wrapper-effect-once**: `macos-runner`, required, runner OS `macos`. [## Native observations](2026-10-26-headless-claude-shell-context.md): "Effect counter remains exactly 1 after replay".
+- **wrapper-quoted-paths**: `macos-runner`, required, runner OS `macos`. [## Native observations](2026-10-26-headless-claude-shell-context.md): "Spaces and apostrophes in root/executable paths".
+- **wrapper-cleanup**: `macos-runner`, required, runner OS `macos`. [## Native observations](2026-10-26-headless-claude-shell-context.md): "Native exit 0, host stopped, no remaining live native group members".
+- **wrapper-binary-fence**: `macos-runner`, required, runner OS `macos`. [## Native observations](2026-10-26-headless-claude-shell-context.md): "Binary unchanged across the case".
+- **upstream-impact-review**: `linux-ci`, required, runner OS `linux, macos`. [## Upstream changes since 2.1.318](2026-11-06-claude-implementer-2.1.319.md): "This receipt therefore rests on observed behavior only".
+
+### Explicitly unverified follow-ups
+
+- **real-provider-model**: `account-or-model`, not required by the current admission receipt. [## Evidence boundaries](2026-11-06-claude-implementer-2.1.319.md): "no real provider authentication, model tool selection".
+- **person-approval**: `tui-desktop`, not required by the current admission receipt. [## Evidence boundaries](2026-11-06-claude-implementer-2.1.319.md): "person approval interaction".
+- **native-task-resume-binding**: `account-or-model`, not required by the current admission receipt. [## Evidence boundaries](2026-11-06-claude-implementer-2.1.319.md): "task-session resume or production-daemon task binding is proved".
+- **host-seatbelt-policy**: `macos-runner`, not required by the current admission receipt. [## Host fixtures and ceilings](2026-10-26-headless-claude-shell-context.md): "The executable task-code profile is host policy verified separately by Darwin fixtures.".
+- **native-internal-timeout**: `macos-runner`, not required by the current admission receipt. [## Observations](2026-10-23-headless-claude-permissions.md): "native internal timeout not established".
+
+## codex-review
+
+Current receipt: [2026-11-06-codex-0167-reviewer-isolation.md](2026-11-06-codex-0167-reviewer-isolation.md). `autoAdmit: false`. Admission requires a successful separately authorized model-backed hub tool call, even when every model-free preparation leg passes.
+
+### Recorded receipt legs
+
+- **source-impact**: `linux-ci`, required, runner OS `linux, macos`. [## Source identity and re-read regions](2026-11-06-codex-0167-reviewer-isolation.md): "Each of the seven files read for 0.166.0".
+  - Changed source: not-run until the changed security/contract regions have been reviewed; never infer a pass from diff availability.
+- **tag-binding**: `linux-ci`, required, runner OS `linux, macos`. [## Source identity and re-read regions](2026-11-06-codex-0167-reviewer-isolation.md): "annotated tag object".
+- **version-negative**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "Refused only at version admission".
+- **empty-home-prepare**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "empty homes | All production preparation legs pass".
+- **ambient-prepare**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "synthetic ambient config | All production preparation legs pass".
+- **control**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "Control 0.166.0, empty homes".
+- **model-free-mcp-inventory-disabled-ambient**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "model-free-mcp-inventory-disabled-ambient".
+- **hub-tools-exact-allowlist**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "hub-tools-exact-allowlist".
+- **plugins-and-hooks-disabled**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "plugins-and-hooks-disabled".
+- **legacy-notify-disabled**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "legacy-notify-disabled".
+- **apps-disabled-effective-feature-readback**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "apps-disabled-effective-feature-readback".
+- **web-search-disabled**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "web-search-disabled".
+- **project-untrusted**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "project-untrusted".
+- **native-public-read-private-deny-write-deny**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "native-public-read-private-deny-write-deny".
+- **native-glob-and-symlink-private-deny**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "native-glob-and-symlink-private-deny".
+- **portable-core-name-and-state-deny**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "portable-core-name-and-state-deny".
+- **standard-host-credential-roots-denied**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "standard-host-credential-roots-denied".
+- **binary-config-stable**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "binary-config-stable".
+- **binary-hash-once-metadata-fence**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "binary-hash-once-metadata-fence".
+- **session-ephemeral**: `macos-runner`, required, runner OS `macos`. [## Native production preparation](2026-11-06-codex-0167-reviewer-isolation.md): "session-ephemeral".
+- **model-backed-hub-call**: `account-or-model`, required, runner OS `macos`. [## Reviewers](../agent-notes/adapters.md): "before marking a reviewer backend/version verified, record a successful model-backed hub tool call".
+
+### Explicitly unverified follow-ups
+
+- **effective-network-web**: `account-or-model`, not required by the current admission receipt. [## Compatibility and evidence boundaries](2026-11-06-codex-0167-reviewer-isolation.md): "The network setting is configured disabled without a separate probe.".
+- **default-profile-selection**: `account-or-model`, not required by the current admission receipt. [## Compatibility and evidence boundaries](2026-11-06-codex-0167-reviewer-isolation.md): "exec selecting the named default profile".
+- **native-linux**: `linux-ci`, not required by the current admission receipt. [## Compatibility and evidence boundaries](2026-11-06-codex-0167-reviewer-isolation.md): "No native Linux result is claimed.".
+
+## kimi-review
+
+Current receipt: [2026-11-06-kimi-251-reviewer-compat.md](2026-11-06-kimi-251-reviewer-compat.md). `autoAdmit: true`. The required native allowlist/broker controls use fixed loopback replies and synthetic credentials, without real inference.
+
+### Recorded receipt legs
+
+- **prepare**: `macos-runner`, required, runner OS `macos`. [## Isolated production and native controls](2026-11-06-kimi-251-reviewer-compat.md): "Production preparation, exact version/current/config, replace environment".
+- **inventory**: `macos-runner`, required, runner OS `macos`. [## Isolated production and native controls](2026-11-06-kimi-251-reviewer-compat.md): "Exactly two MCP tools, empty subagents and skills, config mode 0600".
+- **broker-refusals**: `macos-runner`, required, runner OS `macos`. [## Isolated production and native controls](2026-11-06-kimi-251-reviewer-compat.md): "Wrong task, third tool, missing authorization and revoked broker refusals".
+- **native-tool-loop**: `macos-runner`, required, runner OS `macos`. [## Isolated production and native controls](2026-11-06-kimi-251-reviewer-compat.md): "Actual native two-tool loop, fixed loopback responses".
+- **write-absent**: `macos-runner`, required, runner OS `macos`. [## Isolated production and native controls](2026-11-06-kimi-251-reviewer-compat.md): "Injected Write absent from inventory and native tool-not-found result".
+- **write-positive-control**: `macos-runner`, required, runner OS `macos`. [## Isolated production and native controls](2026-11-06-kimi-251-reviewer-compat.md): "Explicit Write positive control".
+- **environment-decoy**: `macos-runner`, required, runner OS `macos`. [## Isolated production and native controls](2026-11-06-kimi-251-reviewer-compat.md): "Trust-workspace environment decoy removed from launch environment".
+- **cleanup**: `macos-runner`, required, runner OS `macos`. [## Isolated production and native controls](2026-11-06-kimi-251-reviewer-compat.md): "Original synthetic config/credential bytes, owned-group and temporary cleanup".
+- **network-guard-control**: `macos-runner`, required, runner OS `macos`. [## Isolated production and native controls](2026-11-06-kimi-251-reviewer-compat.md): "A separate preload positive control blocked a".
+- **source-review**: `linux-ci`, required, runner OS `linux, macos`. [## Source review](2026-11-06-kimi-251-reviewer-compat.md): "Model-free native exact-two-tool inventories across all fixed-response requests are still required".
+  - Changed source: not-run until the changed security/contract regions have been reviewed; never infer a pass from diff availability.
+
+### Explicitly unverified follow-ups
+
+- **real-oauth-provider**: `account-or-model`, not required by the current admission receipt. [## Isolated production and native controls](2026-11-06-kimi-251-reviewer-compat.md): "login/provider readiness, real OAuth refresh".
+- **model-quota**: `account-or-model`, not required by the current admission receipt. [## Isolated production and native controls](2026-11-06-kimi-251-reviewer-compat.md): "model
+behavior/quality and quota remain unverified.".
+- **tui-coexistence**: `tui-desktop`, not required by the current admission receipt. [## Isolated production and native controls](2026-11-06-kimi-251-reviewer-compat.md): "attached-TUI coexistence".
+- **other-platforms**: `linux-ci`, not required by the current admission receipt. [## Evidence and decision](2026-11-06-kimi-251-reviewer-compat.md): "Other platforms, future versions and model-backed
+behavior are not inferred.".
+
+## jcode
+
+Current receipt: [2026-10-26-jcode-0.99.1.md](2026-10-26-jcode-0.99.1.md). `autoAdmit: true`. ACP, serve, MCP and running-turn steering use an isolated fixed-stream loopback provider; the real TUI/model follow-ups are not current admission legs.
+
+### Recorded receipt legs
+
+- **isolation**: `macos-runner`, required, runner OS `macos`. [## Isolation](2026-10-26-jcode-0.99.1.md): "Every process ran under an isolated `HOME` and `JCODE_HOME`".
+- **serve-cleanup**: `macos-runner`, required, runner OS `macos`. [## Contract legs (idle server, no model)](2026-10-26-jcode-0.99.1.md): "The process group is gone after SIGTERM.".
+- **acp-initialize-new-load-mode-ceilings**: `macos-runner`, required, runner OS `macos`. [## Contract legs (idle server, no model)](2026-10-26-jcode-0.99.1.md): "`session/load` returns `configOptions` and `models` only, with no `sessionId`.".
+- **mcp-owned-environment**: `macos-runner`, required, runner OS `macos`. [## Contract legs (idle server, no model)](2026-10-26-jcode-0.99.1.md): "its environment held exactly `AGENTHUB_PEER_ID` and `AGENTHUB_LAUNCH_ID`".
+- **telemetry**: `macos-runner`, required, runner OS `macos`. [## Contract legs (idle server, no model)](2026-10-26-jcode-0.99.1.md): "no telemetry file appeared in the isolated home.".
+- **active-turn-soft-interrupt**: `macos-runner`, required, runner OS `macos`. [## Steering leg (the 0.99.0 check, now on a running turn)](2026-10-26-jcode-0.99.1.md): "No real provider, key or model was involved.".
+- **source-comparison**: `linux-ci`, required, runner OS `linux, macos`. [## Source comparison v0.99.0..v0.99.1](2026-10-26-jcode-0.99.1.md): "232 commits, 300 files, read only through the GitHub compare API (nothing built).".
+  - Changed source: not-run until the changed security/contract regions have been reviewed; never infer a pass from diff availability.
+
+### Explicitly unverified follow-ups
+
+- **real-provider-model-tool-call**: `account-or-model`, not required by the current admission receipt. [## Not verified](2026-10-26-jcode-0.99.1.md): "A real account, provider or model, and a model turn that calls a hub tool".
+- **tui-repeat**: `tui-desktop`, not required by the current admission receipt. [## Not verified](2026-10-26-jcode-0.99.1.md): "The TUI form (`jcode --resume`)".
+- **linux-intel-second-instance**: `linux-ci`, not required by the current admission receipt. [## Not verified](2026-10-26-jcode-0.99.1.md): "A second instance running beside the base peer, and Linux or Intel macOS builds.".
+
+## agy
+
+Current receipt: [2026-11-03-agy-1.4.12-launcher-nonce.md](2026-11-03-agy-1.4.12-launcher-nonce.md). `autoAdmit: false`. No public installation source is available to the watcher; the current procedure also requires interactive TUI/launcher controls.
+
+### Recorded receipt legs
+
+- **isolation-seatbelt-cleanup**: `macos-runner`, required, runner OS `macos`. [## Environment and isolation](2026-11-03-agy-1.4.12-launcher-nonce.md): "No account and no cloud model call.".
+- **cli-contract**: `macos-runner`, required, runner OS `macos`. [# Antigravity 1.4.12 actual-hub nonce leg through the `ahub agy` launcher (#888)](2026-11-03-agy-1.4.12-launcher-nonce.md): "passed the CLI surface, the synthetic plugin MCP and hook contract and the normal TUI close".
+- **synthetic-plugin-mcp-hooks**: `macos-runner`, required, runner OS `macos`. [## Synthetic plugin MCP and hook contract: passed](2026-11-03-agy-1.4.12.md): "## Synthetic plugin MCP and hook contract: passed".
+- **normal-tui-close**: `tui-desktop`, required, runner OS `macos`. [## Result](2026-11-03-agy-1.4.12-launcher-nonce.md): "0, after `/exit` and Enter; agy closed by itself and printed its resume line".
+- **launcher-actual-hub-nonce**: `tui-desktop`, required, runner OS `macos`. [## Result](2026-11-03-agy-1.4.12-launcher-nonce.md): "the nonce from the scratch bus preface appeared in a provider request after the tool call".
+
+### Explicitly unverified follow-ups
+
+- **real-account-model-permission**: `account-or-model`, not required by the current admission receipt. [## Not verified](2026-11-03-agy-1.4.12-launcher-nonce.md): "A real account, a real model's tool choices and agy's own permission prompts".
+- **ide-linux-other-tui-tools**: `tui-desktop`, not required by the current admission receipt. [## Not verified](2026-11-03-agy-1.4.12-launcher-nonce.md): "`hub_send` and board calls through the TUI, the IDE form and Linux.".
+
+## qwen
+
+Current receipt: [2026-11-06-qwen-0268-acp.md](2026-11-06-qwen-0268-acp.md). `autoAdmit: true`. The admitted ACP/permission procedure uses no prompts or real model; macOS arm64 repetition remains required.
+
+### Recorded receipt legs
+
+- **artifact-private-install-integrity**: `macos-runner`, required, runner OS `macos`. [## Artifact and isolation](2026-11-06-qwen-0268-acp.md): "npm installed into a new private prefix with scratch HOME, cache and tmp, empty user/global npm configs".
+- **reviewed-optional-lifecycle-replay**: `macos-runner`, required, runner OS `macos`. [## Artifact and isolation](2026-11-06-qwen-0268-acp.md): "Fresh ACP and permission probes after the replay passed again.".
+- **native-acp-auth-session-modes**: `macos-runner`, required, runner OS `macos`. [## Native ACP, no prompts](2026-11-06-qwen-0268-acp.md): "ACP prompts sent: 0.".
+- **actual-published-permission-handler**: `macos-runner`, required, runner OS `macos`. [## Actual published permission handler](2026-11-06-qwen-0268-acp.md): "without a model-generated tool turn.".
+- **preload-network-cleanup**: `macos-runner`, required, runner OS `macos`. [## Artifact and isolation](2026-11-06-qwen-0268-acp.md): "This is preload evidence, not kernel network isolation.".
+- **native-macos-repetition**: `macos-runner`, required, runner OS `macos`. [## Actual macOS arm64 repetition](2026-11-06-qwen-0268-acp.md): "The Linux-only receipt did not prove admission on this Mac.".
+- **additional-linux**: `linux-ci`, recorded, not required for admission, runner OS `linux`. [# Qwen Code 0.26.8 ACP receipt](2026-11-06-qwen-0268-acp.md): "The earlier Linux x86_64 run is additional evidence.".
+
+### Explicitly unverified follow-ups
+
+- **real-model-microphone-tui-intel**: `account-or-model`, not required by the current admission receipt. [## Not verified](2026-11-06-qwen-0268-acp.md): "Microphone functionality, Intel macOS, a real login/provider, model-generated permission turns, model behavior, token/quota behavior and TUI qualification.".
+
+## qwen-dual
+
+Current receipt: [2026-10-25-qwen-dual-output-t0.md](2026-10-25-qwen-dual-output-t0.md). `autoAdmit: false`. The current receipt uses a real gateway model and an interactive PTY; model-free automation cannot admit a version.
+
+### Recorded receipt legs
+
+- **real-model**: `account-or-model`, required, runner OS `unspecified`. [# Qwen dual-output TUI verification, 2026-10-25](2026-10-25-qwen-dual-output-t0.md): "`flashnext/qwen3.8-flash-next` through the campus gateway".
+- **pty-harness**: `tui-desktop`, required, runner OS `unspecified`. [# Qwen dual-output TUI verification, 2026-10-25](2026-10-25-qwen-dual-output-t0.md): "the TUI ran on a pseudo-terminal (120x40).".
+- **Q2-submit-stream-queue**: `tui-desktop`, required, runner OS `unspecified`. [# Qwen dual-output TUI verification, 2026-10-25](2026-10-25-qwen-dual-output-t0.md): "queued, not interleaved".
+- **Q3-permissions-native-enter-deny-ceiling**: `tui-desktop`, required, runner OS `unspecified`. [# Qwen dual-output TUI verification, 2026-10-25](2026-10-25-qwen-dual-output-t0.md): "A tool that needs approval emits `control_request` `can_use_tool`".
+- **Q4-known-watchdog-ceiling**: `tui-desktop`, recorded, not required for admission, runner OS `unspecified`. [# Qwen dual-output TUI amendment, 2026-10-25 (#286 Part 3)](../specs/2026-09-19-agent-hub-design.md): "Q2, Q3, Q5 and Q6 pass; Q4's limit is stated".
+  - Recorded accepted watchdog limitation, not a passing cancellation capability; preserve it in future receipts.
+- **Q5-unread-fifo**: `tui-desktop`, required, runner OS `unspecified`. [# Qwen dual-output TUI verification, 2026-10-25](2026-10-25-qwen-dual-output-t0.md): "With `--json-file` a FIFO that nobody opened for reading".
+- **Q6-resume-no-replay**: `tui-desktop`, required, runner OS `unspecified`. [# Qwen dual-output TUI verification, 2026-10-25](2026-10-25-qwen-dual-output-t0.md): "did not replay any earlier `submit`, and appended to the event file.".
+- **Q7-version-identity**: `tui-desktop`, required, runner OS `unspecified`. [# Qwen dual-output TUI verification, 2026-10-25](2026-10-25-qwen-dual-output-t0.md): "`qwen --version` under the isolated environment: 0.26.1.".
+
+### Explicitly unverified follow-ups
+
+- None separately identified.
+
+## How an automation-opened PR gets checks
+
+Token choice remains with the person. This audit enables neither route. Current [GitHub trigger documentation](https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow) describes approval-required runs for GITHUB_TOKEN-created opened/synchronize/reopened PR events; dispatch events remain an exception. This qualifies the issue's older no-trigger shorthand and does not establish unattended PR CI. This is documentation readback, not a live token experiment.
+
+| Route | Benefit | Trade-off and integration work |
+| --- | --- | --- |
+| GITHUB_TOKEN plus explicit `check.yml` dispatch on `compat/<id>-<version>` | Avoids introducing a person-supplied App private key; dispatch can start the full check independently of PR-event approval | Publish job needs dispatch permission; capture and validate the run's exact head SHA. `check.yml` already accepts workflow_dispatch with normal inputs. Dispatch shares its existing check-main queue. It does not itself run the separate closing-refs or routing-receipt workflows; T2 must cover those gates or retain required approval. |
+| Person-provided GitHub App installation token for branch/PR writes | Normal PR events can start all existing checks automatically | The person must provide a narrowly scoped installation and App credentials, with rotation/revocation ownership. Credentials belong only in the publish job, never the third-party package/harness job. Normal review and merge gates remain. |
+
+The [workflow dispatch API](https://docs.github.com/en/rest/actions/workflows#create-a-workflow-dispatch-event) accepts a branch/tag ref and requires Actions write permission for fine-grained tokens. Run evidence must bind to the PR's actual head, rather than merely a branch name. [GitHub App authentication](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow) documents creating an installation token from the App credentials.
+
+Repository readback: `.github/workflows/check.yml` has workflow_dispatch, reads the dispatched SHA when there is no pull_request head, and uses check-main concurrency for ordinary dispatches. `.github/workflows/closing-refs.yml` and `.github/workflows/routing-receipt.yml` currently have only pull_request triggers. No workflow file changed here.
+
+## Scope and handoff
+
+T0 delivers data, provenance and a coverage test only. T1 still implements bounded isolated installation/probes and fail/not-run reporting; T2 still integrates the watcher, no-secret/read-only harness, artifact-only publisher and the person's chosen check-trigger mechanism. No token has been selected or provisioned, and no admission PR is auto-merged.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "ab8ae6f400d741ee9060d3087489e59996a72086",
+      "verifiedAgainst": "fc75a18dc2fa92b8372c19371c23ac6088d21ca3",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "ab8ae6f400d741ee9060d3087489e59996a72086",
+      "verifiedAgainst": "fc75a18dc2fa92b8372c19371c23ac6088d21ca3",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "ab8ae6f400d741ee9060d3087489e59996a72086",
+      "verifiedAgainst": "fc75a18dc2fa92b8372c19371c23ac6088d21ca3",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "ab8ae6f400d741ee9060d3087489e59996a72086",
+      "verifiedAgainst": "fc75a18dc2fa92b8372c19371c23ac6088d21ca3",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "10efdc8b0ea114ae858fff4ede65de09f6c55604",
+      "verifiedAgainst": "d31d7503fce542f37ed9cdacb3c40fc86786cb09",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -132,7 +132,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "ab8ae6f400d741ee9060d3087489e59996a72086",
+      "verifiedAgainst": "fc75a18dc2fa92b8372c19371c23ac6088d21ca3",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -243,7 +243,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "10efdc8b0ea114ae858fff4ede65de09f6c55604",
+      "verifiedAgainst": "d31d7503fce542f37ed9cdacb3c40fc86786cb09",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -291,7 +291,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "ab8ae6f400d741ee9060d3087489e59996a72086",
+      "verifiedAgainst": "fc75a18dc2fa92b8372c19371c23ac6088d21ca3",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -329,7 +329,7 @@
       ]
     },
     "src/cli/help.ts": {
-      "verifiedAgainst": "af37f8fd8b44a2c566aa47629ec5b02ee9f91d69",
+      "verifiedAgainst": "d31d7503fce542f37ed9cdacb3c40fc86786cb09",
       "paths": [
         "src/cli/main.ts",
         "src/cli/launch.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.33.0",
+  "version": "0.34.1",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.33.0",
+  "version": "0.34.1",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -10248,7 +10248,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@staix/agent-hub",
-    version: "0.33.0",
+    version: "0.34.1",
     description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
     license: "MIT",
     type: "module",

package/src/adapters/definitions/native-cli-claude-setup.ts

@@ -1,5 +1,7 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { homedir } from "node:os";
+import { stablePackageRoot } from "../../cli/install-paths.ts";
 import { realPath } from "../../hub/project.ts";
 import { VERSION } from "../../version.ts";
 
@@ -53,11 +55,11 @@ export type PluginState =
   | { state: "stale"; version: string; why: string; notices?: string[] };
 
 const safeDisplayValue = (value: unknown): string | undefined =>
-  typeof value === "string" && value.length <= 4096 && !/[\x00-\x1f\x7f]/.test(value) ? value : undefined;
+  typeof value === "string" && value.length <= 4096 && value.isWellFormed() && !/[\p{Cc}\p{Cf}]/u.test(value) ? value : undefined;
 
 function nonUserPluginNotices(plugins: InstalledPlugin[]): string[] {
   return plugins.filter(plugin => plugin.id === PLUGIN && plugin.scope !== "user").map(plugin => {
-    const scope = plugin.scope === "project" || plugin.scope === "local" ? plugin.scope : "unknown-scope";
+    const scope = safeDisplayValue(plugin.scope) ?? "unknown-scope";
     const path = safeDisplayValue(plugin.projectPath) ?? safeDisplayValue(plugin.installPath);
     const version = safeDisplayValue(plugin.version) ?? "unknown";
     return `${scope} plugin row preserved${path ? ` at ${path}` : ""} (version ${version}); setup never removes non-user scopes`;
@@ -90,14 +92,21 @@ export interface SetupStep {
  * The next thing `ahub setup` has to do, or nothing. One step at a time: the state is read again after every step,
  * because what a step leaves behind is Claude Code's business (removing a marketplace may uninstall its plugins).
  */
-export function nextStep(plugins: InstalledPlugin[], marketplaces: Marketplace[], packageRoot: string): SetupStep | undefined {
+export function nextStep(plugins: InstalledPlugin[], marketplaces: Marketplace[], packageRoot: string, personHome = homedir()): SetupStep | undefined {
   const root = real(packageRoot);
   const market = marketplaces.find((m) => m.name === MARKETPLACE);
   if (market && real(market.path ?? "") !== root) {
-    if (plugins.some(plugin => plugin.id === PLUGIN && plugin.scope !== "user")) return { why: `the ${MARKETPLACE} marketplace points at another source; removing it may remove non-user plugin rows`, argv: [], blocked: true };
+    const blockers = plugins.filter(plugin => plugin.id === PLUGIN && plugin.scope !== "user");
+    if (blockers.length) {
+      const display = (value: unknown) => JSON.stringify(safeDisplayValue(value) ?? "unknown");
+      const rows = blockers.map(plugin => `scope=${display(plugin.scope)}, projectPath=${display(plugin.projectPath)}, version=${display(plugin.version)}, installPath=${display(plugin.installPath)}`).join("; ");
+      const homeProject = blockers.some(plugin => safeDisplayValue(plugin.projectPath) !== undefined && real(plugin.projectPath!) === real(personHome));
+      const danger = homeProject ? ` Do not run 'claude plugin uninstall --scope project' from $HOME (${display(personHome)}): its project settings file ~/.claude/settings.json (${display(join(personHome, ".claude/settings.json"))}) is also the default home's user settings.` : "";
+      return { why: `the ${MARKETPLACE} marketplace points at another source; removing it may remove non-user plugin rows. Blocking rows: ${rows}. Hub-launched Claude sessions load their plugin from ~/.agenthub/releases (${display(join(personHome, ".agenthub/releases"))}), not from these plugin-cache rows. Standalone Claude sessions may still use them.${danger} Next: back up the selected Claude home's plugins/installed_plugins.json, review every listed row, and manually remove only rows confirmed stale and unused, preserving every other row; then rerun ahub setup. Setup never removes these rows automatically`, argv: [], blocked: true };
+    }
     return { why: `the ${MARKETPLACE} marketplace points at ${market.path ?? "another source"}, not at this package`, argv: ["claude", "plugin", "marketplace", "remove", MARKETPLACE] };
   }
-  if (!market) return { why: "register this package as a Claude Code plugin marketplace", argv: ["claude", "plugin", "marketplace", "add", root] };
+  if (!market) return { why: "register this package as a Claude Code plugin marketplace", argv: ["claude", "plugin", "marketplace", "add", stablePackageRoot(root)] };
   const state = pluginState(plugins, root);
   if (state.state === "missing") return { why: "install the user-scope channel plugin", argv: ["claude", "plugin", "install", PLUGIN, "--scope", "user"] };
   // Uninstall rather than update: with an unchanged version number an update has nothing to do.

package/src/cli/autonomy-homes.ts

@@ -22,12 +22,21 @@ export async function usedClaudeHomes(registry: Registry, home: string, env: Nod
   return { ...found, complete: found.complete && !notices.length, notices: [...notices, ...found.notices] };
 }
 export async function autonomyHomeStatus(registry: Registry, home: string, env: NodeJS.ProcessEnv, packageRoot: string, probe: ClaudeHomeProbe) {
-  const found = await usedClaudeHomes(registry, home, env), deadline = performance.now() + 6000;
+  const found = await usedClaudeHomes(registry, home, env);
+  // Doctor also inspects the existing default home; setup's selected write inventory stays unchanged.
+  const defaults = await discoverClaudeHomes({ home, env: { ...env, CLAUDE_CONFIG_DIR: undefined } });
+  // Discovery canonicalizes existing homes through realPath, so lexical aliases share one inspection.
+  const inspected = new Map(found.homes.map(selected => [selected.path, selected]));
+  for (const selected of defaults.homes.filter(selected => selected.exists)) {
+    const previous = inspected.get(selected.path);
+    inspected.set(selected.path, previous ? { ...previous, sources: [...new Set([...previous.sources, ...selected.sources])] } : selected);
+  }
+  const notices = [...new Set([...found.notices, ...defaults.notices])], deadline = performance.now() + 6000;
   const homes = [];
-  for (const selected of found.homes) {
+  for (const selected of inspected.values()) {
     const remaining = Math.floor(deadline - performance.now());
     if (remaining < 1) homes.push({ home: selected, plugin: { state: "unknown", reason: "The machine profile inventory time bound was reached." }, hook: checkClaudeProfileHook(selected) });
     else homes.push(await checkClaudeHome(selected, packageRoot, env, probe, Math.min(remaining, 6000)));
   }
-  return { homes, notices: found.notices, complete: found.complete && performance.now() <= deadline };
+  return { homes, notices, complete: found.complete && defaults.complete && performance.now() <= deadline };
 }

package/src/cli/claude-homes.ts

@@ -3,7 +3,7 @@ import { isAbsolute, join } from "node:path";
 import { realPath } from "../hub/project.ts";
 import { launcherOf, recordPath, MAX_COMMAND_MS, type ProcessIdentity } from "./terminal-recovery.ts";
 import { CLAUDE_PLUGIN_INVENTORY, PLUGIN, nextStep, pluginState, type InstalledPlugin, type Marketplace, type PluginState, type SetupStep } from "./setup.ts";
-import { checkClaudeProfileHook, type ClaudeProfileHookCheck } from "./claude-profile-hook.ts";
+import { checkClaudeProfileHook, type ClaudeProfileHookCheck, type ClaudeProfileHookOptions } from "./claude-profile-hook.ts";
 
 export type ClaudeHomeSource = "environment" | "default" | "recorded-launch";
 export interface ClaudeHome { path: string; exists: boolean; sources: ClaudeHomeSource[] }
@@ -93,12 +93,12 @@ export interface ClaudeHomeCheck {
 }
 
 /** Read-only per-home plugin inspection. Installation never proves that a live permission hook is present. */
-export async function checkClaudeHome(home: ClaudeHome, packageRoot: string, env: NodeJS.ProcessEnv, probe: ClaudeHomeProbe, timeoutMs = MAX_COMMAND_MS, probeMissingDefault = false): Promise<ClaudeHomeCheck> {
+export async function checkClaudeHome(home: ClaudeHome, packageRoot: string, env: NodeJS.ProcessEnv, probe: ClaudeHomeProbe, timeoutMs = MAX_COMMAND_MS, probeMissingDefault = false, hookOptions?: ClaudeProfileHookOptions): Promise<ClaudeHomeCheck> {
   if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_COMMAND_MS) throw new Error("invalid Claude plugin probe time bound");
-  const hook = checkClaudeProfileHook(home);
+  const hook = checkClaudeProfileHook(home, hookOptions);
   const unknown = (): ClaudeHomeCheck => ({ home, plugin: { state: "unknown", reason: "Claude plugin inventory is unavailable or invalid for this home." }, hook });
   if (hook.state === "refused") return unknown();
-  if (!home.exists && !(probeMissingDefault && home.sources.includes("default"))) return { home, plugin: { state: "missing" }, next: nextStep([], [], packageRoot), hook };
+  if (!home.exists && !(probeMissingDefault && home.sources.includes("default"))) return { home, plugin: { state: "missing" }, next: nextStep([], [], packageRoot, validPath(env.HOME) ? env.HOME : undefined), hook };
   const scoped = claudeHomeEnvironment(home, env), deadline = performance.now() + timeoutMs;
   const read = async (argv: readonly string[]): Promise<unknown[] | undefined> => {
     const remaining = Math.floor(deadline - performance.now());
@@ -118,6 +118,6 @@ export async function checkClaudeHome(home: ClaudeHome, packageRoot: string, env
       (row.version === undefined || typeof row.version === "string" && row.version.length <= 64 && (row.id !== PLUGIN ? !/[\u0000-\u001f\u007f-\u009f]/.test(row.version) : /^[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$/.test(row.version))) &&
       (row.installPath === undefined || validPath(row.installPath))) ||
       !marketplaces.every(row => object(row) && typeof row.name === "string" && row.name.length <= 256 && (row.path === undefined || validPath(row.path)))) return unknown();
-    return { home, plugin: pluginState(plugins as InstalledPlugin[], packageRoot), next: nextStep(plugins as InstalledPlugin[], marketplaces as Marketplace[], packageRoot), hook };
+    return { home, plugin: pluginState(plugins as InstalledPlugin[], packageRoot), next: nextStep(plugins as InstalledPlugin[], marketplaces as Marketplace[], packageRoot, validPath(env.HOME) ? env.HOME : undefined), hook };
   } catch { return unknown(); }
 }

package/src/cli/claude-profile-hook.ts

@@ -1,9 +1,9 @@
-import { closeSync, constants, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readSync, renameSync, rmSync, writeFileSync, type Stats } from "node:fs";
+import { closeSync, constants, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readSync, renameSync, rmSync, statSync, writeFileSync, type Stats } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { dirname, isAbsolute, join } from "node:path";
-import { canonicalJson } from "../hub/packs.ts";
 import { factsHook } from "./facts-hook.ts";
 import { shellQuote } from "./shell-quote.ts";
+import { stableBunRuntime, stablePackageRoot } from "./install-paths.ts";
 import type { ClaudeHome } from "./claude-homes.ts";
 
 export interface ClaudeProfileHookOptions { script?: string; runtime?: string }
@@ -25,11 +25,29 @@ interface HookPlan {
 }
 
 function hookEntry(options: ClaudeProfileHookOptions): Record<string, unknown> {
-  const script = options.script ?? join(import.meta.dir, "claude-profile-hook.ts"), runtime = options.runtime ?? process.execPath;
+  const script = options.script ?? join(stablePackageRoot(join(import.meta.dir, "../..")), "src/cli/claude-profile-hook.ts"), runtime = options.runtime ?? stableBunRuntime();
   if (!validPath(script) || !validPath(runtime)) throw new Error("invalid profile hook command");
   return { matcher: "*", hooks: [{ type: "command", command: `${shellQuote(runtime)} ${shellQuote(script)} --run`, timeout: 5 }] };
 }
 
+interface ManagedProfileHook { entry: Record<string, unknown>; hook: Record<string, unknown>; runtime: string; script: string }
+/** Own only the generated command grammar; matcher, timeout and caller metadata remain theirs. */
+function managedProfileHook(candidate: unknown): ManagedProfileHook | undefined {
+  if (!object(candidate) || !Array.isArray(candidate.hooks) || candidate.hooks.length !== 1) return;
+  const hook = candidate.hooks[0];
+  if (!object(hook) || hook.type !== "command" || typeof hook.command !== "string") return;
+  const match = /^'((?:[^']|'\\'')*)' '((?:[^']|'\\'')*)' --run$/.exec(hook.command);
+  if (!match) return;
+  const runtime = match[1]!.replace(/'\\''/g, "'"), script = match[2]!.replace(/'\\''/g, "'");
+  if (!validPath(runtime) || !validPath(script) || !script.endsWith("/src/cli/claude-profile-hook.ts")
+    || hook.command !== `${shellQuote(runtime)} ${shellQuote(script)} --run`) return;
+  return { entry: candidate, hook, runtime, script };
+}
+
+function hookPathPresent(file: string): boolean {
+  try { return statSync(file).isFile(); } catch { return false; }
+}
+
 function settingsSource(file: string): { value: Record<string, unknown>; source?: HookPlan["source"] } {
   let fd: number | undefined;
   try {
@@ -67,13 +85,24 @@ function planClaudeProfileHook(home: ClaudeHome, options: ClaudeProfileHookOptio
     if (value.hooks !== undefined && !object(value.hooks)) return refuse("Claude's hook configuration is malformed.");
     const hooks = value.hooks ?? {}, existing = hooks.PreToolUse ?? [];
     if (!Array.isArray(existing)) return refuse("Claude's PreToolUse hook list is malformed.");
-    const entry = hookEntry(options), expected = canonicalJson(entry);
-    const matches = existing.filter(candidate => canonicalJson(candidate) === expected).length;
-    const next = matches === 1 ? undefined : `${JSON.stringify({ ...value, hooks: { ...hooks, PreToolUse: [...existing.filter(candidate => canonicalJson(candidate) !== expected), entry] } }, null, 2)}\n`;
+    const entry = hookEntry(options), expectedCommand = (entry.hooks as { command: string }[])[0]!.command;
+    const managed = existing.map(managedProfileHook), first = managed.find(candidate => candidate !== undefined);
+    const count = managed.filter(candidate => candidate !== undefined).length;
+    const stale = managed.some(candidate => candidate && (!hookPathPresent(candidate.runtime) || !hookPathPresent(candidate.script)));
+    const configured = count === 1 && first?.hook.command === expectedCommand && !stale;
+    const normalized = existing.flatMap((candidate, index) => {
+      const owned = managed[index];
+      if (!owned) return [candidate];
+      return owned === first ? [{ ...owned.entry, hooks: [{ ...owned.hook, command: expectedCommand }] }] : [];
+    });
+    if (!first) normalized.push(entry);
+    const next = configured ? undefined : `${JSON.stringify({ ...value, hooks: { ...hooks, PreToolUse: normalized } }, null, 2)}\n`;
     if (next !== undefined && Buffer.byteLength(next, "utf8") > MAX_SETTINGS_BYTES) return refuse("Claude's settings would exceed the bounded profile settings size.");
-    return { file, home: directory, parent, source, next, check: matches === 1
-      ? { state: "installed", reason: "The project-neutral profile hook is configured; this does not prove live permission enforcement." }
-      : { state: "missing", reason: matches ? "Duplicate managed profile hooks need normalization." : "The project-neutral profile hook is not configured." } };
+    let reason = "The project-neutral profile hook is not configured for this install; run ahub setup.";
+    if (count > 1) reason = "Duplicate managed profile hooks need normalization; run ahub setup.";
+    if (stale) reason = "A managed profile hook script or runtime is missing; run ahub setup to refresh the selected home's hook.";
+    if (configured) reason = "The project-neutral profile hook is configured; this does not prove live permission enforcement.";
+    return { file, home: directory, parent, source, next, check: { state: configured ? "installed" : "missing", reason } };
   } catch { return refuse("Claude profile settings could not be safely inspected; no settings were changed."); }
 }