@staix/agent-hub 0.6.4 → 0.7.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.7.1
+
+- Restore native sessions while unrelated agents remain in the same worktree; the coordinator continues to fence uncertain terminal creations (#48).
+- Allow a bounded inventory refresh after closing the captured terminal before reporting uncertain shutdown (#48).
+
+## 0.7.0
+
+- Persist queued deliveries and expose uncertain handoffs for explicit operator reconciliation (#46).
+- Show disconnected recipients, important pending counts and work needing review in CLI and dashboard; add console queue inspection and resolution (#46).
+- Separate adapter acceptance from execution completion, use protocol 10 receipts, and support controlled protocol 9 to 10 upgrades (#46).
+- Add an English daily operations and recovery guide with measured evidence and explicit operational limits (#46).
+
 ## 0.6.4
 
 - Refuse accidental CLI flags in `say` and `remember`, while preserving message text around the `--` separator (#40, #44).

package/README.md

@@ -4,15 +4,14 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.6.4. All six milestones of the design spec are implemented; the [smoke checklist](docs/smoke.md)
-says what has and has not been verified against real agents.
+Status: 0.7.1, control protocol 10. Durable delivery records distinguish queued
+work from uncertain execution. The [smoke checklist](docs/smoke.md) records
+verified paths and remaining prerequisites.
 
-Version 0.5.0 adds [controlled upgrade and session recovery](docs/specs/2026-09-20-upgrade-recovery-design.md).
-After bootstrapping a protocol-8 hub, use `ahub restart --dry-run` to inspect one
-project or `ahub upgrade --to <exact-version> --dry-run` to inspect an upgrade of
-the running projects. Remove `--dry-run` to review and schedule the operation;
-`ahub recovery status <operation-id>` reports progress. Existing protocol-5–7
-hubs require their matching CLI and an attended maintenance bootstrap.
+Read the [operations guide](docs/operations.md) for the daily workflow, queue
+reconciliation, and the staged protocol-9 to protocol-10 upgrade command.
+Controlled recovery preserves work; uncertain effects are never automatically
+replayed and may require operator review.
 
 ## Start here
 
@@ -29,7 +28,7 @@ cd <your project> && ahub init && ahub up && ahub tail
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.6.4 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.7.1 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.
@@ -39,6 +38,7 @@ instructions and `ahub setup` to refresh the Claude plugin. Restart the daemon
 and agent sessions so both load the update.
 
 - [Quickstart](docs/quickstart.md): install, first session, the local worker, the commands of a working day
+- [Operations guide](docs/operations.md): managed launchers, task/review flow, receipts, shutdown and recovery
 - [Security notes](docs/security.md): what the hub defends and what it does not
 - [Design spec](docs/specs/2026-09-19-agent-hub-design.md): how it is built and why, with every amendment made along the way
 - [Smoke checklist](docs/smoke.md): the live checks, and what has and has not been verified against real agents
@@ -101,9 +101,10 @@ starts. Inspect `ahub status` for requested routes and reported backend models.
 A project has one managed Pi session owner. Mode changes require the agent to
 settle and preserve the session file. Before the first generation, a live source
 verified to be empty can instead retain its exact session ID without a file.
-Missing history from a nonempty session blocks handover. Protocol 9 adds Pi recovery metadata;
-protocol-8 hubs can use controlled upgrade, while protocols 5-7 still require
-their matching CLI and an attended bootstrap.
+Missing history from a nonempty session blocks handover. Protocol 9 adds Pi
+recovery metadata. Protocol 10 is the 0.7.0 target for durable delivery
+receipts and conservative queue recovery; it is pending live verification.
+Older protocol hubs still require their matching CLI and an attended bootstrap.
 
 ## Runtime
 
@@ -165,7 +166,7 @@ worktrees recall their parent and composite identity. A shared-alias notice does
 not mean that task boards or agent sessions are shared. Provider quota readings
 may describe the same account and should not be added across projects.
 
-Before upgrading to protocol 7, stop existing hubs with their matching CLI, then
-update the package/plugin and restart the desired projects and agent sessions.
+Before upgrading an older hub, inspect the plan with the matching CLI.
 Incompatible or unverified processes are shown explicitly and are never killed by
-PID-name matching. See the [multi-project specification](docs/specs/2026-09-19-multi-project-design.md).
+PID-name matching. See the [operations guide](docs/operations.md) and the
+[multi-project specification](docs/specs/2026-09-19-multi-project-design.md).

package/docs/operations.md

@@ -0,0 +1,217 @@
+# Operations guide
+
+This guide describes ahub 0.7.1 and control protocol 10. Live verification
+results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
+
+## Install and start
+
+Use Bun 1.3 or newer. Install the released package and install its Claude
+channel plugin:
+
+```bash
+bun add -g @staix/agent-hub
+ahub setup
+cd <project>
+ahub init
+ahub up
+ahub tail
+```
+
+`ahub init` writes the project configuration and managed instruction blocks.
+Run it after an upgrade when those blocks need refreshing. `ahub setup`
+updates the shared Claude plugin. Keep `ahub tail` open when a local worker
+may request an approval.
+
+Managed launchers attach native peers to the project daemon:
+
+```bash
+ahub claude
+ahub codex
+ahub kimi
+ahub pi --mode headless --backend auto
+ahub local
+```
+
+Start only the peers configured for the project. A launcher records and checks
+its project and session identity; do not start a second terminal by guessing
+from a process name. For multiple projects, use the explicit selector before
+the command, for example `ahub --project /path/to/project codex`.
+
+## A two-agent task and review
+
+Choose an owner explicitly, then inspect the reviewer selected by the project
+routing policy before work begins:
+
+```bash
+ahub task propose implement "Update the parser" --owner codex --path src/parser.ts
+ahub board
+ahub task show <task-id>
+```
+
+The owner accepts with `hub_task_accept`, makes the change, and reports with
+`hub_task_done` including a summary and refs. The reviewer receives a review
+request and responds with `hub_review`. A console review uses:
+
+```bash
+ahub review <task-id> approved "verified against the requested behavior"
+# or
+ahub review <task-id> changes_requested "describe the required correction"
+```
+
+A task reaching `approved` is a board transition. It is not proof that an
+external side effect happened unless the task's refs and a live readback show
+that effect. The hub can reassign after repeated review changes according to
+the routing configuration.
+
+Use targeted messages for coordination:
+
+```bash
+ahub say @codex "[IMPORTANT] inspect the failing fixture"
+ahub say @claude "[STATUS] the test run is complete"
+ahub say @kimi "[FYI] the result is recorded"
+```
+
+`@peer` addresses one known peer. With no recipient, `ahub say` broadcasts
+to attached peers. `[IMPORTANT]` can bypass batching where the peer supports
+it; `[STATUS]` may batch, and `[FYI]` is recorded without follow-on
+delivery. A delivery or answer is not a task completion receipt.
+
+## Approvals and pauses
+
+Inspect permission requests in the terminal:
+
+```bash
+ahub tail
+ahub permit <request-id> allow
+```
+
+Use the exact option shown by `ahub tail`; do not approve an unresolved or
+unexpected request. `ahub pause <peer>` holds delivery and `ahub resume
+<peer>` releases a manual pause. Budget pauses are distinct:
+
+```bash
+ahub budget
+ahub budget resume <peer>
+```
+
+A budget pause remains authoritative until the budget command explicitly
+overrides it or the window resets. Check `ahub status` and `ahub board` after
+a pause or handoff.
+
+## Durable delivery and queue resolution
+
+Protocol 10 records each recipient delivery in the private project journal.
+The states are `queued`, `dispatching`, `accepted`, `completed`,
+`needs_review`, `failed`, and `discarded`. Adapter acceptance means that
+the native bridge received the delivery; it does not prove that the agent
+executed it. Only native completion or a correlated reply can settle a receipt.
+
+The console interface is:
+
+```text
+ahub queue list [--peer <id>] [--json]
+ahub queue show <delivery-id>
+ahub queue resolve <delivery-id> --action completed|retry|discard --reason "<text>"
+```
+
+These queue commands are part of 0.7.0 and are not available in the released
+0.6.4 CLI. Until protocol 10 is installed, use `ahub status`, `ahub tail`,
+and the task board. A known offline recipient may be queued explicitly once
+the 0.7.0 journal is active; broadcast and automatic assignment still require
+an attached peer.
+
+Resolution requires the current observed revision. A retry closes the old
+record and creates one linked attempt. Stale or conflicting resolutions fail.
+If dispatching or accepted work has an uncertain outcome after a crash,
+the system marks it `needs_review`. Establish evidence before choosing
+`completed`, `retry`, or `discard`. Timeouts,
+disconnects, cancellation, and partial effects are uncertain; do not replay
+them automatically.
+
+## Graceful shutdown
+
+Before stopping, let active turns and approvals settle when possible:
+
+```bash
+ahub status
+ahub tail
+ahub kill
+```
+
+The daemon waits for shutdown work that must survive termination. Afterward,
+run `ahub status` or `ahub up` and read the project state before restarting
+peers. A stopped daemon does not delete task records or the durable journal.
+Do not kill a native terminal by PID or start a replacement while ownership is
+uncertain.
+
+## Upgrade and crash recovery
+
+For an upgrade from 0.6.4 (protocol 9) or 0.7.0, use the patched coordinator without
+replacing the global CLI prematurely. Run from the project directory:
+
+```bash
+bunx --package @staix/agent-hub@0.7.1 ahub upgrade --to 0.7.1 --dry-run
+bunx --package @staix/agent-hub@0.7.1 ahub upgrade --to 0.7.1 --yes
+```
+
+The coordinator verifies and retains the exact target package, preserves its
+own source, and promotes the global CLI only after restored projects pass
+readback. Do not use the old protocol-9 coordinator to target protocol 10.
+
+Once the installed CLI is 0.7.1, review the current project or all registered
+projects first:
+
+```bash
+ahub restart --dry-run
+ahub upgrade --to 0.7.1 --dry-run
+```
+
+Apply only after reviewing the plan:
+
+```bash
+ahub restart --yes
+ahub upgrade --to 0.7.1 --yes
+ahub recovery status <operation-id>
+ahub recovery resume <operation-id>
+ahub recovery abort <operation-id>
+```
+
+The 0.7.0 transition stages the verified package and runs a retained
+coordinator from the source tree. It accepts a verified protocol-9 source and
+moves to a protocol-10 target. The source journal, queued envelopes, tasks,
+manual pauses, budget state, and native session identity are read back before
+release. The global CLI is promoted last.
+
+A lost commit or start reply is reconciled against the actual daemon identity,
+package digest, terminal binding, and phase receipt. An uncertain terminal
+creation is never repeated blindly. If Claude shows its development-channel confirmation screen, confirm it in
+the captured terminal, then run `ahub recovery resume <operation-id>`; resume must not open a duplicate terminal.
+Kimi and local sessions may start fresh with preserved routing and task context.
+Previously stopped projects stay stopped; only the reviewed running projects
+are upgraded.
+
+Do not run an upgrade with an incompatible active protocol, an unverified
+terminal binding, or an unresolved operation lock. Dry-run performs no package,
+plugin, daemon, or terminal mutation.
+
+## Evidence and limits
+
+The 0.6.4 release has real measurements in [the smoke checklist](smoke.md):
+Pi returned an exact file marker through MLX in 5.800 seconds in the production
+probe; the installed-package checks measured Pi MLX at 2.234 seconds, Pi DGX
+at 1.324 seconds, and a 208 ms MLX-to-DGX handover with the same session
+identity. A real Kimi 2.0.1 and Pi run showed queue counts and priority counts
+matching between the CLI and status file. These are individual observations,
+not a latency or reliability benchmark.
+
+The 0.6.4 production readback retained two envelopes for a disconnected Codex
+peer with identical IDs before and after recovery; general status lists attached
+peers and therefore did not show that backlog. No messages were deleted. The
+0.7.0 queue readback and receipt semantics remain pending live verification.
+
+Issue [#12](https://github.com/STAIxBWLB/agent-hub/issues/12) remains open for
+off-campus Access credentials and a natural near-limit budget pause. Tests,
+synthetic approvals, and an authenticated internal network do not close those
+prerequisites. Adapter acceptance is not task completion, and package
+installation or a passing test suite is not proof of a successful production
+cutover.

package/docs/quickstart.md

@@ -0,0 +1,121 @@
+# Quickstart
+
+agent-hub lets the coding agents on one machine work as peers in one project directory: Claude Code, Codex, Kimi Code, and `local`, a worker the hub runs itself on a model you host. You talk to all of them from the hub console.
+
+## Install
+
+Needs [Bun](https://bun.sh) 1.3 or newer and macOS (Linux works without the `local` worker's `bash` and `git` tools, which need the macOS sandbox).
+
+Node alone is not supported. Keep `bun` on PATH even if you install with npm.
+The registry package uses the `staix` organization scope. Install from npm:
+
+```bash
+bun add -g @staix/agent-hub                 # installs `ahub` (also as `agent-hub`)
+ahub setup                                # installs the Claude Code channel plugin from this package, then runs doctor
+```
+
+Or use the matching GitHub release:
+
+```bash
+bun add -g github:STAIxBWLB/agent-hub#v0.7.1
+ahub setup
+```
+
+From a clone instead: `git clone`, `bun install`, `bun link`.
+
+`ahub doctor` tells you what is installed, running and configured. Rows you do not need can stay red: the hub works with any subset of the peers.
+
+For managed launchers, two-agent task/review work, approvals, graceful shutdown,
+and upgrade or crash recovery, see the [operations guide](operations.md).
+
+## First session
+
+In your project directory, one terminal each:
+
+```bash
+ahub init          # .agenthub/config.json, .agenthub/routing.toml, marker blocks in CLAUDE.md and AGENTS.md
+ahub up            # the daemon for this directory (loopback only)
+ahub tail          # keep open: the conversation, state changes, permission requests
+ahub kimi          # Kimi, headless
+ahub codex         # Codex TUI, attached through the hub
+ahub claude        # Claude Code with the hub channel
+```
+
+Then talk:
+
+```bash
+ahub say "Each of you: reply with your name."      # broadcast
+ahub say @kimi "run the tests and report"          # one peer
+```
+
+## The local worker
+
+`local` needs an OpenAI-compatible gateway. Put yours in `.agenthub/config.json`:
+
+```json
+{ "omniroute": { "urls": ["http://your-gateway:20128/v1"], "api_key_file": "/path/to/key" } }
+```
+
+or set `OMNIROUTE_API_KEY`. Name the model in `.agenthub/routing.toml` (`[local] fixed_model`). Then `ahub local`. It works only inside the project, asks before it writes or runs anything (`ahub permit <id> allow`), and everything it executes is sandboxed.
+
+## The five commands of a working day
+
+| Command | What for |
+| --- | --- |
+| `ahub say [@peer] <text>` | talk; start with `[STATUS]` to let it batch, `[FYI]` for the record only |
+| `ahub task propose [--class <c>] <title>` | put work on the board; the hub picks an owner and a reviewer, and the class if you name none |
+| `ahub board` | who has what; `ahub task show <id>` for one task |
+| `ahub status` | peers, queues, pauses; `ahub budget` for quota windows |
+| `ahub ask <question>` | what the board, shared memory and the log say, with the ids the answer rests on |
+| `ahub kill` | stop the daemon and everything it started |
+
+More: `ahub help`. How it is built and why: [`docs/specs/2026-09-19-agent-hub-design.md`](specs/2026-09-19-agent-hub-design.md). What it protects and what it does not: [`docs/security.md`](security.md).
+
+## Browser dashboard
+
+After `ahub up`, run `ahub ui` to open the local dashboard. It refreshes the
+conversation stream, peer queues, task board, budget windows and approvals every
+second. No build step, web server command or browser extension is needed.
+
+Use the page to pause/resume a peer, send a console message, propose/assign tasks,
+and allow/deny agent permission requests. Local-worker requests show no tool
+contents: inspect them with `ahub tail`, then use `ahub permit <id> <option>` to
+allow. They can be denied on the page. PII task details remain available only via
+`ahub task show <id>` in the terminal.
+
+`ahub ui --no-open` prints a one-time link instead of launching a browser. Open it
+within 60 seconds. A session expires after one hour; run `ahub ui` again. Restarting
+the daemon invalidates all links and sessions. The UI listener is started only on
+request, binds loopback and stops with the daemon. Remote access is not supported.
+
+The stream retains the latest 200 events since the dashboard listener was started;
+it does not load historical logs. An unopened dashboard has no listener or event
+buffer. A paused budget window cannot be overridden on the page; the CLI's
+`ahub budget resume <peer>` remains the explicit override.
+
+
+## Concurrent project development (0.4.0)
+
+Initialize and start each repository/worktree separately, or use the global
+`--project <path|id>` prefix. `ahub projects` lists registered roots and live
+status; `ahub status --all` includes peer/task summaries. Within a subdirectory,
+commands use the nearest project inside that Git working-tree boundary.
+
+Open `ahub ui --all` from any directory to manage all registered hubs. Use Start
+to launch an initialized project, Use to view a running project, and Stop to stop
+the selected hub. Stop confirmation names its root. Terminal agent launch is
+still `ahub --project <path> claude` or `ahub --project <path> codex`.
+
+The manager is independent: `ahub ui --all --stop` closes its browser sessions
+without stopping project hubs. One-time links and session expiry work the same
+way as the project-local dashboard. For headless environments use `--no-open`.
+
+Project data is retained after stopping and after `ahub projects remove <id>`.
+To use a custom runtime directory initially, set both `AGENTHUB_PROJECT_DIR` to
+the canonical project root and `AGENTHUB_STATE_DIR` to the desired directory;
+subsequent explicit project selection reads the registered location.
+
+For dashboard-started model workers, put gateway URLs and credential-file
+references in that project's config. The manager never copies another project's
+gateway override or unattended setting. Native memory and provider accounts keep
+their existing sharing rules; the dashboard marks shared native memory aliases.

package/docs/security.md

@@ -0,0 +1,57 @@
+# Security notes
+
+agent-hub connects agents that can each run commands. This page says what the hub defends, how, and what it does not.
+
+## Trust boundaries
+
+- **Other agents' text is untrusted.** Every message that crosses from one peer to another is framed as untrusted input (a channel tag with `meta.source` for Claude, a fixed header line plus a standing instruction for the others). A message body cannot forge the hub's own headers: such lines are quoted (`sanitize`). Replies inherit a hop count capped at 3, so agents cannot ping-pong forever; neither a digest nor a steer can reset it.
+- **The control link is loopback plus a secret.** The daemon and the Codex proxy bind 127.0.0.1 only. The control WebSocket requires a per-run token (`.agenthub/state/control-token`, mode 600), and both servers refuse any request that carries an `Origin` header: any web page can open a WebSocket to localhost, and browsers always send `Origin`. External clients cannot claim the console user's id or a hub-managed peer's id.
+- **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after 120 s of silence. `--unattended` turns prompts off, says so loudly, and is never the default.
+- **The local worker is boxed in.** Paths are resolved through symlinks and must stay inside the project; a secrets denylist (`.env*`, keys, credential files, the hub's own state) applies to its file tools, its git arguments and its memory capture alike; `.git` and `.agenthub` are not writable. Writes, edits, shell commands and mutating git wait for approval, and the approver sees what will be written or run, with control characters escaped. Everything it executes runs under the macOS sandbox, attended or not: no writes outside the project, its git dir and temp; the home directory is unreadable except toolchains; no `.git/hooks` or `.git/config` writes; no network, loopback included. Without the sandbox there is no `bash` tool.
+- **PII has an enforced path.** A task matching `signals.pii_patterns` goes to `local` or to nobody; its text is absent from other peers' envelopes, the console stream, the log and the board listing; the console user reviews it; `local` answers such a turn to the console only, keeps it out of its history, refuses it when the only gateway is off campus, and may not save notes or spin off tasks during it. Nothing about it is sent to claude-mem, whose observer is a cloud model.
+- **Secrets stay where they are read.** The gateway key and Cloudflare Access values are read inside the gateway client and go only into request headers: never into logs, errors, envelopes, tool output, memory, or the generated Switchyard config (the key travels by environment variable name). Subscription logins of Claude, Codex and Kimi are never proxied or pooled.
+- **The hub's own model calls are fenced.** Digest condensation and task triage read agent-written text as data; their output is capped text framed as untrusted, or a value checked against a closed list. It is never used as a route, a peer id, a tool call or an instruction.
+
+## What is not defended
+
+- **A malicious local process running as you.** It can read the control token, `hub.db`, the project and your home directory without the hub's help. The token keeps web pages and other users out, not your own processes.
+- **An agent you launched without its own safeguards.** The hub frames and routes; it does not sandbox Claude Code, Codex or Kimi. `--unattended` plus untrusted peer text is a risk you opt into.
+- **What an approved command does inside the project.** The sandbox bounds where a command can write and what it can read, not whether `rm -rf src` was a good idea. Read what you approve.
+- **Network-level proof for PII.** The hub proves at its own boundaries (tests search every output) that PII text does not leave; packet-level verification of your gateway path is an operations check.
+- **Other operating systems' sandboxes.** Only macOS seatbelt is implemented.
+
+## Reporting
+
+Please report vulnerabilities privately through GitHub's "Report a vulnerability" on this repository rather than in a public issue.
+
+## Local dashboard sessions (issue #6)
+
+- `ahub ui` uses the authenticated console control connection to start an ephemeral HTTP listener on `127.0.0.1`. No UI listener exists before that command. The control and Codex proxy ports continue to refuse every `Origin` header.
+- The daemon issues a cryptographically random, single-use bootstrap ticket valid for 60 seconds. The CLI opens the dashboard with that ticket in the URL fragment, never a query string or the control token. The static page removes the fragment immediately and exchanges it with a same-origin POST. Tickets are consumed once; expired tickets cannot create sessions.
+- The exchange creates a separate random session, valid for one hour without renewal, in an `HttpOnly; SameSite=Strict; Path=/` cookie named for this listener's port. Sessions and tickets live only in memory and die with the daemon. HTTP is loopback-only; the cookie is not a substitute for the origin checks.
+- Every request must have the exact listener Host. Every data or action request, including the ticket exchange and snapshot polling, must be POST with the exact listener Origin and JSON content type. Foreign and missing origins, missing or expired sessions, oversized bodies and unknown actions are rejected. There is no CORS support. The only unauthenticated GET is the fixed, data-free HTML shell. No files or paths are served dynamically.
+- Responses are non-cacheable, cannot be framed, suppress referrers, and use a content security policy restricting scripts/styles to the shipped inline content and connections to this origin. Browser text is rendered with textContent, never interpreted as HTML.
+- The browser receives a bounded redacted event stream, peer states and queue counts, public task views, budget windows and pending approvals. Private envelope bodies and PII task text never cross this endpoint. Local-worker approval titles can contain PII, so their details remain terminal-only; the dashboard identifies the request and directs the operator to `ahub tail` before allowing it. Budget checkpoint summaries are also omitted.
+- The closed action list is permission response, peer pause/resume, console message, task proposal and task assignment. These use the existing daemon/task paths and budget pause rules. There is no generic control proxy, task-detail read, shell, file access, configuration edit, budget override, peer launch or daemon shutdown API.
+- The listener stops with the daemon. Expired sessions must be reopened with `ahub ui`; the page does not silently obtain new credentials.
+
+
+## Multi-project manager (protocol 7)
+
+The manager has its own loopback session server and authenticated local control
+endpoint. Browsers provide registered project IDs and expected daemon instance
+IDs; they cannot submit arbitrary paths, ports, PIDs or control tokens. The
+manager forwards the same closed, redacted dashboard operations as a project-local
+page. It cannot expose private task history or allow local-worker tools.
+
+Per-project control handshakes verify project, root and instance against the
+runtime manifest. Shutdown removes only the owning instance's runtime files and
+waits for owned child processes. Registry and manager startup claims serialize
+concurrent starts; uncertain ownership is reported, not forcibly reclaimed.
+A stale browser action against a restarted daemon is rejected, and mutations are
+never automatically replayed after a connection failure.
+
+The manager can start registered hubs in attended mode. Its project launches do
+not inherit state, unattended or gateway URL/key overrides from the session that
+opened the manager. Native memory is deliberately not a project-isolation boundary:
+its existing basename/worktree aliases and provider accounts can remain shared.