@staix/agent-hub 0.8.1 → 0.10.0

package/src/hub/crash.ts

@@ -0,0 +1,104 @@
+import { chmodSync, existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import type { JournalDelivery } from "./delivery-journal.ts";
+
+/**
+ * Unplanned-crash recovery (issue #37). While the hub runs it keeps `sessions.json`: each attached peer's session
+ * identity (the adapters' recovery metadata: ids and launch options, never message text). A clean stop removes the
+ * file, so finding it at start means the previous run died.
+ */
+export interface SessionRecord {
+  peer: string;
+  /** The adapter's recovery metadata: `launch`, and `sessionId` / `threadId` / `sessionFile` where it has one. */
+  meta: Record<string, unknown>;
+}
+export interface SessionsFile {
+  instanceId: string;
+  at: number;
+  peers: SessionRecord[];
+}
+
+const fileOf = (stateDir: string) => join(stateDir, "sessions.json");
+
+export function writeSessions(stateDir: string, s: SessionsFile): void {
+  const tmp = `${fileOf(stateDir)}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(s)}\n`, { mode: 0o600 });
+  chmodSync(tmp, 0o600);
+  renameSync(tmp, fileOf(stateDir));
+}
+
+export function readSessions(stateDir: string): SessionsFile | undefined {
+  if (!existsSync(fileOf(stateDir))) return undefined;
+  try {
+    const s = JSON.parse(readFileSync(fileOf(stateDir), "utf8")) as SessionsFile;
+    return Array.isArray(s.peers) ? s : undefined;
+  } catch {
+    return undefined; // cut short by the crash: nothing to resume from
+  }
+}
+
+/**
+ * Only the run that wrote it removes it: a stop of an older instance must not erase a newer run's record. Without an
+ * instance id it goes whatever wrote it (a controlled restart, which has its own record of the peers).
+ */
+export function removeSessions(stateDir: string, instanceId?: string): void {
+  if (instanceId === undefined || readSessions(stateDir)?.instanceId === instanceId) rmSync(fileOf(stateDir), { force: true });
+}
+
+const str = (v: unknown) => (typeof v === "string" && v ? v : undefined);
+
+/**
+ * What can come back after a crash. `resume` holds the start arguments for peers the hub launches itself (Kimi through
+ * ACP `session/load`, Pi through its session file, the local worker afresh); the others say what the user has to do.
+ */
+export function crashPlan(records: SessionRecord[]): { peer: string; resume?: Record<string, string>; how: string }[] {
+  return records.map(({ peer, meta }) => {
+    const launch = (meta.launch && typeof meta.launch === "object" ? meta.launch : {}) as Record<string, unknown>;
+    const model = str(launch.model);
+    switch (peer) {
+      case "claude":
+        return { peer, how: "claude: the Claude Code plugin reconnects by itself while that session is still open" };
+      case "codex":
+        return { peer, how: `codex: its app-server died with the hub; run ahub codex again${str(meta.threadId) ? ` (its conversation was thread ${meta.threadId})` : ""}` };
+      case "kimi": {
+        const sessionId = str(meta.sessionId);
+        if (!sessionId) return { peer, how: "kimi: no session id was recorded; start it again with ahub kimi" };
+        return { peer, resume: { sessionId, ...(model ? { model } : {}) }, how: `kimi: session ${sessionId} can be loaded again (ACP session/load)` };
+      }
+      case "pi": {
+        const sessionFile = str(meta.sessionFile) ?? str(launch.sessionFile);
+        if (!sessionFile) return { peer, how: "pi: no session file was recorded; start it again with ahub pi" };
+        // A terminal Pi is run by the CLI that launched it, not by the hub: nothing here could start it again.
+        if (str(launch.mode) === "tui") return { peer, how: `pi: it ran in a terminal; start it again with ahub pi --mode tui --session-file ${sessionFile}` };
+        const args: Record<string, string> = { sessionFile };
+        for (const k of ["mode", "backend", "model"] as const) if (str(launch[k])) args[k] = str(launch[k])!;
+        return { peer, resume: args, how: `pi: its session file can be resumed (${sessionFile})` };
+      }
+      case "local": {
+        // `model` is also recorded as the route's fallback, and a model given at start pins it: pass one or the other.
+        const route = str(launch.route);
+        const args: Record<string, string> = route ? { route } : model ? { model } : {};
+        return { peer, resume: args, how: "local: starts again without its history (the worker keeps none across a hub stop)" };
+      }
+      default:
+        return { peer, how: `${peer}: reconnects by itself if its client is still running` };
+    }
+  });
+}
+
+/**
+ * The loss notice for one peer: the deliveries to it that the crash left in needs_review, with their senders and the
+ * tasks they were about. `taskTitle` must return the public title (`#n [pii]` for a PII task). No message text.
+ */
+export function lossNotice(lost: JournalDelivery[], taskTitle: (id: number) => string | undefined): string {
+  const lines = lost.map((d) => {
+    const from = [...new Set(d.originals.map((e) => e.from))].join(", ");
+    const tasks = [...new Set(d.originals.map((e) => Number(e.refs?.task)).filter((n) => Number.isInteger(n) && n > 0))].map((n) => taskTitle(n) ?? `#${n}`);
+    return `- delivery ${d.id} from ${from}${tasks.length ? `, about task ${tasks.join(", ")}` : ""}`;
+  });
+  return [
+    "The hub stopped unexpectedly and was started again. These deliveries to you were in flight when it stopped, so whether you acted on them is not known; the console has since marked each one completed, retried or discarded:",
+    ...lines,
+    "Check your work against them before you go on.",
+  ].join("\n");
+}

package/src/hub/daemon.ts

@@ -36,11 +36,15 @@ import { Bus } from "./bus.ts";
 import { DeliveryJournal } from "./delivery-journal.ts";
 import { startDashboard } from "./ui.ts";
 import { PROTOCOL, stateDirFor } from "./control-client.ts";
-import { newEnvelope, parseMarker, replyParent, sanitize, USER, type Envelope, type PeerId } from "./envelope.ts";
+import { newEnvelope, parseMarker, replyParent, sanitize, USER, type Envelope, type PeerId, type Priority } from "./envelope.ts";
 import { BasePeer, DEFAULT_WATCHDOG_MS, type PeerAdapter } from "./peers.ts";
 import { MemoryClient, workerUrl } from "../memory/client.ts";
 import { VERSION } from "../version.ts";
 import { projectChain, recallFor } from "../memory/recall.ts";
+import { conflictsOf } from "./conflicts.ts";
+import { crashPlan, lossNotice, readSessions, removeSessions, writeSessions, type SessionsFile } from "./crash.ts";
+import type { JournalDelivery } from "./delivery-journal.ts";
+import { DEFAULT_LIMITS, Limiter, PROJECT_LIMITS, type LimitsConfig } from "./limits.ts";
 import { changedPaths, repoOf, snapshot, Turns } from "./snapshots.ts";
 import { archiveRestartSnapshot, readRestartSnapshot, removeRestartSnapshot, restartPath, writeRestartSnapshot, type RecoveryPhase, type RestartPeerSnapshot, type RestartSnapshot } from "./restart.ts";
 
@@ -58,7 +62,8 @@ export interface HubConfig {
   omniroute: OmniRouteConfig;
   pi: { enabled: boolean; auto_start: boolean; cmd: string[]; backend: "auto" | "dgx" | "mlx"; dgx_coding: string; dgx_fast: string; max_steps: number };
   mlx: Pick<MlxOptions, "provider" | "host" | "runtimeDir" | "modelPath" | "port" | "model" | "sourceModel" | "contextWindow" | "maxInputTokens" | "maxTokens" | "maxConcurrency">;
-  local: { deny: string[]; bash_network: boolean; max_steps: number; read_allow: string[] };
+  /** `sandbox`: "deny-default" (issue #39), or "allow-default", the profile of 0.9 and earlier, kept for one release. */
+  local: { deny: string[]; bash_network: boolean; max_steps: number; read_allow: string[]; sandbox: "deny-default" | "allow-default" };
   /** Pending permission requests: how long they wait, and whether the desktop is told (issue #5). */
   approvals: { timeout_s: number; notify: boolean };
   /** An owner offline this long loses its open tasks back to routing; 0 turns it off (issue #6). */
@@ -67,6 +72,14 @@ export interface HubConfig {
   checks: { timeout_s: number; [cls: string]: string | number };
   /** A git tree at each turn boundary for `ahub turns` and `ahub undo`, the last `keep` per peer (issue #33). */
   snapshots: { enabled: boolean; keep: number };
+  /** Per-sender rate limits and repeat suppression for what agents send (issue #38). */
+  limits: LimitsConfig;
+  /** Reviewer choice from recorded review outcomes, once a reviewer has `min_reviews` of an implementer (issue #35). */
+  review: { adaptive: boolean; min_reviews: number };
+  /** After an unplanned stop, start Kimi, Pi and the local worker again with their recorded sessions (issue #37). */
+  recovery: { auto_resume_after_crash: boolean };
+  /** Per peer, the hub-tool capabilities it has (issue #39); a peer not listed has all of them. */
+  capabilities: Record<string, string[]>;
   /** Machine-local fields a config file set but git could not vouch for, and why (issue #17). */
   ignored?: string[];
 }
@@ -84,13 +97,17 @@ export const DEFAULT_CONFIG: HubConfig = {
   omniroute: DEFAULT_OMNIROUTE,
   pi: { enabled: false, auto_start: false, cmd: ["pi"], backend: "auto", dgx_coding: "coding", dgx_fast: "fast", max_steps: 30 },
   mlx: { provider: "ollama", model: "agenthub-fast-mlx:4b-8k", sourceModel: "qwen3.5:4b-mlx", contextWindow: 8192, maxInputTokens: 6000, maxTokens: 2048, maxConcurrency: 1 },
-  local: { deny: [], bash_network: false, max_steps: 30, read_allow: [] },
+  local: { deny: [], bash_network: false, max_steps: 30, read_allow: [], sandbox: "deny-default" },
   // Off here, so tests and a hub without a config file stay silent; a project's config defaults it on for macOS.
   approvals: { timeout_s: 120, notify: false },
   tasks: { release_after_min: 30 },
   checks: { timeout_s: 600 },
   // Off here like approvals.notify, so tests (whose cwd is this repository) write no objects; a project's config turns it on.
   snapshots: { enabled: false, keep: 20 },
+  limits: DEFAULT_LIMITS,
+  review: { adaptive: false, min_reviews: 5 },
+  recovery: { auto_resume_after_crash: false },
+  capabilities: {},
 };
 
 export { stateDirFor };
@@ -101,7 +118,7 @@ const PEER_ID = /^[a-z][a-z0-9-]{0,31}$/;
 
 /** The shared project config, then the machine's own file, which overrides it block by block (issue #17). */
 const CONFIG_FILES = ["config.json", "config.local.json"] as const;
-const CONFIG_BLOCKS = ["memory", "roles", "budget", "inference", "omniroute", "local", "pi", "approvals", "tasks", "checks", "snapshots", "mlx"];
+const CONFIG_BLOCKS = ["memory", "roles", "budget", "inference", "omniroute", "local", "pi", "approvals", "tasks", "checks", "snapshots", "limits", "review", "recovery", "capabilities", "mlx"];
 
 export function loadConfig(cwd: string): HubConfig {
   const ignored: string[] = [];
@@ -133,7 +150,7 @@ export function loadConfig(cwd: string): HubConfig {
     ...file,
     memory: { ...DEFAULT_CONFIG.memory, ...file.memory },
     roles: { ...DEFAULT_CONFIG.roles, ...file.roles },
-    budget: { ...DEFAULT_CONFIG.budget, ...file.budget },
+    budget: { ...DEFAULT_CONFIG.budget, wait_max_min: 30, ...file.budget }, // on with any project config (issue #36)
     inference: { ...DEFAULT_CONFIG.inference, ...file.inference },
     omniroute: { ...DEFAULT_CONFIG.omniroute, ...file.omniroute },
     local: { ...DEFAULT_CONFIG.local, ...file.local },
@@ -145,6 +162,10 @@ export function loadConfig(cwd: string): HubConfig {
     tasks: { ...DEFAULT_CONFIG.tasks, ...file.tasks },
     checks: { ...DEFAULT_CONFIG.checks, ...file.checks },
     snapshots: { ...DEFAULT_CONFIG.snapshots, enabled: true, ...file.snapshots },
+    limits: { ...PROJECT_LIMITS, ...file.limits }, // on with any project config (issue #38)
+    review: { ...DEFAULT_CONFIG.review, ...file.review },
+    recovery: { ...DEFAULT_CONFIG.recovery, ...file.recovery },
+    capabilities: { ...file.capabilities },
     mlx,
     ...(ignored.length ? { ignored } : {}),
   };
@@ -274,10 +295,57 @@ export async function startDaemon(opts: DaemonOptions) {
     : undefined;
   if ((restartFilePresent && !restored) || (recoveryOperation && !restored)) throw new Error("restart state is unreadable, missing, or does not match this project and recovery operation");
 
+  // A session record left by a run that never shut down means it crashed (issue #37). A controlled restart has its own.
+  const crashed = !recoveryOperation && !restartFilePresent ? readSessions(opts.stateDir) : undefined;
+  // A controlled restart's source may have been cut short before it removed its record: this run is not a crash, and
+  // a record left now would make the next ordinary start look like one.
+  if (recoveryOperation || restartFilePresent) try { removeSessions(opts.stateDir); } catch { /* nothing to remove */ }
+  const autoResume = config.recovery.auto_resume_after_crash === true; // a string "false" is not a yes
+  const startedAt = Date.now();
+  /** What crash recovery did or asks the user to do, for `ahub status`. */
+  const crashReport: string[] = [];
+
   // The hub's own model calls (digest condensation, task triage) are wired below, once the gateway client exists.
   let inference: Inference | undefined;
   const journal = new DeliveryJournal({ file: join(opts.stateDir, "hub.db"), projectRoot: opts.cwd, projectId, instanceId, operationId: recoveryOperation });
-  const bus = new Bus({ journal, batchMax: config.batch_max, batchMs: config.batch_ms, queueCap: config.queue_cap, condense: (envs) => inference?.condense(envs) ?? Promise.resolve(envs) });
+  // What the crash left in flight, per recipient: opening the journal just marked these needs_review.
+  const lost = new Map<PeerId, JournalDelivery[]>();
+  if (crashed) for (const d of journal.list()) if (d.state === "needs_review" && d.reason === "daemon stopped during delivery" && d.updatedAt >= startedAt) lost.set(d.peer, [...(lost.get(d.peer) ?? []), d]);
+  // Capabilities (issue #39): enforced here and in taskOp, never by role text alone. Unlisted peers keep everything.
+  // A listed peer whose value is not a list gets nothing: whoever listed it meant to narrow it.
+  const may = (peer: PeerId, cap: "propose" | "assign" | "remember" | "important"): boolean => {
+    if (peer === USER || peer === HUB || !Object.hasOwn(config.capabilities, peer)) return true;
+    const list = config.capabilities[peer];
+    return Array.isArray(list) && list.includes(cap);
+  };
+  const CAPABILITIES = ["propose", "assign", "remember", "important"];
+  for (const [peer, list] of Object.entries(config.capabilities)) {
+    if (!PEER_ID.test(peer)) log(`capabilities.${peer} is not a peer id; ignored (capabilities is an object of lists, one per peer)`);
+    else if (!Array.isArray(list)) log(`capabilities.${peer} is not a list: ${peer} gets no capabilities`);
+    else for (const c of list) if (!CAPABILITIES.includes(c)) log(`capabilities.${peer}: ${JSON.stringify(c)} is not a capability (${CAPABILITIES.join(", ")}); it grants nothing`);
+  }
+  // Agents only: the console user and the hub itself are never limited (issue #38).
+  // A typo such as "12/min" would read as 0, which turns a limit off without a word: the project default instead.
+  for (const k of Object.keys(config.limits)) if (!(k in PROJECT_LIMITS)) log(`limits.${k} is not a known limit; ignored`);
+  const limits = Object.fromEntries(Object.entries(PROJECT_LIMITS).map(([k, fallback]) => {
+    const v = config.limits[k as keyof LimitsConfig];
+    if (typeof v === "number" && Number.isFinite(v) && v >= 0) return [k, v];
+    log(`limits.${k}: ${JSON.stringify(v)} is not a number of 0 or more; using ${fallback}`);
+    return [k, fallback];
+  })) as unknown as LimitsConfig;
+  const limiter = new Limiter(limits);
+  const admit = (env: Envelope, parent?: string): string | undefined => {
+    // [FYI] is recorded and costs nobody a turn: nothing to limit.
+    if (env.from === USER || env.from === HUB || env.from === DIGEST || env.priority === "fyi") return undefined;
+    if (env.priority === "important" && !may(env.from, "important")) {
+      log(`capabilities: ${env.from} may not send important messages`);
+      return `${env.from} may not send important messages (no "important" in capabilities.${env.from}): send it without [IMPORTANT]`;
+    }
+    const refused = limiter.admit(env.from, env.to, env.priority, env.body, parent);
+    if (refused) log(`limits: ${env.from}: ${refused}`);
+    return refused;
+  };
+  const bus = new Bus({ journal, batchMax: config.batch_max, batchMs: config.batch_ms, queueCap: config.queue_cap, condense: (envs) => inference?.condense(envs) ?? Promise.resolve(envs), admit });
   startupCleanup.push(() => bus.closeJournal());
   const manualPaused = new Set<PeerId>(bus.manualPausedPeers()); // recovery never lifts an operator's pause
   let recoveryOperationId: string | undefined;
@@ -386,6 +454,8 @@ export async function startDaemon(opts: DaemonOptions) {
       }
     },
     triage: { classify: (title, detail) => inference?.triage(title, detail) ?? Promise.resolve(undefined), onCampus: () => onCampus() },
+    quota: (): ReturnType<Budget["headroom"]> => budget.headroom(), // budget is built below; this runs at assignment time
+    review: config.review,
   });
   board.onChange = (t, h) => event({ type: "task", id: t.id, event: h.event, by: h.by, state: t.state, owner: t.owner, reviewer: t.reviewer, class: t.class, pii: tasks.isPii(t) });
   // ---- budget relay -------------------------------------------------------------------------------------------
@@ -423,9 +493,9 @@ export async function startDaemon(opts: DaemonOptions) {
     attached: (peer) => bus.peers.has(peer),
     // Somebody other than the paused peer has to be there, or the handoff would only leave its tasks without an owner.
     canHandOff: (peer) => [...bus.peers.keys()].some((id) => id !== peer && ["idle", "busy"].includes(bus.stateOf(id))),
-    handoff: (peer, context) => tasks.reassignForPause(peer, context),
     // A reading that arrived through a file carries the file's time; a stale one must not look fresh in the export.
     reading: (peer, windows, hard, at) => event({ type: "quota", peer, windows: windows.map((w) => ({ id: w.id, used: w.used, ...(w.resetsAt ? { resetsAt: w.resetsAt } : {}) })), hard, ...(Math.abs(Date.now() - at) > 1000 ? { measuredAt: new Date(at).toISOString() } : {}) }),
+    handoff: (peer, context, urgentOnly) => tasks.reassignForPause(peer, context, urgentOnly),
     resumed: (record) => {
       if (record.peer === "kimi") kimiTokens.length = 0; // a new window: the old counts would pause it again at once
       const moved = record.moved.length ? `While you were paused these moved: ${record.moved.map((m) => `${m.title} (${m.role} -> ${m.to ?? "nobody"})`).join("; ")}. They stay where they are; ask the user if you should take one back.` : "Nothing was moved while you were paused.";
@@ -519,7 +589,19 @@ export async function startDaemon(opts: DaemonOptions) {
   const toolEnv = (peer: PeerId) => ({ AGENTHUB_MODE: "tools", AGENTHUB_PEER_ID: peer, AGENTHUB_STATE_DIR: opts.stateDir, AGENTHUB_PROJECT_DIR: opts.cwd });
 
   /** One entry point for the task tools, whoever calls them: MCP clients, the local worker, the console. */
-  async function taskOp(by: PeerId, op: string, a: Record<string, any>, inProcess = false, piiTurn = false): Promise<string> {
+  // A task op can write the board across awaits (triage, briefs, the dependents an approval releases): a recovery
+  // commit waits for those in flight, or its integrity digest misses their later writes. Completion checks outlive
+  // their op, so recoveryReady() also waits for `tasks.checksPending()`: a check the commit's stop kills would write.
+  let taskOpsInFlight = 0;
+  const taskOp = async (...args: Parameters<typeof taskOpBody>): Promise<string> => {
+    taskOpsInFlight++;
+    try {
+      return await taskOpBody(...args);
+    } finally {
+      taskOpsInFlight--;
+    }
+  };
+  async function taskOpBody(by: PeerId, op: string, a: Record<string, any>, inProcess = false, piiTurn = false): Promise<string> {
     // Inside a PII turn the worker's words may carry the PII whatever they are attached to: a note would go to
     // claude-mem (a cloud observer) and a new task could be routed to a cloud peer without matching any pattern.
     if (piiTurn && (op === "hub_remember" || op === "hub_task_propose")) throw new Error(`${op} is not available while working on a PII task: its text must not leave this machine`);
@@ -534,6 +616,16 @@ export async function startDaemon(opts: DaemonOptions) {
     // console reads a PII task's text deliberately, with `ahub task show <id>`.
     const onPrem = inProcess && by === "local";
     const line = (t: { id: number; state: string; owner: PeerId | null; reviewer: PeerId | null }) => `task #${t.id}: ${t.state}, owner ${t.owner ?? "none"}, reviewer ${t.reviewer ?? "none"}`;
+    const need = (cap: "propose" | "assign" | "remember", what: string) => {
+      if (may(by, cap)) return;
+      log(`capabilities: ${by} may not ${what} (${op})`);
+      throw new Error(`${by} may not ${what} (no "${cap}" in capabilities.${by} in .agenthub/config.json)`);
+    };
+    if (op === "hub_task_propose") {
+      need("propose", "propose tasks");
+      if (typeof a.owner === "string" && a.owner && a.owner !== by) need("assign", "hand tasks to other peers");
+    }
+    if (op === "hub_remember") need("remember", "save notes to shared memory");
     switch (op) {
       case "hub_task_propose": {
         const t = await tasks.propose(by, a);
@@ -552,7 +644,7 @@ export async function startDaemon(opts: DaemonOptions) {
         return tasks.isChecking(t.id) ? `${line(t)}; its check is queued or running, and the result comes as a task message` : line(t);
       }
       case "hub_review":
-        return line(await tasks.review(by, a.id, a.verdict, a.note));
+        return line(await tasks.review(by, a.id, a.verdict, a.note, a.unmet));
       case "hub_remember":
         return tasks.remember(by, a);
       case "hub_checkpoint": {
@@ -563,12 +655,12 @@ export async function startDaemon(opts: DaemonOptions) {
         return "checkpoint received; you will be paused now and resumed when your window resets";
       }
       case "hub_task_list":
-        return JSON.stringify(board.list(a.state).map((t) => (onPrem ? t : tasks.publicView(t))).map(({ history: _h, ...t }) => t));
+        return JSON.stringify(board.list(a.ready === true ? "proposed" : a.state).filter((t) => a.ready !== true || !tasks.waitsFor(t).length).map((t) => (onPrem ? t : tasks.publicView(t))).map(({ history: _h, ...t }) => t));
     }
     if (by !== USER) throw new Error(`${op} is a console command`);
     switch (op) {
       case "task_show":
-        return JSON.stringify(board.get(Number(a.id)) ?? `no task #${a.id}`, null, 2);
+        return JSON.stringify(board.get(Number(a.id)) ? { ...board.get(Number(a.id)), reviews: board.reviews({ task: Number(a.id) }) } : `no task #${a.id}`, null, 2);
       case "task_assign":
         return line(await tasks.assignTo(a.id, String(a.peer)));
       case "task_escalate":
@@ -614,9 +706,9 @@ export async function startDaemon(opts: DaemonOptions) {
     const r = budget.record(id); // one read per peer: status.json is rewritten on every bus event
     return r ? { paused: `budget: ${r.reason}, resets ${new Date(r.resetsAt).toLocaleTimeString()}` } : manualPaused.has(id) && bus.stateOf(id) === "offline" ? { paused: "manual" } : {};
   };
-  let releasing = false; // gone-owner release (#6): one run at a time, and a recovery commit waits for it
+  let releasing = false; // gone-owner release (#6) and the ready sweep (#34): one run at a time, and a recovery commit waits for it
   const recoveryReady = () => {
-    if (!recoveryActive() || releasing || (piReceipts?.inFlight ?? 0) !== 0 || permissions.size !== 0 || starting.size !== 0 || !budget.recoverySettled || [...bus.peers.values()].some((peer) => peer.state === "busy" || (peer instanceof PiPeer && !peer.recoveryReady))) return false;
+    if (!recoveryActive() || releasing || taskOpsInFlight !== 0 || tasks.checksPending() !== 0 || (piReceipts?.inFlight ?? 0) !== 0 || permissions.size !== 0 || starting.size !== 0 || !budget.recoverySettled || [...bus.peers.values()].some((peer) => peer.state === "busy" || (peer instanceof PiPeer && !peer.recoveryReady))) return false;
     if (!recoveryPeerSnapshot) return true;
     const current = recoveryPeers();
     return recoveryPeerSnapshot.every((saved) => {
@@ -673,23 +765,33 @@ export async function startDaemon(opts: DaemonOptions) {
     return [id, row];
   }));
   const digest = (value: unknown) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
-  // `prePlan`: the board as a hub from before the plan column (#31, 0.8.0) digested it. An empty plan is left out, so an
-  // upgrade from such a hub still verifies the board it was handed; a real plan never matches that shape.
-  const integrity = (prePlan = false) => {
+  // Task columns added since a source may have recorded its digest, newest first, with their empty values. A hub from
+  // before them digested its rows without them (0.8.x: no deps, #34; 0.7.x: no plan either, #31). `older` leaves out
+  // the newest `older` of them while they are empty, so an upgrade from such a hub verifies the board it was handed; a
+  // filled one stays in the row and never matches.
+  const ADDED_COLUMNS = [["deps", "[]"], ["plan", "{}"]] as const;
+  const integrity = (older = 0) => {
     const queues = Object.fromEntries(Object.keys(bus.snapshot().queues).sort().map((id) => [id, bus.queueIds(id)]));
-    const tasks = board.list().sort((a, b) => a.id - b.id);
-    const boardState = prePlan ? tasks.map(({ plan, ...t }) => (plan && Object.keys(plan).length ? { ...t, plan } : t)) : tasks;
+    const boardState = board.list().sort((a, b) => a.id - b.id).map((t) => {
+      const row: Record<string, unknown> = { ...t };
+      for (const [col, empty] of ADDED_COLUMNS.slice(0, older)) if (JSON.stringify(row[col]) === empty) delete row[col];
+      return row;
+    });
     const budgetState = budget.persistedPauseDigestRows().sort((a, b) => a.peer.localeCompare(b.peer));
     return { queues, manualPaused: [...manualPaused].sort(), boardDigest: digest(boardState), budgetDigest: digest(budgetState) };
   };
-  /** The integrity in the shape `expected` was recorded in: the current one unless only the pre-plan shape matches. */
+  /** The integrity in the shape `expected` was recorded in: the current one unless only an older shape matches. */
   const integrityAs = (expected: unknown) => {
     const now = integrity();
     if (!expected || JSON.stringify(expected) === JSON.stringify(now)) return now;
-    const old = integrity(true);
-    return JSON.stringify(expected) === JSON.stringify(old) ? old : now;
+    for (let older = 1; older <= ADDED_COLUMNS.length; older++) {
+      const then = integrity(older);
+      if (JSON.stringify(expected) === JSON.stringify(then)) return then;
+    }
+    return now;
   };
   const status = () => ({
+    ...(crashReport.length ? { crash: crashReport } : {}),
     projectId,
     instanceId,
     version: VERSION,
@@ -726,10 +828,11 @@ export async function startDaemon(opts: DaemonOptions) {
   const hubStartedAt = Date.now();
   const releaseGoneOwners = async () => {
     const limit = config.tasks.release_after_min;
-    if (!(limit > 0) || releasing || stopping || recoveryActive()) return;
+    if (releasing || stopping || recoveryActive()) return;
     releasing = true;
     try {
-      await releaseOwners(limit);
+      await tasks.releaseReady(); // #34: dependents a stop cut off between an approval and their assignment
+      if (limit > 0) await releaseOwners(limit);
     } finally {
       releasing = false;
     }
@@ -749,6 +852,74 @@ export async function startDaemon(opts: DaemonOptions) {
   releaseTimer.unref?.();
   intervals.push(releaseTimer);
 
+  // Early conflict detection (issue #32): the files a turn changed, against what other owners' open tasks changed
+  // before it. Warns both owners once per file and task; never blocks a write.
+  const conflictSeen = new Set<string>();
+  const detectConflicts = (peer: PeerId, turnId: string, since: number, changed: string[]) => {
+    const open = board.list().filter((t) => t.owner && ["proposed", "in_progress", "changes_requested"].includes(t.state));
+    const mine = open.filter((t) => t.owner === peer && t.state === "in_progress");
+    if (mine.some((t) => tasks.isPii(t))) return; // a PII turn's files are nobody else's business
+    const visible = open.filter((t) => !tasks.isPii(t));
+    const found = conflictsOf(peer, changed, turnLog!.touchesFor(visible.map((t) => t.id)), visible);
+    // A turn's diff holds whatever changed while it ran. Only what no overlapping turn of another peer changed is
+    // recorded as this peer's; while such a turn's changes are unknown (still running, say), nothing is (review of #49).
+    const record = turnLog!.get(turnId);
+    const overlap = record ? turnLog!.overlapping(record, Math.max(1, Number(config.snapshots.keep) || 20)) : { paths: [], unknown: [] };
+    if (!overlap.unknown.length) {
+      const theirs = new Set(overlap.paths);
+      const own = changed.filter((p) => !theirs.has(p));
+      for (const t of mine) turnLog!.touch(t.id, peer, own);
+    }
+    if (!found.length) return;
+    const others = turnLog!.busySince(peer, since);
+    const concurrent = others.length ? ` Concurrent: ${others.join(", ")} also worked during that turn, so some of these changes may be theirs.` : "";
+    const ours = mine.length ? ` (task ${mine.map((t) => `#${t.id}`).join(", ")})` : "";
+    for (const { task, paths: all } of found) {
+      const paths = all.filter((p) => !conflictSeen.has(`${peer}\0${task.id}\0${p}`));
+      if (!paths.length) continue;
+      for (const p of paths) conflictSeen.add(`${peer}\0${task.id}\0${p}`);
+      const owner = task.owner!;
+      // As with overlaps (#31): a file name that matches a PII pattern is never named to peers, the log or telemetry.
+      const named = paths.filter(tasks.nameable);
+      const hidden = paths.length - named.length;
+      const files = [...named, ...(hidden ? [`${hidden} file(s) whose names are withheld (they match a PII pattern)`] : [])].join(", ");
+      notify(`conflict: ${peer}${ours} changed ${files}, which #${task.id} (owner ${owner}) changed before${others.length ? ` (concurrent: ${others.join(", ")})` : ""}`);
+      event({ type: "conflict", peer, ...(mine[0] ? { task: mine[0].id } : {}), other: task.id, owner, paths: named, concurrent: others.length > 0 });
+      bus.publish(newEnvelope(HUB, `Your last turn${ours} changed ${files}, which ${owner}'s open task (${tasks.publicTitle(task)}) changed before it. Check that you did not overwrite that work, and settle it with ${owner} via hub_send.${concurrent}`, { to: [peer], kind: "task", ...(mine[0] ? { refs: { task: String(mine[0].id) } } : {}) }));
+      if (owner !== USER && owner !== HUB) bus.publish(newEnvelope(HUB, `${peer}'s last turn${ours} changed ${files}, which your open task #${task.id} changed before it. Check that your work there is intact.${concurrent}`, { to: [owner], kind: "task", refs: { task: String(task.id) } }));
+    }
+  };
+
+  // Session identities of the attached peers, kept current for crash recovery (issue #37); a clean stop removes them.
+  let sessionsWritten = "";
+  const recordSessions = () => {
+    if (stopping) return;
+    const peers = [...bus.peers.values()].filter((p) => p.state !== "offline").map((p) => {
+      let meta: Record<string, unknown> = {};
+      try { meta = (p as { recoveryMetadata?: () => Record<string, unknown> }).recoveryMetadata?.() ?? {}; } catch { /* not ready yet: the id alone */ }
+      return { peer: p.id, meta };
+    });
+    const text = JSON.stringify(peers);
+    if (text === sessionsWritten) return;
+    sessionsWritten = text;
+    try { writeSessions(opts.stateDir, { instanceId, at: Date.now(), peers }); } catch (error) { log(`session record not written: ${(error as Error).message}`); }
+  };
+  const recoverAfterCrash = async (prev: SessionsFile) => {
+    const report = (line: string) => (crashReport.push(line), notify(`crash recovery: ${line}`));
+    const lostCount = [...lost.values()].reduce((n, l) => n + l.length, 0);
+    report(`the previous hub run stopped without shutting down${lostCount ? `; ${lostCount} deliveries it had in flight are in needs_review (ahub queue list)` : ""}`);
+    for (const step of crashPlan(prev.peers)) {
+      if (!step.resume || !autoResume) {
+        const fresh = step.peer === "pi" && config.pi.enabled && config.pi.auto_start ? "; pi.auto_start starts a fresh session" : "";
+        report(`${step.how}${step.resume ? " (recovery.auto_resume_after_crash is off)" : ""}${fresh}`);
+        continue;
+      }
+      const r = await startPeer(step.peer, step.resume as Parameters<typeof startPeer>[1]).catch((e: Error) => ({ ok: false, error: e.message }));
+      report(r.ok ? `${step.peer} resumed: ${step.how}` : `${step.peer} not resumed (${String(r.error)}); ${step.how}`);
+    }
+    writeStatus();
+  };
+
   bus.tap((e) => {
     e = redact(e);
     uiEvents.push({ seq: ++uiSequence, event: e });
@@ -770,6 +941,7 @@ export async function startDaemon(opts: DaemonOptions) {
         event({ type: "turn_start", peer: e.peer, turn: id });
       } else if (!busy && open) {
         turns.delete(e.peer);
+        let afterTurn: (() => void) | undefined;
         let files: number | undefined;
         let snapshotMs = open.snapshotMs;
         if (turnLog && (open.private || holdsPii(e.peer))) {
@@ -780,11 +952,21 @@ export async function startDaemon(opts: DaemonOptions) {
           if (open.tree && end.tree) files = changed.length; // unknown, not zero, when a snapshot failed
           snapshotMs = (snapshotMs ?? 0) + end.ms;
           try { turnLog.end(open.id, end.tree, changed, Math.max(1, Number(config.snapshots.keep) || 20)); } catch (error) { log(`turn record ${open.id}: ${(error as Error).message}`); }
+          // After the turn_end event: a notice delivered at once starts the peer's next turn, which must come after it.
+          if (changed.length) afterTurn = () => detectConflicts(e.peer, open.id, open.start, changed);
         }
         event({ type: "turn_end", peer: e.peer, turn: open.id, ms: Date.now() - open.start, ...(open.tokens ? { tokens: open.tokens } : {}), ...(files !== undefined ? { files, snapshotMs } : {}) });
+        try { afterTurn?.(); } catch (error) { log(`conflict check after ${open.id}: ${(error as Error).message}`); }
       }
       if (e.state === "offline") offlineSince.set(e.peer, offlineSince.get(e.peer) ?? Date.now());
       else offlineSince.delete(e.peer);
+      // After a crash, a peer's first attach brings the loss notice: it leads its next delivery (issue #37).
+      if (e.state !== "offline" && lost.has(e.peer)) {
+        const still = lost.get(e.peer)!.filter((d) => { try { return journal.get(d.id)?.state === "needs_review"; } catch { return false; } });
+        lost.delete(e.peer);
+        if (still.length) bus.preface(e.peer, lossNotice(still, (id) => { const t = board.get(id); return t ? tasks.publicTitle(t) : undefined; }));
+      }
+      recordSessions();
     }
     else if (e.t === "undeliverable" || e.t === "overflow") {
       log(e.t === "undeliverable" ? `UNDELIVERABLE to ${e.peer} after retries: ${e.env.id} from ${e.env.from}` : `OVERFLOW ${e.peer}: dropped ${e.env.id} from ${e.env.from}`);
@@ -935,6 +1117,7 @@ export async function startDaemon(opts: DaemonOptions) {
       const kimi = new AcpPeer("kimi", {
         cmd,
         ...(args.model ? { launchModel: args.model } : {}),
+        ...(args.sessionId ? { resumeSessionId: args.sessionId } : {}),
         cwd: opts.cwd,
         watchdogMs: config.watchdog_ms,
         onPermission,
@@ -994,11 +1177,12 @@ export async function startDaemon(opts: DaemonOptions) {
       let piReply: Envelope | undefined;
       const ctx: ToolContext = {
         cwd: opts.cwd, deny: config.local.deny,
-        sandboxProfile: profile(opts.cwd, config.local.bash_network, config.local.read_allow, config.local.deny),
+        sandboxProfile: profile(opts.cwd, config.local.bash_network, config.local.read_allow, config.local.deny, config.local.sandbox === "allow-default" ? "allow" : "deny"),
         permit: (title) => onPermission({ peer: "pi", title, options: [{ optionId: "allow", name: "Allow", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] }).then((picked) => picked === "allow" && pi.acceptingTools && bus.peers.get("pi") === pi),
         send: (text, to) => {
           if (to?.some((id) => !bus.peers.has(id) && id !== USER)) return "error: unknown peer";
-          pi.onMessage?.(text, { inReplyTo: piReply, ...(to?.length ? { to } : {}) }); return "sent";
+          const refused = pi.onMessage?.(text, { inReplyTo: piReply, ...(to?.length ? { to } : {}) });
+          return typeof refused === "string" ? `not sent: ${refused}` : "sent";
         },
       };
       const routing = currentRouting(opts.cwd, log);
@@ -1084,7 +1268,7 @@ export async function startDaemon(opts: DaemonOptions) {
         omni,
         ...(sidecar && route ? { sidecar, route } : {}),
         fixedModel: args.model ?? routing.local.fixed_model,
-        tools: { deny: config.local.deny, bashNetwork: config.local.bash_network, readAllow: config.local.read_allow, permit },
+        tools: { deny: config.local.deny, bashNetwork: config.local.bash_network, readAllow: config.local.read_allow, sandbox: config.local.sandbox, permit },
         ...(capture ? { capture } : {}),
         taskTool: (name, a, turn) => taskOp("local", name, a, true, turn.pii),
         turnPolicy: (envs) => tasks.turnPolicy(envs),
@@ -1270,7 +1454,7 @@ export async function startDaemon(opts: DaemonOptions) {
       return { t: "recovery", ok: true, aborted: true, recovery: recoveryView() };
     }
     if (msg.op === "commit") {
-      if ((recoveryPhase !== "prepared" && recoveryPhase !== "preparing") || !recoveryReady()) return recoveryError("recovery is not ready; inspect until peers are idle and approvals are complete");
+      if ((recoveryPhase !== "prepared" && recoveryPhase !== "preparing") || !recoveryReady()) return recoveryError("recovery is not ready; inspect until peers are idle, approvals are complete and completion checks have finished");
       recoveryPhase = "prepared";
       recoveryPeerSnapshot ??= Object.values(recoveryPeers());
       const currentPeers = recoveryPeers();
@@ -1395,11 +1579,15 @@ export async function startDaemon(opts: DaemonOptions) {
         // A human at the console should not wait out the batch window; agents default to status.
         const { priority, body } = parseMarker(String(msg.body ?? ""), c.peer ? "status" : "important");
         if (!body) return void reply({ t: "sent", ok: false, error: "empty body" });
-        const to: PeerId[] | undefined = Array.isArray(msg.to) && msg.to.length ? msg.to.map(String) : undefined;
+        const to: PeerId[] | undefined = Array.isArray(msg.to) && msg.to.length ? [...new Set<string>(msg.to.map(String))] : undefined;
         const unknown = to?.filter((id) => !bus.knownPeers().includes(id)) ?? [];
         if (unknown.length) return void reply({ t: "sent", ok: false, error: `unknown peer: ${unknown.join(", ")}` });
         const inReplyTo = msg.reply_to ? bus.get(String(msg.reply_to)) : undefined;
-        const targets = bus.publish(newEnvelope(c.peer ?? USER, body, { priority, ...(to ? { to } : {}), ...(inReplyTo ? { inReplyTo } : {}) }));
+        // Built first: limits count the audience it really has (a reply goes to the parent's sender).
+        const env = newEnvelope(c.peer ?? USER, body, { priority, ...(to ? { to } : {}), ...(inReplyTo ? { inReplyTo } : {}) });
+        const refused = c.peer ? admit(env, inReplyTo?.id) : undefined;
+        if (refused) return void reply({ t: "sent", ok: false, error: refused });
+        const targets = bus.publish(env);
         if (c.peer && inReplyTo) bus.completeReply(c.peer, inReplyTo.id);
         return void reply({ t: "sent", ok: true, targets, recorded: priority === "fyi" });
       }
@@ -1526,6 +1714,8 @@ export async function startDaemon(opts: DaemonOptions) {
   }
   async function stopOnce(): Promise<void> {
     stopping = true;
+    // A stop someone asked for is not a crash, even if it then runs past the shutdown deadline: forget the sessions now.
+    try { removeSessions(opts.stateDir, instanceId); } catch { /* the state dir is gone */ }
     checksClosed = true;
     for (const kill of runningChecks) kill();
     log("hub stopping");
@@ -1581,7 +1771,14 @@ export async function startDaemon(opts: DaemonOptions) {
   writeStatus();
   log(`${RUN_START}${process.pid} control=127.0.0.1:${server.port} cwd=${opts.cwd}`);
   ready = true;
-  if (config.pi.enabled && config.pi.auto_start && !recoveryActive()) void startPeer("pi", {}).catch((error) => log(`Pi auto-start failed: ${error.message}`));
+  if (crashed) {
+    // This run owns the record now, so its clean stop removes it even if no peer attaches to rewrite it.
+    try { if (readSessions(opts.stateDir)?.instanceId === crashed.instanceId) writeSessions(opts.stateDir, { ...crashed, instanceId, at: Date.now() }); } catch (error) { log(`session record not adopted: ${(error as Error).message}`); }
+    void recoverAfterCrash(crashed).catch((error) => log(`crash recovery failed: ${(error as Error).message}`));
+  }
+  // Skipped only when crash recovery itself starts Pi again on its recorded session.
+  const piResumes = !!crashed && autoResume && crashPlan(crashed.peers).some((s) => s.peer === "pi" && s.resume);
+  if (config.pi.enabled && config.pi.auto_start && !recoveryActive() && !piResumes) void startPeer("pi", {}).catch((error) => log(`Pi auto-start failed: ${error.message}`));
   return { bus, token, port: server.port as number, stop, stopped: new Promise<void>((r) => (onStop = r)) };
   } finally {
     if (!ready) for (const cleanup of startupCleanup.reverse()) { try { cleanup(); } catch { /* preserve startup error */ } }

package/src/hub/events.ts

@@ -16,6 +16,7 @@ export type HubEvent =
   | { type: "tokens"; peer: string; n: number }
   | { type: "task"; id: number; event: string; by: string; state: string; owner: string | null; reviewer: string | null; class: string; pii: boolean }
   | { type: "overlap"; task: number; owner: string; others: { task: number; owner: string; paths: string[]; symbols?: string[] }[] }
+  | { type: "conflict"; peer: string; task?: number; other: number; owner: string; paths: string[]; concurrent: boolean }
   | { type: "quota"; peer: string; windows: { id: string; used: number; resetsAt?: number }[]; hard: boolean; measuredAt?: string };
 
 export type StampedEvent = HubEvent & { v: number; at: string };