@staix/agent-hub 0.9.0 → 0.11.0

package/src/hub/routing.ts

@@ -135,6 +135,9 @@ export function assign(
     now?: number;
     /** Peers demoted for this task's class, with their recent failure weight (issue #36). */
     demoted?: Record<PeerId, number>;
+    /** Review record per implementer, then per reviewer, for this class (issue #35); followed only when `adaptive`. */
+    reviews?: Record<PeerId, Record<PeerId, { score: number; n: number }>>;
+    adaptive?: { min: number };
   } = {},
 ): Assignment {
   const policy = routing.classes[task.class];
@@ -177,10 +180,25 @@ export function assign(
     return out;
   };
   /** Demoted peers go behind the rest for this class (owners only); each group is then ordered by quota. */
-  const rank = (ok: PeerId[], role: "owner" | "reviewer"): PeerId[] => {
+  /** Reviewers with enough recorded reviews of this owner's work swap places by how those reviews held up. */
+  const byRecord = (list: PeerId[], owner: PeerId | undefined): PeerId[] => {
+    const record = owner ? opts.reviews?.[owner] : undefined;
+    if (!record || !Object.keys(record).length) return list;
+    trace.push(`  review record with ${owner} in ${task.class}: ${Object.entries(record).map(([r, s]) => `${r} ${s.n} reviews, ${Math.round(s.score * 100)}% held`).join("; ")}${opts.adaptive ? "" : " (review.adaptive is off)"}`);
+    if (!opts.adaptive) return list;
+    const known = (p: PeerId) => (record[p] && record[p].n >= opts.adaptive!.min ? record[p].score : undefined);
+    const slots = list.flatMap((p, i) => (known(p) === undefined ? [] : [i]));
+    const sorted = slots.map((i) => list[i]!).sort((a, b) => known(b)! - known(a)!);
+    const out = [...list];
+    slots.forEach((i, k) => (out[i] = sorted[k]!));
+    return out;
+  };
+  const rank = (ok: PeerId[], role: "owner" | "reviewer", owner?: PeerId): PeerId[] => {
     const down = role === "owner" ? ok.filter((p) => opts.demoted?.[p]) : [];
     if (down.length) trace.push(`  demoted for ${task.class}: ${down.map((p) => `${p} (${opts.demoted![p]!.toFixed(1)} recent failures)`).join(", ")}`);
-    return [...byDrain(ok.filter((p) => !down.includes(p))), ...byDrain(down)];
+    const ranked = [...byDrain(ok.filter((p) => !down.includes(p))), ...byDrain(down)];
+    // The review record comes after quota, so it decides among reviewers that have one: idle, then record, then quota.
+    return role === "reviewer" ? byRecord(ranked, owner) : ranked;
   };
 
   const pick = (list: PeerId[], role: "owner" | "reviewer", not?: PeerId): PeerId | undefined => {
@@ -190,7 +208,7 @@ export function assign(
       trace.push(`  ${role} candidate ${peer}: ${why ? `skipped, ${why}` : states[peer]}`);
       if (!why) ok.push(peer);
     }
-    const ranked = rank(ok, role);
+    const ranked = rank(ok, role, not);
     // Demotion applies to local and Pi too: a demoted one loses its place ahead of the cloud peers.
     const localTier = ranked.filter((p) => (p === LOCAL || p === PI) && !(role === "owner" && opts.demoted?.[p]));
     if (localTier.length) return localTier.find((p) => states[p] === "idle") ?? localTier[0]; // local/Pi stays ahead of an idle cloud peer

package/src/hub/tasks.ts

@@ -27,6 +27,8 @@ export interface TasksDeps {
   recordOverlap?: (task: number, owner: PeerId, others: { task: number; owner: PeerId; paths: string[]; symbols?: string[] }[]) => void;
   /** Quota per peer from fresh readings (issue #36): routing drains the windows that reset soonest first. */
   quota?: () => Record<PeerId, { headroom: number; resetsAt?: number }>;
+  /** Reviewer choice from recorded review outcomes (issue #35); off unless the project config turns it on. */
+  review?: { adaptive: boolean; min_reviews: number };
   /** Optional: name a class for a task proposed without one. `onCampus` says whether the model call stays on campus. */
   triage?: { classify: (title: string, detail: string) => Promise<TaskClass | undefined>; onCampus: () => Promise<boolean> };
 }
@@ -37,17 +39,24 @@ const ESCALATE_AFTER = 2;
 // ponytail: fixed constants; make them config when someone needs to tune them.
 const DEMOTION_HALF_LIFE_MS = 24 * 3_600_000;
 const DEMOTE_AT = 1.5;
+/** An approval counts as contradicted when work on the same places fails within this window (issue #35). */
+const CONTRADICTION_WINDOW_MS = 7 * 86_400_000;
 const OPEN: Task["state"][] = ["proposed", "in_progress", "changes_requested"];
 /** Board events that leave a task where its completion check found it; any other event means it moved on meanwhile. */
 const QUIET_EVENTS = new Set(["answer", "reviewer changed"]);
 
+/** A project path as one spelling (#67): no leading `./`, no repeated or trailing `/`; the root is `.`. */
+export const normPath = (p: string) => p.replace(/^(\.\/)+/, "").replace(/\/{2,}/g, "/").replace(/\/+$/, "") || ".";
+
 /** Same path, or one is a directory of the other; the project root (`.`) holds everything. */
 export const samePlace = (a: string, b: string) => {
-  const norm = (p: string) => p.replace(/^\.\//, "").replace(/\/+$/, "") || ".";
-  const [x, y] = [norm(a), norm(b)];
+  const [x, y] = [normPath(a), normPath(b)];
   return x === "." || y === "." || x === y || x.startsWith(`${y}/`) || y.startsWith(`${x}/`);
 };
 
+/** Events that hand a task to an owner (or take it away); newer history records that owner on them (#67). */
+const OWNERSHIP_EVENTS = new Set(["assigned", "escalated", "reassigned", "unassigned"]);
+
 /** One line of model-written text: whitespace (newlines included) collapses, so it can never start a forged log line. */
 const text = (v: unknown) => (typeof v === "string" && v.trim() ? v.replace(/\s+/g, " ").trim().slice(0, 300) : undefined);
 /** A list of short strings; a lone string counts as a list of one. */
@@ -57,7 +66,7 @@ const fields = (input: unknown) => (input && typeof input === "object" && !Array
 /** Tool callers are models: inputSchema is not enforced on the way in, so refs are normalized before they reach the board. */
 function cleanRefs(input: unknown): TaskRefs {
   const r = fields(input);
-  const paths = textList(r.paths);
+  const paths = [...new Set(textList(r.paths).map(normPath))];
   const out: TaskRefs = {};
   for (const k of ["repo", "branch", "commit"] as const) if (text(r[k])) out[k] = text(r[k])!;
   if (paths.length) out.paths = paths;
@@ -67,7 +76,7 @@ function cleanRefs(input: unknown): TaskRefs {
 /** The same for a plan (issue #31): only its four lists, each of short strings. */
 function cleanPlan(input: unknown): TaskPlan {
   const r = fields(input);
-  return Object.fromEntries(PLAN_KEYS.map((k) => [k, textList(r[k])] as const).filter(([, v]) => v.length));
+  return Object.fromEntries(PLAN_KEYS.map((k) => [k, k === "paths" ? [...new Set(textList(r[k]).map(normPath))] : textList(r[k])] as const).filter(([, v]) => v.length));
 }
 
 /** A plan as one line for other owners; the whole plan is on the board. */
@@ -122,11 +131,66 @@ export class Tasks {
     return Object.fromEntries([...sums].filter(([, s]) => s.bad >= DEMOTE_AT && s.bad > s.good).map(([p, s]) => [p, s.bad]));
   }
 
-  /** What assignment weighs besides states and policy: quota and demotion. */
+  /** How each reviewer's reviews of each implementer's work in a class held up (issue #35). */
+  reviewRecord(cls: TaskClass): Record<PeerId, Record<PeerId, { score: number; n: number }>> {
+    // Counted per task: a review that asked for changes and then approved is one review, not two.
+    const c = new Map<string, { reviewed: Set<number>; contradicted: Set<number> }>();
+    for (const r of this.d.board.reviews({ class: cls })) {
+      const key = `${r.implementer}\0${r.reviewer}`;
+      const s = c.get(key) ?? { reviewed: new Set<number>(), contradicted: new Set<number>() };
+      (r.kind === "contradicted" ? s.contradicted : s.reviewed).add(r.task);
+      c.set(key, s);
+    }
+    const out: Record<PeerId, Record<PeerId, { score: number; n: number }>> = {};
+    for (const [key, s] of c) {
+      const [implementer, reviewer] = key.split("\0") as [PeerId, PeerId];
+      const n = s.reviewed.size;
+      if (n) (out[implementer] ??= {})[reviewer] = { score: (n - [...s.contradicted].filter((t) => s.reviewed.has(t)).length) / n, n };
+    }
+    return out;
+  }
+
+  /** Who asked for changes on the current owner's work: requests made before the task changed hands were about someone else's. */
+  private requestedChanges(task: Task): Set<PeerId> {
+    // The window starts where the owner last changed. Newer entries carry the owner, so handing a task to the owner it
+    // already had (`ahub task assign <id> <owner>`) keeps the window; older ones do not, and any of them starts it.
+    let since = -1;
+    let owner: PeerId | null | undefined = null;
+    task.history.forEach((h, i) => {
+      if (!OWNERSHIP_EVENTS.has(h.event)) return;
+      if (h.owner === undefined || h.owner !== owner) since = i;
+      owner = h.owner;
+    });
+    return new Set(task.history.slice(since + 1).filter((h) => h.event === "changes_requested").map((h) => h.by));
+  }
+
+  /** What assignment weighs besides states and policy: quota, demotion and the review record. */
   private weights(cls: TaskClass) {
     const now = Date.now();
     const quota = this.d.quota?.();
-    return { now, demoted: this.demoted(cls, now), ...(quota ? { quota } : {}) };
+    return { now, demoted: this.demoted(cls, now), reviews: this.reviewRecord(cls), ...(quota ? { quota } : {}), ...(this.d.review?.adaptive ? { adaptive: { min: this.d.review.min_reviews } } : {}) };
+  }
+
+  /**
+   * Work on these places failed (a check failure, or changes requested): approvals of other tasks on the same places
+   * within the window were contradicted. Each approval counts once.
+   */
+  private contradict(failed: Task): void {
+    if (this.isPii(failed)) return; // its places are left out everywhere else too
+    const now = Date.now();
+    const mine = this.places(failed);
+    for (const t of this.d.board.list("approved")) {
+      if (t.id === failed.id || !t.owner || this.isPii(t)) continue;
+      const approval = [...t.history].reverse().find((h) => h.event === "approved");
+      if (!approval || now - approval.at > CONTRADICTION_WINDOW_MS || approval.by === USER) continue;
+      const theirs = this.places(t);
+      // Blame needs the same file or symbol: a directory or `.` would contradict every approval under it. Older rows
+      // were stored as written, so both sides are compared in one spelling.
+      const file = (p: string) => normPath(p) !== "." && theirs.paths.some((q) => normPath(q) === normPath(p));
+      const same = mine.paths.some(file) || mine.symbols.some((x) => theirs.symbols.includes(x));
+      if (!same || this.d.board.reviews({ task: t.id }).some((r) => r.kind === "contradicted")) continue;
+      this.d.board.recordReview({ implementer: t.owner, reviewer: approval.by, class: t.class, kind: "contradicted", task: t.id });
+    }
   }
 
   async propose(by: PeerId, input: { title?: string; detail?: string; class?: string; refs?: TaskRefs; plan?: TaskPlan; owner?: PeerId; after?: unknown; urgent?: unknown }): Promise<Task> {
@@ -202,6 +266,18 @@ export class Tasks {
   /** Whether a model-written name may be shown to other peers and in the log: one matching a PII pattern may be PII. */
   nameable = (t: string): boolean => !this.isPii({ signals: detectSignals({ title: "", detail: t, refs: {} }, this.d.routing(), this.d.cwd) });
 
+  /**
+   * Model-written free text about an ordinary task (a done summary, a review note with its unmet items, a handoff)
+   * that matches a PII pattern stays on this machine (#69): every peer gets a stub, `local` too, which handles an
+   * ordinary task's turn like any other (gateway off campus allowed, memory capture on). The board keeps the text for
+   * `ahub task show`. A PII task's messages are private already.
+   */
+  private screen(task: Task, text: string, what: string, to: PeerId | null | undefined): string {
+    if (!text || this.isPii(task) || to === USER || this.nameable(text)) return text;
+    this.d.notify(`task #${task.id}: the ${what} was withheld from ${to ?? "a peer"} (it matches a PII pattern)`);
+    return `[${what} withheld: it matches a PII pattern; ahub task show ${task.id}]`;
+  }
+
   /** Where two tasks meet: shared paths, then shared symbols, leaving out any name that matches a PII pattern. */
   private where(hit: { paths: string[]; symbols: string[] }): string {
     const shown = [...hit.paths.filter(this.nameable), ...hit.symbols.filter(this.nameable).map((s) => `symbol ${s}`)];
@@ -319,7 +395,7 @@ export class Tasks {
   private async sendTask(task: Task, a: Assignment, context?: string, overlap = ""): Promise<void> {
     const pii = this.isPii(task);
     const brief = pii ? undefined : await this.d.briefs?.forTask(task.owner!, task).catch(() => undefined);
-    const rejected = task.history.filter((h) => h.event === "changes_requested").map((h) => `- ${h.by}: ${h.note ?? ""}`);
+    const rejected = task.history.filter((h) => h.event === "changes_requested").map((h) => `- ${h.by}: ${this.screen(task, h.note ?? "", "review note", a.owner)}`);
     const facts = [`class ${task.class}`, a.owner === PI ? `backend pi/${a.piBackend ?? "dgx"}` : "", task.refs.paths?.length ? `paths ${task.refs.paths.join(", ")}` : "", task.refs.branch ? `branch ${task.refs.branch}` : "", a.reviewer ? `reviewer ${a.reviewer}` : "no reviewer"].filter(Boolean).join("; ");
     const plan = planText(task.plan);
     const body = [
@@ -331,7 +407,7 @@ export class Tasks {
       rejected.length ? `Earlier review notes:\n${rejected.join("\n")}` : "",
       brief ?? "",
       // What the previous owner left behind. Peer-written free text: never attached to a PII task.
-      context && !pii ? `Handoff from the previous owner:\n${context.slice(0, 3000)}` : "",
+      context && !pii ? `Handoff from the previous owner:\n${this.screen(task, context, "handoff", a.owner).slice(0, 3000)}` : "",
       `Take it with hub_task_accept {id: ${task.id}, plan: {paths, symbols, signatures, insertion_points}} (what you will change, before you start${pii ? "" : "; owners of overlapping tasks see it"}) or pass with hub_task_decline. When finished: hub_task_done {id: ${task.id}, summary: what changed, why, and the check you ran with its result, refs}.`,
     ].filter(Boolean).join("\n\n");
     this.d.bus.publish(newEnvelope(HUB, body, { to: [task.owner!], kind: "task", priority: "important", refs: { ...task.refs, task: String(task.id) }, ...(pii ? { private: true } : {}) }));
@@ -382,8 +458,11 @@ export class Tasks {
   }
 
   private need(id: unknown, open = false): Task {
-    const task = this.d.board.get(Number(id));
-    if (!task) throw new Error(`no task #${id}`);
+    // Callers are models (#70): an id is a whole number or a digit string, never an array that Number() would accept.
+    const n = typeof id === "number" ? id : typeof id === "string" && /^\s*\d+\s*$/.test(id) ? Number(id) : NaN;
+    if (!Number.isInteger(n)) throw new Error(`id must be a task number, not ${(typeof id === "number" ? String(id) : JSON.stringify(id ?? null)).slice(0, 60)}`);
+    const task = this.d.board.get(n);
+    if (!task) throw new Error(`no task #${n}`);
     // Handing a task to someone else only makes sense while there is work left on it.
     if (open && !OPEN.includes(task.state)) throw new Error(`task #${task.id} is ${task.state}: it can no longer change hands`);
     return task;
@@ -482,6 +561,7 @@ export class Tasks {
     }
     this.d.board.update(id, HUB, "check failed", {}, `${outcome}\n${result.tail}`.trim());
     if (task.owner) this.d.board.recordOutcome(task.owner, task.class, false);
+    this.contradict(task);
     this.d.notify(`task ${this.publicTitle(task)}: its check failed (${outcome}); it stays with ${task.owner ?? by}`);
     this.tell(task, `Task #${id}: its check failed.\n$ ${outcome}${result.tail ? `\n${result.tail}` : ""}\nFix it and call hub_task_done again.`, pii);
   }
@@ -531,36 +611,56 @@ export class Tasks {
     const r = task.refs;
     const last = [...task.history].reverse().find((h) => h.event === "done");
     const where = [r.branch ? `branch ${r.branch}` : "", r.commit ? `commit ${r.commit}` : "", r.paths?.length ? `paths ${r.paths.join(", ")}` : ""].filter(Boolean).join("; ");
-    const body = `Review task #${task.id} [${task.class}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${last?.note ?? "(no summary)"}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}Give your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note}.`;
+    // A checklist that maps the change to its contract (issue #35): reviewers who check against the written plan catch more.
+    const plan = planText(task.plan);
+    const check = [...task.history].reverse().find((h) => h.event === "check passed");
+    const checklist = [
+      "Checklist:",
+      `- Map the changed signatures and call sites to ${plan ? `the plan (${plan})` : task.detail ? "the task detail above" : "the task title"}, and name each one that does not match.`,
+      `- ${check ? `Check result: ${(check.note ?? "").split("\n")[0]}` : "No check ran for this class: run the affected tests yourself."}`,
+      `- List what is unmet in hub_review's unmet, one item each.`,
+    ].join("\n");
+    const summary = last?.note ? this.screen(task, last.note, "summary", reviewer) : "(no summary)";
+    const body = `Review task #${task.id} [${task.class}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${summary}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet}.`;
     this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, task: String(task.id) }, ...(this.isPii(task) ? { private: true } : {}) }));
   }
 
-  async review(by: PeerId, id: unknown, verdict: unknown, note?: string): Promise<Task> {
+  async review(by: PeerId, id: unknown, verdict: unknown, note?: string, unmet?: unknown): Promise<Task> {
     const task = this.need(id);
     this.mine(task, by, "reviewer");
     if (verdict !== "approved" && verdict !== "changes_requested") throw new Error('verdict must be "approved" or "changes_requested"');
     if (task.state !== "in_review") throw new Error(`task #${task.id} is ${task.state}: cannot move to ${verdict} before its owner calls hub_task_done`);
     const pii = this.isPii(task);
+    const items = textList(unmet);
+    if (items.length) note = `${note ?? ""}\nUnmet: ${items.join("; ")}`.trim();
     if (verdict === "approved") {
       const next = this.d.board.update(task.id, by, "approved", { state: "approved", rejections: 0 }, note);
-      if (next.owner) this.d.board.recordOutcome(next.owner, next.class, true);
+      if (next.owner) {
+        this.d.board.recordOutcome(next.owner, next.class, true);
+        this.d.board.recordReview({ implementer: next.owner, reviewer: by, class: next.class, kind: "approved", task: next.id });
+        // Changes requested on this owner's work and the redo passed: those reviews caught something.
+        for (const r of this.requestedChanges(task)) {
+          this.d.board.recordReview({ implementer: next.owner, reviewer: r, class: next.class, kind: "caught", task: next.id });
+        }
+      }
       this.note(next, by, "decision", `Task #${next.id} approved by ${by}: ${next.title}\n${note ?? ""}`);
-      this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${note}` : ""}`, pii);
+      this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${this.screen(next, note, "review note", next.owner)}` : ""}`, pii);
       await this.releaseDependents(next);
       return next;
     }
     const rejected = this.d.board.update(task.id, by, "changes_requested", { state: "changes_requested", rejections: task.rejections + 1 }, note);
     if (rejected.owner) this.d.board.recordOutcome(rejected.owner, rejected.class, false);
+    this.contradict(rejected);
     this.note(rejected, by, "decision", `Task #${rejected.id} changes requested by ${by}: ${rejected.title}\n${note ?? ""}`);
     if (rejected.rejections >= ESCALATE_AFTER) {
       const moved = await this.escalate(HUB, rejected.id, `${rejected.rejections} consecutive changes_requested`);
       if (moved.owner !== rejected.owner) return moved;
       // Nobody to escalate to: the owner still has to hear the verdict and the note.
-      this.tell(moved, `Task #${moved.id}: ${by} requests changes again.${note ? ` ${note}` : ""} Nobody else can take it; fix it and call hub_task_done again.`, pii);
+      this.tell(moved, `Task #${moved.id}: ${by} requests changes again.${note ? ` ${this.screen(moved, note, "review note", moved.owner)}` : ""} Nobody else can take it; fix it and call hub_task_done again.`, pii);
       return moved;
     }
     const reopened = this.d.board.update(rejected.id, HUB, "reopened", { state: "in_progress" });
-    this.tell(reopened, `Task #${reopened.id}: ${by} requests changes.${note ? ` ${note}` : ""} Fix it and call hub_task_done again.`, pii);
+    this.tell(reopened, `Task #${reopened.id}: ${by} requests changes.${note ? ` ${this.screen(reopened, note, "review note", reopened.owner)}` : ""} Fix it and call hub_task_done again.`, pii);
     return reopened;
   }
 
@@ -573,6 +673,8 @@ export class Tasks {
     // The hub's own escalations are not counted: after repeated changes_requested each one already was, and after a
     // Pi inference failure the backend failed, not the work. An escalation by hand counts on its own.
     if (from && by !== HUB) this.d.board.recordOutcome(from, task.class, false);
+    // Only a reviewer that asked for changes on this work saw it fail: not an escalation of unreviewed work (a Pi failure).
+    if (from && task.reviewer && task.reviewer !== USER && this.requestedChanges(task).has(task.reviewer)) this.d.board.recordReview({ implementer: from, reviewer: task.reviewer, class: task.class, kind: "escalated", task: task.id });
     const next = await this.assignOwner(task, by, { candidates: list, event: "escalated", note: `${why}; from ${from ?? "none"}`, context: why });
     if (next.owner && next.owner !== from) {
       this.d.notify(`task ${this.publicTitle(next)} escalated from ${from} to ${next.owner} (${why})`);
@@ -648,6 +750,8 @@ export class Tasks {
   /** Auto notes: only transitions that carry content, never for PII. */
   private note(task: Task, by: PeerId, kind: string, text: string): void {
     if (this.isPii(task) || !this.d.memory) return;
+    // claude-mem's observer is a cloud model: model-written text that matches a PII pattern is not sent (#69).
+    if (!this.nameable(text)) return this.d.notify(`task #${task.id}: a ${kind} note was not saved to shared memory (it matches a PII pattern)`);
     void this.d.memory.save({ text, title: `agent-hub task #${task.id}: ${task.title}`.slice(0, 120), project: this.d.project, metadata: { peer: by, task: task.id, kind } });
   }
 

package/src/local/deny.ts

@@ -30,14 +30,14 @@ export const sbplString = (s: string) => `"${s.replace(/\\/g, "\\\\").replace(/"
  * Seatbelt regex filters equivalent to isDenied. Seatbelt sees absolute paths, so the `local.deny` substrings are
  * anchored under the project root: a bare "private/" would otherwise match /private/var/... and deny the whole temp tree.
  */
-export function denyRegexes(root: string, extra: string[] = []): string[] {
+export function denyRegexes(root: string, extra: string[] = [], withNames = true): string[] {
   const names = DENY_NAMES.map((re) => {
     const body = re.startsWith("^") ? re.slice(1) : `[^/]*${re}`;
     return `/${body}${body.endsWith("$") ? "" : "[^/]*$"}`;
   });
   return [
     ...DENY_SEGMENTS.map((s) => `/${sbplEscape(s)}(/|$)`),
-    ...names,
+    ...(withNames ? names : []),
     ...extra.filter(Boolean).map((e) => `^${sbplEscape(root)}/.*${sbplEscape(e)}`),
   ].map((re) => `(regex ${sbplString(re)})`);
 }

package/src/local/proxy.ts

@@ -0,0 +1,142 @@
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP, connect, createServer, type Server, type Socket } from "node:net";
+
+/**
+ * The only way out for the local worker's commands when `local.bash_network` is on (issue #65): an HTTP CONNECT proxy
+ * on loopback that opens tunnels to allowlisted hosts only. CONNECT only, so TLS stays end to end; plain HTTP is
+ * refused. A name that resolves to a loopback, private or link-local address is refused unless it is listed as an
+ * address: claude-mem and the Codex app-server listen on loopback without auth.
+ */
+
+/** What a project gets unless `local.network_allow` says otherwise: package registries and code hosts. */
+export const DEFAULT_NETWORK_ALLOW = [
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "pypi.org",
+  "files.pythonhosted.org",
+  "github.com",
+  "codeload.github.com",
+  "objects.githubusercontent.com",
+  "raw.githubusercontent.com",
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  "proxy.golang.org",
+  "sum.golang.org",
+];
+
+export interface EgressProxy {
+  port: number;
+  url: string;
+  close(): Promise<void>;
+}
+
+/** `host` or `host:port`; a name also matches its subdomains, an address only itself. Port 443 unless named. */
+export function allowed(list: string[], host: string, port: number): boolean {
+  const h = host.toLowerCase().replace(/\.$/, "");
+  return list.some((raw) => {
+    const entry = raw.trim().toLowerCase();
+    const at = entry.lastIndexOf(":");
+    const [name, p] = at > 0 && !entry.includes("]") && /^\d+$/.test(entry.slice(at + 1)) ? [entry.slice(0, at), Number(entry.slice(at + 1))] : [entry, 443];
+    if (!name || p !== port) return false;
+    return h === name || (!isIP(name) && h.endsWith(`.${name}`));
+  });
+}
+
+// Parsed, not prefix-matched: an IPv4-mapped IPv6 address in any spelling (`::ffff:7f00:1`) checks as its IPv4 address.
+const INTERNAL = new BlockList();
+// IPv4 nets as leading octets: the package check refuses private address literals in published files.
+for (const [a, b, bits] of [[0, 0, 8], [10, 0, 8], [100, 64, 10], [127, 0, 8], [169, 254, 16], [172, 16, 12], [192, 168, 16], [198, 18, 15], [224, 0, 3]] as const) INTERNAL.addSubnet(`${a}.${b}.0.0`, bits, "ipv4");
+for (const [net, bits] of [["::", 96], ["fc00::", 7], ["fe80::", 10], ["fec0::", 10], ["ff00::", 8]] as const) INTERNAL.addSubnet(net, bits, "ipv6");
+
+/** Loopback, private, link-local, site-local, unspecified, carrier-grade NAT, benchmark, multicast or reserved. */
+export function isInternal(address: string): boolean {
+  const family = isIP(address);
+  return family !== 0 && INTERNAL.check(address, family === 6 ? "ipv6" : "ipv4");
+}
+
+const hostOf = (target: string) => {
+  try {
+    return ` ${new URL(target).host}`;
+  } catch {
+    return "";
+  }
+};
+
+export function startEgressProxy(opts: { allow: string[]; log: (line: string) => void }): Promise<EgressProxy> {
+  const sockets = new Set<Socket>();
+  // Half-open on both sides: a client that sends its request and shuts its write side still gets the answer.
+  const server: Server = createServer({ allowHalfOpen: true }, (client) => {
+    sockets.add(client);
+    client.on("close", () => sockets.delete(client));
+    client.on("error", () => client.destroy());
+    let head = Buffer.alloc(0);
+    const onData = (chunk: Buffer) => {
+      head = Buffer.concat([head, chunk]);
+      const end = head.indexOf("\r\n\r\n");
+      if (end < 0) {
+        if (head.length > 8192) refuse(client, 431, "request header too large");
+        return;
+      }
+      client.off("data", onData);
+      client.pause();
+      const rest = head.subarray(end + 4);
+      const [method = "", target = "", version = ""] = head.subarray(0, end).toString("latin1").split("\r\n")[0]!.split(" ");
+      // Answer in the version asked (macOS nc wants HTTP/1.0 back); curl and git take either.
+      void tunnel(client, method, target, rest, version === "HTTP/1.0" ? "HTTP/1.0" : "HTTP/1.1");
+    };
+    client.on("data", onData);
+  });
+
+  const refuse = (client: Socket, code: number, why: string, target = "") => {
+    if (target) opts.log(`network: refused ${target} (${why})`);
+    client.end(`HTTP/1.1 ${code} ${code === 403 ? "Forbidden" : "Bad Request"}\r\nContent-Type: text/plain\r\nConnection: close\r\n\r\nagent-hub: ${why}\n`);
+  };
+
+  const tunnel = async (client: Socket, method: string, target: string, rest: Buffer, http: string) => {
+    // The log gets a method and a host, never a path, a query or userinfo: those carry tokens.
+    if (method.toUpperCase() !== "CONNECT") return refuse(client, 403, "only CONNECT (https) goes through this proxy", `${/^[A-Za-z]{1,16}$/.test(method) ? method : "a request"}${hostOf(target)}`);
+    const m = /^(\[[^\]]+\]|[^:]+):(\d{1,5})$/.exec(target);
+    const host = m?.[1]!.replace(/^\[|\]$/g, "") ?? "";
+    if (!m || !(isIP(host) || /^[a-z0-9.-]+$/i.test(host))) return refuse(client, 400, "bad CONNECT target", "a CONNECT request");
+    const port = Number(m[2]);
+    if (!allowed(opts.allow, host, port)) return refuse(client, 403, `${host}:${port} is not in local.network_allow`, `${host}:${port}`);
+    let address = host;
+    if (!isIP(host)) {
+      try {
+        address = (await lookup(host)).address;
+      } catch {
+        return refuse(client, 403, `${host} does not resolve`, `${host}:${port}`);
+      }
+      // A listed name must not lead back into this machine or its network (DNS can say anything).
+      if (isInternal(address)) return refuse(client, 403, `${host} resolves to an internal address`, `${host}:${port}`);
+    }
+    const upstream = connect({ host: address, port, allowHalfOpen: true });
+    sockets.add(upstream);
+    upstream.on("close", () => sockets.delete(upstream));
+    upstream.once("connect", () => {
+      client.write(`${http} 200 Connection Established\r\n\r\n`);
+      if (rest.length) upstream.write(rest);
+      client.pipe(upstream);
+      upstream.pipe(client);
+      client.resume();
+    });
+    upstream.on("error", () => (client.writable && !client.destroyed ? refuse(client, 403, `${host}:${port} is unreachable`) : client.destroy()));
+    client.on("close", () => upstream.destroy());
+  };
+
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const port = (server.address() as { port: number }).port;
+      resolve({
+        port,
+        url: `http://127.0.0.1:${port}`,
+        close: () => new Promise((done) => {
+          for (const s of sockets) s.destroy();
+          server.close(() => done());
+        }),
+      });
+    });
+  });
+}