agim-cli 1.4.9 → 1.5.1

package/dist/web/server.js

@@ -1,5 +1,6 @@
 // Web chat server — HTTP + WebSocket for browser-based agent interaction
 import { createServer } from 'node:http';
+import { createServer as createNetServer } from 'node:net';
 import { readFileSync, existsSync, readdirSync } from 'node:fs';
 import { readdir, stat, readFile, writeFile, rename, unlink, realpath, open } from 'node:fs/promises';
 import { join, dirname, resolve as resolvePath, sep as pathSep, relative as relativePath } from 'node:path';
@@ -109,7 +110,7 @@ function hasForwardedPeerHeaders(req) {
 function isTrustedLoopbackPeer(req) {
     if (!isLoopbackPeer(req))
         return false;
-    if (isEnvOff('IMHUB_TRUST_LOOPBACK'))
+    if (isEnvOff('AGIM_TRUST_LOOPBACK'))
         return false;
     // A reverse proxy on the same host makes remote users appear as
     // 127.0.0.1. Treat forwarded requests as network traffic and require
@@ -183,7 +184,7 @@ function extractToken(req, url) {
 /** Returns true if the request is authenticated (or auth not required). */
 function checkAuth(req, res, url) {
     // 1. Disabled by env → pass through.
-    if ((process.env.IMHUB_WEB_AUTH || '').toLowerCase() === 'off')
+    if ((process.env.AGIM_WEB_AUTH || '').toLowerCase() === 'off')
         return true;
     // 2. Trusted loopback → pass through (local CLI / browser-on-same-host).
     if (isTrustedLoopbackPeer(req))
@@ -242,7 +243,7 @@ function verifyTokenSync(raw) {
  *    - otherwise → 'web:unknown' (request should already have been rejected
  *      by checkAuth — this branch exists for defensive logging). */
 function getRequestActor(req) {
-    if ((process.env.IMHUB_WEB_AUTH || '').toLowerCase() === 'off')
+    if ((process.env.AGIM_WEB_AUTH || '').toLowerCase() === 'off')
         return 'web:auth-off';
     if (isTrustedLoopbackPeer(req))
         return 'web:loopback';
@@ -266,17 +267,17 @@ function getRequestActor(req) {
  *  can't elevate to control plane (R13 A1).
  *
  *  Trust order:
- *    1. IMHUB_WEB_AUTH=off  → admin (operator explicitly disabled auth)
+ *    1. AGIM_WEB_AUTH=off  → admin (operator explicitly disabled auth)
  *    2. Trusted loopback    → admin (operator on the host)
  *    3. Bearer token        → token.role === 'admin'
  *    4. Otherwise           → not admin
  *
  *  Note: when no token has been created yet (pre-bootstrap), the
  *  trusted-loopback branch still grants admin so the CLI bootstrap flow
- *  works. Disable it with IMHUB_TRUST_LOOPBACK=off. Reverse-proxied
+ *  works. Disable it with AGIM_TRUST_LOOPBACK=off. Reverse-proxied
  *  requests with Forwarded / X-Forwarded-* peer headers never qualify. */
 function isRequestAdmin(req) {
-    if ((process.env.IMHUB_WEB_AUTH || '').toLowerCase() === 'off')
+    if ((process.env.AGIM_WEB_AUTH || '').toLowerCase() === 'off')
         return true;
     if (isTrustedLoopbackPeer(req))
         return true;
@@ -330,9 +331,44 @@ export function createSerialQueue() {
 /**
  * Start the web chat server
  */
+async function assertPortCanListen(port, bindHost) {
+    await new Promise((resolve, reject) => {
+        const probe = createNetServer();
+        const cleanup = () => {
+            probe.off('error', onError);
+            probe.off('listening', onListening);
+        };
+        const onError = (err) => {
+            cleanup();
+            try {
+                probe.close();
+            }
+            catch { /* not listening */ }
+            reject(err);
+        };
+        const onListening = () => {
+            cleanup();
+            probe.close(() => resolve());
+        };
+        probe.once('error', onError);
+        probe.once('listening', onListening);
+        try {
+            probe.listen(port, bindHost);
+        }
+        catch (err) {
+            cleanup();
+            try {
+                probe.close();
+            }
+            catch { /* not listening */ }
+            reject(err);
+        }
+    });
+}
 export async function startWebServer(options) {
     const port = options.port || DEFAULT_PORT;
-    const bindHost = process.env.IMHUB_WEB_BIND || '127.0.0.1';
+    const bindHost = process.env.AGIM_WEB_BIND || '127.0.0.1';
+    await assertPortCanListen(port, bindHost);
     const clients = new Map();
     // R9: threadId → tokenId ownership. A WS peer claims a threadId on
     // first connection (verifyClient already verified the token); later
@@ -344,7 +380,7 @@ export async function startWebServer(options) {
     // v1.1.10+: token-based auth for the web console.
     // ─ loopback peers (127.0.0.1 / ::1) bypass auth (local CLI / curl)
     // ─ public viewer pages (/v/:id, /loc, /l/<token>) remain public
-    // ─ IMHUB_WEB_AUTH=off disables the gate entirely (for ops with proxy auth)
+    // ─ AGIM_WEB_AUTH=off disables the gate entirely (for ops with proxy auth)
     // On first start, bootstrapIfEmpty() generates a one-time bootstrap token
     // and prints it to stdout + the logger so the operator finds it in journalctl.
     const accessTokenModule = await import('../core/access-token.js');
@@ -361,16 +397,16 @@ export async function startWebServer(options) {
         webLog.warn({
             event: 'web.auth_disabled_on_public_bind',
             bind: bindHost,
-        }, 'IMHUB_WEB_AUTH=off + public bind — auth deliberately off, ensure your reverse proxy handles access control');
+        }, 'AGIM_WEB_AUTH=off + public bind — auth deliberately off, ensure your reverse proxy handles access control');
     }
     // R13 C2 — when binding to a non-loopback address, the operator
     // almost certainly intends to put a TLS-terminating reverse proxy
     // in front of agim. We can't reliably detect from inside whether
     // that's been done (X-Forwarded-Proto could be forged), so we
     // surface a one-time banner + audit row at boot. Suppress with
-    // IMHUB_WEB_TLS_ACK=1 for the operator who's already done the
+    // AGIM_WEB_TLS_ACK=1 for the operator who's already done the
     // checklist and wants quiet logs.
-    if (isPublicBind && process.env.IMHUB_WEB_TLS_ACK !== '1') {
+    if (isPublicBind && process.env.AGIM_WEB_TLS_ACK !== '1') {
         const banner = [
             '',
             '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━',
@@ -383,7 +419,7 @@ export async function startWebServer(options) {
             '   any network you do not control.',
             '',
             '   Silence this banner once your terminator is verified:',
-            '       IMHUB_WEB_TLS_ACK=1',
+            '       AGIM_WEB_TLS_ACK=1',
             '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━',
             '',
         ].join('\n');
@@ -392,7 +428,7 @@ export async function startWebServer(options) {
             event: 'web.public_bind_no_tls_ack',
             bind: bindHost,
             port,
-        }, `non-loopback bind without IMHUB_WEB_TLS_ACK=1 — confirm reverse-proxy TLS termination`);
+        }, `non-loopback bind without AGIM_WEB_TLS_ACK=1 — confirm reverse-proxy TLS termination`);
         try {
             void (async () => {
                 const { logAuditEvent } = await import('../core/audit-log.js');
@@ -411,8 +447,8 @@ export async function startWebServer(options) {
         event: 'web.auth_mode',
         bind: bindHost,
         enabled: isAuthEnabled(),
-        trustLoopback: !isEnvOff('IMHUB_TRUST_LOOPBACK'),
-    }, `Web console auth: ${isAuthEnabled() ? 'token-gated' : 'disabled (IMHUB_WEB_AUTH=off)'}`);
+        trustLoopback: !isEnvOff('AGIM_TRUST_LOOPBACK'),
+    }, `Web console auth: ${isAuthEnabled() ? 'token-gated' : 'disabled (AGIM_WEB_AUTH=off)'}`);
     // HTTP request handler — static files + REST API
     const httpServer = createServer(async (req, res) => {
         const url = new URL(req.url || '/', `http://localhost:${port}`);
@@ -423,7 +459,7 @@ export async function startWebServer(options) {
             return;
         // v1.2.72 — v2 SPA is the only web admin. The legacy v1 monolithic
         // HTML pages (settings.html / tasks.html / reminders.html /
-        // memos.html / _app.js) have been removed; the `IMHUB_WEB_V2` env
+        // memos.html / _app.js) have been removed; the `AGIM_WEB_V2` env
         // gate is gone — there is no v1 fallback anymore. Operators who
         // were on the legacy layout flipped over automatically when they
         // upgraded past 1.2.21 (default switch); the env knob remained as
@@ -591,7 +627,7 @@ export async function startWebServer(options) {
             //   - PC browsers anywhere: WGS-84.
             // Default to WGS-84 pass-through (matches the most common Chinese
             // mobile path — WeChat — which was silently miscalibrated before
-            // the 2026-05-12 fix). iOS users in China set IMHUB_H5_COORDS_GCJ02=1
+            // the 2026-05-12 fix). iOS users in China set AGIM_H5_COORDS_GCJ02=1
             // to restore the GCJ→WGS path.  See core/coord-systems.ts.
             const norm = normalizeIncomingCoords('h5-browser-geolocation', rawLat, rawLng);
             const lat = norm.lat;
@@ -775,7 +811,7 @@ export async function startWebServer(options) {
                 return;
             return handleDeleteMemo(req, res, Number.parseInt(memoIdMatch[1], 10));
         }
-        // /api/env — read/write SMTP + Baidu AK + IMHUB_WEB_BIND. Values
+        // /api/env — read/write SMTP + Baidu AK + AGIM_WEB_BIND. Values
         // sensitive enough that GET returns them masked (only the last 4 chars
         // visible) unless an explicit ?reveal=1 is passed. Keep the settings
         // surface admin-only: even masked values disclose configured providers.
@@ -791,7 +827,7 @@ export async function startWebServer(options) {
         }
         // v1.2.67 — Security diagnostics. Surfaces boot-time observations the
         // Security UI page renders as read-only badges (uid, env file perms,
-        // bwrap availability, IMHUB_ALLOWED_USERS configured? …).
+        // bwrap availability, AGIM_ALLOWED_USERS configured? …).
         if (url.pathname === '/api/security/diagnostics' && req.method === 'GET') {
             if (!requireAdmin(req, res))
                 return;
@@ -1174,6 +1210,11 @@ export async function startWebServer(options) {
         if (url.pathname === '/api/service/status' && req.method === 'GET') {
             return handleServiceStatus(res);
         }
+        if (url.pathname === '/api/service/log-tail' && req.method === 'GET') {
+            if (!requireAdmin(req, res))
+                return;
+            return handleServiceLogTail(res, url);
+        }
         if (url.pathname === '/api/service/start' && req.method === 'POST') {
             if (!requireAdmin(req, res))
                 return;
@@ -1232,7 +1273,7 @@ export async function startWebServer(options) {
             }
             // Auth-off / trusted-loopback bypass — mirror checkAuth's two short-circuits
             // so dev / local CLI sessions still work without a token.
-            if ((process.env.IMHUB_WEB_AUTH || '').toLowerCase() === 'off')
+            if ((process.env.AGIM_WEB_AUTH || '').toLowerCase() === 'off')
                 return cb(true);
             if (isTrustedLoopbackPeer(info.req))
                 return cb(true);
@@ -1270,9 +1311,9 @@ export async function startWebServer(options) {
     // M3: cap concurrent WS clients so a leaked / shared web token can't OOM
     // the host by opening unbounded connections. Default 100 is generous for
     // a single-user / small-team setup; production multi-tenant should set
-    // IMHUB_MAX_WS_CLIENTS to a higher value.
+    // AGIM_MAX_WS_CLIENTS to a higher value.
     const maxWsClients = (() => {
-        const raw = process.env.IMHUB_MAX_WS_CLIENTS;
+        const raw = process.env.AGIM_MAX_WS_CLIENTS;
         if (raw) {
             const n = parseInt(raw, 10);
             if (Number.isFinite(n) && n > 0)
@@ -1285,14 +1326,14 @@ export async function startWebServer(options) {
     // token can still spawn N parallel browser tabs / processes and
     // saturate the file-descriptor pool.
     //
-    //   IMHUB_WS_MAX_PER_IP            active connections per IP (default 20)
-    //   IMHUB_WS_MAX_NEW_PER_IP_PER_MIN  new connections per IP per minute (default 30)
+    //   AGIM_WS_MAX_PER_IP            active connections per IP (default 20)
+    //   AGIM_WS_MAX_NEW_PER_IP_PER_MIN  new connections per IP per minute (default 30)
     //
     // Trusted loopback bypasses both — local dev / CLI tooling makes many
     // short connections legitimately. Reverse-proxied loopback traffic is
     // still counted as network traffic.
     const wsMaxPerIp = (() => {
-        const raw = process.env.IMHUB_WS_MAX_PER_IP;
+        const raw = process.env.AGIM_WS_MAX_PER_IP;
         if (raw) {
             const n = parseInt(raw, 10);
             if (Number.isFinite(n) && n > 0)
@@ -1301,7 +1342,7 @@ export async function startWebServer(options) {
         return 20;
     })();
     const wsMaxNewPerIpPerMin = (() => {
-        const raw = process.env.IMHUB_WS_MAX_NEW_PER_IP_PER_MIN;
+        const raw = process.env.AGIM_WS_MAX_NEW_PER_IP_PER_MIN;
         if (raw) {
             const n = parseInt(raw, 10);
             if (Number.isFinite(n) && n > 0)
@@ -1546,10 +1587,34 @@ export async function startWebServer(options) {
         });
     });
     // Default to loopback; operators can opt into LAN/public exposure with
-    // IMHUB_WEB_BIND=0.0.0.0 behind their firewall/reverse proxy.
+    // AGIM_WEB_BIND=0.0.0.0 behind their firewall/reverse proxy.
     await new Promise((resolve, reject) => {
-        httpServer.on('error', reject);
-        httpServer.listen(port, bindHost, () => resolve());
+        const onError = (err) => {
+            httpServer.off('listening', onListening);
+            try {
+                httpServer.close();
+            }
+            catch { /* not listening yet */ }
+            reject(err);
+        };
+        const onListening = () => {
+            httpServer.off('error', onError);
+            resolve();
+        };
+        httpServer.once('error', onError);
+        httpServer.once('listening', onListening);
+        try {
+            httpServer.listen(port, bindHost);
+        }
+        catch (err) {
+            httpServer.off('error', onError);
+            httpServer.off('listening', onListening);
+            try {
+                httpServer.close();
+            }
+            catch { /* not listening yet */ }
+            reject(err);
+        }
     });
     webLog.info({ port, bindHost }, `Chat UI available at http://${bindHost === '0.0.0.0' ? 'localhost' : bindHost}:${port}`);
     // ============================================================
@@ -1700,7 +1765,7 @@ async function handleGetConfig(_req, res) {
         const showGlobalIm = isGlobalImEnabled();
         const showRemoteAgent = isRemoteAgentEnabled();
         // v1.2.69 — IM platform blacklist. When an operator sets
-        // IMHUB_PLATFORM_BLACKLIST=telegram,discord (etc.), those platforms
+        // AGIM_PLATFORM_BLACKLIST=telegram,discord (etc.), those platforms
         // are hidden from the admin SPA entirely — credentials still live
         // on disk but the UI shows nothing for that platform AND the
         // registry refuses to register the adapter at boot. Default empty.
@@ -2190,6 +2255,68 @@ async function handleServiceStatus(res) {
         sendJson(res, 500, { error: err instanceof Error ? err.message : String(err) });
     }
 }
+async function handleServiceLogTail(res, url) {
+    try {
+        const { LOG_FILE } = await import('../cli-ui/service.js');
+        const requestedLines = parseInt(url.searchParams.get('lines') || '120', 10);
+        const lines = Math.min(Math.max(Number.isFinite(requestedLines) ? requestedLines : 120, 20), 500);
+        const maxBytes = 256 * 1024;
+        let st;
+        try {
+            st = await stat(LOG_FILE);
+        }
+        catch (err) {
+            const e = err;
+            if (e.code === 'ENOENT') {
+                sendJson(res, 200, {
+                    path: LOG_FILE,
+                    exists: false,
+                    content: '',
+                    lines: 0,
+                    truncated: false,
+                    size: 0,
+                    mtime: null,
+                });
+                return;
+            }
+            throw err;
+        }
+        if (!st.isFile()) {
+            sendJson(res, 400, { error: 'Service log path is not a regular file' });
+            return;
+        }
+        const start = Math.max(0, st.size - maxBytes);
+        const len = st.size - start;
+        let buf;
+        const fd = await open(LOG_FILE, 'r');
+        try {
+            buf = Buffer.alloc(len);
+            const { bytesRead } = await fd.read(buf, 0, len, start);
+            buf = buf.subarray(0, bytesRead);
+        }
+        finally {
+            await fd.close();
+        }
+        let text = buf.toString('utf8');
+        if (start > 0)
+            text = text.replace(/^[^\n]*(\n|$)/, '');
+        const allLines = text.split(/\r?\n/);
+        const selected = allLines.slice(-lines);
+        const content = selected.join('\n');
+        sendJson(res, 200, {
+            path: LOG_FILE,
+            exists: true,
+            content,
+            lines: content ? selected.length : 0,
+            truncated: start > 0 || allLines.length > lines,
+            size: st.size,
+            mtime: st.mtime.toISOString(),
+        });
+    }
+    catch (err) {
+        sendJson(res, 500, { error: err instanceof Error ? err.message : String(err) });
+    }
+}
 async function handleServiceStart(res) {
     try {
         const { detectService, spawnBackground, reapStrayAgimProcesses } = await import('../cli-ui/service.js');
@@ -2227,7 +2354,7 @@ async function handleServiceStart(res) {
             }
             try {
                 const { spawn } = await import('node:child_process');
-                const unitName = existsSync('/etc/systemd/system/agim.service') ? 'agim.service' : 'im-hub.service';
+                const unitName = 'agim.service';
                 // Detached + fire-and-forget so the HTTP response isn't held
                 // for the full systemd activation timeline.
                 const child = spawn('systemctl', ['start', unitName], { detached: true, stdio: 'ignore' });
@@ -2261,8 +2388,7 @@ async function handleServiceStop(res) {
         // systemctl stop handles the kill for us — no self-exit needed.
         try {
             const { execSync } = await import('node:child_process');
-            // Match service.ts's detection: prefer agim.service, fall back.
-            const unitName = existsSync('/etc/systemd/system/agim.service') ? 'agim.service' : 'im-hub.service';
+            const unitName = 'agim.service';
             execSync(`systemctl stop ${unitName}`);
             // R14 §四 — sweep stray pids after systemctl stop, same way
             // restart does pre-stop. systemctl reports success when its
@@ -2345,7 +2471,7 @@ async function handleServiceRestart(res) {
         }
         try {
             const { spawn } = await import('node:child_process');
-            const unitName = existsSync('/etc/systemd/system/agim.service') ? 'agim.service' : 'im-hub.service';
+            const unitName = 'agim.service';
             // v1.5 — fire-and-forget. execSync blocked the HTTP response until
             // systemctl had finished stop+start (5-10s), making the web button
             // look frozen to the user. Detach the child so we can ACK the
@@ -2822,82 +2948,82 @@ async function handleDeleteMemo(_req, res, id) {
 }
 // ─── env file (SMTP + Baidu AK + …) ────────────────────────────────────
 const ENV_EDITABLE_KEYS = [
-    'IMHUB_SMTP_HOST', 'IMHUB_SMTP_PORT', 'IMHUB_SMTP_USER', 'IMHUB_SMTP_PASS',
-    'IMHUB_SMTP_FROM', 'IMHUB_SMTP_SECURE',
-    'IMHUB_BAIDU_MAP_AK',
-    'IMHUB_LOC_BASE_URL', 'IMHUB_TZ_OFFSET_HOURS',
+    'AGIM_SMTP_HOST', 'AGIM_SMTP_PORT', 'AGIM_SMTP_USER', 'AGIM_SMTP_PASS',
+    'AGIM_SMTP_FROM', 'AGIM_SMTP_SECURE',
+    'AGIM_BAIDU_MAP_AK',
+    'AGIM_LOC_BASE_URL', 'AGIM_TZ_OFFSET_HOURS',
     // Safety card toggle — drives the Claude --dangerously-skip-permissions
     // branch in plugins/agents/claude-code/index.ts. Not a secret, plain '1'/'0'.
-    'IMHUB_DANGEROUSLY_SKIP_PERMISSIONS',
+    'AGIM_DANGEROUSLY_SKIP_PERMISSIONS',
     // Approval Policy card — 'allow' | 'deny' (default deny). Decides what the
     // approval bus does when a tool-use prompt times out with no human reply.
     // Hot-reload: handlePutEnv mutates process.env so approval-bus picks up the
     // new value on the next timer fire, no restart needed.
-    'IMHUB_TIMEOUT_DEFAULT',
+    'AGIM_TIMEOUT_DEFAULT',
     // v1.2 — IM long-message viewer. Operator sets the public URL pointing at
     // their reverse-proxied agim web port; thresholds tune when routing kicks
     // in. Hot-reload works because viewer-config reads process.env every call.
-    'IMHUB_VIEWER_ENABLED',
-    'IMHUB_VIEWER_PUBLIC_BASE_URL',
-    'IMHUB_VIEWER_CHARS',
-    'IMHUB_VIEWER_LINES',
-    'IMHUB_VIEWER_CODE_LINES',
-    'IMHUB_VIEWER_MAX_PASTES',
-    'IMHUB_VIEWER_TUNNEL_MODE',
+    'AGIM_VIEWER_ENABLED',
+    'AGIM_VIEWER_PUBLIC_BASE_URL',
+    'AGIM_VIEWER_CHARS',
+    'AGIM_VIEWER_LINES',
+    'AGIM_VIEWER_CODE_LINES',
+    'AGIM_VIEWER_MAX_PASTES',
+    'AGIM_VIEWER_TUNNEL_MODE',
     // v1.2.43 — opt out of community default paste server (viewer.iclaw.host).
-    'IMHUB_VIEWER_NO_DEFAULT_REMOTE',
+    'AGIM_VIEWER_NO_DEFAULT_REMOTE',
     // v1.1.10 — A2A notification settings (see src/core/a2a-notify.ts).
-    'IMHUB_A2A_TIMEOUT_DEFAULT_MS',
-    'IMHUB_A2A_MAX_TIMEOUT_MS',
-    'IMHUB_A2A_NOTIFY_MODE',
-    'IMHUB_A2A_NOTIFY_MAX_DEPTH',
-    'IMHUB_A2A_HEARTBEAT_MIN',
+    'AGIM_A2A_TIMEOUT_DEFAULT_MS',
+    'AGIM_A2A_MAX_TIMEOUT_MS',
+    'AGIM_A2A_NOTIFY_MODE',
+    'AGIM_A2A_NOTIFY_MAX_DEPTH',
+    'AGIM_A2A_HEARTBEAT_MIN',
     // v1.5 — long-term memory (see src/core/memory.ts + persona.ts).
-    'IMHUB_MEMORY_ENABLED',
+    'AGIM_MEMORY_ENABLED',
     // P1/P2 — dream distillation (background fact extraction; see
     // src/core/memory-distiller.ts).
-    'IMHUB_MEMORY_DISTILL_ENABLED',
-    'IMHUB_MEMORY_DISTILL_SOURCE',
-    'IMHUB_MEMORY_DISTILL_AGENT',
-    'IMHUB_MEMORY_DISTILL_INTERVAL_MS',
-    'IMHUB_MEMORY_DISTILL_FLOOR_MIN',
-    'IMHUB_MEMORY_DISTILL_BATCH_MAX',
-    'IMHUB_MEMORY_DISTILL_MAX_PENDING',
+    'AGIM_MEMORY_DISTILL_ENABLED',
+    'AGIM_MEMORY_DISTILL_SOURCE',
+    'AGIM_MEMORY_DISTILL_AGENT',
+    'AGIM_MEMORY_DISTILL_INTERVAL_MS',
+    'AGIM_MEMORY_DISTILL_FLOOR_MIN',
+    'AGIM_MEMORY_DISTILL_BATCH_MAX',
+    'AGIM_MEMORY_DISTILL_MAX_PENDING',
     // v1.6 — vector retrieval (opt-in, OFF by default).
-    'IMHUB_MEMORY_VECTOR_BACKEND',
-    'IMHUB_MEMORY_VECTOR_LOCAL_MODEL',
-    'IMHUB_MEMORY_VECTOR_OPENAI_BASE_URL',
-    'IMHUB_MEMORY_VECTOR_OPENAI_MODEL',
-    'IMHUB_MEMORY_VECTOR_OPENAI_API_KEY',
-    'IMHUB_MEMORY_VECTOR_BATCH_SIZE',
-    'IMHUB_MEMORY_VECTOR_HYBRID_WEIGHT',
+    'AGIM_MEMORY_VECTOR_BACKEND',
+    'AGIM_MEMORY_VECTOR_LOCAL_MODEL',
+    'AGIM_MEMORY_VECTOR_OPENAI_BASE_URL',
+    'AGIM_MEMORY_VECTOR_OPENAI_MODEL',
+    'AGIM_MEMORY_VECTOR_OPENAI_API_KEY',
+    'AGIM_MEMORY_VECTOR_BATCH_SIZE',
+    'AGIM_MEMORY_VECTOR_HYBRID_WEIGHT',
     // v1.2.67 — Security page surfaces these (added in v1.2.58–v1.2.66).
     // Sender allowlist — who can talk to the bot at all.
-    'IMHUB_ALLOWED_USERS',
+    'AGIM_ALLOWED_USERS',
     // Native fs tools — workspace restriction + per-tool timeout.
-    'IMHUB_NATIVE_FS_RESTRICT',
-    'IMHUB_NATIVE_FS_TIMEOUT_MS',
+    'AGIM_NATIVE_FS_RESTRICT',
+    'AGIM_NATIVE_FS_TIMEOUT_MS',
     // Native web tools — SSRF guards.
-    'IMHUB_NATIVE_WEB_ALLOW_PRIVATE',
-    'IMHUB_NATIVE_WEB_SSRF_WHITELIST',
-    'IMHUB_NATIVE_WEB_TIMEOUT_MS',
+    'AGIM_NATIVE_WEB_ALLOW_PRIVATE',
+    'AGIM_NATIVE_WEB_SSRF_WHITELIST',
+    'AGIM_NATIVE_WEB_TIMEOUT_MS',
     // Native exec tool — bwrap sandbox + sub-knobs.
-    'IMHUB_EXEC_SANDBOX',
-    'IMHUB_EXEC_SANDBOX_NET',
-    'IMHUB_EXEC_TIMEOUT_MS',
-    'IMHUB_EXEC_MAX_OUTPUT',
+    'AGIM_EXEC_SANDBOX',
+    'AGIM_EXEC_SANDBOX_NET',
+    'AGIM_EXEC_TIMEOUT_MS',
+    'AGIM_EXEC_MAX_OUTPUT',
     // Native call_agent per-turn cap.
-    'IMHUB_NATIVE_CALL_AGENT_MAX_PER_TURN',
+    'AGIM_NATIVE_CALL_AGENT_MAX_PER_TURN',
     // v1.2.69 — IM platform blacklist (CSV of platform ids). Default
     // empty (no blocks); listed platforms vanish from web + CLI + are
     // refused at registry.registerMessenger.
-    'IMHUB_PLATFORM_BLACKLIST',
+    'AGIM_PLATFORM_BLACKLIST',
     // v1.2.126 — web_search provider chain (CSV) + each provider's API
-    // key. `IMHUB_WEB_SEARCH_PROVIDERS` orders the fallback chain (e.g.
+    // key. `AGIM_WEB_SEARCH_PROVIDERS` orders the fallback chain (e.g.
     // 'tavily,brave,duckduckgo'); a missing/empty value falls back to
     // DEFAULT_PROVIDER_ORDER in web-dispatcher. The 5 *_API_KEY values
     // gate per-provider availability (duckduckgo needs no key).
-    'IMHUB_WEB_SEARCH_PROVIDERS',
+    'AGIM_WEB_SEARCH_PROVIDERS',
     'TAVILY_API_KEY',
     'BRAVE_API_KEY',
     'SERPER_API_KEY',
@@ -2907,47 +3033,47 @@ const ENV_EDITABLE_KEYS = [
     // timeout / blank-response retry / length-recovery retry). Hot-
     // reload: each subsystem re-reads process.env on every call, so
     // editing these takes effect without a restart.
-    'IMHUB_NATIVE_TOOL_RESULT_MAX_CHARS',
-    'IMHUB_NATIVE_TOOL_TIMEOUT_MS',
-    'IMHUB_NATIVE_BLANK_RETRY_MAX',
-    'IMHUB_NATIVE_LENGTH_RECOVERY_MAX',
+    'AGIM_NATIVE_TOOL_RESULT_MAX_CHARS',
+    'AGIM_NATIVE_TOOL_TIMEOUT_MS',
+    'AGIM_NATIVE_BLANK_RETRY_MAX',
+    'AGIM_NATIVE_LENGTH_RECOVERY_MAX',
     // v1.2.127 — A2A sub-agent spawn (depth / timeout / in-process /
     // per-turn cap). All hot-read; flipping in-process to 'off' makes
     // the next call_agent('native', …) reboot via the subprocess CLI
     // adapter instead of the v1.2.121 fast path.
-    'IMHUB_A2A_MAX_DEPTH',
-    'IMHUB_A2A_TIMEOUT_DEFAULT_MS',
-    'IMHUB_NATIVE_CALL_AGENT_IN_PROCESS',
-    'IMHUB_NATIVE_CALL_AGENT_MAX_PER_TURN',
+    'AGIM_A2A_MAX_DEPTH',
+    'AGIM_A2A_TIMEOUT_DEFAULT_MS',
+    'AGIM_NATIVE_CALL_AGENT_IN_PROCESS',
+    'AGIM_NATIVE_CALL_AGENT_MAX_PER_TURN',
     // v1.2.127 — early-stop + critic. Semantic stuck-loop default ON
     // catches the v1.2.122 case (3 different tools, same salient arg).
     // Critic default OFF — opt-in goal-divergence detector.
-    'IMHUB_NATIVE_SEMANTIC_STUCK_LOOP',
-    'IMHUB_NATIVE_CRITIC',
-    'IMHUB_NATIVE_CRITIC_ROLE',
-    'IMHUB_NATIVE_PLAN_MODE',
+    'AGIM_NATIVE_SEMANTIC_STUCK_LOOP',
+    'AGIM_NATIVE_CRITIC',
+    'AGIM_NATIVE_CRITIC_ROLE',
+    'AGIM_NATIVE_PLAN_MODE',
     // v1.2.135 — auto-enter heuristic + custom phrase list.
-    'IMHUB_PLAN_INTENT_AUTO',
-    'IMHUB_PLAN_INTENT_PHRASES',
+    'AGIM_PLAN_INTENT_AUTO',
+    'AGIM_PLAN_INTENT_PHRASES',
     // v1.2.127 — auto-compact 4 sliders (OpenHands Condenser pattern).
     // KEEP_FIRST defaults to 1 since v1.2.125 (original user goal at idx 0).
-    'IMHUB_NATIVE_COMPACT_TRIGGER_CHARS',
-    'IMHUB_NATIVE_COMPACT_KEEP_TURNS',
-    'IMHUB_NATIVE_COMPACT_KEEP_FIRST',
-    'IMHUB_NATIVE_COMPACT_SUMMARY_CHARS',
+    'AGIM_NATIVE_COMPACT_TRIGGER_CHARS',
+    'AGIM_NATIVE_COMPACT_KEEP_TURNS',
+    'AGIM_NATIVE_COMPACT_KEEP_FIRST',
+    'AGIM_NATIVE_COMPACT_SUMMARY_CHARS',
     // v1.2.127 — streaming + iteration cap. STREAM_PARTIAL default ON
     // preserves partial assistant text on IM's 30-min hard timeout.
-    'IMHUB_NATIVE_STREAM_PARTIAL',
-    'IMHUB_NATIVE_AGENT_MAX_ITER',
+    'AGIM_NATIVE_STREAM_PARTIAL',
+    'AGIM_NATIVE_AGENT_MAX_ITER',
     // v1.2.138 — first-token retry on transient stream errors (terminated /
     // ECONNRESET / fetch failed / socket hang up). Default retries once.
-    'IMHUB_NATIVE_FIRSTTOKEN_RETRY_MAX',
-    'IMHUB_NATIVE_FIRSTTOKEN_RETRY_DELAY_MS',
+    'AGIM_NATIVE_FIRSTTOKEN_RETRY_MAX',
+    'AGIM_NATIVE_FIRSTTOKEN_RETRY_DELAY_MS',
 ];
 const SECRET_KEYS = new Set([
-    'IMHUB_SMTP_PASS',
-    'IMHUB_BAIDU_MAP_AK',
-    'IMHUB_MEMORY_VECTOR_OPENAI_API_KEY',
+    'AGIM_SMTP_PASS',
+    'AGIM_BAIDU_MAP_AK',
+    'AGIM_MEMORY_VECTOR_OPENAI_API_KEY',
     // v1.2.126 — web search keys are bearer tokens / API keys, so
     // they're masked on GET and refused if echoed back on PUT.
     'TAVILY_API_KEY',
@@ -3002,10 +3128,10 @@ async function handleSecurityDiagnostics(_req, res) {
                 // (process.env, which is what runtime sees) without round-tripping
                 // through the env file.
                 liveEnv: {
-                    IMHUB_EXEC_SANDBOX: process.env.IMHUB_EXEC_SANDBOX ?? null,
-                    IMHUB_NATIVE_FS_RESTRICT: process.env.IMHUB_NATIVE_FS_RESTRICT ?? null,
-                    IMHUB_TIMEOUT_DEFAULT: process.env.IMHUB_TIMEOUT_DEFAULT ?? null,
-                    IMHUB_DANGEROUSLY_SKIP_PERMISSIONS: process.env.IMHUB_DANGEROUSLY_SKIP_PERMISSIONS ?? null,
+                    AGIM_EXEC_SANDBOX: process.env.AGIM_EXEC_SANDBOX ?? null,
+                    AGIM_NATIVE_FS_RESTRICT: process.env.AGIM_NATIVE_FS_RESTRICT ?? null,
+                    AGIM_TIMEOUT_DEFAULT: process.env.AGIM_TIMEOUT_DEFAULT ?? null,
+                    AGIM_DANGEROUSLY_SKIP_PERMISSIONS: process.env.AGIM_DANGEROUSLY_SKIP_PERMISSIONS ?? null,
                 },
             },
         });
@@ -3100,9 +3226,9 @@ async function handleEmailTest(req, res) {
         // Drain body even though we don't use it, so the connection doesn't
         // stall under keep-alive.
         await readBody(req, res);
-        const host = process.env.IMHUB_SMTP_HOST?.trim();
-        const user = process.env.IMHUB_SMTP_USER?.trim();
-        const pass = process.env.IMHUB_SMTP_PASS;
+        const host = process.env.AGIM_SMTP_HOST?.trim();
+        const user = process.env.AGIM_SMTP_USER?.trim();
+        const pass = process.env.AGIM_SMTP_PASS;
         if (!host || !user || !pass) {
             sendError(res, 400, 'EMAIL_NOT_CONFIGURED', {
                 message: 'SMTP not configured (host / user / pass required)',
@@ -3110,10 +3236,10 @@ async function handleEmailTest(req, res) {
             });
             return;
         }
-        const portRaw = process.env.IMHUB_SMTP_PORT?.trim();
+        const portRaw = process.env.AGIM_SMTP_PORT?.trim();
         const portNum = portRaw ? Number.parseInt(portRaw, 10) : 465;
         const port = Number.isFinite(portNum) && portNum > 0 && portNum <= 65535 ? portNum : 465;
-        const secureRaw = process.env.IMHUB_SMTP_SECURE?.trim().toLowerCase();
+        const secureRaw = process.env.AGIM_SMTP_SECURE?.trim().toLowerCase();
         const secure = secureRaw !== undefined
             ? (secureRaw === '1' || secureRaw === 'true' || secureRaw === 'yes')
             : port === 465;
@@ -3989,7 +4115,7 @@ async function handleSkillsList(_req, res) {
 // install still happens via the skillhub CLI on the host (see docs).
 //
 // Enterprise / air-gapped deployments can disable this endpoint via
-// `IMHUB_SKILLHUB_ENABLED=0`. When disabled, the API returns a stub
+// `AGIM_SKILLHUB_ENABLED=0`. When disabled, the API returns a stub
 // shape `{ disabled: true, items: [] }` so the UI can show "disabled
 // by enterprise policy" without breaking the page. This is the only
 // product-default outbound call to a non-IM domain, so the toggle
@@ -3997,7 +4123,7 @@ async function handleSkillsList(_req, res) {
 let remoteHotCache = null;
 const REMOTE_HOT_TTL_MS = 5 * 60_000;
 function isSkillhubEnabled() {
-    const v = (process.env.IMHUB_SKILLHUB_ENABLED ?? '1').trim().toLowerCase();
+    const v = (process.env.AGIM_SKILLHUB_ENABLED ?? '1').trim().toLowerCase();
     return v !== '0' && v !== 'false' && v !== 'no' && v !== 'off';
 }
 async function handleSkillsRemoteHot(_req, res) {
@@ -4006,7 +4132,7 @@ async function handleSkillsRemoteHot(_req, res) {
         // so the SPA can render "disabled" copy without a network error
         // toast. Status 200 because this is a deliberate operator choice,
         // not a transient failure.
-        sendJson(res, 200, { disabled: true, items: [], reason: 'IMHUB_SKILLHUB_ENABLED=0' });
+        sendJson(res, 200, { disabled: true, items: [], reason: 'AGIM_SKILLHUB_ENABLED=0' });
         return;
     }
     try {
@@ -4484,10 +4610,18 @@ async function handleWorkspaceFileWrite(req, res, url) {
             throw err;
         }
         const finalSt = await stat(target);
+        const savedPath = relativePath(base, target);
+        if (savedPath === 'MEMORY.md') {
+            try {
+                const { ensureAgentMemoryLink } = await import('../core/agent-cwd.js');
+                await ensureAgentMemoryLink(agent);
+            }
+            catch { /* best-effort: memory file itself was saved successfully */ }
+        }
         sendJson(res, 200, {
             ok: true,
             agent,
-            path: relativePath(base, target),
+            path: savedPath,
             size: finalSt.size,
             mtime: finalSt.mtime.toISOString(),
         });
@@ -5448,14 +5582,14 @@ function sendToClient(ws, data) {
  *
  * Polls every 50 ms — node's `ws` doesn't emit a `drain` event we can hook,
  * but the buffered amount drops monotonically once the kernel ACKs flush.
- * Bounded by IMHUB_WS_BACKPRESSURE_TIMEOUT_MS (default 5 s) so a frozen
+ * Bounded by AGIM_WS_BACKPRESSURE_TIMEOUT_MS (default 5 s) so a frozen
  * client can't wedge the agent's chunk producer indefinitely.
  */
 async function awaitWsDrain(ws) {
     if (ws.bufferedAmount < WS_BACKPRESSURE_HIGHWATER_BYTES)
         return;
     const timeoutMs = (() => {
-        const raw = process.env.IMHUB_WS_BACKPRESSURE_TIMEOUT_MS;
+        const raw = process.env.AGIM_WS_BACKPRESSURE_TIMEOUT_MS;
         if (raw) {
             const n = parseInt(raw, 10);
             if (Number.isFinite(n) && n > 0)