@huynle/hub 0.9.2 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,325 @@
 # Changelog
 
+## 0.10.1
+
+Clicking the composer's Model chip changes the session's model. No migration is needed. Machines need the new
+plugin (and an OpenCode restart) for the chip to become clickable; with older plugins it stays display only.
+
+### Console
+- **The composer's Model chip changes the session's model** (user decision, 2026-11-10: "yes, it should change the
+  session model"). Clicking (or Enter on) "Model: …" opens the same picker as the Voice model (search over the
+  session machine's catalog, the variant step, arrows, Enter and 1–9); a pick sets the **session's own model**, so its
+  next turn and every later one run on it, whether the prompt comes from the hub console, the OpenCode TUI or a
+  Voice relay. The chip then shows it with source "chosen" (the picker marks it). The Voice chip and its picker are
+  unchanged, and a Voice pick still never changes the session's model.
+  - Mechanism: OpenCode 2.x's `session.switchModel`, which stores the model on the session (the same call the TUI
+    makes when you pick a model there); the runner uses it for every turn of that session. Last writer wins: a model
+    you then pick in the TUI's own model dialog replaces it at the TUI's next prompt. OpenCode has no way to go back
+    to "no model chosen", so the picker has no Default entry: pick the default model itself.
+  - New console route `PUT /api/sessions/:id/model {model: {providerID, modelID, variant?}}` → `{model}` (the
+    session's model now). The same access as sending a prompt: the session's owner only (foreign or unknown
+    sessions 404, session/app tokens and grant-holders 403, as for every console route). 400 for a malformed body or
+    a model or variant the session's catalog lacks, 409 `unsupported` when its spoke is older. Audited as
+    `session.model`.
+  - Protocol (additive): spoke op `setModel {sessionID, model}` → `{model: SessionModel}`, announced as the new spoke
+    feature `setModel`. Older spokes (and hubs that list no features) keep the chip display only.
+
+## 0.10.0
+
+One release for everything since 0.9.2: the production-testing fixes, the voice update (Voice front on by default,
+the old `voice` agent removed, Concierge front and grant requests), finding your sessions (Touched by me, Working
+set, activity meter, Context cards), session subscriptions, and the app front (connect apps with consent; speech,
+conversation and Decisions for apps; `packages/voice-client`). No migration is needed: new state is created on
+first use. Machines need the new plugin, and a fast `voiceModel` for the Voice front (see Operators below).
+
+### Voice and the Concierge
+- **The Concierge can ask you for a grant** (user decision, 2026-11-08). When you ask it to help or act in a project
+  no grant of its covers, it offers in one sentence, then (after your yes) requests a scoped, short grant with the
+  new hub verb `concierge_request_grant` (`POST /api/agent/concierge/grant-requests`, the current Concierge only).
+  It is a **tap Decision** for you (never armable, never by voice); **Approve grant** creates it **as you**, holder
+  `@@concierge`, beside the Settings grant (revoke it in Settings → Agents). The hub clamps it: verbs approve, deny,
+  answer (prompt or stop only when you asked), at most 24 hours (8 by default), only projects the Concierge watches
+  (no wildcards), no "always", 60 actions an hour, and your never rules carried over plus `shell:git push*` and
+  `shell:rm *`. One open request at a time; none for 24 hours after you deny one. The board shows whether a grant
+  covers each session's project (`inGrant=yes (verbs)` / `inGrant=no`), and the context names the grants you
+  approved at its request. Concierge prompt v9. See [docs/concierge.md](docs/concierge.md#asking-you-for-a-grant).
+- **Voice mode always uses the voice front; the `voice` agent swap is gone** (user decision, 2026-11-07). The
+  console's Settings → Voice → **Voice front** (no longer experimental) is **on by default**, also for Voice mode
+  started from the TUI's `/voice` link; turning it off on a device makes Voice mode talk to the session directly.
+  The hub asks for a front whenever the machine serves it (`voiceFront`) unless the device sent `front: false`.
+  - **The session you talk to is never switched to another agent or model.** Without a front (turned off, an older
+    plugin, a front that could not start or failed, or an older hub sending `conversation {on}`), the hub talks
+    to the session itself and its turns get the short spoken-reply style. The `voice` agent, its orchestrator
+    prompt and the `hub_task_stop` tool are removed. A session an older plugin left on the `voice` agent (a crash
+    mid-conversation) is moved to the default agent before the hub's next prompt, or after a turn fails with
+    "Agent not found": OpenCode 2.2.3 does not fall back on its own.
+  - **`voiceModel` is the voice front's model: set a fast, paid model** (a free one that runs out of quota makes
+    the front fail and Voice mode fall back to the session). A session's Voice model in the console is the
+    front's too, and applies the next time Voice mode starts; it no longer switches the session's own model.
+  - **Hands-on fixes to the front** (preview test, 2026-11-08): it **stops talking after it hands a request to the
+    session** (its text after `voice_main_send`/`voice_main_stop` in that turn is never spoken, and the tools say
+    the turn is over); it **never reports an old reply as news** (only text from a session turn that started after
+    its latest relay counts as the latest reply; older text is labelled old, and a turn-end report carries only that
+    turn's text); it **says "the session", never "main"**; and a **correction relayed while the session works gets
+    one report**, after the corrected request finishes (a turn end is held while a relay is not delivered yet, at
+    most 60 s). A relay cancelled in the session's queue (or lost in an event gap) no longer holds reports: the
+    report comes at the turn end. Once the front hands off, nothing more it writes in that run is spoken, even if
+    the model hands off a second time.
+  - **The front never thinks, and its request is lean**: the hub turns its model's thinking off (Anthropic
+    `thinking: {type: "disabled"}`, also over a model's own thinking setting or a `#variant`; OpenAI-style models
+    the lowest reasoning effort they list), and its system prompt is its own prompt only (no `AGENTS.md`/`CLAUDE.md`
+    or other instruction files, no environment or worktree blocks). Measured through OmniRoute, first token of the
+    echo: Haiku 4.5 from about 3.0 s to 1.2 s (median; 0.76–0.87 s on warm turns), Haiku 5.5 from about 2.0 s to
+    1.2 s. **Recommended `voiceModel`: a fast model; Claude Haiku 4.5 measured fastest (0.7–0.8 s first token
+    through OmniRoute), Haiku 5.5 is the alternative.**
+  - **The Worker model is gone**: no Worker chip in the composer; an older console's worker selection is accepted
+    and ignored, and older stored ones are not shown. In `config.json`, `subagent` and `workModel` are obsolete:
+    read without error, ignored, logged once per process, and dropped the next time the plugin saves the file.
+  - **The composer shows the session's own model** ("Model: Claude Opus 5.5", provider/model in the tooltip): the model
+    chosen for the session, else the model its latest reply ran on (what the default resolved to), else the default
+    model; "default" only before the spoke knows anything. It updates after each run and Voice never changes it (the
+    voice front is a separate session). On a phone it drops the "Model:" prefix and ends in an ellipsis when long.
+    New optional `model {providerID, modelID, variant?, name?, source: "chosen" | "reply" | "default"}` in the
+    spoke's `summary` result (`GET /api/sessions/:id/summary`); older spokes leave it out and the chip says default.
+- **The Concierge gets the voice front too** (P2, user decision 2026-11-08). Voice in the Concierge panel now talks to
+  a fast voice front in front of the Concierge session, as in sessions: the "front" chip and the fallback note show,
+  no spoken fillers play, and the Concierge keeps its agent, model, board, grant and Decisions. A spoken "yes"/"no"
+  still answers the armed Decision on your device before anything reaches the front.
+  - The front answers simple status questions from a compact copy of the Concierge's board (your watched sessions
+    with @name, project, machine, state and what they wait for), and hands everything else (approvals, Decisions,
+    watch/mute, intents, anything needing the grant) to the Concierge.
+  - **New: "tell the hub session to run the tests"** goes straight to that existing session, on any machine, as if
+    you typed it there (`relay_to_session`). The front says its pick first ("Sending that to Hub on baruch."); "no,
+    the other one" sends it to the other session. It is a message only: it never approves, answers, stops or starts
+    anything, and the session's own permissions still apply. No grant and no Decision are needed (it is your own
+    voice), and the hub enforces it: only your own, visible sessions (never a front or the Concierge), only for what
+    you just said (never from an update), at most 2 sessions per thing you say. Each relay is in Settings → Agents →
+    Activity as your prompt, "Relayed by voice from you (Concierge front)", with the device; refused attempts are
+    listed too.
+  - **Questions about a session are answered, not relayed**: "can you check on the billing lead?" gets an answer
+    from the board (or the Concierge) instead of going to @billing-lead, which answered about itself in the first
+    hands-on test. The hub refuses a relay of a question about a session ("did hub run the tests?", "what happened in
+    hub", "is hub waiting for me"), while requests phrased as questions still go ("could hub update the changelog?",
+    "can we squash the commits in hub?"). For a question that also names work, the front may say what it sends and
+    confirm once.
+  - **The relay delivers only your words**, as the hub heard them, starting with "(by voice, via the Concierge, for you)":
+    never the front's rewording or summary. Text on the board from other agents therefore cannot steer a relay or
+    invert your request, and a relayed "[hub] …" line cannot pose as a hub message. "No, the other one" carries your
+    earlier request only when you said it on the same device.
+  - The Concierge's board no longer says "Grant: none" when grants you approved at its request apply: "Grant: none
+    from Settings; approved at your request: …".
+  - The sessions you relayed to report back like the session in session mode: their question, permission or failure
+    is spoken once, and the front says what they did when their turn ends (one report per job, never old news). Other
+    watched sessions keep the Concierge's usual updates.
+  - Needs the hub and the plugin of this release on the Concierge's machine (`conciergeFront`); with an older plugin
+    the Concierge answers Voice itself, as before.
+
+### Session subscriptions
+- **A session can follow other sessions** and react to what happens there: `hub subscribe @builder --type state:idle`
+  (also `@@role`, `#team`, `children`; families `state`, `blocker`, `message`, `launch`, `naming`, `presence`,
+  `manage`, exact types or `*`). The hub sends the subscriber one batched hub message per window (default 30 s) from
+  `app:subscriptions`, waking it when idle without interrupting a turn (`--delivery steer|silent` to change that).
+  Visibility is the subscriber's (team scope included), its own events never come back to it, notices continue the
+  message hop chain (mutual subscribers stop at the hop cap), and each subscription has an hourly limit (default 20)
+  and an expiry (default 1 day, at most 30). Cursors survive restarts; a subscription ends when it expires or its
+  sessions are archived or deleted. API `/api/agent/subscriptions`, the OpenCode `hub` tool verbs `subscribe`,
+  `unsubscribe` and `subscriptions`, the CLI, the SDK and a **Subscriptions** card in the console's Details rail.
+  Journal events `subscription.created` / `subscription.removed`. App tokens need `events:subscribe`, `sessions:read`
+  and, unless `delivery` is `silent`, `messages:send`. Batches are claimed before they are sent (batch ID `sb_…`;
+  at least once, rarely twice after a crash), notices take no reply, and a Concierge session cannot subscribe.
+  No migration is needed.
+  [docs/subscriptions.md](docs/subscriptions.md)
+
+### Context cards (opt-in)
+**Context cards (opt-in).** Each session can get short, automatically updated cards that help you (and the
+Concierge) pick its work back up. The first, **Pick up where you left off**, is written by a light model the hub
+calls directly: a one-line headline of where the work stands plus a short summary (what you asked, what the agent did,
+what it waits on). A second, **Changes**, lists the working-tree changes without a model. Cards are modular:
+providers in a hub registry. **They are off for every user until that user turns them on** in Settings › Concierge ›
+Context cards; nothing is sent to any model before. Titles are never rewritten; a session still titled "New session"
+is auto-named. No migration is needed.
+
+**For users**
+- **Settings › Concierge › Context cards**: turn them on for yourself; it shows the model, exactly what is sent and
+  your daily budget.
+- The session's Details rail has a **Context cards** card (after Subagents): each card with its headline, summary,
+  fields and "updated 3m ago · model", a Refresh button each (one per card per 30 s), live updates.
+- The Concierge board shows each watched session's pick-up headline.
+
+**For operators**
+- **`contextCards`** in `hub.json` (`enabled`, `model {provider, model, baseURL, apiKey}`, `budget {calls, tokens}`)
+  and **`HUB_CONTEXT_CARDS=off`** (the hub-wide kill switch; `false`, `0`, `no` too, and `on`/`true`/`1`/`yes` turn
+  cards back on over `hub.json`; any other value stops startup with an error). Model: OpenRouter `anthropic/claude-haiku-4.5`, reusing
+  the speech OpenRouter key. Per-user daily budget (default 200 calls, 400,000 tokens), reserved before every call and
+  counting failed calls; repeated model failures back a user off and pause the hub's calls for 5 minutes. Automatic
+  cards run on one leader pod. What is sent and redacted: [docs/context-cards.md](docs/context-cards.md#privacy-and-cost)
+- **Redaction** (voice recordings and context cards) now also covers whole private key blocks (also cut off and on one
+  line), AWS secret keys and STS credentials, `password=`/`passphrase=`/`secret=`/`token=`/`*_API_KEY=`-style values
+  (quoted values whole), passwords in URLs and `Authorization` headers. Other secrets in free text are not detected.
+- Context card refresh limits are kept per pod; the daily budget is hub-wide. One user's model failures can no longer
+  pause another user's cards (the hub-wide pause needs provider errors from at least 3 users).
+
+**For integrators**
+- `GET /api/agent/sessions/:addr/context-cards` (scopes like the intent read), console routes
+  `GET /api/sessions/:id/context-cards`, `POST …/context-cards/:provider/refresh {force?}` (429 with `Retry-After`),
+  `GET /api/context-cards/primary`, `GET|PUT /api/settings/context-cards`; SSE `contextCard`; journal
+  `session.contextCard`; board item `pickup`.
+
+### Find your sessions
+- **Touched by me**: the hub keeps, per user, when you last prompted (terminal, console, Voice), answered or opened
+  each session, and a 24 h histogram of your actions and the agent's turns and tool calls (StateStore collection
+  `human-activity`, 30 days, throttled writes; no migration needed). `GET /api/activity/mine`, SSE `activity`;
+  `GET /api/intents/mine` for the stored intents. Terminal prompts are matched exactly: the OpenCode spoke marks the
+  prompts the hub carried (`session.inbox.delivered {carried: true}`, spoke feature `inboxCarried`), and so does the
+  Codex spoke; update them to have terminal prompts counted. Claude Code already reports them as the hub's. Context
+  cards' automatic runs now gate on this persisted activity, and the list's second line is the primary card's
+  headline when there is one. Launch first
+  prompts and Concierge proposals are not counted as yours; only an explicit open (`POST …/read {open: true}`) is.
+- **All sessions**: a **Touched by me** chip (24 h, or 1 h / 7 days), a **Last touched** column and sort, a **24 h**
+  activity meter column (agent bars, your marks) that sorts by Most active, the session's intent as a second line
+  under titles, and "waiting 12m" on sessions that need you (status entries carry `blockedSince`).
+- **Sidebar**: a **Working set** after Needs you (pinned + the 7 sessions you touched most recently within 7 days),
+  second lines under titles and waiting times.
+  [docs/session-view.md → Finding your sessions](docs/session-view.md#finding-your-sessions)
+
+### Console
+- **Subagents** card in the session's Details rail: the session's subagents with their live state, running ones
+  first (then finished, failed first; older ones fold under "N more finished"), each linking into its session.
+- **Redacted thoughts** say what happened: the provider sent only an encrypted signature, no thought text.
+- **Mermaid diagrams** in a streaming reply no longer flicker while the reply updates.
+- **Full-screen viewer** steps through all of a session's media (images and diagrams, in transcript order) with ←/→,
+  on-screen buttons or a swipe.
+- **Settings › Voice › Recording**: your recordings fold into one summary row (count and storage) that opens a
+  scrolling list grouped by day. Old `#recording` links (the ● Recording chip) open that list.
+- **Voice bar** keeps End on the status row (a long status is cut short; narrow bars move the chips and model to a
+  second row), and the pressed voice button keeps its icon visible.
+- **New grant** form: search pickers for the holder (keyboard friendly), project and pattern chips, help for each
+  verb and quick expiry choices.
+- **Settings → Agents & access → Connected apps and App clients**: see the apps connected to your account with their
+  scopes and revoke them; register app clients (admins: hub-wide; anyone: for their own account only) with exact
+  redirect URIs and a scope ceiling; the secret is shown once, and can be rotated; disable or delete a client.
+  Connected apps can be chosen as grant holders. The consent page (`/connect/consent/…`) cannot be framed.
+
+### App front (for app developers)
+- **The app front, end to end** ([docs/app-front.md](docs/app-front.md), now the full guide: the BFF pattern, no
+  tokens in the browser, no CORS, the scopes, the grants each feature needs, limits and quotas, the refresh rule, the
+  security rules, a walkthrough). The **SDK** (`packages/sdk`) gains the app server's side: `HubConnect` (authorize
+  URL, callback `state`/`iss` checks, code exchange, refresh, revoke; OAuth errors as `HubOAuthError`), `pkcePair`,
+  `ConnectionTokens` (one pair per connection in a `TokenStore`, refreshed single-flight and stored before use; a
+  connection the hub ended is forgotten), `hub.speech` (`transcribe`, `speak`), `hub.conversation` (`stream`: the
+  frames as an async iterator that resumes with `Last-Event-ID` after a drop, `end slow` or `token_expired`, retrying
+  refused reconnects (network, 5xx, 429 with its `retryAfter`) with capped, jittered exponential backoff and stopping
+  after `maxReconnects` without progress; `set`,
+  `utterance`, `interrupt`) and `hub.appDecisions` (`list`, `answer`); `HubClient` takes a token function (asked
+  before every request) and knows `upstream_failed` and app-answered Decisions. The voice loop
+  (`packages/voice-client`) gains **`appTransport`**: its `VoiceTransport` onto the app's own server (six routes
+  under one base, the relayed stream resumed, `onEnd` for revoked/grant/gone), never the hub. A reference BFF,
+  [examples/app-front-bff](examples/app-front-bff/README.md): a token store, single-flight refresh, SSE
+  pass-through, no CORS, sign-in and connect as same-origin POSTs (Origin or Sec-Fetch-Site required), `state` bound
+  to the session, a `Secure` cookie over https, a streamed body limit. The **app fixture** (`test/it/app-fixture.ts`) gains a registered app
+  client (in the startup line), control routes acting as the user on the consent page (`POST /connect/approve`,
+  `/connect/deny`), for grants, app tokens and connections, a fake speech provider, sessions that stream a reply
+  (`POST /sessions/:id/reply`), a simulated voice front (heard, a sentence, relayed to main) and Decisions a session
+  asks (`POST /sessions/:id/ask`); `test/it/app-front.test.ts` runs the whole journey and its refusals against it,
+  and `test/it/app-front-proxy.test.ts` runs the voice-client transport through the example BFF against a real hub.
+  [docs/app-integration-testing.md](docs/app-integration-testing.md)
+- **Decisions from apps** (`app-decisions` in `/.well-known/hub` `features`; new scope `decisions:answer`, offered on
+  the consent page and in Settings → Agents): `GET /api/agent/decisions?answerable=1[&state=open]` lists, and
+  `POST /api/agent/decisions/:id/answer {option?, text?}` answers, the **confirm-tier** Decisions without an action
+  that one of the app's sessions asked: a session it launched, or one covered by an active grant allowing **`answer`**
+  (a prompt-only grant does not count). Everything else is refused: another session's Decision, a deleted session's,
+  or an unknown ID `404`; not open, or another answer won first (console or app) `410 gone`; `tap` tier, escalated
+  permissions, grant requests, Concierge proposals, Concierge-asked Decisions and lasting options (`always`) `403`;
+  a body with `via` `400`; the kill switch `423 paused`. The answer reads `answeredBy: "app"` with the app's party
+  (`app`) and label (`appLabel`); the asker's reply says which app answered; the agent audit lists
+  `decision.answer` by the app. The console names the app on answered Decisions and says so when a waiting card was
+  answered by an app. [docs/app-front.md](docs/app-front.md#decisions-from-apps)
+- **Conversation for apps** (`app-conversation` in `/.well-known/hub` `features`; new scopes `conversation:read` and
+  `conversation:write`, offered on the consent page and in Settings → Agents): for a session the app launched or
+  holds a grant allowing `prompt` for (any other session, a deleted one, or one covered only by an answer- or
+  stop-only grant is `404`), `GET /api/agent/sessions/:addr/stream` streams the reply
+  (`ready`, `delta`, `say`, `heard`, `status`, `conversation`, `reset`, `end`; closed frames, no reasoning, activity
+  or blocker text), resumable with `Last-Event-ID` (`reset` when the gap is not covered; in a cluster a resume ends
+  with `reset {log}`), re-checked every 30 s and at once on revocations (`end` `token_expired`, `revoked`, `grant`,
+  `gone`, also when the grant is narrowed to drop `prompt` or the session is deleted), capped at 4 streams per app credential and 20 per user (`429`), and cut off for readers more than 1 MiB
+  behind (`end slow`). `POST …/conversation {on, front?}` (the voice front: asked for with `front: true`; never the
+  Concierge's front, whose relays act as you), `POST …/utterance {text}` → `202
+  {inboxID}` and `POST …/interrupt` need `conversation:write` plus a grant allowing `prompt`, the kill switch off and
+  (utterances) the grant's `maxActionsPerHour`; utterances carry the same hub-prompt provenance as typed app turns.
+  Typed turns use the existing `POST …/prompt`, now also admitted with `conversation:write`; `GET …/log` is admitted
+  with `conversation:read` for the app's sessions. An app whose act the session refuses gets a generic "The session
+  refused it" (the session's words stay in the hub's log). [docs/app-front.md](docs/app-front.md#conversation-for-apps)
+- **Speech for apps** (`app-speech` in `/.well-known/hub` `features`): with the new scope `speech:use` (hand-made
+  `hat_` tokens and connected apps alike; offered on the consent page and in Settings → Agents),
+  `POST /api/agent/speech/transcribe` (raw audio → `{text}`) and `POST /api/agent/speech/speak` (`{text}` →
+  `audio/mpeg`, streamed) use the user's own speech provider and key, within the console's audio and text limits
+  (text longer than `HUB_MAX_SPEECH_CHARS` is refused, not cut). Per-credential quotas, cluster-wide: transcribe
+  20/min and 300/h, speak 60/min, 1000/h and 100 000 characters/h, then `429 rate_limited` with `retryAfter`.
+  No provider: `422 unsupported` (`feature: "speech"`); a provider failure: the new error code
+  `502 upstream_failed` (a generic message and the provider's HTTP status; the provider's text stays in the hub's
+  log). Admission is atomic across parallel requests and pods (fixed clock windows, so up to twice a limit around a
+  window edge). App credentials only (devices use the console routes); control characters are stripped before
+  speech. Apps never see speech settings or keys, nothing is recorded for them, and the audit lists their speech use
+  per credential every 15 minutes at most, with the hour's request counts and no content. [docs/app-front.md](docs/app-front.md#speech-for-apps)
+- **Connect an app with consent** (`app-connect` in `/.well-known/hub` `features`): a web app's server connects to a
+  Hub user's account through an OAuth 2.1-style authorization code + PKCE (S256) flow instead of a hand-made token.
+  `GET /connect/authorize` sends the user to the hub's consent page (the app's name, where the browser returns to and
+  the requested scopes, which the user can narrow); `POST /connect/token` exchanges the one-time code (60 s) for a
+  1-hour `hca_` access token and a rotating `hcr_` refresh token (30 days sliding; reusing the just-rotated one within
+  30 s answers the same pair, any other reuse revokes the connection); `POST /connect/revoke` (RFC 7009) ends it.
+  RFC 8414 metadata at `/.well-known/oauth-authorization-server`; OAuth error bodies; flows and codes in the shared Kv
+  (cluster-safe); rate limits per client. The app acts as `app:<connection>`, stable across refreshes, so its grants
+  and launches survive rotation; revoking deletes its grants and webhooks. Hand-made `hat_` tokens are unchanged.
+  Hardening: wrong client secrets never lock out an app's real server (failures are limited per client and client
+  address; only authenticated requests count against the per-client limit), the authorize limit is per client and
+  client address and unaudited, a code is checked against its client before it is spent, at most 50 hub-wide and 10
+  personal clients per user, and a refused `hca_` token answers `WWW-Authenticate: Bearer error="invalid_token"`.
+  Apps must keep one current token pair per connection (see the strict reuse rule in the docs).
+  [docs/app-front.md](docs/app-front.md#connect-an-app)
+- **App-front contract updated with the user's answers** (decision nixct956): confidential clients only, a 30 s refresh
+  grace, per-user clients next to hub-wide ones, app utterances marked "via app" (AF3), speech quotas configurable in
+  `hub.json` (AF2).
+- **App-front contract (frozen, not built yet)**: how an external app's server will use Hub as its AI layer:
+  connect with consent (OAuth 2.1-style authorization code + PKCE, short-lived access tokens and rotating refresh
+  tokens, clients registered by the owner in Settings), speech, a conversation stream (including the voice front) and
+  answering its own sessions' confirm-tier Decisions. New JSON Schema `packages/protocol/schema/app-front/v1.schema.json`
+  and shared constants in `packages/protocol` (`APP_FRONT_SCOPES`, `APP_FRONT_FEATURES`, …).
+  [docs/plans/2026-11-08-app-front-contracts.md](docs/plans/2026-11-08-app-front-contracts.md)
+- **Voice client package (AF5)**: the console's hands-free Voice loop is now `packages/voice-client`
+  (`@huynle/hub-voice-client`, internal), so other web apps can embed it. Everything to and from the session goes
+  through the contract's `VoiceTransport` (conversation, utterance, interrupt, transcribe, speak, events); the package
+  never holds a Hub token and never calls Hub (an app's transport calls its own server). Spoken diagrams, the cue
+  voice key and recording are optional plug-ins (recording off by default). `npm run build:voice-client` builds a
+  standalone `dist/` with the workers, onnxruntime-web's wasm, the Silero VAD and Smart Turn models and their licence
+  files; the README lists the CSP an embedding app needs (workers, `'wasm-unsafe-eval'` for the worker scripts). The
+  console uses the package with no change in behaviour; like the console, the package's loop asks for the voice
+  front by default (`front: () => false` opts out). [docs/app-front.md](docs/app-front.md),
+  [packages/voice-client/README.md](packages/voice-client/README.md)
+
+
+### OpenCode TUI
+
+- **`/who` shows who you are**: a `You: @name · project` line heads the dialog (`You: ses_… (unnamed; …)` with how
+  to name it), your own row is marked `(you)` and listed first, then online sessions before offline ones, named before
+  unnamed. Unnamed online sessions show their title next to their ID; the dialog title counts sessions and online
+  ones. The OpenCode `hub` tool's `who` verb marks the caller the same way.
+- **Fix**: the `/who` RPC schema now lists every field the TUI sends and reads. OpenCode drops unlisted keys, so the
+  `#team` filter, the team sections (HWA-40) and the caller marker never reached the dialog before.
+- **Incoming hub messages** no longer repeat the sender (`From @x:` twice), and the `hub` tool's results carry a
+  title (`hub · reply to @x: …`). Showing those titles in the TUI needs an OpenCode change.
+
+### For operators (upgrading)
+- **New StateStore collections**: `context-cards`, `context-card-usage`, `context-card-settings`, `human-activity`,
+  `subscriptions` and `subscription-index`. No migration is needed; they are created on first use.
+- **New leaders**: `context-cards` and `subscriptions` (one pod each in cluster mode).
+- **New spoke feature `inboxCarried`**: update the OpenCode and Codex spokes with the hub so terminal prompts count
+  as yours (Touched by me, context cards' activity gate).
+- **`agents.speechQuotas`** in `hub.json`: per-credential quotas of speech for apps, any subset of
+  `{transcribe: {perMinute, perHour}, speak: {perMinute, perHour, charsPerHour}}` (defaults 20, 300; 60, 1000,
+  100 000).
+- **`HUB_TRUSTED_PROXIES`**: the reverse proxies whose `X-Forwarded-For` the hub may read to tell clients apart for
+  per-address rate limits (connect-app). Unset, the hub uses the TCP peer and never reads the header.
+
 ## 0.9.2
 
 Webhooks can reach a named receiver on your own network without opening the hub to every private address. No

package/Dockerfile

@@ -24,11 +24,14 @@ COPY packages/claude-code/package.json ./packages/claude-code/
 COPY packages/conformance/package.json ./packages/conformance/
 COPY packages/preset/package.json ./packages/preset/
 COPY packages/codex/package.json ./packages/codex/
+COPY packages/voice-client/package.json ./packages/voice-client/
 RUN npm ci --no-audit --no-fund --ignore-scripts
 COPY web ./web
-# The console imports the protocol and SDK sources (web/src/… ../packages/{protocol,sdk}/src).
+# The console imports the protocol, SDK and voice-client sources (web/src/… ../packages/{protocol,sdk,voice-client}/src;
+# the voice client brings the speech-detection and turn models).
 COPY packages/protocol/src ./packages/protocol/src
 COPY packages/sdk/src ./packages/sdk/src
+COPY packages/voice-client/src ./packages/voice-client/src
 RUN npx vite build --config web/vite.config.ts
 
 FROM oven/bun:1.4.4-slim@sha256:1846adf22496bd711036aae8be147e57bdebbaea2e5264e3e0b5af1db187d9a4 AS deps
@@ -46,6 +49,7 @@ COPY packages/claude-code/package.json ./packages/claude-code/
 COPY packages/conformance/package.json ./packages/conformance/
 COPY packages/preset/package.json ./packages/preset/
 COPY packages/codex/package.json ./packages/codex/
+COPY packages/voice-client/package.json ./packages/voice-client/
 # Bun migrates package-lock.json; --frozen-lockfile keeps the pinned versions.
 RUN bun install --production --frozen-lockfile --ignore-scripts
 COPY docker/hub-deps.ts ./