@staix/agent-hub 0.12.17 → 0.12.19

package/CHANGELOG.md

@@ -4,6 +4,17 @@ Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the
 
 ## Unreleased
 
+## 0.12.19
+
+- Pi's write, edit, bash and git write approvals offer `Always allow <tool> until Pi restarts`: later calls of that tool by the running Pi skip the prompt, still under the path guard and sandbox. The grant is in memory only, logged by tool name, and the dashboard can still only deny (#209).
+- Control protocol stays 15 and events schema stays 1; a running 0.12.18 hub upgrades with the 0.12.19 coordinator.
+
+## 0.12.18
+
+- Attribute token increments, provider usage and completed turns to task ids by delivery or a single open task; add `ahub report --by task` with task/class totals, explicit unknown counters, unattributed shares and a separate historical bucket. Preserve PII id-only exports and derive no prices (#200).
+- Add semantic colors to console stream headers, footer and panels with `--color=auto|always|never`; keep plain-text Unicode geometry, sanitize incoming controls before the fixed palette, and restore terminal attributes on exit. Tail, logs, JSON and polling remain unchanged (#201).
+- Control protocol stays 15 and events schema stays 1; a running 0.12.17 hub upgrades with the 0.12.18 coordinator.
+
 ## 0.12.17
 
 - Add an operator console with confirmed approvals, bounded status polling and optional peer, approval, task, queue and event panels; open it from interactive `up` and preserve the tail renderer (#190, #191).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.12.17, control protocol 15. Durable delivery records distinguish queued
+Status: 0.12.19, control protocol 15. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -28,7 +28,7 @@ cd <your project> && ahub init && ahub up
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.17 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.12.19 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.

package/docs/agent-notes/adapters.md

@@ -6,6 +6,7 @@ Scope: the Codex, ACP and Pi adapters and the Pi extension (turn `generation` an
 - Codex 0.154.0 `agentMessage` items carry `text` and `phase` (not `content[]`); only the last non-`commentary` message of a turn is shared.
 - Approval titles are agent-written text shown to a person: the daemon escapes control characters, and write/edit/bash show what will be written or run.
 - An ACP permission request may carry no `rawInput` (Kimi 2.0.1): the arguments were on the earlier `tool_call` update, which `acp.ts` remembers by `toolCallId`. Kimi 2.1.1 sends no `rawInput` before the answer at all: the argument JSON streams as `content` text on `tool_call_update`, and only complete JSON counts. A payload that still cannot be resolved, or is too long to show whole (marked `[cut, N chars]`), withholds its `allow_always` option - never render a bare tool name as if it described the call.
+- Pi's `always` grant (#209) is keyed by `executeTool`'s tool name, never parsed from the approval title, and lives only in that Pi start's closure. Never persist it, share it with the local worker, or let the dashboard give it.
 - Auto-approval covers the hub's own tools by exact `mcp__agent-hub__<name>` title and only ever picks `allow_once`. Identity comes from the permission request title or, when an agent titles the request with the argument JSON (Qwen), from the announced `tool_call` title bound to the call id and resolved against the session's configured MCP servers, never from payload text, a prefix or an unrelated display title. Never widen it to a prefix, and never set Kimi's session mode to `auto` or `yolo` instead: those approve everything.
 - Every agent the hub spawns (the Codex app-server, ACP agents such as Kimi, Pi) runs in its own process group and is stopped as one (`stopOwnedProcess(proc, { group: true })`, `trackGroup` after spawn): `codex` is a node launcher, and mid-turn its native app-server does not exit on SIGTERM within the grace period, so a SIGKILL to the launcher alone left the app-server running under init and holding the daemon alive (#113, #115). A new adapter that spawns an agent does the same.
 - To stop a process tree, freeze it (SIGSTOP) before reading what it contains, then SIGKILL, and call it done only when the table shows none of it (with no table at all, the stop can only ask the group itself, which cannot see groups below it). A process a read after the freeze shows for the first time is frozen and read again before anything is killed. A snapshot taken while the tree runs misses what it starts next: three review rounds of #113 found such a gap (groups of its own, an unreadable first read, a child started during the grace period).

package/docs/events.md

@@ -30,9 +30,9 @@ marked `private: true`, and PII tasks `pii: true`.
 | `split` | `task`, `where` (`routing`: routing chose the first owner of a task overlapping another owner's task not started yet, not an escalation, relay or reassignment, the record calibration reads; `cohort`: an overlap formed or changed a cohort), `verdict` (`split`, `single`, `unknown`), `single` (the peer that would finish both units alone soonest), `splitS`, `singleS`, `reason` (for `unknown`), `trace` (the inputs and steps: peer names, their profiles of versions and coordination, and numbers only): a shadow split prediction; it never changes the assignment (issue #109) |
 | `state` | `peer`, `state` |
 | `turn_start` | `peer`, `turn` (`<peer>#<hub run>.<n>`, unique across restarts). A turn follows the adapter: pausing a busy peer does not end it |
-| `turn_end` | `peer`, `turn`, `ms`, `tokens` (when the adapter reported any during the turn), `files` and `snapshotMs` (when snapshots are on: how many files the turn changed, and the time both snapshots took) |
-| `tokens` | `peer`, `n` (tokens added since the previous report) |
-| `usage` | `peer`, `source`, opaque `id`, optional `measuredAt` (provider/source time), requested/served model and provider labels, and any provider-reported input/output/cache/total counters. Missing counters stay unknown. |
+| `turn_end` | `peer`, `turn`, `ms`, `tokens` (when the adapter reported any during the turn), `files` and `snapshotMs` (when snapshots are on: how many files the turn changed, and the time both snapshots took); optional numeric `task`, `attribution` (`delivery`, `single_open`, `unattributed`) frozen at turn start, `pii: true` for an attributed PII task |
+| `tokens` | `peer`, `n` (tokens added since the previous report), optional numeric `task`, `attribution` (`delivery`, `single_open`, `unattributed`), `pii: true` for an attributed PII task |
+| `usage` | `peer`, `source`, opaque `id`, optional `measuredAt` (provider/source time), requested/served model and provider labels, and any provider-reported input/output/cache/total counters; optional numeric `task`, `attribution` (`delivery`, `single_open`, `unattributed`), `pii: true` for an attributed PII task. Missing counters stay unknown. |
 | `task` | `id`, `event` (the board history event, e.g. `proposed`, `assigned`, `done`, `check failed`, `blocked`, `ready`), `by`, `state`, `owner`, `reviewer`, `class`, `pii` |
 | `overlap` | `task`, `owner`, `others` (`task`, `owner`, `paths`, and `symbols` when plans name the same symbol; a name that matches a PII pattern is left out, so either list can be empty), the structured twin of the console notice |
 | `quota` | `peer`, `windows` (`id`, `used`, `resetsAt`), `hard`, `measuredAt` (when the reading was taken, if not when it arrived: Claude's numbers come through a file) |
@@ -50,6 +50,40 @@ Token usage by adapter:
 - `ahub report` deduplicates usage records by peer, source and id. Coverage counts distinguish calls with provider usage from calls where usage was absent. Token counters are provider-reported values; the report never derives a price or treats missing spend as zero. Estimated price and measured provider spend remain unknown unless a future source reports them.
 - Usage telemetry has no prompt, completion, task text, credential, Access header, session id or transcript path.
 
+## Per-task usage reports
+
+`ahub report --by task` (also `--json` and `--since`) reads only `events.jsonl`.
+It reports task ids, the latest recorded class/outcome, completed logical turns,
+and wall time from the first `in_progress` task event to the first `approved`
+event. Wall time is unknown if either boundary is absent or the latest outcome
+is not approved. Each task and class rollup includes per-peer native token
+increments and provider-reported input/output/cache/total counters. Usage is
+deduplicated by peer, source and id; missing counters are `null` in JSON and
+`unknown` in text, with known-record counts alongside measured subsets. A
+missing task history has unknown class/outcome and belongs to the unknown class
+rollup. PII tasks have ids and a `pii: true` flag, never titles. No prices are derived.
+
+At write time, the first applicable attribution rule wins:
+
+- `delivery`: the current turn's original delivery names exactly one distinct positive task id, including work by a peer that does not own it.
+- `single_open`: otherwise the peer owns exactly one `in_progress` task.
+- `unattributed`: otherwise no task is assigned to the record.
+
+`Bus.onDeliver` observes originals immediately before `peer.deliver` starts the
+turn. Pending task identity is consumed at turn start and cleared on delivery
+admission/failure, so later user-started native turns do not inherit it. Usage
+and token events apply the rule at write time; `turn_end` keeps the start-time
+attribution. Local usage uses its request-bound route policy task when present.
+The existing relay has no task-bearing route usage event; this change adds no
+new usage source. Schema version 1 and the control protocol are unchanged.
+
+The unattributed share is always printed for token increments and deduplicated
+usage records, against all recorded increments/usage records. A zero denominator
+has unknown share. Records with no `attribution` field belong to a separate
+`before attribution` bucket displayed beside the share, even if a task field is
+present. Neither bucket is redistributed. `ahub export` preserves these fields
+as raw JSON lines; plain `ahub report` keeps its existing behavior.
+
 The file is local and never uploaded. It grows without rotation; delete it to start
 over (the hub recreates it).
 

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.12.17 and control protocol 15. Live verification
+This guide describes ahub 0.12.19 and control protocol 15. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Operator console and panels
@@ -17,6 +17,12 @@ approval titles are terminal-only; expiry and answers from another console remov
 the pending item. Approval audit records contain id, peer, option kind, response
 time and answering surface, without the title.
 
+Pi's write, edit, bash and git write requests also offer `Always allow <tool>
+until Pi restarts`. It allows later calls of that tool by the running Pi without
+asking, under the same path guard and sandbox; a Pi restart or replacement, or a
+hub restart, drops it. The hub log records each granted call by tool name only.
+The dashboard can only deny Pi's requests.
+
 Tab toggles stream and panels; `ahub console --panels` starts in panels. Peers,
 Approvals, Tasks, Queue and Events support arrow keys or j/k, Enter for detail,
 Escape to return and `?` for help. `:` enters a command. Assignment, delivery
@@ -26,6 +32,43 @@ a reason. Tasks use the same public redaction as the board. Panels need at least
 polling runs only while the corresponding panel is visible. Leaving restores
 the terminal and returning from panels replays the bounded stream buffer.
 
+Console color policy is `--color=auto|always|never`, with `auto` as the default.
+Auto enables color only when both input and output are TTYs, `TERM` is not
+`dumb`, and `NO_COLOR` is empty or absent. Explicit `always` overrides these
+conditions, including redirected stream output; `never` disables styling.
+Neither option changes terminal size requirements, panel decisions, cursor
+management or the final reset. Invalid values fail before connecting.
+
+| Meaning | Palette | Examples |
+|---|---|---|
+| Information and navigation | Cyan, bold cyan for active/selected labels | Tabs, section/peer labels and `>` selection marker |
+| Success and availability | Green | Idle peer, approved task |
+| Waiting and attention | Yellow | Busy/paused peer, pending approval, confirmation, review/ready task, important priority |
+| Failure and intervention | Red | Failed/check-failed task, undeliverable/overflow, `needs_review` queue, denial request or expired/cancelled approval |
+| Metadata | Bright black | Ages and remaining approval time |
+
+Offline peers, primary titles, action details and message body lines keep the
+terminal's default foreground. Labels and prompts remain readable without
+color. Stream styling applies only to the header, using structured event data;
+message text cannot choose a color. A local denial is shown as requested, not
+as a confirmed receipt; a remote answered closure has no option-kind metadata
+and is not guessed to be a denial. A fixed palette is applied after terminal
+control sanitization. Width, clipping, wrapping and cursor placement use plain
+Unicode text. Each styled span and every interactive exit restores attributes.
+Color adds no polling, timers or extra redraws. `ahub tail`, logs and JSON stay
+unchanged.
+
+```sh
+ahub console --panels --color=auto
+NO_COLOR=1 ahub console
+ahub console --color=never
+ahub console --color=always > console-stream.txt
+```
+
+Actual light/dark terminal readability and bounded idle-CPU observations are
+recorded separately in the smoke ledger; fake-terminal tests establish policy,
+geometry, sanitization and restoration only.
+
 The command input accepts existing status, board, task, review, say, pause,
 resume, budget, queue, permit, ask, remember, route, turns, undo, check-path and
 report operations. It executes an argument vector with closed stdin. Lifecycle,
@@ -346,11 +389,16 @@ token counts, never message bodies or task titles.
 ```bash
 ahub report --since 7d          # turns, busy time and tokens per peer, messages, overlaps, task events
 ahub report --since 7d --json   # the same numbers as JSON
+ahub report --by task           # tokens, turns and wall time per task and class, with the unattributed share
 ahub export --since 24h         # the raw events as JSON lines, for your own analysis
 ```
 
 `ahub report` counts the same overlap warnings as `scripts/overlaps.ts`, from the
-structured events instead of log lines.
+structured events instead of log lines. `--by task` uses the task each usage and
+token record was attributed to when it was written: the delivery that started the
+turn, otherwise the peer's only `in_progress` task. Everything else is reported as
+unattributed, and records from before 0.12.18 as a separate bucket; neither is
+redistributed (rules: [events](events.md#per-task-usage-reports)).
 
 ## Turns and undo
 
@@ -744,21 +792,21 @@ Rows without a live process are stale registrations; forget them with
 
 Upgrade running projects with the target release's own coordinator. It accepts
 a running source on control protocol 9 (0.6.x), 10 (0.7.0 through 0.12.0),
-11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15) 14 (0.12.16) or 15 (0.12.17), and only
+11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15) 14 (0.12.16) or 15 (0.12.17 through 0.12.19), and only
 a target on its own protocol, so the target's coordinator fits every supported
 source and carries every recovery fix released up to it. Protocol 8 and older
 (0.5.x and earlier) are refused as `manual-bootstrap-required`. Run from the
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.12.17 ahub upgrade --to 0.12.17 --dry-run
-bunx --package @staix/agent-hub@0.12.17 ahub upgrade --to 0.12.17 --yes
+bunx --package @staix/agent-hub@0.12.19 ahub upgrade --to 0.12.19 --dry-run
+bunx --package @staix/agent-hub@0.12.19 ahub upgrade --to 0.12.19 --yes
 ```
 
 | Running now | Coordinator to use |
 | --- | --- |
 | 0.6.x (protocol 9) | the target's, through `bunx` as above |
-| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 (protocol 15) | the target's, through `bunx` as above |
+| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15) | the target's, through `bunx` as above |
 | any supported source, with the installed CLI already at the target | `ahub upgrade` below, which is the same coordinator |
 | 0.5.x or earlier (protocol 8 and older) | not supported: bootstrap by hand with the matching CLI |
 
@@ -790,14 +838,14 @@ projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.12.17 --dry-run
+ahub upgrade --to 0.12.19 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.12.17 --yes
+ahub upgrade --to 0.12.19 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.17
+bun add -g github:STAIxBWLB/agent-hub#v0.12.19
 ahub setup
 ```
 

package/docs/security.md

@@ -6,9 +6,9 @@ agent-hub connects agents that can each run commands. This page says what the hu
 
 - **Other agents' text is untrusted.** Every message that crosses from one peer to another is framed as untrusted input (a channel tag with `meta.source` for Claude, a fixed header line plus a standing instruction for the others). A message body cannot forge the hub's own headers: such lines are quoted (`sanitize`). Replies inherit a hop count capped at 3, so agents cannot ping-pong forever; neither a digest nor a steer can reset it.
 - **The control link is loopback plus a secret.** The daemon and the Codex proxy bind 127.0.0.1 only. The control WebSocket requires a per-run token (`.agenthub/state/control-token`, mode 600), and both servers refuse any request that carries an `Origin` header: any web page can open a WebSocket to localhost, and browsers always send `Origin`. External clients cannot claim the console user's id or a hub-managed peer's id.
-- **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after `approvals.timeout_s` (default 120 s) of silence; the macOS notification for a waiting request carries the peer and the tool name only. The one exception is the hub's own tools (`hub_send` and the task tools, matched by exact name): Kimi's requests for them are approved once without a prompt and logged by name, the same trust Codex gets through `approval_mode` in the hub's config. They invoke hub-owned operations rather than arbitrary file or shell tools, and every call passes the hub's own checks. Identity comes from the exact permission title, or from the earlier tool-call title bound to the same call id and resolved against the configured MCP servers when the permission title contains argument JSON (Qwen). Payload text and unrelated display titles never establish identity. A payload longer than the console shows is marked as cut and never offers a session-wide grant. `--unattended` turns prompts off, says so loudly, and is never the default.
+- **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after `approvals.timeout_s` (default 120 s) of silence; the macOS notification for a waiting request carries the peer and the tool name only. The one exception is the hub's own tools (`hub_send` and the task tools, matched by exact name): Kimi's requests for them are approved once without a prompt and logged by name, the same trust Codex gets through `approval_mode` in the hub's config. They invoke hub-owned operations rather than arbitrary file or shell tools, and every call passes the hub's own checks. Identity comes from the exact permission title, or from the earlier tool-call title bound to the same call id and resolved against the configured MCP servers when the permission title contains argument JSON (Qwen). Payload text and unrelated display titles never establish identity. For ACP agents, a payload longer than the console shows is marked as cut and never offers a session-wide grant. Pi's write, edit, shell and git write requests are relayed the same way and can be answered `Always allow <tool> until Pi restarts`: later calls of that tool by the same Pi start skip the prompt but stay inside the path guard and sandbox. The grant covers every later call of that tool whatever its payload, is kept in memory only, cannot be given from the dashboard, and each call it allows is logged by tool name. `--unattended` turns prompts off, says so loudly, and is never the default.
 - **A committed config cannot choose launch commands, credential files, data endpoints or a wider sandbox.** The machine-local fields (`kimi_cmd`, `codex_bin`, `pi.cmd`, `checks`, `mlx.bin`, `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`, `omniroute.access_hosts`, the `omniroute` key files, `memory.worker_url`, `local.read_allow`, `local.bash_network`, `local.network_allow`) apply only from a config file git confirms nobody committed: `.agenthub/config.json` or `.agenthub/config.local.json`, matched by file identity so no other spelling the file system accepts slips past, and `.agenthub` itself not a committed symlink or submodule. Without a repository, or when git fails, they keep their defaults; an empty value always means the default. "Untracked" is answered by the repository that contains the project: a checkout copied or extracted into an unrelated repository, or into an ignored directory of one, is trusted like your own files. So a cloned repository cannot choose a launch command, a completion check, a gateway to send a key file to, a memory endpoint, or a wider sandbox. A command in `checks` runs as you, outside the local worker's sandbox, like a git hook. Nothing in `routing.toml` or in task text is ever run. `routing.toml` and the other shared fields still come from the checkout, and they matter: `routing.toml` picks the models the local worker and the hub's inference use at your gateway and can turn the PII constraint off, and roles and budget shape who does what. Review them in a repository you do not trust.
-- **Telemetry holds no bodies.** `.agenthub/state/events.jsonl` (issue #40) records envelope ids, routing and sizes, task ids and states, overlapping paths and token counts. It never records a message body, a task title or detail, and marks private (PII) envelopes and tasks as such. It stays on the machine; `ahub export` only prints it.
+- **Telemetry holds no bodies.** `.agenthub/state/events.jsonl` (issue #40) records envelope ids, routing and sizes, task ids and states, overlapping paths and token counts, and the task id (with a PII flag) that each usage and token record is attributed to. It never records a message body, a task title or detail, and marks private (PII) envelopes and tasks as such. It stays on the machine; `ahub export` only prints it.
 - **Snapshots stay in your repository.** Per-turn snapshots (issue #33) are git objects in the project's own object store, written through a temporary index; nothing is referenced, pushed or copied elsewhere, and `git gc` prunes them. They hold what the work tree held, including untracked files that are not ignored, so keep secrets in ignored files. They carry the repository's own permissions, and nothing caps their disk use but `git gc`. A turn of a peer holding an open PII task is not snapshotted; a PII file left in the project is snapshotted by later turns like any other file. `ahub undo` restores only files whose current content is exactly what the turn left.
 - **The edit hook reads, never decides.** `ahub check-path --hook` (issue #32) reads hub.db and returns context for Claude and a line for you; it sets no permission decision, so your permission rules stay in charge. It names other owners' task ids, titles and states, which then reach Claude's model; PII tasks are left out.
 - **The session record holds identities only.** `.agenthub/state/sessions.json` (issue #37, mode 600) keeps each attached peer's recovery metadata: launch options, session and thread ids, Pi's session file path. No message or task text; loss notices name deliveries by id, sender and public task title.
@@ -38,7 +38,10 @@ capability. Conflicting or malformed markers fail closed. There is no `--as-user
 Human-only operations are refused before connecting, including permission answers,
 queue resolution, budget overrides, lifecycle and recovery operations, and `ask`.
 The operator uses a plain terminal or `ahub console`. A Claude `!` command that
-inherits the agent markers follows the same rule.
+inherits the agent markers follows the same rule. The console strips control
+sequences from agent and daemon text before it quotes forged headers, and its
+colors come only from a fixed palette applied afterwards, so message text cannot
+set styles or operate the terminal.
 
 This is an honest default against accidental impersonation and injected commands.
 It does not make the token inaccessible to an agent with unrestricted project

package/docs/smoke.md

@@ -1252,3 +1252,36 @@ the sentinel. Missing served-model evidence remains `identified: false`.
 Before recording live acceptance, run a bounded unavailable-local/healthy-remote
 leg and retain the sanitized JSON plus process cleanup confirmation. Fixture
 verdicts do not certify provider availability or a real local generation.
+
+## 0.12.18 live checks: task attribution and console colors (#200, #201, 2026-10-09)
+
+The agent-hub project's own hub was upgraded from 0.12.17 to 0.12.18 by the
+user with the 0.12.18 coordinator, run from a plain terminal (an agent shell is
+refused by the identity gate). Claude (the session writing this) and Pi on
+`dgx/coding` were attached for the checks. Times are UTC.
+
+- **The upgrade left Claude held.** Operation `c671d786` (source 0.12.17,
+  protocol 15, running) was created at 05:26:55, the 0.12.18 daemon started
+  the same second, and the operation completed with the project verified. Ten deliveries Claude had accepted but never settled (three board review
+  requests, seven Codex chats, all handled before the upgrade) were moved to
+  `needs_review` with "peer disconnected before delivery settlement", and
+  Claude's queue was held behind them. `ahub queue resolve` is a console
+  command, so only the user can release it; the unsettled acceptances are #205.
+- **#200 AC4, attribution on a live turn.** Board task #19 (class `test`,
+  owner Pi) was proposed at 05:30:03, accepted at 05:30:07, done at 05:34:52
+  and approved at 05:35:16. `ahub report --by task` at 05:35:06 attributed Pi's
+  one turn and 602,255 tokens to #19 by its delivery. Unattributed: 2,159,396
+  of 38,171,695 token increments (5.7%) and 21 of 116 usage records (18.1%),
+  all Claude's own user-driven turns, which have no task-bearing delivery and
+  no single open task. The `before attribution` bucket held 35,410,044 tokens
+  and 95 records from before the upgrade. Both shares equal the JSON
+  `unattributed` counts over `totals`, and the JSON carried task ids, class and
+  outcome but no title or detail text.
+- **Pi could not run the check itself.** Its sandbox denies
+  `.agenthub/state/` (the `ahub` binary under the bunx cache and `events.jsonl`
+  both failed with EPERM). It reported every check as not run instead of
+  passing it, and the reviewer ran them.
+- **#201 AC7, idle console CPU.** Sampled with `ps` cumulative CPU time while
+  nothing happened on the hub: plain `ahub console`, 0.11 s over 60 s
+  (about 0.18%); `ahub console --panels`, 0.46 s over 120 s from 05:52:30
+  (about 0.38%, 0.21 to 0.25 s per minute, not growing).

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1360,6 +1360,30 @@ approval. Deny is direct. Pending requests include expiry and are withdrawn by
 Panels expose Peers, Approvals, Tasks, Queue and Events with bounded polling and
 Unicode cell widths, fall back below 80x24, and restore terminal state on exit.
 
+Console semantic colors (issue #201) use spans with a fixed terminal-native
+palette: cyan information, bold cyan active/selected labels, green availability
+and success, yellow attention/waiting, red failure/intervention, and restrained
+bright-black metadata. Offline peers, ordinary titles, action details and body
+lines use the default foreground. Existing labels, selection markers and
+confirmation prompts remain sufficient without color. Stream headers use event
+structure for their tone; body text is never parsed for meaning or passed
+through as terminal styling. Denial requests and observed expiry/cancellation
+are red; an answered remote closure lacks option-kind metadata and is not
+guessed to be a denial.
+
+`--color=auto|always|never` affects styling only. Auto requires terminal input
+and output, a non-dumb TERM, and absent/empty NO_COLOR. Always overrides those
+checks even for redirected stream output, without enabling panels or raw mode;
+never disables styling. Invalid values fail with usage text before connection.
+Plain `renderConsole` remains available, while `renderConsoleLines` exposes
+semantic spans. Geometry is computed from sanitized plain Unicode text before
+painting. `paint` sanitizes every span, inserts only fixed palette SGR sequences
+and resets each styled span. Interactive exits, signals, disconnect and errors
+retain the console restoration sequence. No new dependencies, protocol changes,
+polling or redraw triggers are added. Tail, logs and machine-readable output
+remain unchanged. Native light/dark readability and idle-CPU observations are
+separate smoke evidence, not inferred from fake-terminal tests.
+
 Agent shell CLI calls connect as the detected peer in tools mode. Hub launches
 set `AGENTHUB_PEER_ID`; the pinned installed Codex shell injects
 `CODEX_THREAD_ID` after environment filtering, and Claude uses `CLAUDECODE`.
@@ -1465,3 +1489,48 @@ provider/configuration change, account retry or authority relaxation. Once quota
 is available under an authorized account, the same isolated read-only status-tool
 and ordinary-role refusal probe must record a native tool event and daemon result
 before this Kimi prerequisite can be marked verified.
+
+## Amendment: per-task usage attribution (issue #200)
+
+Task usage is attributed by a rule at write time, never by a proportional guess:
+
+- A turn whose original delivery names exactly one distinct positive `refs.task` uses that id and `attribution: "delivery"`, even when the peer does not own the task. Two distinct delivery task ids fall through to the next rule.
+- Otherwise a peer with exactly one owned `in_progress` task uses that id and `attribution: "single_open"`.
+- Otherwise the record carries `attribution: "unattributed"` and no task id.
+
+The bus calls `onDeliver(peer, originals)` immediately before `peer.deliver`,
+after retaining the original delivery. The daemon consumes pending delivery
+identity during the synchronous busy/turn-start transition and clears it on
+delivery admission/failure. A user-started native turn cannot inherit an older
+delivery. Tokens and usage use the rule at write time; turn ends preserve the
+start-time attribution. Local worker usage carries its request-bound route
+policy task when one exists. Relay usage would use a route decision's task when
+present; the current daemon has no such relay usage writer, so collection is
+unchanged. Attributed PII records carry only a task id and `pii: true`.
+
+`ahub report --by task` and `--by task --json` use only events, never the board or
+task text. They report latest task class/outcome, attributed turn ends, first
+accept-to-first-approval wall time (unknown while not approved or without both
+boundaries), per-peer token increments and provider counters, and class rollups.
+Usage deduplication uses peer/source/id. Missing counters stay unknown, distinct
+from reported zero, and known-record counts identify measured subsets.
+
+Unattributed token and usage-record shares always appear. Older records without
+`attribution` stay in a distinct `before attribution` bucket, never redistributed
+to a task; both buckets appear even when empty. A zero denominator has unknown
+share. Export carries the new fields without task text. No prices or savings
+counterfactuals are derived. These additive fields retain events schema 1 and
+the existing control protocol. Plain `ahub report` remains unchanged.
+
+## Amendment: Pi "always" approvals (issue #209)
+
+Pi's `write`, `edit`, `bash` and `git` write calls ask with three options:
+`allow` (`allow_once`), `always` (`allow_always`, named `Always allow <tool>
+until Pi restarts`) and `deny` (`reject_once`). `always` allows the call and
+every later call of the same hub tool by that Pi start without asking. The grant
+is held in memory by the Pi start: stopping or replacing Pi, or restarting the
+hub, drops it, and nothing is persisted. A granted call is logged by tool name
+only. The path guard, denylist and sandbox still apply to each call; the
+dashboard still offers Pi only deny; unattended mode still picks `allow_once`;
+the local worker keeps allow and deny. The console and `ahub permit` already
+handle more than one allow option, so the control protocol is unchanged.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "20ad5e68fd1264fa43dd7426f60cb0c8211d6555",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -68,7 +68,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "20ad5e68fd1264fa43dd7426f60cb0c8211d6555",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -80,7 +80,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "20ad5e68fd1264fa43dd7426f60cb0c8211d6555",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -92,7 +92,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "20ad5e68fd1264fa43dd7426f60cb0c8211d6555",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -118,7 +118,7 @@
       ]
     },
     "docs/agent-notes/local-worker.md": {
-      "verifiedAgainst": "8b7d7254f1bb5602ec5d658e7814e236f8fb43e7",
+      "verifiedAgainst": "4b44b92dd2dc4b5515b6e87627fe4bdfcd6742c3",
       "paths": [
         "src/adapters/local-worker.ts",
         "src/local/",
@@ -136,7 +136,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "c3d1e22f9b200cbe3f484c9e73d30bad046c9221",
+      "verifiedAgainst": "4b44b92dd2dc4b5515b6e87627fe4bdfcd6742c3",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -151,7 +151,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "2a274289e280252b264716da3a1112f67b0c278e",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "test/",
         "scripts/check.sh",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.17",
+  "version": "0.12.19",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.17",
+  "version": "0.12.19",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15403,7 +15403,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.12.17",
+  version: "0.12.19",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/adapters/local-worker.ts

@@ -35,7 +35,7 @@ export interface LocalOptions {
   /** Runs a hub task tool (hub_task_*, hub_review, hub_remember) as this peer. Absent = the tools are not offered. */
   taskTool?: (name: string, args: Record<string, unknown>, turn: { pii: boolean }) => Promise<string>;
   /** Successful provider responses only; usage may be absent when the gateway omits it. Never includes prompt data. */
-  onUsage?: (record: { id: string; at: string; usage?: ChatResult["usage"]; requestedModel: string; servedModel?: string; provider?: string }) => void;
+  onUsage?: (record: { id: string; at: string; usage?: ChatResult["usage"]; requestedModel: string; servedModel?: string; provider?: string; task?: number }) => void;
   /** Atomic task/run admission immediately before every model request or tool execution. */
   admitBudget?: (envs: Envelope[], unit: "model_calls" | "tool_calls") => Promise<ExecutionBudgetDecision[]>;
   /** Per-turn policy from the task the delivery carries: the class's route, and whether it is a PII task. */
@@ -76,6 +76,7 @@ export class LocalPeer extends BasePeer {
   private readonly routes: HubRouteRuntime;
   private routeEnvs: Envelope[] = [];
   private routePii = false;
+  private routeTask?: number;
   private labelTurnId?: string;
   private turn = 0; // generation guard, as in acp.ts: a turn aborted by the watchdog must not touch the next one
   private abort: AbortController | undefined;
@@ -94,13 +95,13 @@ export class LocalPeer extends BasePeer {
     this.routes = new HubRouteRuntime({
       execute: async (model, messages, judge, signal, maxTokens) => {
         if (signal.aborted) throw new Error("turn cancelled before model request");
-        const envs = this.routeEnvs, pii = this.routePii, generation = this.turn;
+        const envs = this.routeEnvs, pii = this.routePii, generation = this.turn, task = this.routeTask;
         await this.requireBudget(envs, "model_calls");
         if (generation !== this.turn) throw new Error("route belongs to an ended turn");
         if (signal.aborted) throw new Error("turn cancelled before model request");
         const tools = judge ? undefined : [...TOOL_SCHEMAS, ...(this.opts.taskTool ? [...TASK_TOOLS, ...CONDUCTOR_TOOLS].map(asFunction) : [])];
         const result = await this.opts.omni.chat({ model, messages, ...(tools ? { tools } : {}), ...(judge ? { max_tokens: maxTokens ?? 2048 } : {}) }, { signal, ...(pii ? { onCampusOnly: true } : {}) });
-        this.recordUsage(result, model);
+        this.recordUsage(result, model, task);
         if (generation !== this.turn) throw new Error("route belongs to an ended turn");
         this.lastServedBy = `hub ${model} (provider ${result.provider ?? "?"})`;
         return result;
@@ -329,11 +330,12 @@ export class LocalPeer extends BasePeer {
   }
 
   /** L2 when the sidecar is up, otherwise (or when a call through it fails) the fixed model on L3. */
-  private async call(turnMsgs: ChatMessage[], policy: { route?: string; fixedModel?: string; pii?: boolean } | undefined, envs: Envelope[]): Promise<ChatResult> {
+  private async call(turnMsgs: ChatMessage[], policy: { route?: string; fixedModel?: string; pii?: boolean; task?: string } | undefined, envs: Envelope[]): Promise<ChatResult> {
     const { omni, sidecar } = this.opts;
     // A task turn asks for its class's route; a route needs the sidecar, which exists only when the worker was started with one.
     const route = policy?.route ?? this.opts.route;
     const fixedModel = policy?.fixedModel ?? this.opts.fixedModel;
+    const task = policy?.task === undefined ? undefined : Number(policy.task);
     const tools = [...TOOL_SCHEMAS, ...(this.opts.taskTool ? [...TASK_TOOLS, ...CONDUCTOR_TOOLS].map(asFunction) : [])];
     const signal = this.abort!.signal;
     const messages: ChatMessage[] = [{ role: "system", content: system(this.opts.cwd, this.opts.preamble) }, ...this.history, ...turnMsgs];
@@ -345,7 +347,7 @@ export class LocalPeer extends BasePeer {
       try {
         const res = await omni.chat({ model: route!, messages, tools }, { via, sessionId: this.sessionId, signal });
         this.lastServedBy = `switchyard ${route} -> ${res.selectedModel ?? "?"}`;
-        this.recordUsage(res, route!);
+        this.recordUsage(res, route!, task);
         return res;
       } catch (e) {
         if (signal.aborted) throw e;
@@ -355,7 +357,7 @@ export class LocalPeer extends BasePeer {
     await this.requireBudget(envs, "model_calls");
     const res = await omni.chat({ model: fixedModel, messages, tools }, { signal, ...(policy?.pii ? { onCampusOnly: true } : {}) });
     this.lastServedBy = `omniroute ${fixedModel} (provider ${res.provider ?? "?"})`;
-    this.recordUsage(res, fixedModel);
+    this.recordUsage(res, fixedModel, task);
     return res;
   }
 
@@ -364,6 +366,7 @@ export class LocalPeer extends BasePeer {
     try { id = this.opts.turnId?.(); } catch { /* optional host metadata */ }
     id ??= `${this.id}#${this.sessionId}.${generation}`;
     const number = task ? Number(task) : undefined;
+    this.routeTask = Number.isSafeInteger(number) && number! > 0 ? number : undefined;
     this.labelTurnId = id;
     this.routes.beginTurn({ turn: id, pii, ...(Number.isSafeInteger(number) && number! > 0 ? { task: number } : {}) });
     return id;
@@ -418,13 +421,14 @@ export class LocalPeer extends BasePeer {
     } catch { /* optional research observations */ }
   }
 
-  private recordUsage(res: ChatResult, requestedModel: string): void {
+  private recordUsage(res: ChatResult, requestedModel: string, task?: number): void {
     try {
       this.opts.onUsage?.({
         id: randomUUID(),
         at: new Date().toISOString(),
         ...(res.usage ? { usage: res.usage } : {}),
         requestedModel: safeModelLabel(requestedModel) ?? "unknown",
+        ...(Number.isSafeInteger(task) && task! > 0 ? { task } : {}),
         ...(safeModelLabel(res.servedModel ?? res.selectedModel) ? { servedModel: safeModelLabel(res.servedModel ?? res.selectedModel)! } : {}),
         ...(safeModelLabel(res.provider) ? { provider: safeModelLabel(res.provider)! } : {}),
       });