@staix/agent-hub 0.12.18 → 0.12.19

package/CHANGELOG.md

@@ -4,6 +4,11 @@ Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the
 
 ## Unreleased
 
+## 0.12.19
+
+- Pi's write, edit, bash and git write approvals offer `Always allow <tool> until Pi restarts`: later calls of that tool by the running Pi skip the prompt, still under the path guard and sandbox. The grant is in memory only, logged by tool name, and the dashboard can still only deny (#209).
+- Control protocol stays 15 and events schema stays 1; a running 0.12.18 hub upgrades with the 0.12.19 coordinator.
+
 ## 0.12.18
 
 - Attribute token increments, provider usage and completed turns to task ids by delivery or a single open task; add `ahub report --by task` with task/class totals, explicit unknown counters, unattributed shares and a separate historical bucket. Preserve PII id-only exports and derive no prices (#200).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.12.18, control protocol 15. Durable delivery records distinguish queued
+Status: 0.12.19, control protocol 15. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -28,7 +28,7 @@ cd <your project> && ahub init && ahub up
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.18 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.12.19 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.

package/docs/agent-notes/adapters.md

@@ -6,6 +6,7 @@ Scope: the Codex, ACP and Pi adapters and the Pi extension (turn `generation` an
 - Codex 0.154.0 `agentMessage` items carry `text` and `phase` (not `content[]`); only the last non-`commentary` message of a turn is shared.
 - Approval titles are agent-written text shown to a person: the daemon escapes control characters, and write/edit/bash show what will be written or run.
 - An ACP permission request may carry no `rawInput` (Kimi 2.0.1): the arguments were on the earlier `tool_call` update, which `acp.ts` remembers by `toolCallId`. Kimi 2.1.1 sends no `rawInput` before the answer at all: the argument JSON streams as `content` text on `tool_call_update`, and only complete JSON counts. A payload that still cannot be resolved, or is too long to show whole (marked `[cut, N chars]`), withholds its `allow_always` option - never render a bare tool name as if it described the call.
+- Pi's `always` grant (#209) is keyed by `executeTool`'s tool name, never parsed from the approval title, and lives only in that Pi start's closure. Never persist it, share it with the local worker, or let the dashboard give it.
 - Auto-approval covers the hub's own tools by exact `mcp__agent-hub__<name>` title and only ever picks `allow_once`. Identity comes from the permission request title or, when an agent titles the request with the argument JSON (Qwen), from the announced `tool_call` title bound to the call id and resolved against the session's configured MCP servers, never from payload text, a prefix or an unrelated display title. Never widen it to a prefix, and never set Kimi's session mode to `auto` or `yolo` instead: those approve everything.
 - Every agent the hub spawns (the Codex app-server, ACP agents such as Kimi, Pi) runs in its own process group and is stopped as one (`stopOwnedProcess(proc, { group: true })`, `trackGroup` after spawn): `codex` is a node launcher, and mid-turn its native app-server does not exit on SIGTERM within the grace period, so a SIGKILL to the launcher alone left the app-server running under init and holding the daemon alive (#113, #115). A new adapter that spawns an agent does the same.
 - To stop a process tree, freeze it (SIGSTOP) before reading what it contains, then SIGKILL, and call it done only when the table shows none of it (with no table at all, the stop can only ask the group itself, which cannot see groups below it). A process a read after the freeze shows for the first time is frozen and read again before anything is killed. A snapshot taken while the tree runs misses what it starts next: three review rounds of #113 found such a gap (groups of its own, an unreadable first read, a child started during the grace period).

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.12.18 and control protocol 15. Live verification
+This guide describes ahub 0.12.19 and control protocol 15. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Operator console and panels
@@ -17,6 +17,12 @@ approval titles are terminal-only; expiry and answers from another console remov
 the pending item. Approval audit records contain id, peer, option kind, response
 time and answering surface, without the title.
 
+Pi's write, edit, bash and git write requests also offer `Always allow <tool>
+until Pi restarts`. It allows later calls of that tool by the running Pi without
+asking, under the same path guard and sandbox; a Pi restart or replacement, or a
+hub restart, drops it. The hub log records each granted call by tool name only.
+The dashboard can only deny Pi's requests.
+
 Tab toggles stream and panels; `ahub console --panels` starts in panels. Peers,
 Approvals, Tasks, Queue and Events support arrow keys or j/k, Enter for detail,
 Escape to return and `?` for help. `:` enters a command. Assignment, delivery
@@ -786,21 +792,21 @@ Rows without a live process are stale registrations; forget them with
 
 Upgrade running projects with the target release's own coordinator. It accepts
 a running source on control protocol 9 (0.6.x), 10 (0.7.0 through 0.12.0),
-11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15) 14 (0.12.16) or 15 (0.12.17 and 0.12.18), and only
+11 (0.12.1 and 0.12.2), 12 (0.12.3), 13 (0.12.4 through 0.12.15) 14 (0.12.16) or 15 (0.12.17 through 0.12.19), and only
 a target on its own protocol, so the target's coordinator fits every supported
 source and carries every recovery fix released up to it. Protocol 8 and older
 (0.5.x and earlier) are refused as `manual-bootstrap-required`. Run from the
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.12.18 ahub upgrade --to 0.12.18 --dry-run
-bunx --package @staix/agent-hub@0.12.18 ahub upgrade --to 0.12.18 --yes
+bunx --package @staix/agent-hub@0.12.19 ahub upgrade --to 0.12.19 --dry-run
+bunx --package @staix/agent-hub@0.12.19 ahub upgrade --to 0.12.19 --yes
 ```
 
 | Running now | Coordinator to use |
 | --- | --- |
 | 0.6.x (protocol 9) | the target's, through `bunx` as above |
-| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 and 0.12.18 (protocol 15) | the target's, through `bunx` as above |
+| 0.7.0 through 0.12.0 (protocol 10), 0.12.1 and 0.12.2 (protocol 11), 0.12.3 (protocol 12), 0.12.4 through 0.12.15 (protocol 13), 0.12.16 (protocol 14), 0.12.17 through 0.12.19 (protocol 15) | the target's, through `bunx` as above |
 | any supported source, with the installed CLI already at the target | `ahub upgrade` below, which is the same coordinator |
 | 0.5.x or earlier (protocol 8 and older) | not supported: bootstrap by hand with the matching CLI |
 
@@ -832,14 +838,14 @@ projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.12.18 --dry-run
+ahub upgrade --to 0.12.19 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.12.18 --yes
+ahub upgrade --to 0.12.19 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.12.18
+bun add -g github:STAIxBWLB/agent-hub#v0.12.19
 ahub setup
 ```
 

package/docs/security.md

@@ -6,7 +6,7 @@ agent-hub connects agents that can each run commands. This page says what the hu
 
 - **Other agents' text is untrusted.** Every message that crosses from one peer to another is framed as untrusted input (a channel tag with `meta.source` for Claude, a fixed header line plus a standing instruction for the others). A message body cannot forge the hub's own headers: such lines are quoted (`sanitize`). Replies inherit a hop count capped at 3, so agents cannot ping-pong forever; neither a digest nor a steer can reset it.
 - **The control link is loopback plus a secret.** The daemon and the Codex proxy bind 127.0.0.1 only. The control WebSocket requires a per-run token (`.agenthub/state/control-token`, mode 600), and both servers refuse any request that carries an `Origin` header: any web page can open a WebSocket to localhost, and browsers always send `Origin`. External clients cannot claim the console user's id or a hub-managed peer's id.
-- **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after `approvals.timeout_s` (default 120 s) of silence; the macOS notification for a waiting request carries the peer and the tool name only. The one exception is the hub's own tools (`hub_send` and the task tools, matched by exact name): Kimi's requests for them are approved once without a prompt and logged by name, the same trust Codex gets through `approval_mode` in the hub's config. They invoke hub-owned operations rather than arbitrary file or shell tools, and every call passes the hub's own checks. Identity comes from the exact permission title, or from the earlier tool-call title bound to the same call id and resolved against the configured MCP servers when the permission title contains argument JSON (Qwen). Payload text and unrelated display titles never establish identity. A payload longer than the console shows is marked as cut and never offers a session-wide grant. `--unattended` turns prompts off, says so loudly, and is never the default.
+- **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after `approvals.timeout_s` (default 120 s) of silence; the macOS notification for a waiting request carries the peer and the tool name only. The one exception is the hub's own tools (`hub_send` and the task tools, matched by exact name): Kimi's requests for them are approved once without a prompt and logged by name, the same trust Codex gets through `approval_mode` in the hub's config. They invoke hub-owned operations rather than arbitrary file or shell tools, and every call passes the hub's own checks. Identity comes from the exact permission title, or from the earlier tool-call title bound to the same call id and resolved against the configured MCP servers when the permission title contains argument JSON (Qwen). Payload text and unrelated display titles never establish identity. For ACP agents, a payload longer than the console shows is marked as cut and never offers a session-wide grant. Pi's write, edit, shell and git write requests are relayed the same way and can be answered `Always allow <tool> until Pi restarts`: later calls of that tool by the same Pi start skip the prompt but stay inside the path guard and sandbox. The grant covers every later call of that tool whatever its payload, is kept in memory only, cannot be given from the dashboard, and each call it allows is logged by tool name. `--unattended` turns prompts off, says so loudly, and is never the default.
 - **A committed config cannot choose launch commands, credential files, data endpoints or a wider sandbox.** The machine-local fields (`kimi_cmd`, `codex_bin`, `pi.cmd`, `checks`, `mlx.bin`, `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`, `omniroute.access_hosts`, the `omniroute` key files, `memory.worker_url`, `local.read_allow`, `local.bash_network`, `local.network_allow`) apply only from a config file git confirms nobody committed: `.agenthub/config.json` or `.agenthub/config.local.json`, matched by file identity so no other spelling the file system accepts slips past, and `.agenthub` itself not a committed symlink or submodule. Without a repository, or when git fails, they keep their defaults; an empty value always means the default. "Untracked" is answered by the repository that contains the project: a checkout copied or extracted into an unrelated repository, or into an ignored directory of one, is trusted like your own files. So a cloned repository cannot choose a launch command, a completion check, a gateway to send a key file to, a memory endpoint, or a wider sandbox. A command in `checks` runs as you, outside the local worker's sandbox, like a git hook. Nothing in `routing.toml` or in task text is ever run. `routing.toml` and the other shared fields still come from the checkout, and they matter: `routing.toml` picks the models the local worker and the hub's inference use at your gateway and can turn the PII constraint off, and roles and budget shape who does what. Review them in a repository you do not trust.
 - **Telemetry holds no bodies.** `.agenthub/state/events.jsonl` (issue #40) records envelope ids, routing and sizes, task ids and states, overlapping paths and token counts, and the task id (with a PII flag) that each usage and token record is attributed to. It never records a message body, a task title or detail, and marks private (PII) envelopes and tasks as such. It stays on the machine; `ahub export` only prints it.
 - **Snapshots stay in your repository.** Per-turn snapshots (issue #33) are git objects in the project's own object store, written through a temporary index; nothing is referenced, pushed or copied elsewhere, and `git gc` prunes them. They hold what the work tree held, including untracked files that are not ignored, so keep secrets in ignored files. They carry the repository's own permissions, and nothing caps their disk use but `git gc`. A turn of a peer holding an open PII task is not snapshotted; a PII file left in the project is snapshotted by later turns like any other file. `ahub undo` restores only files whose current content is exactly what the turn left.

package/docs/smoke.md

@@ -1252,3 +1252,36 @@ the sentinel. Missing served-model evidence remains `identified: false`.
 Before recording live acceptance, run a bounded unavailable-local/healthy-remote
 leg and retain the sanitized JSON plus process cleanup confirmation. Fixture
 verdicts do not certify provider availability or a real local generation.
+
+## 0.12.18 live checks: task attribution and console colors (#200, #201, 2026-10-09)
+
+The agent-hub project's own hub was upgraded from 0.12.17 to 0.12.18 by the
+user with the 0.12.18 coordinator, run from a plain terminal (an agent shell is
+refused by the identity gate). Claude (the session writing this) and Pi on
+`dgx/coding` were attached for the checks. Times are UTC.
+
+- **The upgrade left Claude held.** Operation `c671d786` (source 0.12.17,
+  protocol 15, running) was created at 05:26:55, the 0.12.18 daemon started
+  the same second, and the operation completed with the project verified. Ten deliveries Claude had accepted but never settled (three board review
+  requests, seven Codex chats, all handled before the upgrade) were moved to
+  `needs_review` with "peer disconnected before delivery settlement", and
+  Claude's queue was held behind them. `ahub queue resolve` is a console
+  command, so only the user can release it; the unsettled acceptances are #205.
+- **#200 AC4, attribution on a live turn.** Board task #19 (class `test`,
+  owner Pi) was proposed at 05:30:03, accepted at 05:30:07, done at 05:34:52
+  and approved at 05:35:16. `ahub report --by task` at 05:35:06 attributed Pi's
+  one turn and 602,255 tokens to #19 by its delivery. Unattributed: 2,159,396
+  of 38,171,695 token increments (5.7%) and 21 of 116 usage records (18.1%),
+  all Claude's own user-driven turns, which have no task-bearing delivery and
+  no single open task. The `before attribution` bucket held 35,410,044 tokens
+  and 95 records from before the upgrade. Both shares equal the JSON
+  `unattributed` counts over `totals`, and the JSON carried task ids, class and
+  outcome but no title or detail text.
+- **Pi could not run the check itself.** Its sandbox denies
+  `.agenthub/state/` (the `ahub` binary under the bunx cache and `events.jsonl`
+  both failed with EPERM). It reported every check as not run instead of
+  passing it, and the reviewer ran them.
+- **#201 AC7, idle console CPU.** Sampled with `ps` cumulative CPU time while
+  nothing happened on the hub: plain `ahub console`, 0.11 s over 60 s
+  (about 0.18%); `ahub console --panels`, 0.46 s over 120 s from 05:52:30
+  (about 0.38%, 0.21 to 0.25 s per minute, not growing).

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1521,3 +1521,16 @@ to a task; both buckets appear even when empty. A zero denominator has unknown
 share. Export carries the new fields without task text. No prices or savings
 counterfactuals are derived. These additive fields retain events schema 1 and
 the existing control protocol. Plain `ahub report` remains unchanged.
+
+## Amendment: Pi "always" approvals (issue #209)
+
+Pi's `write`, `edit`, `bash` and `git` write calls ask with three options:
+`allow` (`allow_once`), `always` (`allow_always`, named `Always allow <tool>
+until Pi restarts`) and `deny` (`reject_once`). `always` allows the call and
+every later call of the same hub tool by that Pi start without asking. The grant
+is held in memory by the Pi start: stopping or replacing Pi, or restarting the
+hub, drops it, and nothing is persisted. A granted call is logged by tool name
+only. The path guard, denylist and sandbox still apply to each call; the
+dashboard still offers Pi only deny; unattended mode still picks `allow_once`;
+the local worker keeps allow and deny. The console and `ahub permit` already
+handle more than one allow option, so the control protocol is unchanged.

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "4b44b92dd2dc4b5515b6e87627fe4bdfcd6742c3",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "4b44b92dd2dc4b5515b6e87627fe4bdfcd6742c3",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "4b44b92dd2dc4b5515b6e87627fe4bdfcd6742c3",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "4b44b92dd2dc4b5515b6e87627fe4bdfcd6742c3",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "4b44b92dd2dc4b5515b6e87627fe4bdfcd6742c3",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -68,7 +68,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "4b44b92dd2dc4b5515b6e87627fe4bdfcd6742c3",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -80,7 +80,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "4b44b92dd2dc4b5515b6e87627fe4bdfcd6742c3",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -92,7 +92,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "4b44b92dd2dc4b5515b6e87627fe4bdfcd6742c3",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -151,7 +151,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "4b44b92dd2dc4b5515b6e87627fe4bdfcd6742c3",
+      "verifiedAgainst": "25d6ffe00c490a3690fc81782a45e62bfb383803",
       "paths": [
         "test/",
         "scripts/check.sh",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.18",
+  "version": "0.12.19",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.18",
+  "version": "0.12.19",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15403,7 +15403,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.12.18",
+  version: "0.12.19",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/hub/daemon.ts

@@ -1979,11 +1979,22 @@ export async function startDaemon(opts: DaemonOptions) {
       });
       piReceipts ??= new PiToolReceipts(join(opts.stateDir, "hub.db"));
       let piReply: Envelope | undefined;
+      // Tools the person allowed "always" for this Pi start; a new start gets a new set (#209).
+      const piAlways = new Set<string>();
+      const piPermit = async (title: string, tool: string): Promise<boolean> => {
+        if (piAlways.has(tool)) log(`permission auto-allowed for pi: ${tool} (granted until Pi restarts)`); // the name only, never the arguments
+        else {
+          const picked = await onPermission({ peer: "pi", title, options: [{ optionId: "allow", name: "Allow", kind: "allow_once" }, { optionId: "always", name: `Always allow ${tool} until Pi restarts`, kind: "allow_always" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] });
+          if (picked === "always") piAlways.add(tool);
+          else if (picked !== "allow") return false;
+        }
+        return pi.acceptingTools && bus.peers.get("pi") === pi;
+      };
       const ctx: ToolContext = {
         cwd: opts.cwd, deny: config.local.deny,
         sandboxProfile: profile(opts.cwd, sandboxNetwork, config.local.read_allow, config.local.deny),
         sandboxEnv: { ...proxyEnv(sandboxNetwork), AGENTHUB_PEER_ID: "pi" },
-        permit: (title) => onPermission({ peer: "pi", title, options: [{ optionId: "allow", name: "Allow", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] }).then((picked) => picked === "allow" && pi.acceptingTools && bus.peers.get("pi") === pi),
+        permit: async () => false, // Pi's calls ask through piPermit in executeTool, which knows the tool's name
         send: (text, to) => {
           if (to?.some((id) => !bus.peers.has(id) && id !== USER)) return "error: unknown peer";
           const refused = pi.onMessage?.(text, { inReplyTo: piReply, ...(to?.length ? { to } : {}) });
@@ -2005,12 +2016,12 @@ export async function startDaemon(opts: DaemonOptions) {
             if (!raw || typeof raw !== "object" || Array.isArray(raw)) return "error: invalid tool arguments";
             const nativeTurn = pi.observationTurn;
             const output = TASK_TOOLS.some((t) => t.name === name) || CONDUCTOR_TOOL_NAMES.has(name) ? await taskOp("pi", name, raw as Record<string, unknown>, true) : await runTool(name, JSON.stringify(raw), { ...ctx, signal, permit: async title => {
-              if (!signal) return ctx.permit(title);
+              if (!signal) return piPermit(title, name);
               if (signal.aborted) return false;
               return new Promise<boolean>((resolve, reject) => {
                 const finish = (allowed: boolean) => { signal.removeEventListener("abort", aborted); resolve(allowed && !signal.aborted); };
                 const aborted = () => finish(false); signal.addEventListener("abort", aborted, { once: true });
-                Promise.resolve(ctx.permit(title)).then(finish, error => { signal.removeEventListener("abort", aborted); reject(error); });
+                piPermit(title, name).then(finish, error => { signal.removeEventListener("abort", aborted); reject(error); });
               });
             } });
             if (!signal?.aborted && bus.peers.get("pi") === pi) {