@staix/agent-hub 0.7.6 → 0.7.7

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+## 0.7.7
+
+- `ahub setup` without a terminal and without `--yes` prints the step it would take and exits non-zero instead of waiting forever at its prompt, as `restart` and `upgrade` already did. A piped answer (`yes | ahub setup`) is no longer read: use `--yes` (#73).
+- The smoke ledger no longer names the internal gateway's address, and the package check fails when any published file contains a private IPv4 address, naming only the file and line (#74).
+- Kimi's requests for the hub's own tools (`hub_send`, the task tools) are approved once without a console prompt, as Codex's already were, so a Kimi nobody watches can claim work and record notes. Kimi 2.1.1 approval prompts for other tools show the command again: the payload falls back to the streamed argument JSON when the request carries none. A payload too long to show whole is marked as cut and no longer offers a session-wide grant, for every ACP agent (#72).
+- The operations guide's upgrade section names each supported source range (0.6.x, 0.7.x before the target) and the unsupported one (0.5.x and earlier): run the target release's coordinator through `bunx`. Dry-runs from running 0.6.4 and 0.7.5 hubs are recorded (#75).
+
 ## 0.7.6
 
 - Shared notes reach the agents working now: `hub_remember` has a `fail` kind for approaches that do not work, and every saved note rides on the other peers' next delivery (newest 10, one line each) instead of waiting for their next session. A note that matches a PII pattern is refused. A preface returned by a failed delivery no longer overwrites one created meanwhile (#68).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.7.6, control protocol 10. Durable delivery records distinguish queued
+Status: 0.7.7, control protocol 10. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -28,7 +28,7 @@ cd <your project> && ahub init && ahub up && ahub tail
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.7.6 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.7.7 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.7.6 and control protocol 10. Live verification
+This guide describes ahub 0.7.7 and control protocol 10. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Install and start
@@ -178,31 +178,50 @@ Rows without a live process are stale registrations; forget them with
 
 ## Upgrade and crash recovery
 
-For an upgrade from 0.6.4 (protocol 9) or 0.7.0, use the patched coordinator without
-replacing the global CLI prematurely. Run from the project directory:
+Upgrade running projects with the target release's own coordinator. It accepts
+a running source on control protocol 9 (0.6.x) or 10 (0.7.0 and later) and only
+a target on its own protocol, so the target's coordinator fits every supported
+source and carries every recovery fix released up to it. Protocol 8 and older
+(0.5.x and earlier) are refused as `manual-bootstrap-required`. Run from the
+project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.7.6 ahub upgrade --to 0.7.6 --dry-run
-bunx --package @staix/agent-hub@0.7.6 ahub upgrade --to 0.7.6 --yes
+bunx --package @staix/agent-hub@0.7.7 ahub upgrade --to 0.7.7 --dry-run
+bunx --package @staix/agent-hub@0.7.7 ahub upgrade --to 0.7.7 --yes
 ```
 
+| Running now | Coordinator to use |
+| --- | --- |
+| 0.6.x (protocol 9) | the target's, through `bunx` as above |
+| 0.7.0 up to the release before the target (protocol 10) | the target's, through `bunx` as above |
+| any supported source, with the installed CLI already at the target | `ahub upgrade` below, which is the same coordinator |
+| 0.5.x or earlier (protocol 8 and older) | not supported: bootstrap by hand with the matching CLI |
+
+Do not use an older installed CLI as the coordinator. A 0.6.x CLI cannot target
+protocol 10: its plan does not check the target's protocol, so the dry-run shows
+no blocker, and `--yes` stops at staging ("target protocol requires a newer
+coordinator") with an operation left to clear by `ahub recovery abort <id>`. An
+older 0.7.x CLI may lack recovery fixes released after it. The
+[smoke ledger](smoke.md) records dry-runs from real 0.6.4 and 0.7.5 hubs (issue
+#75); an applied upgrade was last proven with the 0.7.0 coordinator.
+
 The coordinator verifies and retains the exact target package, preserves its
 own source, and promotes the global CLI only after restored projects pass
-readback. Do not use the old protocol-9 coordinator to target protocol 10.
+readback.
 
-Once the installed CLI is 0.7.6, review the current project or all registered
+Once the installed CLI is 0.7.7, review the current project or all registered
 projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.7.6 --dry-run
+ahub upgrade --to 0.7.7 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.7.6 --yes
+ahub upgrade --to 0.7.7 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.7.6
+bun add -g github:STAIxBWLB/agent-hub#v0.7.7
 ahub setup
 ```
 

package/docs/security.md

@@ -6,7 +6,7 @@ agent-hub connects agents that can each run commands. This page says what the hu
 
 - **Other agents' text is untrusted.** Every message that crosses from one peer to another is framed as untrusted input (a channel tag with `meta.source` for Claude, a fixed header line plus a standing instruction for the others). A message body cannot forge the hub's own headers: such lines are quoted (`sanitize`). Replies inherit a hop count capped at 3, so agents cannot ping-pong forever; neither a digest nor a steer can reset it.
 - **The control link is loopback plus a secret.** The daemon and the Codex proxy bind 127.0.0.1 only. The control WebSocket requires a per-run token (`.agenthub/state/control-token`, mode 600), and both servers refuse any request that carries an `Origin` header: any web page can open a WebSocket to localhost, and browsers always send `Origin`. External clients cannot claim the console user's id or a hub-managed peer's id.
-- **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after 120 s of silence. `--unattended` turns prompts off, says so loudly, and is never the default.
+- **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after 120 s of silence. The one exception is the hub's own tools (`hub_send` and the task tools, matched by exact name): Kimi's requests for them are approved once without a prompt and logged by name, the same trust Codex gets through `approval_mode` in the hub's config. They touch no file and run no process, and every call passes the hub's own checks. The match relies on the agent putting the tool name in the request's `title`, as Kimi does; an ACP agent that titles calls with model-written text must not be configured as `kimi_cmd`. A payload longer than the console shows is marked as cut and never offers a session-wide grant. `--unattended` turns prompts off, says so loudly, and is never the default.
 - **The local worker is boxed in.** Paths are resolved through symlinks and must stay inside the project; a secrets denylist (`.env*`, keys, credential files, the hub's own state) applies to its file tools, its git arguments and its memory capture alike; `.git` and `.agenthub` are not writable. Writes, edits, shell commands and mutating git wait for approval, and the approver sees what will be written or run, with control characters escaped. Everything it executes runs under the macOS sandbox, attended or not: no writes outside the project, its git dir and temp; the home directory is unreadable except toolchains; no `.git/hooks` or `.git/config` writes; no network, loopback included. Without the sandbox there is no `bash` tool.
 - **PII has an enforced path.** A task matching `signals.pii_patterns` goes to `local` or to nobody; its text is absent from other peers' envelopes, the console stream, the log and the board listing; the console user reviews it; `local` answers such a turn to the console only, keeps it out of its history, refuses it when the only gateway is off campus, and may not save notes or spin off tasks during it. Nothing about it is sent to claude-mem, whose observer is a cloud model.
 - **Secrets stay where they are read.** The gateway key and Cloudflare Access values are read inside the gateway client and go only into request headers: never into logs, errors, envelopes, tool output, memory, or the generated Switchyard config (the key travels by environment variable name). Subscription logins of Claude, Codex and Kimi are never proxied or pooled.

package/docs/smoke.md

@@ -57,7 +57,7 @@ and the local worker:
 - Task #1 reached `approved` with its file written. The local worker served
   `sy/coding` through the switchyard on 127.0.0.1:4813
   (`vllm/deepseek-ai/DeepSeek-V4-Flash-0731`), and Pi's `dgx/coding` traffic
-  went through the gateway (omniroute 172.16.229.33:20128) as before.
+  went through the internal gateway as before.
 - Kimi stayed healthy through the run (KIMI-IDLE-AGAIN, KIMI-FINAL-MARKER
   markers, zero queued at the end). The disposable hub and manager were
   stopped after recording.
@@ -693,3 +693,116 @@ cutover; it also exposed three recovery defects that became 0.7.3 and 0.7.4.
 
 Issue [#12](https://github.com/STAIxBWLB/agent-hub/issues/12) remains open
 for off-campus Access credentials and a natural near-limit budget pause.
+
+## Shared notes and claims live run (issue #68, 0.7.6, 2026-09-30)
+
+Measured against the released 0.7.6 package (global CLI and Claude plugin both
+0.7.6 after `ahub setup`) in a disposable git project, with real Kimi 2.1.1 under
+ACP and real Codex (codex-cli 0.156.1) behind the hub's app-server proxy. A script
+stood in for the Codex TUI (the `scripts/smoke-codex.ts` pattern, attached to the
+live daemon's proxy). No Claude peer was attached. No console message named a tool
+or a note kind; the role text and the AGENTS.md block in the peers' prompts do, by
+design. Times are hub.log timestamps (UTC).
+
+- Fail note, kind chosen by the model: asked at 03:07:24.886Z to "record this for
+  the other agents so nobody retries it" (a WeakMap cannot replace this
+  string-keyed Map), Codex called `hub_remember` with `kind: "fail"` on its own,
+  with a title and "Do not retry this replacement without a different key model
+  or new evidence". The log showed `note from codex [fail]: ...` at 03:07:32.331Z
+  (7.4 s); Codex closed with `[FYI]`, so nobody's turn was spent on the answer.
+- No turn of its own: Kimi was idle with nothing queued and made no `busy`
+  transition between the note and the next console message.
+- Ride-along, once: the next console question to Kimi at 03:07:48.827Z ("Should
+  src/cache.ts switch its Map to a WeakMap so entries can be garbage
+  collected? ...", without mentioning the note) was delivered with the note in the
+  same prompt. Kimi's session transcript has the note in the first of its three
+  turn prompts only. Kimi answered "No" at 03:08:06.398Z (17.6 s) and said the
+  answer "rests on the code itself plus codex's earlier recorded fail note". The
+  same first prompt also carried 1042 chars of claude-mem recall from an unrelated
+  earlier project: claude-mem keys a project by its directory name, and this one
+  was `proj`. Later runs should use a unique directory name.
+- Self-claim: told to claim unassigned work without editing, Kimi picked
+  `hub_task_propose` with `owner: kimi` and `refs: src/cache.ts` itself. Task #1
+  went straight to `in_progress` (`proposed` at 03:11:40.342Z, `claimed by kimi`
+  at 03:11:40.343Z, reviewer codex), and no task envelope came back to Kimi.
+- Overlap: Codex then claimed "everything under src/" (`owner: codex`,
+  `refs.paths: ["src/"]`). Its tool result carried `Overlaps #1 (owner kimi) on
+  src/. Settle it with that owner via hub_send before editing those paths.`, the
+  console printed `... Overlaps #1 (owner kimi) on src/. codex is told to settle
+  it.` at 03:12:01.494Z, and Kimi received nothing. Codex acknowledged the overlap
+  in its `[FYI]` answer (in Korean, translated: coordination is needed before
+  editing) and did not message Kimi in the claim turn: it had been told not to
+  edit yet, and the guidance asks for settlement before editing.
+- Environmental limit: Kimi 2.1.1 asked approval for both of its
+  `hub_task_propose` calls (its `Read` call asked for none), and sent no
+  `rawInput` before the approval, so unlike 2.0.1 the hub had nothing to show:
+  the console read `mcp__agent-hub__hub_task_propose (payload not reported by
+  the agent)` with `approve_once` / `reject` only (the always option is withheld,
+  as designed). Kimi's own transcript records the approval before its tool-call
+  event, so the arguments seem to arrive after the request (inferred, not
+  captured on the ACP stream). The first request (03:08:48.088Z) went unanswered,
+  was cancelled at the 120 s permission timeout, and the claim was lost; Kimi
+  reported that accurately at 03:10:58.585Z. Codex called the same tools without
+  an approval. A Kimi that should claim or record notes unattended needs a
+  tool-approval policy of its own for the agent-hub server; the hub does not
+  change it.
+- The disposable hub was stopped and its registration removed after recording.
+
+## Kimi approvals for the hub's own tools (issue #72, 2026-09-30)
+
+Kimi 2.1.1 under ACP. The capture used a small ACP client of its own with the hub's
+tools server; the live run used a disposable project and a hub built from the PR
+branch. Times are hub.log timestamps (UTC).
+
+- ACP stream, captured for `mcp__agent-hub__hub_task_list` (saved) and observed in a
+  second capture for `Bash` (`echo probe-72`; output not kept, and the live run
+  below shows the same command on the console): `tool_call` (`pending`) names the
+  tool and has no `rawInput`;
+  `tool_call_update` (`in_progress`) streams the argument JSON cumulatively as
+  `content` text (`{"command":"` ... `{"command":"echo probe-72"}`); then
+  `session/request_permission` arrives with no `rawInput` and Kimi's own line
+  (`Requesting approval to Running: echo probe-72`); `rawInput` appears only on the
+  update after the answer. Options: `approve_once`, `approve_always` ("Approve for
+  this session"), `reject`. `session/new` offers modes `default`, `plan`, `auto`,
+  `yolo` and nothing per server or tool.
+- Unattended claim and note: with no console tail open, one message at
+  05:40:04.837Z asked Kimi to claim unassigned work and record why a WeakMap cannot
+  replace the string-keyed Map. hub.log shows
+  `permission auto-approved for kimi: mcp__agent-hub__hub_task_propose`
+  (05:40:17.083Z), `... hub_remember` (05:40:17.104Z), the note
+  `note from kimi [fail]: ...` (05:40:17.126Z, kind chosen by Kimi), and a second
+  auto-approved `hub_task_propose` (05:40:22.741Z) that claimed task #1
+  (`claimed by kimi` at 05:40:22.749Z). Kimi's first propose had no `class`; this
+  hub had no triage model, so it answered `class is required` and Kimi retried with
+  `implement`. Kimi closed with `[FYI]` at 05:40:26.318Z. Nobody answered anything.
+- Other tools still ask, now with the arguments: asked to run `echo probe-72`, Kimi's
+  request reached the console at 05:40:58.696Z as `kimi asks permission: Bash:
+  {"command":"echo probe-72"}`, with `approve_always` offered again because the
+  payload was complete. It was rejected; Kimi did not run it and said so at
+  05:41:04.397Z.
+- The disposable hub was stopped and its registration removed after recording.
+
+## Upgrade sources for the operations guide (issue #75, 2026-09-30)
+
+Two disposable projects, each the only running registered project at the time,
+ran a released hub through `bunx --package @staix/agent-hub@<version> ahub up`:
+0.7.5 (hub.log `ahub up` at 05:43:12.894Z) and 0.6.4 (06:13:57.001Z).
+
+- From 0.7.5 (protocol 10): `bunx --package @staix/agent-hub@0.7.6 ahub upgrade
+  --to 0.7.6 --dry-run` exited 0 with plan `kind: upgrade`, `version: 0.7.6`, no
+  plan blockers; the project read as `running`, source 0.7.5, protocol 10, no
+  project blockers. The installed 0.7.6 CLI's dry-run showed the same project,
+  source and blockers (its `sourceRoot`, and so its fingerprint, differ).
+- From 0.6.4 (protocol 9): the same 0.7.6 dry-run exited 0 with no plan or
+  project blockers; the project read as `running`, source 0.6.4, protocol 9.
+- Nothing changed: each hub kept running, and its hub.log gained no line until it
+  was stopped for cleanup.
+- Code basis: `RECOVERY_SOURCE_PROTOCOLS = [9, PROTOCOL]`
+  (`src/hub/control-client.ts`) admits a running protocol-9 or protocol-10 source
+  (`makeUpgradePlan` in `src/cli/upgrade-runtime.ts`); an older one is refused as
+  `manual-bootstrap-required`; the staged target must report the coordinator's own
+  `PROTOCOL` (`stage` in the same file).
+- Not measured here: an applied (`--yes`) upgrade from either source (last proven
+  with the 0.7.0 coordinator, see above), and session or terminal planning: no peer
+  was attached, so `peers` and `terminals` were empty.
+- Both hubs were stopped and their registrations removed after recording.

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -727,3 +727,27 @@ that need no new service and cost no peer an extra turn.
   envelope's closing line ask for what changed, why, and the check that was run with
   its result. The verifier role already asks for what passed and what did not, so it
   stays as it was.
+
+## Amendment: Kimi approvals for the hub's own tools (issue #72)
+
+Measured on Kimi 2.1.1 (ACP stream captured on 2026-09-30): a permission request
+carries no `rawInput`; the argument JSON streams before it as `content` text on
+`tool_call_update`, and `rawInput` arrives only after the answer. Kimi offers
+session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool.
+
+- Kimi's requests for exactly `mcp__agent-hub__<name>`, where `<name>` is
+  `hub_send` or a task tool, are answered with their `allow_once` option by the
+  hub, without a console prompt, and logged by tool name only. This matches the
+  `approval_mode = "approve"` Codex already gets for the same tools. Every other
+  request keeps the console path; `allow_always` is never chosen automatically.
+- For the other tools, the console payload falls back to the streamed argument
+  text once it is a complete JSON object. A partial stream stays unresolved and
+  keeps `allow_always` withheld.
+- For every ACP agent, `rawInput` included: a payload longer than the 600
+  characters the console shows is marked `[cut, N chars]` and withholds
+  `allow_always`, because the hidden tail can change what runs.
+- Name collisions (inferred from reading Kimi 2.1.1's bundled code, not tested
+  live): tool names are qualified as `mcp__<server>__<tool>` after replacing
+  anything outside `[a-zA-Z0-9_-]`, and a server passed in `session/new` shadows a
+  configured server of the same name, so only the hub's `agent-hub` server can
+  produce the approved names.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.7.6",
+  "version": "0.7.7",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15727,7 +15727,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.7.6",
+  version: "0.7.7",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/adapters/acp.ts

@@ -33,6 +33,8 @@ export interface AcpOptions {
   /** Resolve with an optionId, or undefined to cancel. Absent = every request is cancelled.
    *  A request whose payload could not be resolved is titled as such and carries no session-wide allow option. */
   onPermission?: (req: PermissionRequest) => Promise<string | undefined>;
+  /** Tool titles approved once without asking: the hub's own tools, as Codex gets them (issue #72). Exact names only. */
+  autoApprove?: (toolTitle: string) => boolean;
   log?: (line: string) => void;
 }
 
@@ -42,6 +44,16 @@ const TOOL_INPUT_CAP = 64;
 
 type Pending = { resolve: (v: any) => void; reject: (e: Error) => void };
 
+/** Streamed argument text as a payload: a complete JSON object, or nothing (a partial stream is not what will run). */
+function jsonObject(text: string | undefined): object | undefined {
+  try {
+    const v = text === undefined ? undefined : JSON.parse(text);
+    return v !== null && typeof v === "object" && !Array.isArray(v) ? v : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 /** ACP client (JSON-RPC 2.0, newline-delimited, over the child's stdio). One session, one prompt in flight. */
 export class AcpPeer extends BasePeer {
   private proc: ChildProcessWithoutNullStreams | undefined;
@@ -50,6 +62,7 @@ export class AcpPeer extends BasePeer {
   private readonly pending = new Map<number, Pending>();
   private chunks: string[] = [];
   private readonly toolInputs = new Map<string, unknown>();
+  private readonly toolText = new Map<string, string>(); // streamed argument text, per call, until it finishes
   private primed = false;
   private turn = 0; // generation: a prompt cancelled by the watchdog must not touch the turn that followed it
   private activeDeliveryId: string | undefined;
@@ -183,10 +196,15 @@ export class AcpPeer extends BasePeer {
       if (u?.sessionUpdate === "agent_message_chunk" && u.content?.type === "text") this.chunks.push(u.content.text);
       // The permission request that follows may carry no `rawInput` (Kimi 2.0.1 does not), and then the
       // console would be asked to approve a bare tool name. Keep what the call said it would run (issue #31).
+      // Kimi 2.1.1 sends no rawInput before the answer either: the argument JSON streams as content text (issue #72).
       else if ((u?.sessionUpdate === "tool_call" || u?.sessionUpdate === "tool_call_update") && typeof u.toolCallId === "string") {
+        // A new call starts clean, so a reused id can never show the arguments of the call before it.
+        if (u.sessionUpdate === "tool_call") (this.toolInputs.delete(u.toolCallId), this.toolText.delete(u.toolCallId));
         if (u.rawInput !== undefined) this.toolInputs.set(u.toolCallId, u.rawInput);
-        if (u.status === "completed" || u.status === "failed") this.toolInputs.delete(u.toolCallId);
-        while (this.toolInputs.size > TOOL_INPUT_CAP) this.toolInputs.delete(this.toolInputs.keys().next().value as string);
+        const text = Array.isArray(u.content) ? u.content.map((c: any) => (c?.type === "content" && c.content?.type === "text" ? String(c.content.text) : "")).join("") : "";
+        if (text) this.toolText.set(u.toolCallId, text);
+        if (u.status === "completed" || u.status === "failed") (this.toolInputs.delete(u.toolCallId), this.toolText.delete(u.toolCallId));
+        for (const map of [this.toolInputs, this.toolText]) while (map.size > TOOL_INPUT_CAP) map.delete(map.keys().next().value as string);
       }
       else if (u?.sessionUpdate === "usage_update" && this.opts.onTokens) {
         const f = { ...u, ...(typeof u.usage === "object" ? u.usage : {}) } as Record<string, unknown>;
@@ -208,13 +226,23 @@ export class AcpPeer extends BasePeer {
 
   private async answerPermission(msg: any): Promise<void> {
     const call = msg.params?.toolCall ?? {};
+    const once = (msg.params?.options ?? []).find((o: PermissionOption) => o.kind === "allow_once");
+    if (once && typeof call.title === "string" && this.opts.autoApprove?.(call.title)) {
+      this.opts.log?.(`permission auto-approved for ${this.id}: ${call.title}`); // the name only: arguments may quote a PII turn
+      return this.send({ jsonrpc: "2.0", id: msg.id, result: { outcome: { outcome: "selected", optionId: once.optionId } } });
+    }
     // The approver has to see what runs, not only the tool's name ("Bash"). The request itself carries it
-    // for some agents; for the rest it was on the `tool_call` update that announced the call.
-    const raw = call.rawInput ?? (typeof call.toolCallId === "string" ? this.toolInputs.get(call.toolCallId) : undefined);
-    const input = raw === undefined ? "" : `: ${(typeof raw === "string" ? raw : JSON.stringify(raw)).slice(0, 600)}`;
+    // for some agents; for the rest it was on the `tool_call` update that announced the call, as rawInput or,
+    // failing that, as streamed argument text that only counts once it is a complete JSON object.
+    const id = typeof call.toolCallId === "string" ? call.toolCallId : undefined;
+    const raw = call.rawInput ?? (id === undefined ? undefined : this.toolInputs.get(id) ?? jsonObject(this.toolText.get(id)));
+    const full = raw === undefined ? "" : typeof raw === "string" ? raw : JSON.stringify(raw);
+    // A cut payload hides its tail, and a tail can change what runs: it is marked and buys no session-wide grant.
+    const cut = full.length > 600;
+    const input = raw === undefined ? "" : `: ${cut ? `${full.slice(0, 600)} [cut, ${full.length} chars]` : full}`;
     // An unknown payload is never dressed up as a description, and it must not buy a blanket grant.
     const title: string = raw === undefined ? `${call.title ?? "tool call"} (payload not reported by the agent)` : `${call.title ?? "tool call"}${input}`;
-    const options: PermissionOption[] = (msg.params?.options ?? []).filter((o: PermissionOption) => raw !== undefined || o.kind !== "allow_always");
+    const options: PermissionOption[] = (msg.params?.options ?? []).filter((o: PermissionOption) => (raw !== undefined && !cut) || o.kind !== "allow_always");
     const picked = await this.opts.onPermission?.({ peer: this.id, title, options }).catch(() => undefined);
     const valid = options.some((o) => o.optionId === picked);
     this.send({

package/src/cli/main.ts

@@ -404,6 +404,8 @@ const commands: Record<string, () => Promise<void> | void> = {
     else {
       console.log(`ahub setup changes your Claude Code plugin configuration, one step at a time, re-checking after each. First step:\n  ${step.argv.join(" ")}\n      ${step.why}`);
       if (!args.includes("--yes")) {
+        // Nobody can answer without a terminal: waiting would hang a script forever (issue #73).
+        if (!process.stdin.isTTY) fail("not a terminal: nothing was changed; rerun with --yes to apply");
         const rl = createInterface({ input: process.stdin, output: process.stdout });
         const answer = (await rl.question("Proceed (this and the steps that follow from it)? [y/N] ")).trim().toLowerCase();
         rl.close();

package/src/hub/daemon.ts

@@ -409,6 +409,10 @@ export async function startDaemon(opts: DaemonOptions) {
     return { ...e, env: { ...env, ...(task ? { refs: { task } } : {}), body: `[private${task ? `: task #${task}, see ahub task show ${task}` : ""}]` } };
   };
   const SERVER_JS = join(import.meta.dir, "..", "..", "plugins", "agent-hub", "server.js");
+  // What the hub's MCP server offers a native peer. Codex approves them in config, Kimi's requests for exactly these
+  // names are answered by the hub: no file or process is touched, and every call passes the hub's own checks.
+  const HUB_TOOLS = ["hub_send", ...TASK_TOOLS.map((t) => t.name)];
+  const HUB_TOOL_TITLES = new Set(HUB_TOOLS.map((name) => `mcp__agent-hub__${name}`));
   const toolEnv = (peer: PeerId) => ({ AGENTHUB_MODE: "tools", AGENTHUB_PEER_ID: peer, AGENTHUB_STATE_DIR: opts.stateDir, AGENTHUB_PROJECT_DIR: opts.cwd });
 
   /** One entry point for the task tools, whoever calls them: MCP clients, the local worker, the console. */
@@ -691,6 +695,10 @@ export async function startDaemon(opts: DaemonOptions) {
         cwd: opts.cwd,
         watchdogMs: config.watchdog_ms,
         onPermission,
+        // The hub's own tools pass without a console prompt, as Codex's do (approval_mode below; issue #72). This
+        // relies on the agent putting the tool name in `title`, as Kimi does; an ACP agent that titles calls with
+        // model-written text must not be configured as kimi_cmd. A stopping hub approves nothing.
+        autoApprove: (title) => !stopping && HUB_TOOL_TITLES.has(title),
         log,
         onTokens: onKimiTokens,
         mcpServers: [{ name: "agent-hub", command: "bun", args: ["run", SERVER_JS], env: Object.entries(toolEnv("kimi")).map(([name, value]) => ({ name, value })) }],
@@ -713,7 +721,7 @@ export async function startDaemon(opts: DaemonOptions) {
           ["command", '"bun"'],
           ["args", JSON.stringify(["run", SERVER_JS])],
           ["env", `{${Object.entries(toolEnv("codex")).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(", ")}}`],
-          ...["hub_send", ...TASK_TOOLS.map((t) => t.name)].map((name) => [`tools.${name}.approval_mode`, '"approve"']),
+          ...HUB_TOOLS.map((name) => [`tools.${name}.approval_mode`, '"approve"']),
         ].flatMap(([k, v]) => ["-c", `mcp_servers.agent-hub.${k}=${v}`]),
         preamble: roleContract("codex", config.roles),
         onUsage: (rateLimits, hard) => budget.report("codex", codexWindows(rateLimits), hard),