The brain
that connects.

A WebSocket stream (wss://host/stream) broadcasts hook events to every connected card in real time — event, batch_update, and clear_all message types. AgentEKG cards receive live tool calls, errors, and agent decisions the moment they happen. No polling. No latency.

Every connection to QuantaHub uses TLS with certificate pinning — clients only trust the hub's own self-signed cert, ignoring system CAs entirely. Bearer token authentication on every API call. The token never reaches the JavaScript layer. An attacker with access to the frontend still can't talk to the hub.

All stdin and stdout from every AgentTUI pane flows to QuantaHub on port 4002 — ANSI-stripped, non-blocking, batched every 5 seconds or 8KB per pane. Sensitive keyword detection flags sudo prompts, tokens, passwords, and AWS credentials automatically. Full session observability with zero throughput impact.

Every tool in the suite — QuantaCanvas, AgentWhisper, AgentTUI, AgentEKG — registers with QuantaHub on startup. Events from any app are immediately available to every other app. One hub, one event history, one source of truth across your entire agent workflow.

QuantaHub supports bidirectional event responses — apps can post a response back to an event ID, enabling human approval flows. An agent pauses and waits. You respond via the hub. The agent continues. The entire interaction is logged and auditable.

Client connections use exponential backoff reconnection — 2 seconds up to 60 seconds — with graceful degradation when the hub is unreachable. QuantaHub auto-generates its TLS config and bearer token on first run, stored at ~/Library/Application Support/quantahub/. Apps discover it automatically.