`rig specs ls`, `show` and `preview` accept any --kind. For a value other than rig, agent or workflow, the command prints one stderr warning naming the supported kinds, still queries the daemon with the value URL-encoded, and keeps only the entries whose kind matches exactly. A known kind trusts the daemon's filtered list as before, so `rig up`'s library lookup is unchanged. When a --kind filter matches nothing, `specs ls` prints "No <kind> specs found" instead of the empty-library message. The warning goes only to stderr, so stdout and --json stay parseable.
Command +35/-10, tests +105/-1.
Launching seats that share a working directory made its `CLAUDE.md` and `AGENTS.md` grow by one byte per managed block per launch. When `mergeManagedBlock` replaced a block already in the file, it wrote the result plus a newline even when the result already ended in the previous merge's newline. Now it adds the newline only when it's missing, so a file is the same size from the second merge on. Every byte outside OpenRig's blocks is kept, including blank lines a person left after the last block, so a file that already grew isn't trimmed. A first write, an append and the replaced-id trim are unchanged; a CRLF file is left alone on re-merge, and `rig down` still gives back a file's exact bytes after one start or two.
Source +4/-2 (one expression plus comments), tests +46 new and two reworded comments. Reported in #2372.
A Claude seat's rebuild handover could stop at "Waiting to confirm the new Claude process in this pane" although the new Claude was running, when its argv[0] was spelled through the native installer's symlink (`~/.local/bin/claude`) rather than the versioned file it points to. A managed launch freezes the realpath, and readiness compared a path-shaped argv[0] only with that frozen path; the OS executable path was read only for other row shapes.
Now, when the exact-path match finds nothing for a launch that froze an executable, readiness admits a foreground process whose argv[0] is an absolute path named `claude` and whose OS executable path (on Linux, `/proc/<pid>/exe`) is exactly the frozen file, absolute with no `.` or `..` segments. The process must still name this launch's own conversation, be the only candidate, look the same in two samples under the same pane, and its first match is pinned. Only such a process has its OS path read: an exact launch, run with exactly the frozen path, is proved without it, as before, so a slow path read can't change its pinned fingerprint. Another install's binary, an unreadable or relative OS path, another conversation and a process outside the foreground group are still refused. The `#!` wrapper rule from #2354 is unchanged.
Runtime +25/-8, tests +64/-1. Refs #2341.
When the daemon answers `rig workspace validate` with an error status (400 or above), the command now prints the daemon's message as one line on stderr, falling back to its error code and then to "Validate failed (HTTP <status>)", instead of the raw JSON response. Every error this route returns carries an error code and a message, such as `invalid_workspace_kind` for an unknown `--kind`, so the line is that refusal's own text. Under `--json` the command prints the same JSON as before, and the exit code is still 1. The daemon remains the only place that lists the workspace kinds; the CLI adds no check of its own.
Command +11/-2, tests +81.
The runner conformance check (`docs/reference/runner-conformance/check-runner.mjs`), which runner authors run on their own machines, could falsely fail a correct runner on a busy machine at case 4b's read cells. After a permission read that OpenRig answers with an unlisted status (such as 500) or `activity_grant_stale`, it waited a fixed `scale(4000)` for the agent's outcome, tighter than section 7, which sets no time limit after a read. That wait is now the check's own per-step observation budget, `opts.waitMs` (8 seconds by default, scaled by `--wait-ms`). The unreachable-read cell keeps `scale(10000)`, since a runner may retry a read that got no answer. A dropped or wrong outcome still fails the same exact checks. The test double gains a `--read-retries <n>` mode, and a test cell runs case 4b with it.
Check +3/-2, test double and test +17/-1.
A Pi seat mid-turn now keeps reading `working` through a long, quiet model request (local inference, a slow provider) instead of flipping to idle or unknown after 15 seconds. The Pi runner already had an idle heartbeat; it now also posts an `active` beat while its `streaming` flag says a turn is in flight. The heartbeat timer ticks every 5 seconds and a beat goes out once 5 seconds have passed since the runner's last post, real or beat, so a working hook stays inside the seat-activity oracle's 15-second `HOOK_AUTHORITY_WINDOW_MS` on ordinary on-time ticks. The beat stops when `streaming` clears at the turn's end, an abort or error, and with the runner's exit; frequent real events postpone it, and the idle heartbeat's three-minute gate is unchanged. OMP keeps its no-op timer. `main()` starts the same exported timer the new fake-timer tests drive.
Runner +55/-13, tests +167/-4.
Runner contract section 8 now names ACP's `session/resume` (capability `sessionCapabilities.resume`) beside `session/load`, which is what dsh `0.2.1-rc.2` advertises, and marks open question 1 answered. It also says how a runner tells a missing conversation from one that won't reopen, since an agent may answer one error for both: missing comes only from the agent's own not-found (`-32002`), anything else is unconfirmed, and an agent's `session/list` is positive evidence only. An unlisted conversation isn't missing unless the agent guarantees its list is complete, which dsh doesn't.
The dsh example runner reads the list first when dsh advertises it, following any string cursor unchanged (the empty string included) for up to 50 pages; a non-string cursor, an entry without a string `sessionId`, or a failed list decides nothing. It always tries the reopen: a reopen that works resumes, `-32002` is missing unless the list named the conversation, and any other error, `-32602` included, is unconfirmed. It never starts a new conversation. The dsh README and `dsh.yaml` limits say the same, and the runner keeps its executable mode.
Runner +24/-2, contract and dsh docs +30/-7, tests +82/-1.
A clean install of the CLI couldn't start: bare `rig` and `rig --help` exited 1 with `ERR_MODULE_NOT_FOUND` for `@modelcontextprotocol/sdk`. `packages/cli/src/commands/environment.ts` imports the SDK client at module load and `index.ts` loads the environment command statically, but the SDK was declared only in the CLI's `devDependencies`, so an install without development dependencies didn't have it. The SDK (`^1.32.2`) is now a production dependency of `packages/cli`; the lockfile update is metadata only (its dev flags), with no package added, removed or re-versioned. `scripts/cli-runtime-dependencies.test.mjs` walks the import closure from the CLI's entry points and fails if any external package it reaches isn't a production dependency, and the testbed image now runs `rig --help` after `rig --version`.
4 files, +77/-87.
The capability map said a typed reply to a question parked on its own person resumes it but isn't recorded as the answer. Since #2293 it is: that person's typed reply resumes the question and is kept the same way as on an unparked ask, in the same transaction. A reply whose order against the posted question can't be confirmed resumes it with the words in context and isn't recorded. Only that sentence changes.
Text only. 1 file, +3/-2.
The runner conformance check (`docs/reference/runner-conformance/check-runner.mjs`), which runner authors run on their own machines, could fail a correct runner when the machine was busy. Case 1 waited 800 ms after seeing `session/new` and took one sample, so if the check's own timers ran late it called a correctly written launch record early; it now samples the record against the agent's log for the whole unanswered window, which is at least as strict. Case 4b required the cancelled or ended turn's `Stop` to arrive after the withdraw, an order section 7 doesn't promise; the turn-end checks now count only the `Stop` that follows the agent's own `session/prompt` reply with its stop reason, on either side of the withdraw, so an early idle `Stop` can't stand in for a missing end. Check names, the contract text and the kit's README are unchanged.
Check +28/-6, tests and fixtures +46/-4.
Main's CHANGELOG gains the `## [0.7.7]` section, byte for byte as on `release/0.7.7-prep`, directly above `## [0.7.6]`: 0.7.7 is 0.7.6 with three reliability fixes for managed Claude seats (the "Update installed" footer reads idle, managed compaction doesn't type into an unsent draft, and a Claude seat behind a non-exec wrapper rebuilds, with a failed handover keeping its resume target), with its upgrade step, known limits and thanks. Nothing else changes.
Text only. 1 file, +60/-0.
A provider switch on a Claude seat (`rig provider switch --seat <seat>`) no longer refuses with `effort_would_change` when the seat runs with an `--effort` that differs from its saved, non-explicit effort. The relaunch keeps the running effort, so a person recovering from a limit or an outage doesn't have to set effort and switch again. An explicit `rig seat set-effort` choice still wins: restore's launch-effort seam reads the seat at launch, uses the choice when one exists (latest wins) and the kept effort only when none does, and reports what it selected on every keep-pane relaunch. The kept effort is never written to the seat. The switch's `effort` line is worded from that report; without one it says so, and a relaunch that doesn't report resuming says what was asked and the rule the recovery command follows, not a value read before the switch. An unreadable running effort proceeds as before and is disclosed. #2344's token-reference restore, pre-stop and unknown-effect handling are unchanged.
Follows #2344. Source +102/-25, tests +196/-27.
Runner docs that still described the first, refuse-every-request version of permissions now describe the answered path. The harness runner contract's four "0.7.7" labels for the answered path read "0.7.8", the release that ships it; section 7's text is otherwise unchanged. `author-contracts.md` gives the answered recipe instead of "refusal-first", `community-harness-presets.md` notes the runner-preset exception to "relays none", the conformance README no longer says a runner refuses another person's click or typed words, and the OpenShell guest README lists the three permission routes beside the hooks route. This is the same change as the docs commit on the 0.7.8 release preparation branch, so main stops describing the old behavior.
Text only. 5 files, +9/-9.
A managed Claude seat whose `claude` is a `#!` script that starts the real Claude without `exec` can be rebuilt again. `rig seat handover --source rebuild` on such a seat stopped after 30 seconds at "Waiting to confirm the new Claude process in this pane", though the new Claude was running: the wrapper keeps running the script as the pane's foreground process, with Claude as its child, and no process passed the script rule. Readiness now also admits the direct child of the process running the frozen script, in the pane's foreground group, when its arguments name this launch's own conversation token; the token match, single candidate, two stable samples and pane PID checks are unchanged, and every other process is refused as before.
A failed handover no longer moves the seat's resume target to the new, unprimed conversation while the seat keeps its previous occupant. A Claude `session_identity` hook carrying an occupant generation that isn't current, isn't registered for the seat, and arrives while the seat has a current tenure now answers `tokenPersisted: false` with `generation_uncommitted`; a successful handover still writes the launch token at commit. Codex is unchanged. Limit: a seat whose current generation was never registered (an adopted Claude carrying another generation, or a managed launch whose tenure record failed to write) keeps its first token, and later hooks don't move it.
Refs #2341. Source +33/-1, tests +138/-1.
`docs/reference/community-harness-examples/dsh/` adds a preset (`dsh.yaml`), an example runner (`openrig-dsh-runner.mjs`) and a README showing a runner author the runner contract end to end for dsh, a harness that speaks ACP: launch, activity, input, cancel and permissions. Permission requests follow section 7 of the runner contract: the runner submits the agent's live request, delivers the person's answer once, permits with the agent's allow option when nobody can be asked, and refuses and holds attention only on the seat's `--deny` or when no allow option is offered. `docs/reference/community-harness-presets.md` points to the example. A real dsh hasn't run it yet. One limit is named: the runner keeps one hold per seat, so a second request in the same turn can release an earlier one's hold. Docs and example +658, tests +447.
The runner conformance check now follows section 7 of `docs/reference/harness-runner-contract.md` as merged. Case 4: with nobody to ask, a runner permits with the agent's allow option (`allow_once` when offered), whether OpenRig lacks the answered path or can't be reached, and refuses at once only on `denied_by_seat` or when the request has no allow option. Case 4b checks the answered path itself: the live request is submitted with the agent's request id unchanged, reads wait at most 25 seconds (or not at all), exactly one answer reaches the agent, a stale or withdrawn request is cancelled with nothing held, and refusals are read by their code. A new test runs the check's test double against OpenRig's real permission routes with no model or provider. Docs and kit +324/-45, tests +377/-11.
Migration 145's comment said a null `nodes.permissions_to` meant the runner refuses and holds attention, which was the first version's behaviour. It now says what the merged code does: with no chosen person, the default person is asked, and the request is permitted when nobody can be asked. Comment only; the migration's name, SQL and behaviour are unchanged. +1/-1.
A new runbook, `docs/reference/pi-tool-selection-recovery.md`, explains how to recover a Pi seat whose tool selection went wrong, and `docs/reference/agent-startup-guide.md` links to it. For an agent OpenRig drives over RPC, it sends each extension command with `rig send <agent> --raw "<command>"`, so the command arrives without the messaging envelope while the usual interactive-prompt guard still applies. It also says what loading the linked helper registers: the agent-callable `openrig_runtime_status` and `openrig_slots` tools, a snapshot of the bound rig's agents and active queue items, and an optional prompt section when a guidance file is set. Docs only: +87.
An operator's `OPENRIG_WAKE_SUSPEND` override for a destination that has a colon of its own, such as `slack:U123@external`, now suspends that destination's wake retries for the declared window. Before, each entry was split at its first colon, so such a destination never matched and retries fired inside the window. Each entry now matches the checked destination's own prefix (`<destination>:`) and passes the rest to `Date.parse`, as before, so every date form main already accepted still suspends; other destinations and unparseable entries behave as before. This finishes #2114 by @Vaishnavi220506, who found the colon bug: their commit and its test are kept, with four new cells for the space and textual date forms. Source +7/-9, tests +25.
Co-authored-by: Vaishnavi220506 <[email protected]>
A runner seat's agent asks permission before an edit or a command; the runner contract's first version refused every request, so a job that needed one approved couldn't finish. Now a person answers and the default is permit. By default the default person (from `rig gateway default`, or the only registered person) gets an ordinary ask with the agent's own options; `rig seat set-permissions-to <seat> --to <person> --reason` chooses someone else and `--clear` goes back to the default, stored in a new nullable `nodes.permissions_to` column (migration 145), audited and shown in `rig seat status`. When no one can be asked, the request is permitted at once with the agent's allow option, preferring `allow_once`. `--deny` opts a seat in to refusing and holding attention. A click on an offered option by the asked person, another registered person or the primary user gives that option; a plain yes gives allow; a plain no or a Feed denial gives reject, or cancelled without one, and is never a grant; a handoff to another person keeps the options; no answer stays pending until the turn ends. The runner submits, reads and withdraws through `/api/activity/permission-requests`, and an answer reaches only its live request, once. Section 7 of `docs/reference/harness-runner-contract.md` carries the full rules. Source +792/-45, docs +128/-10, tests +661/-1.
After a human decision was resolved, its Slack notice re-rendered the original question with live buttons and the typed-reply hint, so it read as a new ask. `buildOutboundMessage` now renders a `human-decision-resolved` notice's questions and options as plain text, with no actions block and no reply hint, in both the blocks and the fallback text. A decision closed by a button click writes the same notice kind, so it gets the same rendering. Open and shared-channel asks are unchanged. Source +6/-3, tests +18.
The CLI's `host-bindings` and `restore` tests built filesystem paths from `URL.pathname`, which stays percent-encoded (and is `/C:/...` on Windows), so both failed from a checkout whose path contains a space or a non-ASCII character. They now use `fileURLToPath`, as the other CLI tests already do; the contention child still runs in `packages/cli` and the restore test still reads `src/commands/restore.ts`. No other `import.meta.url` pathname used as a file path remains in `packages/` or `scripts/`. Not run on Windows. Test-only: tests +4/-2.
Managed compaction could append its preparation prompt to an unsent draft when the optional typing guard was off, before its idle wait and including `--skip-map` requests. The preparation prompt, `/compact` and owed restore input now opt into the adapter's existing pre-paste composer check, through an internal send option that only the compaction enforcer sets. Typed, unreadable or changed input stops before any paste with the existing `draft_*` reason, the attempt or owed stage stays inspectable and retries once the box is empty, and the manual route explains the hold. Empty input and high-confidence suggestions go ahead. Ordinary sends, other notices, typing defaults and the existing busy, occupant and permission checks are unchanged. The terminal observation is not atomic against simultaneous manual typing. Merged with main's bounded idle wait for completed maps, whose `/compact` send keeps the same check. Source +22/-4, tests +109/-26.
A contained Claude resume whose saved startup context has no `claude_activity_hooks` entry no longer comes back silently without its activity hooks. When the seat's current specification still selects the hooks, restore re-applies the current marker through the same adapter seam as the saved-entry path and warns. A healed re-apply stays a warning and doesn't downgrade the rig; a re-apply that was skipped, failed or threw, including one where no Claude runtime adapter was available, records a restore gap, so the rig reports `partially_restored`. When the current specification doesn't select the hooks, nothing changes; when the selection can't be determined, restore warns and records no gap. `rig restore-check` reads the same current selection. Refs #1530. Source +175/-26, tests +225/-3.
After `rig provider switch --seat <claude-seat>`, the seat's recorded token reference matches the process actually running, and the seat keeps the effort it was running with unless its own saved choice says otherwise.
- A kept-pane launch that failed before its takeover sent any signal is now marked `nothingStopped`, and the switch reads it as no effect and puts the old token reference back. Failures after TERM, and a process that didn't end after TERM and KILL, still read `unknown` with the recovery command; the message for an untouched seat says it is as it was before the switch.
- Before touching the seat, the switch reads the running Claude's `--effort` from its argv. When the relaunch would change it and the relaunch's effort isn't the seat's explicit `rig seat set-effort` choice, the switch stops, changes nothing, and shows both values and the `rig seat set-effort` command that keeps the running one. It goes ahead for an explicit choice, a process with no `--effort` flag, or a process it can't read.
- The pane-process walk behind model reads and expected-conversation checks counts the pane process itself when its argv0 isn't a shell, and recognizes a native install's Claude by its versioned path.
A relaunch still uses the seat's saved model. Source +57/-10, tests +80/-2.
`rig daemon status` no longer prints "Daemon stopped" while a daemon start holds `daemon-start.lock` and its listener isn't up yet. When the probe is refused and the reservation names a live launcher or child PID, status stays `unverified` with a `startPending` record and prints "Daemon starting: launch reserved by pid N since T; not listening yet". Commands that need a responsive daemon treat a pending start as nothing listening and stop with "Daemon is starting ... Wait, then re-check with 'rig daemon status'." The refused probe's code is kept. No new status value; start and stop sequencing, the reservation's lifecycle, the readiness deadline and the `OPENRIG_URL` branch are unchanged. Source +70/-7, tests +147.
A valid host alias whose name matches an Object prototype property, such as constructor, toString or valueOf, now learns its identity on first contact. Before, recordUnderLock read the inherited property as a prior binding, reported a false conflict and wrote a sidecar entry without a host id. It now checks for an own property, and real bindings match and conflict as before; the other readers of the bindings read only a host id or conflict flag and were already safe. Source +1/-1, tests +23.
When someone watches a tmux server through a read-only client (tmux attach -r), tmux 3.7 and 3.8 refuse every send-keys, including -l, so each agent's submit key stalled with its text typed but not sent. A lone Enter or C-m that tmux refuses with "client is read-only" now goes as a carriage return through the existing guarded paste route (load-buffer, then paste-buffer -d -r without -p), which tmux doesn't block for read-only clients. Just before the paste, the same checks as before the key run again: the delivery guard, the caller's original-input check, the pane lease and the caller's input check; a change in that gap stops the carriage return, and a successful submit is recorded once. Other keys, key sequences and other refusals are unchanged. Not run natively on tmux 3.7 or 3.8. Finishes #2090. Source +24/-4, tests +88.
Co-authored-by: Mydudeclaps <[email protected]>
Following #1037's decision, a typed Slack reply still closes a structured decision, and the agent now has what it needs to read it correctly. The question's block and fallback text say a typed reply submits the answer without waiting for every question; shared-channel questions keep their existing hint. The correlated inbound answer's attribution footer, not the answer text, tells the agent to read the person's words rather than treat closure as approval, so the words recorded in humanAnswers are unchanged, and a replayed event carries the same footer so deduplication stays stable. This is guidance, not enforcement: decision close, buttons, delivery and shared-channel behaviour are unchanged. Source +16/-5, tests +18/-1.
rig export now preserves member-level startup declarations: startup files and actions come from the seat's retained launch recipe, or from a unique pre-launch materialization, and a new rig whose startup files are member-only keeps its source root. When the original source is unavailable, or its files can't be represented under the export's single root, the export names what it omitted, and the CLI checks required member files beside its output. The rig spec reference documents the provenance, missing-file and legacy limits. Pod startup actions are outside this change. Source +55/-6, docs +4/-3, tests +209.
rig down no longer deletes a seat's recorded skill copy when the source it was taken from has changed or disappeared. rig up --existing then restores the copy the seat had, its saved selection, instead of reporting it missing with nothing to put back. When the source is unchanged, down still removes the copy and restore rebuilds it from the source, as before, and deleting the rig still removes every recorded copy, since nothing would restore it. Source +15/-5, tests +48/-2.
When removing an agent image's .pinned sentinel fails, for example because the path is a directory or deletion is denied, unpinning now reports the error and keeps the image protected in memory. Before, it reported success and made the image eligible for deletion or pruning while the sentinel was still on disk. An already absent sentinel still unpins successfully. Source +4/-2, tests +23.
A Codex in-place restart that refuses with pane_shape_unknown gave a generic refusal with no evidence of what it saw. Its JSON result now includes detail.panePid and detail.processChain, ordered from the selected Codex process toward the pane, with only pid, parent pid and observed process name; a missing name stays null. The human-readable guidance points to rig seat restart --plan --json and asks for both the CLI and daemon versions. This is diagnostic support for #2200; it doesn't change which panes are accepted. Source +6/-1, tests +33/-1.
When OPENRIG_TMUX_CONTROL=1 is selected, OpenRig now starts its control client only if the tmux server's version identifies a release with the simultaneous-start fix (3.7c or newer). Older, development and unrecognized servers fall back to the existing spawned-client path, so OpenRig no longer creates its own vulnerable control client there; the opt-in speed-up is unavailable on those servers. This doesn't fix tmux or protect against control clients started by other tools, and existing command and unknown-write behaviour is unchanged. The tmux server guide names the version requirement. Source +9/-6, docs +5/-1, tests +9/-11.
The rig tui instance table drew a dotted rule between pods inside a rig but nothing between rigs, so one rig's last pod shared a block with the next rig's first pod, and trailing single-pod rigs ran together. Each rig boundary now gets a solid rule, and pods inside a rig keep the dotted rule. Source +4, tests +2.
A queue row's body written in Markdown now renders in Slack instead of showing raw **bold**, ## headings, [text](url) links and hyphen lists. Bold, heading lines, links (including bare URLs in list items), code spans and fences render as Slack mrkdwn, and lists become native Slack rich_text list blocks, with nesting and ordered numbering, falling back to text at the block limit. A hand-written Slack link <url|text> is kept as a link. Mentions and Slack control syntax stay literal text, unsafe links aren't linked, and secret redaction runs as before. A fenced code block split across several messages is closed and reopened in each part, with room reserved for the delimiters. Source +210/-8, tests +252.
A seat stuck at a permission or choice prompt keeps getting its escalation to someone when human delivery is unavailable. Generated escalation rows now stay on an admissible local agent carrier with OpenRig attribution and keep their ids, history and member obligations. An unreadable or missing person registry no longer rejects a valid agent carrier. An unaccepted legacy person carrier is rerouted through the existing fallback on the same row, and a newly configured lead gets one wake before the human rung; choice prompts stay explicit-only. Human-delivery readiness is checked before a new dispatch, and findings about undelivered escalation notices stay visible without escalating recursively. Ordinary rows without an owner-notification key now take their notification and decision identity from the existing meaningful-progress episode, so an escalation that returns after progress posts again even when the earlier notice was delivered and acknowledged; retries within an episode keep their identity, and accepted gateway deliveries keep custody. Source +118/-18, docs +8/-2, tests +224/-11.
A seat that has never started now starts on its first rig launch <rig> --seats <seat>. Before, a never-started pod seat (no startup context, nothing to resume) failed with "Fresh launch failed: Input target/occupant changed; no input written", and no agent process started. Restore retires the provisional shell before handing the seat to the persisted fresh launcher, but it left the lifecycle lease naming the retired binding, so the launcher's ownership check refused. Now retireProvisionalSession checks the lease still holds the seat after the stop, then clears the binding and rebinds the lease with no await between, as clearStaleState already does. A concurrent rebind during the stop refuses and is kept, and a replacement after the rebind still refuses at the launcher. --fresh, --retry-startup-from and the pristine single-seat first start are unchanged. Source +8, tests +66.
A Claude seat that is busy when its compaction preparation deadline passes no longer loses the restore map it already wrote. Before, the attempt ended with preparation_incomplete even though the map was complete, the next attempt asked the seat to write another map, and context kept climbing. Now a completed automatic map stays armed and /compact is sent at the seat's next idle moment, bounded by the original preparation deadline plus the existing retry interval (35 minutes by default), the same bound after a daemon restart. While it waits, the seat isn't asked to prepare again. The context monitor finishes an armed map when usage readings have gone stale or unknown, but a fresh reading below the threshold still holds compaction, and nothing new starts from stale usage. An attempt that expires with a finished map reports map_complete_seat_never_idle, distinct from preparation_incomplete, in the routes, rig compact --state and the help. The manual 180-second budget is unchanged. Source +56/-17, tests +79/-14.
With OPENRIG_TMUX_CONTROL=1, the tmux server no longer crashes, taking every session with it, when a daemon's control client ends while another client leaves, on tmux 3.3a to 3.7c. Before tmux 3.8, a client whose input has closed stops counting as attached while the server still holds it, so another client leaving in that window had destroy-unattached free the control session under it. The control session now sets destroy-unattached off, whatever a tmux.conf sets globally, and a session client-detached hook, if-shell -F '#{==:#{session_attached},0}' kill-session, so the session ends only once its own client has gone and kill-session takes any remaining client out first. The session_attached guard stops the hook killing a control session when tmux fires it for another session's lost client. The crash while two control clients start at the same instant, before tmux 3.7c, is left open. Source +18/-8, tests +43/-4 (unit and native tmux).
The host registry could only gain entries, so a mistyped target or a retired machine could only be fixed by hand-editing hosts.yaml. This adds rig host edit <id> (--target, --user, --url, --notes; an empty string clears an optional field) and rig host remove <id>, with matching POST /api/hosts/update and /api/hosts/remove routes beside /add. An edit keeps the host's id and transport fixed, and unknown fields fail with the editable set for that transport. Both routes refuse secret-shaped fields with add's no_secret_values check before any lookup or write, never overwrite an invalid registry, and go through the same parity-pinned writer and validator as add, with byte-parity tests across the CLI and daemon writers. Remove deletes only the registry entry: no credential files, no learned identity, nothing on the remote machine. Both report wasSelected and leave the selection pointer unchanged, and the CLI says where the selection stands. The routes are bearer-gated exactly like /add.
A charge post retry that comes due while another OpenRouter lookup is in progress is no longer dropped when that lookup returns a retryable response. Before, flushAlone deferred to the running pump, but the pump flushed only after a lookup reached an outcome, so the post waited for a later outcome. A flag now records the due retry, and the pump serves it once after a retryable outcome. A successful lookup's normal flush posts everything unposted and clears the flag, so nothing posts twice. A parameterized regression holds one lookup with another queued, fires the retry mid-lookup, and checks the 404 and success cases. Source +9/-3, tests +27.
The roadmap names the current release. The "Released in 0.7.5" section becomes "Released in 0.7.6": its one line links the published 0.7.6 release and summarises it in that release's own title, and points to its release notes for what shipped, known issues, upgrade instructions and contributor credits. Nothing else in the file changes. One file, +2/-2, text only.
An application that selected a Claude Code or Codex conversation could read or send through its seat name after that name moved to another native conversation, and get the other conversation's output or deliver into it. Two opt-in endpoints now check an expected identity (node, canonical session, runtime and native ID) where Core reads or injects: GET /api/sessions/:sessionName/generation-record-expected returns the checked tuple with bounded bytes from the same opened record, stopping at the first identity-bearing line, and POST /api/transport/send-expected rechecks after buffer preparation before paste and again before Enter. The expectation stays on the durable outbox receipt through held input, committed dispatch and delivery-id reuse. A mismatch or unavailable identity returns 409 with only documented codes, and during a preparing or confirmed runtime switch a conditional send returns 409 expected_identity_unavailable with nothing retained. Older daemons answer 404 rather than ignoring an unknown field. Callers without an expectation are unchanged. A native change after the final observation before Enter remains a race, terminal attachments are unchanged, and a delivery receipt doesn't prove model consumption. Source +275/-31, tests +243, docs +51; no new dependency or migration.
A Claude seat at an empty prompt reads idle after Claude installs an update, instead of unknown, so managed compaction can see it is idle and send. Claude prints "✔ Update installed · /restart to apply" (or "Restart to apply") below its mode bar, and CLAUDE_STATUS_WARNINGS didn't list that line, so the footer finder never reached the mode bar. One anchored entry now matches both spellings exactly. The #808 readiness cases run over both spellings across every mode bar, and three near misses (a suffix, no glyph, another verb) still read unknown. Source +2, tests +18/-1, no new refusal or error code.
OpenRig's managed seats can now run on a tmux server of their own instead of sharing the person's default server. `rig config set terminal.tmux_server isolated` keeps them on a persistent server derived from the canonical OpenRig home, so they stop cluttering the person's own `tmux ls`. `inherit` remains the default and keeps the existing native server selection and attachment behaviour; both modes keep normal tmux configuration. The selection is made before reconciliation, and a change waits while this instance's registered seats still run on the previous server, or while that server can't be inspected; it never moves or kills a live pane. Launch, capture, inventory, terminal views and cleanup use the effective selection. Ordinary inheritance tolerates missing or invalid advisory records and gains no new identity prerequisite; strict record and identity checks apply to isolation. Fixed isolated and migration selections carry a durable pin, and an opt-out records it before removing the marker, so startup and offline cleanup agree after an interrupted update. SSH tiles follow the viewing instance's effective mode: inherited views keep `ssh -t … tmux attach`, and isolated views use the remote `rig terminal attach` and never fall back to a same-named session on the default server. The reference includes a two-instance recipe with separate homes, databases and ports.
openrig.dev serves these contract pages from the release tag, and they still described 0.7.6 as an unreleased candidate. The harness runner, execution platform and joined author contracts now say the drafts were published with OpenRig 0.7.6 (tag `v0.7.6`). The `runner: true` with `launch_result: true` and `passes_model: true` rows read "Released in 0.7.6", in the published release notes' own terms. The implemented-interface baseline stays `b6bd4633`, and the published release adds repairs and documentation on top of it. The contracts stay drafts. Nothing about later releases is added, and the permissions section is unchanged. Text only: three files, +11/-11.
A seat placed in an OpenShell sandbox can now be stopped at the level its owner chooses, and brought back exactly. `rig environment effect` closes the viewer, stops the native agent, stops compute, or deletes an owned environment, and each returns what was observed: pending, confirmed, refused or unconfirmed. An attached environment is never stopped or deleted, only its viewer is closed. Deleting an owned one is confirmed only when its workload, supervisor and volumes are observed gone, and a failed lookup isn't treated as absence. Each effect has one operation identity, so a daemon restart or lost reply reconciles it without a second provider call. A finite run can be selected with `rig environment completion`: once its own task closes done with a verified export, the chosen stop runs, after eligibility is checked again just before dispatch; a pending stop is re-checked at most once a minute. `rig environment checkpoint` keeps the native history privately, and `rig environment recreate` replaces owned compute on the same host. A normal restore then resumes the exact saved conversation and first artifact, delivers the current resolved context and verifies it at the destination, and refuses missing or changed history instead of starting fresh. The recorded requester is transport-attributed. Stop and delete reach the vendor by name after the exact id is checked, so a deliberate reuse of the name in that gap is a stated limit; others are in the README.
The packaged-plugin version check (`scripts/check-packaged-plugin-versions.mjs`) requires a bundled plugin's version to advance when its files change, measured against `scripts/fixtures/packaged-plugins-last-release.json`. That baseline still described 0.7.2 (openrig-core 0.1.19), so a plugin change since 0.7.6 could pass without a version bump, and two installs could carry different hook or skill files under the same plugin version. The fixture now describes the published 0.7.6 package (openrig-core 0.1.23), checked byte-equal against the published tarball and the v0.7.6 tag's tree. openrig-core moves to 0.1.24 in both harness manifests: main was still at 0.1.21, because 0.7.6's version bump lived only on its release branch, and the plugin's files have changed since. Against the old baseline the check passed wrongly; against the new one it fails at 0.1.21 and passes at 0.1.24. Three files, +6/-6; no source or test change.
A runner author can now check their runner against the harness and runner contract with one command: `node docs/reference/runner-conformance/check-runner.mjs --runner '<command with {agent}>' --name <harness>`. It needs Node and tmux, and no daemon, model, credentials or network. It starts the runner in a private tmux server with a runner preset's environment and an empty OpenRig home, delivers input the way `rig send` does, and records what the runner posts to a stand-in for the activity endpoint, against a scriptable ACP agent. The cases follow the contract: the launch record and a failed handshake, framing, queued messages and cancel, activity and generation, refused permissions, resume, death mid-turn, errors, unknown requests and first input. Shutdown, which section 9 marks as proposed, is reported as advisory, met or not met, outside pass, fail and the exit status. `--wait-ms` scales the check's waits and the fake agent's own delays together, for slow machines and slow-starting agents. The README says what each case checks and what it leaves out. The contract's section 10 points to the check, and it ships in the package under `daemon/docs/reference/runner-conformance/`. It checks the runner's side only; a run with a real agent is still the useful evidence, and the answered permission cases follow separately.
Tingri Lohar Mohammed Mohsin