[lydakis]

Requested by George · project thread

Bumps agent, agent-client and sonny to 0.5.0 (Cargo.lock follows), on main at b0869f7 (#291), with the whole plate merged. The release notes are the section below; they become the GitHub release's notes.

Checked: cargo metadata --locked passes. No visible change, so no screenshots.

---

Agent 0.5.0

Everything since v0.4.1: the daemon sandboxes a bot's commands, writes and
edits the way Codex does, and Sonny sandboxes its leads and tasks by
default; the approver follows Codex's guardian and judges only sandbox
escapes; Sonny opens full screen, with find, a side pane for files,
/status, /background and side chat; agent-only Sonny commands become tools;
pictures work end to end; bots run read and command calls in parallel,
patch files with apply_patch and search the web; a five-part pacer
rework keeps many bots fast under rate limits and overloads; and settings
move to ~/.agent/config.toml.

Before you update

• Update the daemon and its clients together. The socket protocol is now
  21 (was 19), for task resolution (Sonny: group the lead's tasks by state in /status, and let the lead resolve them #244) and tools a client answers (Declared tools a client answers: hold, then park, with gates #248).
• The store migrates once at first open (schema 53 to 59). History is
  kept; 0.4.1 cannot open a migrated store.
• Settings live in ~/.agent/config.toml (Effort defaults for leads, tasks and judges in ~/.agent/config.toml #251). ~/.agent/env keeps
  provider keys only. AGENT_JUDGE is gone: set [judge] model and
  effort instead. In .agents/project.toml, reasoning is now effort
  and threads_reasoning is now threads_effort.
• Sonny's agent-only commands are tools now (Sonny: the six agent-only commands become tools the lookout answers #268, Sonny: memory and triggers become tools the lookout answers #278). sonny task
  start and rm, show, run, the lookout subscriptions and project add
  are no longer commands; memory and triggers are tools too, and the
  ~/.agent/memory and ~/.agent/trigger scripts stay for people and
  scripts.
• Sandboxes are on by default in Sonny (Sonny: sandbox leads and tasks by default #285). Leads in auto and
  ask run workspace-write with the network on and their repository's
  git folder writable; full runs danger-full-access; tasks always run
  workspace-write. A call that would leave the sandbox goes to the
  approver. Git hooks and config stay read-only inside a writable git
  folder.
• The tap still needs trusting once if you skipped 0.4.1:
  brew trust lydakis/agent.

Sandbox and approvals

• The daemon sandboxes bots (Daemon: sandbox a bot's commands, writes and edits as Codex does #265). New bot settings sandbox
  (read-only, workspace-write or danger-full-access), writable and
  network. shell runs under bubblewrap on Linux and Seatbelt on macOS,
  ported from Codex, and confined write and edit run inside it. Only
  escapes are gated; with no gate they are refused. Children and forks
  inherit their creator's sandbox.
• Sandboxed bots keep the agent and sonny CLIs (Sandbox: sandboxed bots use the agent CLI through their own socket, capped by caller #276) through a
  socket of their own, which answers as that bot: no configure, no
  answering approvals, no shutdown, and it removes only its own bots.
• The approver follows Codex's guardian (Approver: judge by Codex's guardian policy, deny at once, fail closed #237, Approver: show the judge the agent's history and the AGENTS.md it was given #243, Approver: judge only sandbox escapes, and let a model judge look read-only first #275). Codex's
  written policy and one assessment per call; a denial goes straight back
  to the model; reviews fail closed and say so. The judge sees the agent's
  history (tool output marked untrusted) and its AGENTS.md, judges only
  sandbox escapes, and a model judge may look around read-only first.
• Sonny shows auto-review (Sonny: show auto-review in progress and its denials; /approve retries one #261). "Reviewing approval request" while
  the judge works, "✗ Request denied" with its reason, and /approve
  retries a denied call once.

Sonny

• Full screen by default (Sonny: full screen with drag-to-copy, behind /fullscreen #235, Sonny: full screen by default, without the newer-rows note #255, Sonny full screen: Ctrl+F find, older messages on scroll, pictures that keep their shape #258, Sonny full screen: a 100-column conversation, and a pane beside it for files, /status and side chat #264). Drag, double- and
  triple-click copy with no held key; Ctrl+F finds text; older messages
  load as you scroll back; the conversation keeps to 100 columns; a pane
  beside it shows file previews with syntax colors and Markdown, /status,
  the side chat and /background (Sonny: /background opens in the side pane on the full screen #283). /fullscreen switches to inline.
• /status groups tasks (Sonny: group the lead's tasks by state in /status, and let the lead resolve them #244, Sonny: timers show the running turn's time, or how long the last turn took #266, Sonny: tasks resolve themselves, as claude.ai threads do #284): Needs you, Working, Ready
  for review, Idle and Resolved. The lead resolves tasks with
  resolve_task, and a task can resolve itself; new work reopens it.
  Timers show the running turn's time, or how long the last turn took.
• /background (Sonny: /background lists triggers and lookout subscriptions, with a ↻ count per agent #267) lists triggers and lookout subscriptions, fires
  or removes them, and a ↻ count marks agents with something running.
• ask is a decision (Sonny: ask puts a decision with reasons where it was asked #245): a question, why it is asked, two to four
  options with what each means, and a recommendation, drawn where it was
  asked. Open questions older than the replayed history stay open (Sonny: keep open questions older than the replayed history #226).
• Every folder gets its own lead (Sonny: every folder outside git gets its own lead #259, Sonny: a project can keep the folders below it (subfolders = "project") #263). Outside git, the folder
  Sonny opens in is its own project; in a repository, the nearest project
  in it, else the repository's top. subfolders = "project" keeps the
  folders below a project.
• Roles are files (Sonny: the lead's and tasks' roles as editable files in ~/.agents/agents #240): the lead's and tasks' roles are written to
  ~/.agents/agents/lead.md and task.md, and your edits are kept.
• Tasks: isolated copies that are removed when done (Sonny: keep task copies isolated, and remove tasks that are done #227, Sonny: a task's brief names its copy, not the lead's folder #234); a
  task's brief names its copy; sandfs 0.9 freezes copies of folders on
  another disk and a waiting task gives memory back (Sonny: sandfs 0.9, frozen copies for folders on another disk, and a waiting task gives memory back #271); a new task's
  worktree starts with clones of the lead's build folders (Sonny: a new task's worktree starts with clones of the lead's build folders #286).
• Leads (Sonny: leads act across tasks, and every agent cares about the person #229, Take back a queued message with interrupt --turn; lead rules for consent, open decisions, notes and relays #260): a lead acts across its tasks and every agent
  cares about the person; at most three open decisions; nothing goes out
  in the person's name without their words; agent interrupt --turn
  takes back a queued note.
• First run (Sonny: a first run that sets itself up and says hello, and a Linux install script #253) sets itself up and says hello; Linux gets an install
  script. Effort defaults for leads, tasks and judges (Effort defaults for leads, tasks and judges in ~/.agent/config.toml #251).
• Lookout (Lookout: task results reach the lead within a minute #228, Lookout: send task news as soon as the lead rests #232, Lookout: the lead sees every task message; the judge only decides what cannot wait #239, Lookout: the judge picks a task drifting from what the person means, busy or not #273): task news reaches the lead as soon
  as it rests; the lead sees every task message and the judge only decides
  what cannot wait, including a task drifting from what the person means.
• Smaller: clickable link text and file paths, Ctrl-H (Sonny: clickable link text and file paths, Ctrl-H, room around staged messages #230); shell
  editing keys in the composer (Pictures in messages and from read, counted at their token cost; Sonny's shell editing keys #242); a named project lead, surviving a
  terminal waking, new leads in their own tab (Sonny: name the project lead, survive a terminal waking, open a new lead in its own tab #238); Herdr restarts keep
  Sonny's services (Keep Sonny's services and Herdr presence across Herdr restarts; fix flaky fake-program tests #231); Claude bots use the one-hour prompt cache
  (Sonny: make Claude bots with the one-hour prompt cache #249).

Runtime

• Pictures (Pictures in messages and from read, counted at their token cost; Sonny's shell editing keys #242, A request keeps its newest pictures; older ones go as their words #269). Pictures go with a message, read returns an
  image as a picture, each counts at its token cost, and a request keeps
  its newest pictures while older ones go as their words.
• Tools a client answers (Declared tools a client answers: hold, then park, with gates #248). A declared tool can be answered by the
  client: the call holds, then parks, behind gates. history reads another
  agent's turns, so tasks see their siblings (history reads another agent's turns, so tasks can see their siblings #256).
• Parallel tool calls (Run a row of read and command calls together, up to four at a time #291). A row of calls that only read or run
  ungated commands starts together, up to four at a time, as in Codex.
  Results are recorded in call order; gated calls, declared tools, writes
  and edits still run one at a time.
• apply_patch (apply_patch: Codex's patch tool beside edit, freeform on Responses #254) beside edit, freeform on the Responses API, as
  Codex has it.
• Web search (Bots search the web the way their provider offers it, as Codex does #287) the way each provider offers it, as Codex does:
  web.run on an OpenAI API key, hosted search on the Claude API and on
  GPT via Bedrock. It is on by default; web_search = "disabled" in
  ~/.agent/config.toml turns it off. ChatGPT plan logins and Claude on
  Bedrock get no search.
• Shell (Shell: keep both ends of output past 1 MiB instead of failing #236, Shell: drain runaway output slowly, run without a terminal, report wall time #247). Output past 1 MiB keeps both ends instead of
  failing; runaway output drains slowly; commands run without a terminal
  (TERM=dumb, pagers set to cat); results report wall_time_ms.
• Pacer (Pacer: a lone overload backs off its own call; clustered overloads close the pool #262, Pacer: reserve the output Anthropic calls have been writing #272, Pacer: server errors wait as their response asks, and a spent cap ends the turn #274, Pacer: Anthropic calls reserve and are charged only the input that counts #280, Pacer: a call waiting for its allowance to refill parks #281). A lone overload backs off only
  its own call; Anthropic calls reserve the output they actually write and
  are charged only the input that counts against the limit; server errors
  wait as their response asks; a spent cap ends the turn; a call waiting
  for its allowance parks instead of holding its request in memory.
• Daemon (Overloads mid-reply hold the provider's pool, an empty reply after a tool call ends the turn, keep the answer a steer came after #233, Daemon: park retry backoffs, classify in-stream overloads, keep statements prepared #257). Retry backoffs park, in-stream overloads are
  retried, statements stay prepared; an empty reply after a tool call ends
  the turn.
• Triggers and memory (Triggers: show skipped checks, fire prints its turn handle, add --replace keeps history; memory up to 16 KiB #241): skipped checks show, fire prints its
  turn handle, add --replace keeps history, memory holds up to 16 KiB.

Docs and CI

• Pull requests are gated on the Rust tests and the runtime suite (Gate pull requests on the Rust tests and the runtime suite #246,
  Fix three flaky tests the new gate trips on #250, Tests check what happened first, not how long it took #282).
• README benchmarks rerun on 0.4.1 (Rerun the five-harness screen on 0.4.1 and refresh the README table #288), and a Perf workflow screens
  each daemon change against its base (CI: screen each daemon change against its base #289).

---

🤖 Generated with Claude Code

https://claude.ai/code/session_013jkdGEK7HMibaxgHFDtGXA

[lydakis]

runtime failed in tests.test_lookout (test_a_resting_lead_hears_every_message_and_the_person_s_words, final self.asked.empty()). This PR changes only the three crate versions and Cargo.lock. Its base, main at 93e57b8, passed the same suite in Test run 40666998894, so the failure isn't this PR's: the lookout judged one more turn than the test expects, which looks timing-dependent. No fix exists yet, and this session can't re-run jobs. The PR stays a draft until #285, #287 and #291 merge. It will be rebased then, which runs CI again, and I'll look at this test again if it fails a second time.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T10:51:58.269208Z	ed92a48	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-28T10:52:57.234847Z	ed92a48	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.