[lydakis]

Agent 0.7.0

Agents now meet in the commons, a task's question reaches its lead, and a task can fork from another's turn with its files. Leads coach, hold work that waits on something outside, and check in when work would go stale instead of on a fixed heartbeat. Sonny reads with one visual system and one vocabulary, and /sky shows every agent live. Each call an exec script makes is approved on its own, the pull cord pauses every agent, and the daemon keeps up with thousands of bots and gated calls while starting with only what its client names. Read Before you update first: the protocol and the store both move, --bot is now --agent, and agent approver is now sonny approver.

Before you update

• Update the daemon and its clients together. The socket protocol is now 24 (was 23): a client may declare up to 32 tools, up from 16 (Sonny: the commons, threads every agent of every project reads and writes #392). text_delta and thinking_delta carry item, the output item they stream (Stream each message apart: text deltas name their item #396); follow takes kinds, the event kinds it wants, and the lookout leaves streamed text out (Daemon: a follow can name the event kinds it wants; the lookout leaves streamed text out #407); a declared tool can carry steps: true and its client asks approve_step for each call inside it (Approve each call an exec script makes, as Codex does, instead of the script #393); pause and resume stop and restart every agent, and ready, stats and the paused / resumed events carry the pause (The pull cord: pause every agent until resume, across restarts #408).
• The store moves to schema 64 (Approve each call an exec script makes, as Codex does, instead of the script #393 adds approval steps, The pull cord: pause every agent until resume, across restarts #408 the pause). The 0.7.0 daemon migrates the store on first start, and 0.6.0 can't open it after that, so copy ~/.agent/state.sqlite while the old daemon is stopped if you may go back.
• After the upgrade, the first agent or sonny command replaces the old daemon (Starting the daemon replaces an older one once its turns end #413). It asks the old daemon to stop, gives running turns up to 2 minutes and interrupts the rest, then starts the new one on the same socket. So back up the store before you run either command.
• submit requires delivery (Daemon: the opinions that leaked in move out to clients #447). The daemon no longer picks reject for you; a submit without it gets invalid_delivery. The CLI defaults to AGENT_DELIVERY, then reject, and Sonny sends its own.
• No fixed round bound (Daemon: the opinions that leaked in move out to clients #447). The 200-round cap is now the bot's max_rounds setting (--max-rounds), unbounded when unset.
• The daemon starts with what its client names (Daemon: the opinions that leaked in move out to clients #447). Terminal variables (TMUX*, HERDR_*, CMUX_*, REX_*) are kept out of tool shells through --shell-exclude, and secret field names through serve --redact-field / --redact-block, both passed by the CLI that starts the daemon, so nothing changes if you start it with agent or Sonny. A daemon you run by hand with agent serve redacts only the credentials it holds unless you pass them. Likewise the folders a sandbox keeps read-only (.git, .agents, .codex, and .aws where it exists) are named with serve --protect and --protect-existing, which the CLI passes (Sandbox: the folders kept read-only are the client's to name #460). Tool descriptions, the summarizer request and the CLI preamble state facts only.
• agent approver is now sonny approver (Approver moves to sonny approver; the CLI keeps only the gate #458). The approver is a client of the daemon, and the CLI no longer starts one itself: a bot on --approval auto is refused with approver_not_serving until an approver serves. Sonny keeps sonny approver running as a companion.
• The approver's OpenAI Decisions judge is gone (Approver: drop the OpenAI Decisions judge #389). Every judge is a provider/model the daemon serves; --judge-url and the approver's OPENAI_API_KEY are removed.
• sonny --bot NAME is now sonny --agent NAME (Sonny: one vocabulary for what the person reads #438), with no alias, so Herdr or cmux panes saved by 0.6.0 won't resume after the upgrade; reopening Sonny lays them out again. /approve is now /retry.
• Outside git, a task now shares its lead's folder by default (Sonny: the lead picks a task's folder: shared, a repository's worktree, or its own #409). A lead can instead give a task a worktree of a repository inside its folder (folder) or an empty folder of its own (own_folder). Each start_task result lists the folders the lead's gone tasks left, with their sizes, and remove_task clears them (Sonny: a start lists the folders the lead's gone tasks left #446).

Sonny

• /sky (Sonny: /sky, every agent lit up live as they talk #457, experimental). Every agent the daemon keeps, live, as a radial sky in braille dots: leads on the inner ring, the agents they made behind them, you in the middle. A message flies as a spark from sender to receiver, which lights up and fades; a follow's or an automation's message comes in from the rim, a commons post ripples and a working agent shines. The last five messages read below it in words.
• One vocabulary for what you read (Sonny: one vocabulary for what the person reads #438). Slash descriptions are imperatives ("Pick the model and effort"), and one word names one idea everywhere: /approve is /retry, the judge is the reviewer, triggers are automations (r runs one now in /background), lookout subscriptions are follows, "said nothing" is "no reply" and Patched is Edited. The agents' own tool names stay until an eval backs a rename (Sonny: rename the agents' automation and follow words (tools, CLI, lead instructions), with an eval #439). It also fixes a line cut at the edge when it ended in ──, margin folding at 141 to 142 columns, a list over the composer hiding its pick, /status scroll, and Ctrl+O on messages between agents.
• The commons (Sonny: the commons, threads every agent of every project reads and writes #392). Threads every agent of every project reads and writes, through the commons tool: list, read, post, reply. Nothing is pushed and nothing wakes an agent; a reply reaches a thread's earlier posters as a note on their next model call. Posts are signed with the calling agent and marked external when their turn read outside content. /commons (or /forum) opens them in the pane. The commons can be turned off in /config, and a new thread invites an agent whose past turns match its title: 3 invites a day plus one for each invite answered that week, with every tenth a golden ticket. Clients can search history across agents with the new history_search op (Commons: an on/off setting, and a new thread invites one agent whose turns touch it #445). /usage shows what the commons, triggers and the margin cost, from the origins breakdown the daemon's usage read now gives (usage: spend by each turn's origin; /usage shows what the commons cost #451). An invite is now a token budget, [sonny] commons_invite_tokens (a million by default): a reply wakes an invited agent that has tokens left, so a conversation goes on until its invites are spent. [sonny] commons_invites sets the base invites a day (Commons: an invite pays for tokens in its thread; both invite budgets are settings #456).
• Task updates in a row gather into one row (Sonny: task updates in a row gather into one row; /status opens the agent clicked; margin_opens #384) that names whose news it holds; a click lists them. A click on an agent in /status opens it in the pane. [sonny] margin_opens says when a new note opens the margin again (always, unless-closed, never).
• A task whose goal's check passed reads checked (Sonny: a task whose goal's check passed reads checked, apart from one that only stopped #379), and one with a goal still set reads checking, apart from one that only stopped.
• A task's question reaches its lead, and a decision stands out (Sonny: a task's question reaches its lead, and a decision stands out #395). A task's ask is news to its lead, quoted as the task's words, and the roster marks the task needs you; you answer it in the task. Leads and tasks send decisions through the ask tool, and the decision card has a yellow bar down its side.
• A first run that finds what the machine has and asks only the rest (Sonny: a first run that finds what the machine has and asks only the rest #402). Sonny's first start detects the providers and sign-ins already on the machine and asks only for what's missing; sonny setup runs it again. It can bring your MCP servers over from Claude Code, Codex, OpenCode and Kiro (Sonny: bring MCP servers from Claude Code, Codex, OpenCode and Kiro #415). After an upgrade, the first lead tells you what's new and offers any new setup once (Sonny: after an upgrade, the first lead tells what's new and offers new setup once #420). sonny setup with flags (--provider, --model, --key-stdin, --import-mcp, --json) asks nothing, so any agent or script can drive it through the sonny-setup skill; with no model reachable yet, setup can hand off to Claude Code, Codex, OpenCode or Kiro to finish it with you; and backup is offered once (Sonny setup: flags and --json, the sonny-setup skill, a hand-off to another agent, and the backup offer #428).
• One visual system across every terminal theme (Sonny: one visual system across every terminal theme #405). Muted text and diff tints come from the terminal's own theme colors, diffs show a -/+ sign, Markdown headings are bold with dim # marks and no color, and NO_COLOR is honored.
• The clean view sums up work as one row, and every fold has a key (Sonny: every fold has a key, and the clean view stays text #421). Commands, reads and edits in a row read as one summary row, Ctrl+O opens every fold, and ↑↓ and Enter work in /status.
• One key-hint grammar and a ? shortcuts sheet (Sonny: one key-hint grammar, one state table, one list over the composer #427). ? marks what needs you in the roster, /status and the footer, and lists pick from one 8-row list over the composer.
• Your messages sit on a band, and the footer says context left (Sonny: your messages on a band, context as % left, rules that end at the edge #432). Your own turns are tinted from the theme so they're easy to find, and the footer reads 62% context left (yellow at half, red at four fifths), from the context window the daemon now reports on each round's usage event (context_window, optional).
• A task forks from another's turn with its files then (A task forks from another's turn with its files then #380). When a task's turn completes in its worktree, the lookout snapshots the files into a private git ref; start_task with from (and optionally turn) gives the fork that conversation and those files in a worktree of its own, so two attempts no longer edit the same files. Search across many agents' history is also much faster (1.6 s to 313 ms on 800 bots).
• An agent's name in the conversation opens that agent (Sonny: an agent's name in the conversation opens that agent #435). Names in replies, task-update rows and /status are drawn in the agents' blue and open the agent in the pane on a click; /status opens with the agent named last already picked, so /status then Enter goes there.
• The pull cord (The pull cord: pause every agent until resume, across restarts #408, experimental). /pause REASON or agent pause --reason TEXT interrupts every running turn and starts none until a person runs /resume or agent resume, across daemon restarts. Every window shows who paused and why. Agents are told to pull it when they see agents doing harm, and a sandboxed agent can't resume.
• Tab queues (Sonny: Tab queues a message for after the running turn #400). While an agent works, Tab queues your message for after its turn; Enter still steers, as in Codex.
• Each message streams apart (Stream each message apart: text deltas name their item #396). While a reply streams, each message the bot sends shows as its own block instead of one run-on paragraph (Model planning text can leak into the reply (ChatGPT-login provider) #350); agent run --pretty and follow start a new paragraph too.
• /goal WHAT (Sonny: /goal WHAT asks the agent to set its own goal; /goal shows, /goal clear clears #397) asks the agent to set its own goal for what you typed, as Codex's /goal does; /goal shows the goals of the agent and its tasks, and /goal clear clears its own.
• Leads pick a task's model from the models list (Sonny: a lead picks a task's model from the models list, not only when the person names one #385), not only when you name one, and are asked why they start a new task while they have others (Ask a lead why it starts a task while it has others #386), so work one of them holds goes to it.
• Leads and tasks give straight feedback and coach repeated habits (Sonny: leads and tasks give straight feedback, coach repeated habits and weigh what sources report #394), saving how you work to memory, and weigh what sources report against the rest of your work. A lead starts, or sets up, what you said you will do (Sonny: a lead starts what the person said they will do when nothing owns it #399). The nightly memory cleanup also reflects on your habits, from what you wrote and sent (Sonny: the nightly cleanup reflects on habits, from what the person wrote and sent #403), and a chat or mail server it can't read keeps the night open so it is read again next time (memory-cleanup: a server it cannot read holds the night open #411); and agents a trigger starts get Sonny's tools, gated by the agent's mode. What your memory says about how you want work done now overrides the defaults in the role files, and agents save what worked as well as what you corrected (Sonny: memory overrides the role files' defaults, and saves what worked #410). A fact can carry how often you confirmed it and pushed back on it, shown in the memory index, and the nightly cleanup reads your reactions and your picks on asks to raise those counts, reinforcing approaches, never agreement (Sonny: memory reinforces what the person confirms #431). An agent writing to another agent puts in what the reader needs to act alone, such as facts, paths and what was checked, not a pointer to go look (Sonny: a message to another agent carries what it needs to act #443). A lead holds work that waits on something outside, such as a review or a check, and finds out why if it never comes; the opt-in superlead profile checks that its projects' work fits together, keeps quiet work moving, and saves a rule you give one lead to memory for all of them (Sonny: superlead checks that projects' work fits together; leads hold outside waits #430). Instead of a fixed heartbeat, a lead keeps one repeating LEAD.next trigger set to the earliest time something it holds would go stale, skipped while you're writing, later after a look that found nothing, and removed once nothing is open (Sonny leads: a self-set next look instead of a fixed heartbeat #433).
• T3 Code's model picker shows each model by its provider's name (Sonny in T3 Code: show each model by its provider's name #377), as Global Claude Opus 5.5 · bedrock.
• The lookout stays light with thousands of bots (Lookout: stays light with thousands of bots #398). An event reaches only the lookouts that hear its bot, a bot made or deleted is checked alone, a restart follows from its cursor instead of replaying the whole log, and notes go out beside the stream. At 1,100 bots and 100 subscribers, start time fell from 13 s to 0.35 s and CPU under load from 87% to 4%. The lookout's cursor file now holds two numbers.
• Every agent gets the subscriptions tool, and agents no one opened since an upgrade get this build's tools when the lookout starts (Open links without xdg-open, give agents Sonny's current tools and subscriptions, retry Bedrock clock-skew refusals #382). Links open with the desktop's opener, and are copied when none is installed.
• Several leads per folder, fixed (Sonny: each store notes its own last lead, and a gone lead's tasks stay off the first lead #376): each store remembers its own last lead, and a deleted lead's tasks no longer move to the first lead.
• Back up memory, skills, profiles and config to a git repo (Sonny: back up memory, skills, profiles and config to a git repo #417, experimental). sonny setup backup [URL] sets it up, a 10-minute LaunchAgent or systemd timer keeps it synced, and sonny home sync and sonny home status run or show it. Over SSH with no display and no BROWSER, a link, file or page Sonny would open goes on the clipboard instead of starting a browser on the box's screen (Sonny: over SSH with no display, what it would open is copied instead #437). [sonny] start_at_boot, off by default and set in /config, starts the daemon at login with a LaunchAgent, or at boot with a systemd user unit (Sonny: [sonny] start_at_boot starts the daemon with the machine #441).
• Role files have byte budgets (Sonny: role files get byte budgets, the lead's repeated rules merge, and a role eval #440). Lead, task and superlead roles were trimmed of repeated rules with no change in behavior, and a test holds each under its ceiling (16, 4 and 3 KiB); the lead role went from 20 KiB to 16 KiB with no loss on the role eval (Sonny: lead.md in 16 KiB, the same rules in fewer words #452). bench/role_eval.py A/B-tests role changes with scripted days.
• What failed in the background shows (Sonny: what failed in the background is a red ✗ in the footer and first in /background #419). A trigger fire that fails, a turn a fire sent that fails later, or a server the nightly cleanup couldn't read puts a red ✗ in the footer and margin, and the failure is listed first in /background. A one-off trigger, or a --runs trigger's last run, keeps its record until its turn completes, so a later failure still shows (Sonny triggers: a sent one-shot keeps its row until its turn ends well #442).
• Fixes: each repository inside an agent's folder, up to six folders down, keeps its git hooks and config read-only in the sandbox, so a sandboxed agent can't plant what git later runs as you (Sonny: each repository inside an agent's folder keeps what git runs #444); Sonny redraws the whole screen after a resize, when the terminal regains focus, and on Ctrl+L, so a display wake or a multiplexer reattach no longer leaves stale rows (Sonny: the whole screen is drawn again on resize, focus and Ctrl+L #424); a failed agent call reads as what it tried instead of "Started X", and links no longer draw over /config or a picker (Sonny: a failed call reads as what it tried, and links never draw over a list #416); a task's turn-end reply reaches its lead with the turn's end instead of being dropped by a steer (Lookout: a turn's end reaches the lead with its reply, or waits for it #378); a margin note changed while no window was open shows as it is now (Sonny margin: replay from where the notes were brought up to; key a close by where it landed #383).

Runtime

• Each call an exec script makes is approved on its own (Approve each call an exec script makes, as Codex does, instead of the script #393), as Codex's code mode does, instead of one verdict for the whole script. An MCP tool asks first by its server's default_tools_approval_mode or tools.TOOL.approval_mode, with Codex's names: auto (the default) asks for a tool marked destructive and not read-only, writes asks for every call except a read-only tool's, prompt always asks and approve never does. The script's clock stops while a call waits.
• Hour-long Anthropic cache after compaction (Pin the compaction summary at the request's cache lifetime #381). A bot on the 1h cache was refused with a 400 on every call after its first compaction summary. Every cache breakpoint in a request now takes one lifetime, and a bot stuck this way recovers on its next turn. A five-minute cache you set explicitly now stays five minutes in Sonny; inspect reports an unset cache_ttl as null (An explicit five-minute cache stays five minutes #423).
• The approver keeps up with thousands of gated calls (Daemon: bound each session's queue by bytes, not 64 messages #425, Approver: no cap on rounds, and its lease renewals never wait in line #436). A session's queue is bounded by bytes instead of 64 messages; the approver no longer caps judge rounds at 32, and its lease renewals are answered as they're read instead of waiting behind its own requests. At 5,000 gated calls with a 5 s judge, every call was judged in 62 s and the longest renewal took 94 ms.
• Clients take turns at the daemon (Daemon: sessions take turns at the service loop #450). Each session's requests sit in a queue of their own, served round robin under the same overall bound, so one client's flood no longer holds up the rest.
• Waiting requests keep no task or timer of their own (Daemon: client requests that wait keep no task or timer of their own #434). A client wait with a timeout, a parked turn's deadline and an approve_step waiting on its step are entries on the run loop's one schedule.
• history searches every agent a bot pattern matches (History search takes a bot pattern to search every agent #373), with each match's bot and turn handle.
• Bedrock retries a clock-skew refusal (Open links without xdg-open, give agents Sonny's current tools and subscriptions, retry Bedrock clock-skew refusals #382), signed again.
• Codex's opt-in shell environment excludes (Tool shells: Codex's opt-in shell environment excludes #412). Nothing changes by default. [shell_environment_policy] ignore_default_excludes = false in ~/.agent/config.toml keeps *KEY*, *SECRET* and *TOKEN* variables out of tool shells, and exclude = [...] adds more patterns; it applies from the next daemon start (agent serve --shell-exclude).

Docs and CI

• The README's "How fast is it?" table was measured again on this release's daemon (Rerun the five-harness screen on the 0.7.0 daemon #461): 32 agents at 64 KiB a turn take 28.9 MiB peak memory and 0.65 s of CPU, unchanged from 0.6.0 within drift.
• macOS tests now gate pull requests (CI: a macOS test failure fails the run #375).
• sonny/FEATURES.md lists every Sonny feature added, changed or removed, with why and whether it's used (Sonny: a register of every feature it has had, and why #401).
• Sonny's README covers a folder's several leads and a T3 Code thread as a lead of its own (Sonny docs: a folder's several leads, and a T3 Code thread as a lead of its own #374).

Known flakes

• sonny math rendering: a LaTeX test can hit its 5 s timeout on a busy runner.
• test_served interrupted_mid_setup can race on /proc on Linux.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T08:48:33.700809Z	61aa2e4	PR opened
🔒 Security Review	✅ Completed 2026-10-30T08:49:17.334396Z	61aa2e4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.