@aion0/forge 0.6.0 → 0.6.3

package/.forge/agent-context.json

@@ -1,6 +1,6 @@
 {
-  "workspaceId": "656c9e65-9d73-4cb6-a065-60d966e1fc78",
-  "agentId": "engineer-1774920478256",
-  "agentLabel": "Engineer",
+  "workspaceId": "6fc40ffc-3dfc-4e2d-bf93-c934d1996af2",
+  "agentId": "lead-1778546799874",
+  "agentLabel": "Lead",
   "forgePort": 8403
 }

package/.forge/mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "forge": {
       "type": "sse",
-      "url": "http://localhost:8406/sse?workspaceId=656c9e65-9d73-4cb6-a065-60d966e1fc78"
+      "url": "http://localhost:8406/sse?workspaceId=6fc40ffc-3dfc-4e2d-bf93-c934d1996af2&agentId=lead-1778546799874"
     }
   }
 }

package/RELEASE_NOTES.md

@@ -1,8 +1,11 @@
-# Forge v0.6.0
+# Forge v0.6.3
 
-Released: 2026-04-28
+Released: 2026-05-11
 
-## Changes since v0.5.50
+## Changes since v0.6.2
 
+### Bug Fixes
+- fix: codex — auto-detect skipPermissionsFlag for new vs legacy CLI versions
 
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.5.50...v0.6.0
+
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.6.2...v0.6.3

package/bin/forge-server.mjs

@@ -314,42 +314,41 @@ function cleanupOrphans() {
 // ── Start standalone services (single instance each) ──
 const services = [];
 
-function startServices() {
+// When forge runs in the background, services need to fully detach from the
+// invoking shell. Otherwise: closing that shell sends SIGHUP to its process
+// group → terminal-standalone / telegram / workspace die → all browser
+// terminals disconnect.
+//
+// `daemonize` (passed by startBackground) flips on:
+//   - detached: true        → new process group, survives parent SIGHUP
+//   - stdio redirected to forge.log fds (no inherited tty fds that go away)
+//   - child.unref()         → child doesn't keep the launcher alive
+function startServices(daemonize = false) {
   cleanupOrphans();
 
   const instanceTag = `--forge-port=${webPort}`;
+  const stdio = daemonize
+    ? ['ignore', openSync(LOG_FILE, 'a'), openSync(LOG_FILE, 'a')]
+    : ['ignore', 'inherit', 'inherit'];
+  const detached = daemonize;
+
+  const spawnService = (label, script) => {
+    const child = spawn('npx', ['tsx', script, instanceTag], {
+      cwd: ROOT,
+      stdio,
+      detached,
+      env: { ...process.env },
+    });
+    if (daemonize) child.unref();
+    services.push(child);
+    console.log(`[forge] ${label} started (pid: ${child.pid})`);
+    return child;
+  };
 
-  // Terminal server
-  const termScript = join(ROOT, 'lib', 'terminal-standalone.ts');
-  const termChild = spawn('npx', ['tsx', termScript, instanceTag], {
-    cwd: ROOT,
-    stdio: ['ignore', 'inherit', 'inherit'],
-    env: { ...process.env },
-  });
-  services.push(termChild);
-  console.log(`[forge] Terminal server started (pid: ${termChild.pid})`);
-
-  // Telegram bot
-  const telegramScript = join(ROOT, 'lib', 'telegram-standalone.ts');
-  const telegramChild = spawn('npx', ['tsx', telegramScript, instanceTag], {
-    cwd: ROOT,
-    stdio: ['ignore', 'inherit', 'inherit'],
-    env: { ...process.env },
-  });
-  services.push(telegramChild);
-  console.log(`[forge] Telegram bot started (pid: ${telegramChild.pid})`);
-
-  // Workspace daemon
-  const workspaceScript = join(ROOT, 'lib', 'workspace-standalone.ts');
-  const workspaceChild = spawn('npx', ['tsx', workspaceScript, instanceTag], {
-    cwd: ROOT,
-    stdio: ['ignore', 'inherit', 'inherit'],
-    env: { ...process.env },
-  });
-  services.push(workspaceChild);
-  console.log(`[forge] Workspace daemon started (pid: ${workspaceChild.pid})`);
+  spawnService('Terminal server', join(ROOT, 'lib', 'terminal-standalone.ts'));
+  spawnService('Telegram bot',    join(ROOT, 'lib', 'telegram-standalone.ts'));
+  spawnService('Workspace daemon', join(ROOT, 'lib', 'workspace-standalone.ts'));
 
-  // Track all child PIDs for clean shutdown
   const childPids = services.map(c => c.pid).filter(Boolean);
   savePids(childPids);
 }
@@ -426,8 +425,9 @@ function startBackground() {
   protectedPids.add(String(child.pid));
   child.unref();
 
-  // Start services in background too (cleanupOrphans will skip protectedPids)
-  startServices();
+  // Start services in background too — detached so closing the launcher's
+  // shell can't take the daemons (and all attached browser terminals) down.
+  startServices(true);
 
   console.log(`[forge] Started in background (pid ${child.pid})`);
   if (!getArg('--port')) {

package/components/SettingsModal.tsx

@@ -1099,7 +1099,7 @@ function AgentsSection({ settings, setSettings }: { settings: any; setSettings:
   const [showAdd, setShowAdd] = useState(false);
   const cliDefaults: Record<string, any> = {
     'claude-code': { taskFlags: '-p --verbose --output-format stream-json --dangerously-skip-permissions', resumeFlag: '-c', outputFormat: 'stream-json', skipPermissionsFlag: '--dangerously-skip-permissions' },
-    'codex': { taskFlags: '', resumeFlag: '', outputFormat: 'text', skipPermissionsFlag: '--full-auto' },
+    'codex': { taskFlags: '', resumeFlag: '', outputFormat: 'text', skipPermissionsFlag: '--dangerously-bypass-approvals-and-sandbox' },
     'aider': { taskFlags: '--message', resumeFlag: '', outputFormat: 'text', skipPermissionsFlag: '--yes' },
     'generic': { taskFlags: '', resumeFlag: '', outputFormat: 'text', skipPermissionsFlag: '' },
   };
@@ -1422,7 +1422,7 @@ function AgentsSection({ settings, setSettings }: { settings: any; setSettings:
                     <div className="flex gap-1 mt-1">
                       {[
                         { label: 'Claude', flag: '--dangerously-skip-permissions' },
-                        { label: 'Codex', flag: '--full-auto' },
+                        { label: 'Codex', flag: '--dangerously-bypass-approvals-and-sandbox' },
                         { label: 'Aider', flag: '--yes' },
                       ].map(p => (
                         <button key={p.label} onClick={() => updateAgent(a.id, 'skipPermissionsFlag', p.flag)}

package/components/TerminalLauncher.tsx

@@ -308,6 +308,7 @@ export interface WorkspaceTerminalInfo {
   tmuxSession: string | null;
   cliCmd?: string;
   cliType?: string;
+  skipPermissionsFlag?: string;
   supportsSession?: boolean;
 }
 
@@ -332,6 +333,7 @@ export async function resolveWorkspaceTerminal(
       tmuxSession: data.tmuxSession || null,
       cliCmd: data.cliCmd,
       cliType: data.cliType,
+      skipPermissionsFlag: data.skipPermissionsFlag,
       supportsSession: data.supportsSession ?? true,
     };
   } catch {
@@ -346,7 +348,7 @@ export async function resolveWorkspaceTerminal(
 export async function resolveWorkspaceAgentInfo(
   workspaceId: string,
   agentId: string,
-): Promise<{ cliCmd?: string; cliType?: string; env?: Record<string, string>; model?: string; supportsSession?: boolean }> {
+): Promise<{ cliCmd?: string; cliType?: string; skipPermissionsFlag?: string; env?: Record<string, string>; model?: string; supportsSession?: boolean }> {
   try {
     const res = await fetch(`/api/workspace/${workspaceId}/smith`, {
       method: 'POST',

package/components/WorkspaceView.tsx

@@ -2119,7 +2119,7 @@ function fireSmithBell(label: string, status: 'done' | 'failed') {
 }
 
 // ─── Terminal Dock (right side panel with tabs) ──────────
-type TerminalEntry = { agentId: string; label: string; icon: string; cliId: string; cliCmd?: string; cliType?: string; workDir?: string; tmuxSession?: string; sessionName: string; resumeMode?: boolean; resumeSessionId?: string; profileEnv?: Record<string, string> };
+type TerminalEntry = { agentId: string; label: string; icon: string; cliId: string; cliCmd?: string; cliType?: string; skipPermissionsFlag?: string; workDir?: string; tmuxSession?: string; sessionName: string; resumeMode?: boolean; resumeSessionId?: string; profileEnv?: Record<string, string>; skipPermissions?: boolean };
 
 function TerminalDock({ terminals, projectPath, workspaceId, onSessionReady, onClose }: {
   terminals: TerminalEntry[];
@@ -2192,12 +2192,14 @@ function TerminalDock({ terminals, projectPath, workspaceId, onSessionReady, onC
               agentCliId={active.cliId}
               cliCmd={active.cliCmd}
               cliType={active.cliType}
+              skipPermissionsFlag={active.skipPermissionsFlag}
               workDir={active.workDir}
               preferredSessionName={active.sessionName}
               existingSession={active.tmuxSession}
               resumeMode={active.resumeMode}
               resumeSessionId={active.resumeSessionId}
               profileEnv={active.profileEnv}
+              skipPermissions={active.skipPermissions}
               onSessionReady={(name) => onSessionReady(active.agentId, name)}
             />
           </div>
@@ -2208,13 +2210,14 @@ function TerminalDock({ terminals, projectPath, workspaceId, onSessionReady, onC
 }
 
 // ─── Inline Terminal (no drag/resize, fills parent) ──────
-function FloatingTerminalInline({ agentLabel, agentIcon, projectPath, agentCliId, cliCmd: cliCmdProp, cliType, workDir, preferredSessionName, existingSession, resumeMode, resumeSessionId, profileEnv, isPrimary, skipPermissions, boundSessionId, onSessionReady }: {
+function FloatingTerminalInline({ agentLabel, agentIcon, projectPath, agentCliId, cliCmd: cliCmdProp, cliType, skipPermissionsFlag, workDir, preferredSessionName, existingSession, resumeMode, resumeSessionId, profileEnv, isPrimary, skipPermissions, boundSessionId, onSessionReady }: {
   agentLabel: string;
   agentIcon: string;
   projectPath: string;
   agentCliId: string;
   cliCmd?: string;
   cliType?: string;
+  skipPermissionsFlag?: string;
   workDir?: string;
   preferredSessionName?: string;
   existingSession?: string;
@@ -2306,7 +2309,8 @@ function FloatingTerminalInline({ agentLabel, agentIcon, projectPath, agentCliId
               const resumeFlag = isClaude && resumeId ? ` --resume ${resumeId}` : '';
               let mcpFlag = '';
               if (isClaude) { try { const { getMcpFlag } = await import('@/lib/session-utils'); mcpFlag = await getMcpFlag(projectPath); } catch {} }
-              const sf = skipPermissions ? (cliType === 'codex' ? ' --full-auto' : cliType === 'aider' ? ' --yes' : ' --dangerously-skip-permissions') : '';
+              const defaultSkipFlag = cliType === 'codex' ? ' --dangerously-bypass-approvals-and-sandbox' : cliType === 'aider' ? ' --yes' : ' --dangerously-skip-permissions';
+              const sf = skipPermissions ? ` ${skipPermissionsFlag || defaultSkipFlag.trim()}` : '';
               commands.push(`${cdCmd} && ${cli}${resumeFlag}${modelFlag}${sf}${mcpFlag}`);
               commands.forEach((cmd, i) => {
                 setTimeout(() => {
@@ -2335,13 +2339,14 @@ function FloatingTerminalInline({ agentLabel, agentIcon, projectPath, agentCliId
   return <div ref={containerRef} className="w-full h-full" style={{ background: '#0d1117' }} />;
 }
 
-function FloatingTerminal({ agentLabel, agentIcon, projectPath, agentCliId, cliCmd: cliCmdProp, cliType, workDir, preferredSessionName, existingSession, resumeMode, resumeSessionId, profileEnv, isPrimary, skipPermissions, persistentSession, boundSessionId, initialPos, docked, onSessionReady, onClose }: {
+function FloatingTerminal({ agentLabel, agentIcon, projectPath, agentCliId, cliCmd: cliCmdProp, cliType, skipPermissionsFlag, workDir, preferredSessionName, existingSession, resumeMode, resumeSessionId, profileEnv, isPrimary, skipPermissions, persistentSession, boundSessionId, initialPos, docked, onSessionReady, onClose }: {
   agentLabel: string;
   agentIcon: string;
   projectPath: string;
   agentCliId: string;
   cliCmd?: string;               // resolved CLI binary (claude/codex/aider)
   cliType?: string;              // claude-code/codex/aider/generic
+  skipPermissionsFlag?: string;
   workDir?: string;
   preferredSessionName?: string;
   existingSession?: string;
@@ -2555,7 +2560,8 @@ function FloatingTerminal({ agentLabel, agentIcon, projectPath, agentCliId, cliC
             const resumeFlag = isClaude && resumeId ? ` --resume ${resumeId}` : '';
             let mcpFlag = '';
             if (isClaude) { try { const { getMcpFlag } = await import('@/lib/session-utils'); mcpFlag = await getMcpFlag(projectPath); } catch {} }
-            const sf = skipPermissions ? (cliType === 'codex' ? ' --full-auto' : cliType === 'aider' ? ' --yes' : ' --dangerously-skip-permissions') : '';
+            const defaultSkipFlag = cliType === 'codex' ? ' --dangerously-bypass-approvals-and-sandbox' : cliType === 'aider' ? ' --yes' : ' --dangerously-skip-permissions';
+            const sf = skipPermissions ? ` ${skipPermissionsFlag || defaultSkipFlag.trim()}` : '';
             commands.push(`${cdCmd} && ${cli}${resumeFlag}${modelFlag}${sf}${mcpFlag}`);
 
             // Send each command with delay between them
@@ -3569,8 +3575,8 @@ function WorkspaceViewInner({ projectPath, projectName, onClose }: {
     setMascotTheme(t);
     if (typeof window !== 'undefined') localStorage.setItem('forge.mascotTheme', t);
   };
-  const [floatingTerminals, setFloatingTerminals] = useState<{ agentId: string; label: string; icon: string; cliId: string; cliCmd?: string; cliType?: string; workDir?: string; tmuxSession?: string; sessionName: string; resumeMode?: boolean; resumeSessionId?: string; profileEnv?: Record<string, string>; isPrimary?: boolean; skipPermissions?: boolean; persistentSession?: boolean; boundSessionId?: string; initialPos?: { x: number; y: number } }[]>([]);
-  const [termPicker, setTermPicker] = useState<{ agent: AgentConfig; sessName: string; workDir?: string; supportsSession?: boolean; currentSessionId: string | null; initialPos?: { x: number; y: number } } | null>(null);
+  const [floatingTerminals, setFloatingTerminals] = useState<{ agentId: string; label: string; icon: string; cliId: string; cliCmd?: string; cliType?: string; skipPermissionsFlag?: string; workDir?: string; tmuxSession?: string; sessionName: string; resumeMode?: boolean; resumeSessionId?: string; profileEnv?: Record<string, string>; isPrimary?: boolean; skipPermissions?: boolean; persistentSession?: boolean; boundSessionId?: string; initialPos?: { x: number; y: number } }[]>([]);
+  const [termPicker, setTermPicker] = useState<{ agent: AgentConfig; sessName: string; workDir?: string; supportsSession?: boolean; skipPermissionsFlag?: string; currentSessionId: string | null; initialPos?: { x: number; y: number } } | null>(null);
   // Terminal layout: floating (draggable windows) or docked (fixed grid at bottom)
   const [terminalLayout, setTerminalLayout] = useState<'floating' | 'docked'>(() => {
     if (typeof window === 'undefined') return 'floating';
@@ -3783,7 +3789,7 @@ function WorkspaceViewInner({ projectPath, projectName, onClose }: {
               // All agents: show picker (current session / new session / other sessions)
               const resolveRes = await wsApi(workspaceId, 'open_terminal', { agentId: agent.id, resolveOnly: true }).catch(() => ({})) as any;
               const currentSessionId = resolveRes?.currentSessionId ?? null;
-              setTermPicker({ agent, sessName, workDir, supportsSession: resolveRes?.supportsSession ?? true, currentSessionId, initialPos });
+              setTermPicker({ agent, sessName, workDir, supportsSession: resolveRes?.supportsSession ?? true, skipPermissionsFlag: resolveRes?.skipPermissionsFlag, currentSessionId, initialPos });
             },
             onSaveAsTemplate: async () => {
               const name = prompt('Template name:', agent.label);
@@ -3811,7 +3817,7 @@ function WorkspaceViewInner({ projectPath, projectName, onClose }: {
               const workDir = agent.workDir && agent.workDir !== './' && agent.workDir !== '.' ? agent.workDir : undefined;
               const resolveRes = await wsApi(workspaceId, 'open_terminal', { agentId: agent.id, resolveOnly: true }).catch(() => ({})) as any;
               const currentSessionId = resolveRes?.currentSessionId ?? null;
-              setTermPicker({ agent, sessName, workDir, supportsSession: resolveRes?.supportsSession ?? true, currentSessionId, initialPos });
+              setTermPicker({ agent, sessName, workDir, supportsSession: resolveRes?.supportsSession ?? true, skipPermissionsFlag: resolveRes?.skipPermissionsFlag, currentSessionId, initialPos });
             },
           } satisfies AgentNodeData,
         };
@@ -4247,7 +4253,7 @@ function WorkspaceViewInner({ projectPath, projectName, onClose }: {
             const tmux = res?.tmuxSession || sessName;
             setFloatingTerminals(prev => [...prev, {
               agentId: agent.id, label: agent.label, icon: agent.icon,
-              cliId: agent.agentId || 'claude', workDir,
+              cliId: agent.agentId || 'claude', cliCmd: res?.cliCmd, cliType: res?.cliType, skipPermissionsFlag: res?.skipPermissionsFlag || termPicker.skipPermissionsFlag, workDir,
               tmuxSession: tmux, sessionName: sessName,
               isPrimary: agent.primary, skipPermissions: agent.skipPermissions !== false,
               persistentSession: agent.persistentSession, boundSessionId, initialPos: pickerInitialPos,
@@ -4267,6 +4273,7 @@ function WorkspaceViewInner({ projectPath, projectName, onClose }: {
           agentCliId={ft.cliId}
           cliCmd={ft.cliCmd}
           cliType={ft.cliType}
+          skipPermissionsFlag={ft.skipPermissionsFlag}
           workDir={ft.workDir}
           preferredSessionName={ft.sessionName}
           existingSession={ft.tmuxSession}
@@ -4325,6 +4332,7 @@ function WorkspaceViewInner({ projectPath, projectName, onClose }: {
                 agentCliId={ft.cliId}
                 cliCmd={ft.cliCmd}
                 cliType={ft.cliType}
+                skipPermissionsFlag={ft.skipPermissionsFlag}
                 workDir={ft.workDir}
                 preferredSessionName={ft.sessionName}
                 existingSession={ft.tmuxSession}

package/lib/agents/index.ts

@@ -3,6 +3,7 @@
  * Agents coexist (not mutually exclusive). Each entry point can select any agent.
  */
 
+import { execFileSync } from 'node:child_process';
 import { loadSettings } from '../settings';
 import type { AgentAdapter, AgentConfig, AgentId } from './types';
 import { createClaudeAdapter, detectClaude } from './claude-adapter';
@@ -13,6 +14,38 @@ export type { AgentAdapter, AgentConfig, AgentId } from './types';
 // Module-level cache
 const adapterCache = new Map<AgentId, AgentAdapter>();
 
+/** Probe the installed codex CLI's `--help` and return whichever
+ *  "skip all approvals / sandbox" flag it actually accepts.
+ *
+ *  - Modern codex: `--dangerously-bypass-approvals-and-sandbox`
+ *  - Legacy codex: `--full-auto`
+ *
+ *  If neither shows up, default to the modern flag so users can still override
+ *  the value in settings.yaml if a future CLI renames it again.
+ */
+const codexSkipFlagCache = new Map<string, string>();
+export function probeCodexSkipFlag(binary = 'codex'): string {
+  const cached = codexSkipFlagCache.get(binary);
+  if (cached) return cached;
+
+  let help = '';
+  try {
+    help = execFileSync(binary, ['--help'], { encoding: 'utf-8', timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'] });
+  } catch {
+    // `--help` might exit non-zero on some versions — also try without args.
+    try { help = execFileSync(binary, [], { encoding: 'utf-8', timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'] }); } catch {}
+  }
+
+  const flag = help.includes('--dangerously-bypass-approvals-and-sandbox')
+    ? '--dangerously-bypass-approvals-and-sandbox'
+    : help.includes('--full-auto')
+      ? '--full-auto'
+      : '--dangerously-bypass-approvals-and-sandbox';
+
+  codexSkipFlagCache.set(binary, flag);
+  return flag;
+}
+
 /** Get all configured agents */
 export function listAgents(): AgentConfig[] {
   const settings = loadSettings();
@@ -30,7 +63,7 @@ export function listAgents(): AgentConfig[] {
   const codex = detectAgent('codex', 'OpenAI Codex', codexConfig?.path || 'codex', ['exec']);
   if (codex) {
     codex.capabilities.requiresTTY = false; // exec subcommand is non-interactive
-    agents.push({ ...codex, enabled: codexConfig?.enabled !== false, detected: true, skipPermissionsFlag: codexConfig?.skipPermissionsFlag || '--full-auto', cliType: 'codex' } as any);
+    agents.push({ ...codex, enabled: codexConfig?.enabled !== false, detected: true, skipPermissionsFlag: codexConfig?.skipPermissionsFlag || probeCodexSkipFlag(codexConfig?.path || 'codex'), cliType: 'codex' } as any);
   }
 
   // Aider
@@ -193,6 +226,7 @@ export interface TerminalLaunchInfo {
   cliType: string;             // claude-code, codex, aider, generic
   supportsSession: boolean;    // has session files to resume
   resumeFlag: string;          // -c, --resume, etc.
+  skipPermissionsFlag?: string; // --dangerously-skip-permissions (claude), version-detected for codex, --yes (aider)
   env?: Record<string, string>; // profile env vars to export
   model?: string;              // profile model override (--model flag)
 }
@@ -208,13 +242,16 @@ export function resolveTerminalLaunch(agentId?: string): TerminalLaunchInfo {
     || (agentId === 'codex' ? 'codex' : agentId === 'aider' ? 'aider' : 'claude-code');
 
   // Determine CLI command and capabilities from cliType
-  const cliMap: Record<string, { cmd: string; session: boolean; resume: string }> = {
-    'claude-code': { cmd: 'claude', session: true, resume: '--resume' },
-    'codex': { cmd: 'codex', session: false, resume: '' },
-    'aider': { cmd: 'aider', session: false, resume: '' },
-    'generic': { cmd: agentCfg.path || agentId || 'claude', session: false, resume: '' },
+  const cliMap: Record<string, { cmd: string; session: boolean; resume: string; skip: string }> = {
+    'claude-code': { cmd: 'claude', session: true, resume: '--resume', skip: '--dangerously-skip-permissions' },
+    'codex': { cmd: 'codex', session: false, resume: '', skip: '' },
+    'aider': { cmd: 'aider', session: false, resume: '', skip: '--yes' },
+    'generic': { cmd: agentCfg.path || agentId || 'claude', session: false, resume: '', skip: '' },
   };
   const cli = cliMap[cliType] || cliMap['claude-code'];
+  const skipPermissionsFlag = agentCfg.skipPermissionsFlag
+    || (cliType === 'codex' ? probeCodexSkipFlag(agentCfg.path || 'codex') : cli.skip)
+    || undefined;
 
   // Resolve env/model: either from this agent's own profile fields, or from linked profile
   let env: Record<string, string> | undefined;
@@ -239,6 +276,7 @@ export function resolveTerminalLaunch(agentId?: string): TerminalLaunchInfo {
     cliType,
     supportsSession: cli.session,
     resumeFlag: agentCfg.resumeFlag || cli.resume,
+    skipPermissionsFlag,
     env,
     model,
   };

package/lib/agents/types.ts

@@ -22,7 +22,7 @@ export interface AgentConfig {
   flags?: string[];         // extra CLI flags
   capabilities: AgentCapabilities;
   version?: string;
-  skipPermissionsFlag?: string; // e.g., "--dangerously-skip-permissions", "--full-auto"
+  skipPermissionsFlag?: string; // e.g., "--dangerously-skip-permissions" (claude), "--dangerously-bypass-approvals-and-sandbox" (codex), "--yes" (aider)
   // Profile fields
   base?: string;             // base agent ID — makes this a profile
   isProfile?: boolean;       // true if this is a profile (not a base agent)

package/lib/help-docs/01-settings.md

@@ -61,7 +61,7 @@ The `cliType` field determines how Forge interacts with the agent:
 | CLI Type | Session Support | Resume | Skip Permissions |
 |----------|----------------|--------|------------------|
 | `claude-code` | Yes (session files) | `-c` / `--resume <id>` | `--dangerously-skip-permissions` |
-| `codex` | No | — | `--full-auto` |
+| `codex` | No | — | `--dangerously-bypass-approvals-and-sandbox` |
 | `aider` | No | — | `--yes` |
 | `generic` | No | — | — |
 
@@ -81,7 +81,7 @@ agents:
     enabled: true
     cliType: codex
     requiresTTY: true
-    skipPermissionsFlag: --full-auto
+    skipPermissionsFlag: --dangerously-bypass-approvals-and-sandbox
 ```
 
 ## Agent Profiles

package/lib/help-docs/10-troubleshooting.md

@@ -2,12 +2,20 @@
 
 ## Common Issues
 
-### "fork failed: Device not configured" (macOS)
-PTY device limit exhausted:
+### "fork failed: Device not configured" / "posix_spawnp failed" (macOS)
+Symptom: after the server has been running for a long time, opening a new terminal fails with `Failed to create tmux session: posix_spawnp failed`.
+
+Forge ≥ 0.5.46 auto-recovers by killing idle sessions on PTY exhaustion (both random-name and fixed-name `create` paths go through the same recovery). On older versions, or if the macOS PTY pool is genuinely too small, raise the limit:
 ```bash
 sudo sysctl kern.tty.ptmx_max=2048
 echo 'kern.tty.ptmx_max=2048' | sudo tee -a /etc/sysctl.conf
 ```
+Manual cleanup if needed:
+```bash
+tmux list-sessions
+tmux kill-session -t <name>      # kill specific
+tmux kill-server                  # nuclear option — kills ALL tmux sessions
+```
 
 ### Session cookie invalid after restart
 Fix AUTH_SECRET so it persists:

package/lib/terminal-standalone.ts

@@ -116,12 +116,63 @@ function getDefaultCwd(): string {
   return homedir();
 }
 
+/** Recognize the "system out of pty / process slots" family of errors. */
+function isPtyExhaustedError(e: any): boolean {
+  const msg = e?.stderr?.toString() || e?.message || '';
+  return /posix_spawn|fork failed|EAGAIN|EMFILE|ENFILE|No such file/.test(msg);
+}
+
+/** Aggressive last-resort cleanup when posix_spawn fails: kill every session
+ *  with no live WebSocket client, regardless of whether it's "attached" from
+ *  tmux's POV or appears in saved layout. Saved layout will rebuild lost
+ *  sessions on the next user reconnect. Workspace agent sessions
+ *  (`mw-forge-*`) are still preserved — orchestrator owns those. */
+function reapIdleForPtyRecovery(): number {
+  const all = listTmuxSessions();
+  let killed = 0;
+  for (const s of all) {
+    if (s.name.startsWith(`${SESSION_PREFIX}forge-`)) continue;
+    if ((sessionClients.get(s.name)?.size ?? 0) > 0) continue;
+    if (killTmuxSession(s.name)) {
+      killed++;
+      console.log(`[terminal] PTY-recovery cleanup: killed "${s.name}"`);
+    }
+  }
+  return killed;
+}
+
+/** Run `tmux new-session` with auto-recovery on PTY exhaustion. Used by both
+ *  the random-name and fixed-name create paths so neither leaves the user
+ *  staring at a raw `posix_spawnp failed` error. */
+function tmuxNewSession(name: string, cols: number, rows: number, cwd: string): void {
+  const args = `${TMUX} new-session -d -s ${name} -x ${cols} -y ${rows}`;
+  const env = { ...process.env, TERM: 'xterm-256color' };
+  try {
+    execSync(args, { cwd, env });
+  } catch (e: any) {
+    if (!isPtyExhaustedError(e)) throw e;
+    console.error(`[terminal] PTY exhausted, running recovery cleanup…`);
+    const killed = reapIdleForPtyRecovery();
+    if (killed === 0) {
+      throw new Error('Failed to create terminal session: PTY devices exhausted and no idle sessions to reclaim. Try: sudo sysctl kern.tty.ptmx_max=2048');
+    }
+    try {
+      execSync(args, { cwd, env });
+    } catch (retryErr: any) {
+      if (isPtyExhaustedError(retryErr)) {
+        throw new Error('Failed to create terminal session after cleanup. PTY pool still exhausted — try: sudo sysctl kern.tty.ptmx_max=2048');
+      }
+      throw retryErr;
+    }
+  }
+}
+
 function createTmuxSession(cols: number, rows: number): string {
-  // Auto-cleanup: if too many sessions, kill the oldest idle ones
+  // Preemptive: if too many sessions, kill the oldest idle ones to stay
+  // under the soft cap (separate from PTY-exhaustion recovery).
   const existing = listTmuxSessions();
   if (existing.length >= MAX_SESSIONS) {
     const idle = existing.filter(s => !s.attached);
-    // Kill oldest idle sessions to make room
     const toKill = idle.slice(0, Math.max(1, idle.length - Math.floor(MAX_SESSIONS / 2)));
     for (const s of toKill) {
       console.log(`[terminal] Auto-cleanup: killing idle session "${s.name}"`);
@@ -131,36 +182,7 @@ function createTmuxSession(cols: number, rows: number): string {
 
   const id = Date.now().toString(36) + Math.random().toString(36).slice(2, 6);
   const name = `${SESSION_PREFIX}${id}`;
-  try {
-    execSync(`${TMUX} new-session -d -s ${name} -x ${cols} -y ${rows}`, {
-      cwd: getDefaultCwd(),
-      env: { ...process.env, TERM: 'xterm-256color' },
-    });
-  } catch (e: any) {
-    const msg = e.stderr?.toString() || e.message || '';
-    if (msg.includes('posix_spawn') || msg.includes('fork failed') || msg.includes('No such file')) {
-      // PTY exhausted — aggressive cleanup: kill ALL idle sessions
-      console.error(`[terminal] PTY exhausted, cleaning up all idle sessions...`);
-      const all = listTmuxSessions();
-      for (const s of all) {
-        if (!s.attached) {
-          killTmuxSession(s.name);
-          console.log(`[terminal] Killed idle session: ${s.name}`);
-        }
-      }
-      // Retry once
-      try {
-        execSync(`${TMUX} new-session -d -s ${name} -x ${cols} -y ${rows}`, {
-          cwd: getDefaultCwd(),
-          env: { ...process.env, TERM: 'xterm-256color' },
-        });
-      } catch {
-        throw new Error('Failed to create terminal session. PTY devices exhausted. Run: sudo sysctl kern.tty.ptmx_max=2048');
-      }
-    } else {
-      throw e;
-    }
-  }
+  tmuxNewSession(name, cols, rows, getDefaultCwd());
   // Mouse and scrollback are set in attachToTmux (always called after create)
   return name;
 }
@@ -337,10 +359,10 @@ wss.on('connection', (ws: WebSocket) => {
                 break;
               }
               name = parsed.sessionName;
-              execSync(`${TMUX} new-session -d -s ${name} -x ${cols} -y ${rows}`, {
-                cwd: homedir(),
-                env: { ...process.env, TERM: 'xterm-256color' },
-              });
+              // Goes through the same PTY-exhaustion recovery path as random-name creates,
+              // so workspace-agent reconnects and named-tab creates don't fail with raw
+              // `posix_spawnp failed` after the server has been running for a long time.
+              tmuxNewSession(name, cols, rows, homedir());
               // Mouse and scrollback are set in attachToTmux (always called after create)
             } else {
               name = createTmuxSession(cols, rows);

package/lib/workspace/orchestrator.ts

@@ -2577,6 +2577,7 @@ Silently ingest this context. Do NOT respond — await an actual task.`;
           cliCmd = info.cliCmd || 'claude';
           cliType = info.cliType || 'claude-code';
           supportsSession = info.supportsSession ?? true;
+          if (info.skipPermissionsFlag) skipPermissionsFlag = info.skipPermissionsFlag;
           const agents = listAgents();
           const agentDef = agents.find((a: any) => a.id === config.agentId);
           if (agentDef?.skipPermissionsFlag) skipPermissionsFlag = agentDef.skipPermissionsFlag;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.6.0",
+  "version": "0.6.3",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {

package/reviewer/.forge/agent-context.json

@@ -0,0 +1,6 @@
+{
+  "workspaceId": "6fc40ffc-3dfc-4e2d-bf93-c934d1996af2",
+  "agentId": "reviewer-1778546827271",
+  "agentLabel": "Reviewer",
+  "forgePort": 8403
+}