@brutalsystems/muster 0.2.0 → 0.4.0

package/README.md

@@ -58,13 +58,36 @@ still returns JSON. Put Muster options before any `-- RUNTIME_OPTIONS`.
 `output` always prints captured task text and does not accept `--format`.
 MCP tools retain their existing JSON responses.
 
+Human output uses subtle colors in interactive terminals: green for idle or
+running, yellow for busy or starting, gray for ended states and field labels,
+red for failures or nonzero exit codes, and cyan for follow-up commands. IDs
+and paths retain the normal text color. Set `NO_COLOR=1` to disable colors;
+piped output and `TERM=dumb` are always uncolored. JSON never includes colors.
+
 `run` accepts an optional `--` followed by runtime arguments. The normal allowlist
 is `--model` / `-m`, plus Claude's `--effort`. Unknown options, bundled short
-options, config injection and permission overrides are refused. Prompt strings
+options, config injection and raw permission overrides are refused, even with
+`allow_dangerous_flags` enabled. Use Muster's normalized permission flags. Prompt strings
 are passed as a single literal argument after the runtime's option terminator.
 
 ## Terminal lifetime
 
+Add `--open` to display the launched session in a new Terminal.app window on macOS:
+
+```sh
+muster run codex --open --prompt "Review this project" --format human
+muster run claude --open --prompt "Review this project" --format human
+```
+
+MCP `run` accepts `open: true`. This requires tmux and selects it when the host
+is auto; explicit pty hosts and tasks are rejected. Detached launch remains the
+default. Terminal.app is currently the only supported viewer; there is no
+`--terminal` selection yet. The host remains tmux, and successful results include
+`terminal_opened: true` (a launch event, not a live window-status check).
+Closing the Terminal window leaves the session running; use `muster stop <id>`
+to stop it. macOS may require Terminal automation permission. If opening fails,
+Muster stops the launched session and returns an error.
+
 Auto-selection tries tmux, then pty. Every peer includes `host`, `capabilities`
 and `attach_hint`. Watchability is separate from the runtime's idle/busy state.
 
@@ -90,24 +113,67 @@ Missing configuration uses these defaults:
 host = "auto"
 launch_timeout_sec = 30
 max_concurrent = 4
+permissions = "deny"
 sandbox = "read-only"
 allow_dangerous_flags = false
 ```
 
 Choose `sandbox = "workspace-write"` yourself when agents should edit files.
-`danger-full-access` additionally requires `allow_dangerous_flags = true`.
+`full-access` and `permissions = "bypass"` require `allow_dangerous_flags = true`.
+The old config spelling `danger-full-access` remains accepted as an alias.
+
+Per-launch `--permissions` and `--sandbox` override these config defaults. The
+same named fields are accepted by MCP `run`. Both session and task launches
+support them:
+
+```sh
+muster run codex --permissions auto --sandbox workspace-write \
+  --prompt 'Implement the change' --format human
+muster run claude --permissions auto --sandbox workspace-write \
+  --prompt 'Implement the change' --format human
+```
+
+| Muster permissions | Codex translation | Claude Code translation |
+|---|---|---|
+| `deny` (default) | Approval policy `never` | Permission mode `dontAsk` |
+| `auto` | `--approve-for-me` | Permission mode `auto` |
+| `bypass` | Bypass approvals and sandbox | Permission mode `bypassPermissions` |
+
+`deny` refuses actions that would require approval; it does not prohibit tools
+already allowed by the sandbox or permission rules. `auto` delegates permission
+review to the runtime and may still reject an action; it is not blanket approval.
+Auto mode requires `workspace-write` in Muster because the Codex preset selects
+that sandbox. Explicitly select it; Muster never widens a read-only request.
+Bypass requires `full-access`; combinations claiming a sandbox while bypassing
+it are refused. `deny` can be combined with any authorized sandbox setting.
+
+`full-access` disables the runtime command sandbox and requires operator-owned
+config authorization even without bypass. Muster never writes that config.
+Config defaults apply to subsequent launches; overrides apply to one launch.
+Resolved `permissions` and `sandbox` are returned in records, shown in human
+output, persisted for listing, and written in the pre-launch log. Old records
+without those fields remain readable; their settings are not guessed.
+
+The runtimes' enforcement differs: Codex reviews sandbox escalation requests;
+Claude's classifier reviews tool permission requests while its Bash sandbox is
+separate. Auto-mode availability and decisions remain subject to runtime,
+model, account, and managed policy. These fields describe Muster's resolved
+launch settings, not a continuous attestation of remote policy or user changes.
+See [Codex auto-review](https://learn.chatgpt.com/docs/sandboxing/auto-review) and
+[Claude permission modes](https://code.claude.com/docs/en/permission-modes).
+
 The concurrency cap is shared by separate CLI/MCP processes, including pending
 launches. Settings apply to both kinds; tasks are read-only by default.
 
-Codex gets an explicit sandbox and never-ask approval policy. Muster enumerates
+Codex defaults to an explicit sandbox and never-ask approval policy. Muster enumerates
 and explicitly disables inherited MCP servers, then verifies the effective
 configuration. Hooks, plugins, app connectors, automatic skill-MCP installation
 and external notifications are disabled for the child. Unknown MCP names that
 cannot be addressed safely are refused.
 
-Claude's built-in tools default to enabled. Its command sandbox is enabled,
+Claude's built-in tools default to enabled. Unless full access is selected, its command sandbox is enabled,
 requires availability, and forbids unsandboxed retries. File-writing tools and
-sandbox writes are denied in read-only mode; permissions use `dontAsk` so an
+sandbox writes are denied in read-only mode; default permissions use `dontAsk` so an
 unattended child does not auto-grant escalations. User/project settings and MCP
 servers are not inherited. Detected managed policy is refused because the CLI
 cannot prove that inline settings override it. Enterprise remote policy can

package/dist/config.js

@@ -8,8 +8,14 @@ export const configSchema = z
     host: z.enum(["auto", "tmux", "pty", "macos-terminal"]).default("auto"),
     launch_timeout_sec: z.number().finite().positive().max(600).default(30),
     max_concurrent: z.number().int().positive().max(1000).default(4),
+    permissions: z.enum(["auto", "deny", "bypass"]).default("deny"),
     sandbox: z
-        .enum(["read-only", "workspace-write", "danger-full-access"])
+        .enum([
+        "read-only",
+        "workspace-write",
+        "full-access",
+        "danger-full-access",
+    ])
         .default("read-only"),
     allow_dangerous_flags: z.boolean().default(false),
 })
@@ -25,7 +31,9 @@ export async function loadConfig(home = musterHome()) {
             throw e;
     }
     const result = configSchema.parse(value);
-    if (result.sandbox === "danger-full-access" && !result.allow_dangerous_flags)
-        throw new Error("danger-full-access requires allow_dangerous_flags in config.toml");
+    if ((["danger-full-access", "full-access"].includes(result.sandbox) ||
+        result.permissions === "bypass") &&
+        !result.allow_dangerous_flags)
+        throw new Error("full-access or bypass requires allow_dangerous_flags in config.toml");
     return result;
 }

package/dist/format.js

@@ -12,38 +12,57 @@ function argument(value) {
         ? value
         : "'" + value.replaceAll("'", "'\\''") + "'";
 }
-function recordHuman(record) {
+export function humanColorEnabled(isTTY, env) {
+    return isTTY === true && env.NO_COLOR === undefined && env.TERM !== "dumb";
+}
+function recordHuman(record, color) {
+    const paint = (value, code) => color ? `\u001b[${code}m${value}\u001b[0m` : value;
+    const field = (label, value) => `  ${paint(label + ":", 90)} ${value}`;
+    const badExit = typeof record.exit_code === "number" && record.exit_code !== 0;
+    const stateColor = record.state === "failed" || badExit
+        ? 31
+        : ["idle", "running"].includes(record.state ?? "")
+            ? 32
+            : ["busy", "starting"].includes(record.state ?? "")
+                ? 33
+                : 90;
     const id = record.id ?? record.thread_id ?? record.session_id;
     if (record.stopped === true)
-        return `Stopped ${clean(id)}.`;
+        return `${paint("Stopped", 90)} ${clean(id)}.`;
     const lines = [
-        `${clean(record.runtime)} · ${clean(record.kind)} · ${clean(record.state)}`,
-        `  ID: ${clean(id)}`,
+        `${clean(record.runtime)} · ${clean(record.kind)} · ${paint(clean(record.state), stateColor)}`,
+        field("ID", clean(id)),
     ];
     if (record.canonical_id)
-        lines.push(`  Address: ${clean(record.canonical_id)}`);
-    lines.push(`  Directory: ${clean(record.cwd)}`);
+        lines.push(field("Address", clean(record.canonical_id)));
+    lines.push(field("Directory", clean(record.cwd)));
+    if (record.permissions)
+        lines.push(field("Permissions", clean(record.permissions)));
+    if (record.sandbox)
+        lines.push(field("Sandbox", clean(record.sandbox)));
     if (record.host)
-        lines.push(`  Host: ${clean(record.host)}${record.host === "pty" ? " (not watchable or attachable)" : ""}`);
+        lines.push(field("Host", `${clean(record.host)}${record.host === "pty" ? " (not watchable or attachable)" : ""}`));
+    if (record.terminal_opened)
+        lines.push(field("Terminal", "Terminal.app (opened at launch)"));
     if (record.exit_code !== undefined)
-        lines.push(`  Exit code: ${clean(record.exit_code)}`);
+        lines.push(field("Exit code", badExit ? paint(clean(record.exit_code), 31) : clean(record.exit_code)));
     if (record.signal)
-        lines.push(`  Signal: ${clean(record.signal)}`);
+        lines.push(field("Signal", clean(record.signal)));
     if (record.error)
-        lines.push(`  Error: ${clean(record.error)}`);
+        lines.push(field("Error", paint(clean(record.error), 31)));
     const live = ["starting", "running", "idle", "busy"].includes(record.state ?? "");
     if (live && record.attach_hint)
-        lines.push(`  Attach: ${clean(record.attach_hint)}`);
+        lines.push(field("Attach", paint(clean(record.attach_hint), 36)));
     if (record.kind === "task" && id)
-        lines.push(`  Output: muster output ${argument(clean(id))}`);
+        lines.push(field("Output", paint(`muster output ${argument(clean(id))}`, 36)));
     if (live && id)
-        lines.push(`  Stop: muster stop ${argument(clean(id))}`);
+        lines.push(field("Stop", paint(`muster stop ${argument(clean(id))}`, 36)));
     return lines.join("\n");
 }
-export function formatHuman(value) {
+export function formatHuman(value, color = false) {
     if (Array.isArray(value))
         return value.length
-            ? value.map(recordHuman).join("\n\n") + "\n"
+            ? value.map((record) => recordHuman(record, color)).join("\n\n") + "\n"
             : "No Muster runs.\n";
-    return recordHuman(value) + "\n";
+    return recordHuman(value, color) + "\n";
 }

package/dist/guard.js

@@ -13,28 +13,31 @@ export const runSchema = z
         .transform((s) => resolve(s)),
     kind: z.enum(["session", "task"]).default("session"),
     host: z.enum(["auto", "tmux", "pty", "macos-terminal"]).optional(),
+    open: z.boolean().optional(),
+    permissions: z.enum(["auto", "deny", "bypass"]).optional(),
+    sandbox: z.enum(["read-only", "workspace-write", "full-access"]).optional(),
     args: z.array(z.string()).default([]),
 })
     .strict();
-const danger = new Set([
-    "--dangerously-skip-permissions",
-    "--dangerously-bypass-approvals-and-sandbox",
-    "--approve-for-me",
-    "--allow-dangerously-skip-permissions",
-    "--dangerously-bypass-hook-trust",
-    "--yolo",
-    "-y",
-]);
-function extras(req, config) {
+export function resolvePermissions(req, config) {
+    const permissions = req.permissions ?? config.permissions;
+    const configuredSandbox = req.sandbox ?? config.sandbox;
+    const sandbox = configuredSandbox === "danger-full-access"
+        ? "full-access"
+        : configuredSandbox;
+    if ((permissions === "bypass" || sandbox === "full-access") &&
+        !config.allow_dangerous_flags)
+        throw new Error("bypass or full-access requires allow_dangerous_flags=true in config.toml");
+    if (permissions === "auto" && sandbox !== "workspace-write")
+        throw new Error("--permissions auto requires --sandbox workspace-write; no sandbox is widened automatically");
+    if (permissions === "bypass" && sandbox !== "full-access")
+        throw new Error("--permissions bypass requires --sandbox full-access");
+    return { permissions, sandbox };
+}
+function extras(req) {
     const result = [];
     for (let i = 0; i < req.args.length; i++) {
         const arg = req.args[i], flag = arg.split("=")[0].toLowerCase().replaceAll("_", "-");
-        if (danger.has(flag)) {
-            if (!config.allow_dangerous_flags)
-                throw new Error(`Dangerous flag refused: ${arg}; only config.toml can enable it`);
-            result.push(arg);
-            continue;
-        }
         if (!["--model", "-m", "--effort"].includes(flag) ||
             (flag === "--effort" && req.runtime !== "claude"))
             throw new Error(`Runtime option refused: ${arg}`);
@@ -50,30 +53,46 @@ function extras(req, config) {
     return result;
 }
 export function launchArgs(req, config) {
-    const extra = extras(req, config);
+    const extra = extras(req);
+    const policy = resolvePermissions(req, config);
     if (req.runtime === "codex")
         return [
             "codex",
             ...(req.kind === "task"
                 ? ["exec", "--ignore-user-config", "--skip-git-repo-check"]
                 : []),
-            "--sandbox",
-            config.sandbox,
-            ...(req.kind === "session" ? ["--ask-for-approval", "never"] : []),
+            ...(policy.permissions === "auto"
+                ? ["--approve-for-me"]
+                : policy.permissions === "bypass"
+                    ? ["--dangerously-bypass-approvals-and-sandbox"]
+                    : [
+                        "--sandbox",
+                        policy.sandbox === "full-access"
+                            ? "danger-full-access"
+                            : policy.sandbox,
+                        ...(req.kind === "session"
+                            ? ["--ask-for-approval", "never"]
+                            : ["-c", 'approval_policy="never"']),
+                    ]),
             ...extra,
             "--",
             req.prompt,
         ];
-    const readonly = config.sandbox === "read-only";
+    const readonly = policy.sandbox === "read-only";
+    const mode = policy.permissions === "auto"
+        ? "auto"
+        : policy.permissions === "bypass"
+            ? "bypassPermissions"
+            : "dontAsk";
     const settings = {
         disableAllHooks: true,
         permissions: {
-            defaultMode: "dontAsk",
+            defaultMode: mode,
             deny: readonly ? ["Edit", "Write", "NotebookEdit"] : [],
             additionalDirectories: [],
         },
         sandbox: {
-            enabled: config.sandbox !== "danger-full-access",
+            enabled: policy.sandbox !== "full-access",
             failIfUnavailable: true,
             autoAllowBashIfSandboxed: true,
             allowUnsandboxedCommands: false,
@@ -87,7 +106,7 @@ export function launchArgs(req, config) {
         "--tools",
         "default",
         "--permission-mode",
-        "dontAsk",
+        mode,
         "--setting-sources",
         "",
         "--strict-mcp-config",

package/dist/hosts/terminal.js

@@ -0,0 +1,47 @@
+import { access, realpath } from "node:fs/promises";
+import { constants } from "node:fs";
+import { delimiter, join } from "node:path";
+import { command } from "../identity/processes.js";
+export async function terminalAvailable(platform = process.platform) {
+    if (platform !== "darwin")
+        return false;
+    try {
+        await access("/System/Applications/Utilities/Terminal.app");
+        await access("/usr/bin/osascript", constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function tmuxExecutable() {
+    for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+        if (!dir)
+            continue;
+        const path = join(dir, "tmux");
+        try {
+            await access(path, constants.X_OK);
+            return await realpath(path);
+        }
+        catch { }
+    }
+    throw new Error("Cannot locate tmux executable for Terminal.app");
+}
+export async function openTerminal(tmux, server, hostRef, deadline) {
+    if (!/^[a-zA-Z0-9_-]+$/.test(server) || !/^@\d+$/.test(hostRef))
+        throw new Error("Invalid tmux terminal target");
+    if (Date.now() >= deadline)
+        throw new Error("Launch deadline expired before opening Terminal.app");
+    const quoted = "'" + tmux.replaceAll("'", "'\\''") + "'";
+    const shellCommand = `${quoted} -L ${server} attach-session -t muster \\; select-window -t ${hostRef}`;
+    await command("/usr/bin/osascript", [
+        "-e",
+        `on run argv
+  tell application "Terminal"
+    activate
+    do script (item 1 of argv)
+  end tell
+end run`,
+        shellCommand,
+    ], Math.max(1, Math.min(10000, deadline - Date.now())));
+}

package/dist/hosts/tmux.js

@@ -3,6 +3,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { command, processRef, stopTree } from "../identity/processes.js";
+import { terminalAvailable, tmuxExecutable, openTerminal } from "./terminal.js";
 export class TmuxHost {
     server;
     id = "tmux";
@@ -23,6 +24,12 @@ export class TmuxHost {
             return false;
         }
     }
+    openAvailable() {
+        return terminalAvailable();
+    }
+    async open(hostRef, deadline) {
+        await openTerminal(await tmuxExecutable(), this.server, hostRef, deadline);
+    }
     capabilities() {
         return { watchable: true, attachable: true, survivesParentExit: true };
     }

package/dist/identity/codex.js

@@ -5,7 +5,7 @@ import { readdir, realpath } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { command, descendants } from "./processes.js";
-export async function resolveCodex(root, env, deadline) {
+export async function resolveCodex(root, env, deadline, isDirectCli) {
     const family = new Set(await descendants(root, deadline));
     let dir = join(env.CODEX_HOME ?? join(env.HOME ?? homedir(), ".codex"), "thread-writer-locks");
     try {
@@ -46,8 +46,18 @@ export async function resolveCodex(root, env, deadline) {
                 matches.set(path.slice(dir.length + 1, -5), pid);
         }
     }
-    if (matches.size > 1)
-        throw new Error("Multiple Codex writer locks held by launched descendants");
-    const first = [...matches][0];
+    let candidates = [...matches];
+    if (candidates.length > 1 && isDirectCli) {
+        // Auto-review owns internal threads in the same process. Inspect only
+        // identities already tied to our descendants; never diff global sessions.
+        const selected = [];
+        for (const candidate of candidates)
+            if (await isDirectCli(candidate[0]))
+                selected.push(candidate);
+        candidates = selected;
+    }
+    if (candidates.length > 1)
+        throw new Error("Multiple Codex CLI writer locks held by launched descendants");
+    const first = candidates[0];
     return first ? { id: first[0], pid: first[1] } : undefined;
 }

package/dist/muster.js

@@ -7,19 +7,21 @@ import { z } from "zod";
 import { Muster } from "./run.js";
 import { runSchema } from "./guard.js";
 import { delay } from "./identity/processes.js";
-import { formatHuman } from "./format.js";
+import { formatHuman, humanColorEnabled } from "./format.js";
 const listSchema = z
     .object({ kind: z.enum(["session", "task"]).optional() })
     .strict();
 const idSchema = z.object({ id: z.string().min(1) }).strict();
 const help = `Usage:
-  muster run <codex|claude> --prompt TEXT [--cwd DIR] [--kind session|task] [--host ID] [-- RUNTIME_OPTIONS]
+  muster run <codex|claude> --prompt TEXT [--cwd DIR] [--kind session|task] [--host ID] [--open] [-- RUNTIME_OPTIONS]
   muster list [--kind session|task] [--format json|human]
   muster stop <id> [--format json|human]
   muster output <id>
   muster mcp
 
-run also accepts --format json|human before -- RUNTIME_OPTIONS.
+run also accepts --format json|human, --permissions auto|deny|bypass,
+and --sandbox read-only|workspace-write|full-access before -- RUNTIME_OPTIONS.
+--open displays a tmux session in Terminal.app on macOS.
 run, list and stop default to JSON. output prints raw task text.
 
 pty launches print their record and keep this process running. Ctrl-C stops the
@@ -51,7 +53,7 @@ async function main() {
             });
         });
     if (mcp) {
-        const server = new Server({ name: "muster", version: "0.2.0" }, { capabilities: { tools: {} } });
+        const server = new Server({ name: "muster", version: "0.4.0" }, { capabilities: { tools: {} } });
         server.setRequestHandler(ListToolsRequestSchema, async () => ({
             tools: [
                 {
@@ -72,6 +74,20 @@ async function main() {
                                 type: "string",
                                 enum: ["auto", "tmux", "pty", "macos-terminal"],
                             },
+                            open: {
+                                type: "boolean",
+                                description: "Open the tmux session in Terminal.app (macOS only).",
+                            },
+                            permissions: {
+                                type: "string",
+                                enum: ["auto", "deny", "bypass"],
+                                description: "Defaults to config (deny). Auto requires workspace-write; bypass requires authorized full-access.",
+                            },
+                            sandbox: {
+                                type: "string",
+                                enum: ["read-only", "workspace-write", "full-access"],
+                                description: "Defaults to config (read-only). Full access requires config authorization.",
+                            },
                             args: { type: "array", items: { type: "string" } },
                         },
                         required: ["runtime", "prompt"],
@@ -153,7 +169,10 @@ async function main() {
                 cwd: { type: "string" },
                 kind: { type: "string" },
                 host: { type: "string" },
+                open: { type: "boolean" },
                 format: { type: "string" },
+                permissions: { type: "string" },
+                sandbox: { type: "string" },
             },
         });
         const { format = "json", ...values } = parsed;
@@ -161,7 +180,9 @@ async function main() {
             throw new Error("format must be json or human");
         if (command === "output" && parsed.format !== undefined)
             throw new Error("output prints raw task text; --format applies to run, list and stop");
-        const print = (value) => process.stdout.write(format === "human" ? formatHuman(value) : JSON.stringify(value) + "\n");
+        const print = (value) => process.stdout.write(format === "human"
+            ? formatHuman(value, humanColorEnabled(process.stdout.isTTY, process.env))
+            : JSON.stringify(value) + "\n");
         if (command === "run") {
             const runtime = positionals[0];
             const args = positionals.slice(1);

package/dist/run.js

@@ -4,7 +4,7 @@ import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { loadConfig } from "./config.js";
-import { runSchema, launchArgs, launchEnv } from "./guard.js";
+import { runSchema, launchArgs, launchEnv, resolvePermissions, } from "./guard.js";
 import { Registry } from "./registry.js";
 import { LaunchLog } from "./log.js";
 import { hosts, selectHost } from "./hosts/index.js";
@@ -52,13 +52,20 @@ export class Muster {
             throw new Error("cwd is not a directory");
         if (req.kind === "task" && req.host)
             throw new Error("host applies only to session launches");
+        const requestedHost = req.host ?? this.config.host;
+        if (req.open &&
+            (req.kind !== "session" || !["auto", "tmux"].includes(requestedHost)))
+            throw new Error("--open requires a tmux session on macOS");
+        const permissions = resolvePermissions(req, this.config);
         const argv = launchArgs(req, this.config), driver = req.kind === "session"
-            ? await selectHost(req.host ?? this.config.host, this.drivers)
+            ? await selectHost(req.open ? "tmux" : requestedHost, this.drivers)
             : undefined;
+        if (req.open && (!driver?.open || !(await driver.openAvailable?.())))
+            throw new Error("--open requires Terminal.app on macOS and tmux");
         let policy = [];
         if (req.runtime === "claude")
             await assertClaudePolicy(this.env);
-        const reservation = await this.registry.reserve(req, this.config.max_concurrent);
+        const reservation = await this.registry.reserve({ runtime: req.runtime, kind: req.kind, cwd: req.cwd, ...permissions }, this.config.max_concurrent);
         this.owned.add(reservation.launchId);
         let entry = reservation;
         const startedAt = Date.now();
@@ -74,7 +81,9 @@ export class Muster {
                 prompt: req.prompt,
                 host: driver?.id ?? null,
                 requester,
+                ...(req.open ? { open: true } : {}),
                 args: req.args,
+                ...permissions,
             });
             if (req.runtime === "codex") {
                 policy = await codexPolicyArgs(this.env, req.cwd, deadline);
@@ -121,9 +130,21 @@ export class Muster {
                     throw new Error("Launch cancelled: Muster is closing");
                 if (!(await isSame(root)))
                     throw new Error(`process exited at ${((Date.now() - startedAt) / 1000).toFixed(2)}s`);
+                let openingTerminal = false;
                 try {
                     const identity = req.runtime === "codex"
-                        ? await resolveCodex(root.pid, this.env, deadline)
+                        ? await resolveCodex(root.pid, this.env, deadline, async (id) => {
+                            try {
+                                const { thread } = await rpc.call("thread/read", { threadId: id }, deadline);
+                                return (thread?.id === id &&
+                                    thread.source === "cli" &&
+                                    thread.ephemeral !== true &&
+                                    thread.canAcceptDirectInput !== false);
+                            }
+                            catch {
+                                return false;
+                            }
+                        })
                         : await resolveClaude(root.pid, this.env, deadline);
                     if (identity) {
                         diagnostic =
@@ -149,6 +170,7 @@ export class Muster {
                         ])[0];
                         const peer = {
                             kind: "session",
+                            ...permissions,
                             name: named.display,
                             canonical_id: named.canonicalId,
                             runtime,
@@ -162,6 +184,11 @@ export class Muster {
                             capabilities: driver.capabilities(),
                             attach_hint: driver.attachHint(launched.hostRef),
                         };
+                        if (req.open) {
+                            openingTerminal = true;
+                            await driver.open(launched.hostRef, deadline);
+                            peer.terminal_opened = true;
+                        }
                         entry = await this.registry.update(entry.launchId, {
                             id: identity.id,
                             status: "running",
@@ -176,6 +203,8 @@ export class Muster {
                     }
                 }
                 catch (e) {
+                    if (openingTerminal)
+                        throw e;
                     if (Date.now() < deadline)
                         diagnostic = e.message;
                 }
@@ -237,6 +266,8 @@ export class Muster {
             child.unref();
             const handle = {
                 kind: "task",
+                permissions: entry.permissions,
+                sandbox: entry.sandbox,
                 id: entry.id,
                 runtime: entry.runtime,
                 state: "running",
@@ -364,6 +395,9 @@ export class Muster {
                 result.push({
                     ...e.peer,
                     kind: "session",
+                    ...(e.permissions
+                        ? { permissions: e.permissions, sandbox: e.sandbox }
+                        : {}),
                     id: e.id,
                     runtime: e.peer?.runtime ?? e.runtime,
                     state: e.status === "running" ? (e.peer?.state ?? "idle") : e.status,
@@ -378,6 +412,9 @@ export class Muster {
                 catch { }
                 result.push({
                     kind: "task",
+                    ...(e.permissions
+                        ? { permissions: e.permissions, sandbox: e.sandbox }
+                        : {}),
                     id: e.id,
                     runtime: e.runtime,
                     cwd: e.cwd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/muster",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Launch instructed, reachable local agent sessions",
   "type": "module",
   "engines": {