@brutalsystems/muster 0.2.1 → 0.5.0

package/README.md

@@ -66,11 +66,36 @@ piped output and `TERM=dumb` are always uncolored. JSON never includes colors.
 
 `run` accepts an optional `--` followed by runtime arguments. The normal allowlist
 is `--model` / `-m`, plus Claude's `--effort`. Unknown options, bundled short
-options, config injection and permission overrides are refused. Prompt strings
+options, config injection and raw permission overrides are refused, even with
+`allow_dangerous_flags` enabled. Use Muster's normalized permission flags. Prompt strings
 are passed as a single literal argument after the runtime's option terminator.
 
 ## Terminal lifetime
 
+Add `--open` to display the launched session in a new Terminal.app window on macOS:
+
+```sh
+muster run codex --open --prompt "Review this project" --format human
+muster run claude --open --terminal ghostty --prompt "Review this project" --format human
+muster run codex --open --terminal iterm2 --prompt "Review this project" --format human
+```
+
+MCP `run` accepts `open: true`. This requires tmux and selects it when the host
+is auto; explicit pty hosts and tasks are rejected. Detached launch remains the
+default. `--terminal auto|terminal|iterm2|ghostty` requires `--open`; omitted or
+`auto` uses Terminal.app. MCP accepts the same `terminal` values. Explicit
+choices never silently fall back. iTerm2 and Ghostty must be installed as
+`iTerm.app` or `Ghostty.app` in `/Applications` or `~/Applications`.
+The host remains tmux. Successful results include `terminal_opened: true` and
+the resolved `terminal` (a launch event, not a live window-status check).
+Closing the Terminal window leaves the session running; use `muster stop <id>`
+to stop it. Terminal.app and iTerm2 may require macOS Automation permission.
+Ghostty opens a separate app instance that exits when its last window closes;
+it uses the [Ghostty macOS launch interface](https://github.com/ghostty-org/ghostty/discussions/9221).
+iTerm2 uses its [documented scripting interface](https://iterm2.com/documentation-scripting.html).
+If the launch request to the viewer fails,
+Muster stops the launched session and returns an error.
+
 Auto-selection tries tmux, then pty. Every peer includes `host`, `capabilities`
 and `attach_hint`. Watchability is separate from the runtime's idle/busy state.
 
@@ -96,24 +121,67 @@ Missing configuration uses these defaults:
 host = "auto"
 launch_timeout_sec = 30
 max_concurrent = 4
+permissions = "deny"
 sandbox = "read-only"
 allow_dangerous_flags = false
 ```
 
 Choose `sandbox = "workspace-write"` yourself when agents should edit files.
-`danger-full-access` additionally requires `allow_dangerous_flags = true`.
+`full-access` and `permissions = "bypass"` require `allow_dangerous_flags = true`.
+The old config spelling `danger-full-access` remains accepted as an alias.
+
+Per-launch `--permissions` and `--sandbox` override these config defaults. The
+same named fields are accepted by MCP `run`. Both session and task launches
+support them:
+
+```sh
+muster run codex --permissions auto --sandbox workspace-write \
+  --prompt 'Implement the change' --format human
+muster run claude --permissions auto --sandbox workspace-write \
+  --prompt 'Implement the change' --format human
+```
+
+| Muster permissions | Codex translation | Claude Code translation |
+|---|---|---|
+| `deny` (default) | Approval policy `never` | Permission mode `dontAsk` |
+| `auto` | `--approve-for-me` | Permission mode `auto` |
+| `bypass` | Bypass approvals and sandbox | Permission mode `bypassPermissions` |
+
+`deny` refuses actions that would require approval; it does not prohibit tools
+already allowed by the sandbox or permission rules. `auto` delegates permission
+review to the runtime and may still reject an action; it is not blanket approval.
+Auto mode requires `workspace-write` in Muster because the Codex preset selects
+that sandbox. Explicitly select it; Muster never widens a read-only request.
+Bypass requires `full-access`; combinations claiming a sandbox while bypassing
+it are refused. `deny` can be combined with any authorized sandbox setting.
+
+`full-access` disables the runtime command sandbox and requires operator-owned
+config authorization even without bypass. Muster never writes that config.
+Config defaults apply to subsequent launches; overrides apply to one launch.
+Resolved `permissions` and `sandbox` are returned in records, shown in human
+output, persisted for listing, and written in the pre-launch log. Old records
+without those fields remain readable; their settings are not guessed.
+
+The runtimes' enforcement differs: Codex reviews sandbox escalation requests;
+Claude's classifier reviews tool permission requests while its Bash sandbox is
+separate. Auto-mode availability and decisions remain subject to runtime,
+model, account, and managed policy. These fields describe Muster's resolved
+launch settings, not a continuous attestation of remote policy or user changes.
+See [Codex auto-review](https://learn.chatgpt.com/docs/sandboxing/auto-review) and
+[Claude permission modes](https://code.claude.com/docs/en/permission-modes).
+
 The concurrency cap is shared by separate CLI/MCP processes, including pending
 launches. Settings apply to both kinds; tasks are read-only by default.
 
-Codex gets an explicit sandbox and never-ask approval policy. Muster enumerates
+Codex defaults to an explicit sandbox and never-ask approval policy. Muster enumerates
 and explicitly disables inherited MCP servers, then verifies the effective
 configuration. Hooks, plugins, app connectors, automatic skill-MCP installation
 and external notifications are disabled for the child. Unknown MCP names that
 cannot be addressed safely are refused.
 
-Claude's built-in tools default to enabled. Its command sandbox is enabled,
+Claude's built-in tools default to enabled. Unless full access is selected, its command sandbox is enabled,
 requires availability, and forbids unsandboxed retries. File-writing tools and
-sandbox writes are denied in read-only mode; permissions use `dontAsk` so an
+sandbox writes are denied in read-only mode; default permissions use `dontAsk` so an
 unattended child does not auto-grant escalations. User/project settings and MCP
 servers are not inherited. Detected managed policy is refused because the CLI
 cannot prove that inline settings override it. Enterprise remote policy can

package/dist/config.js

@@ -8,8 +8,14 @@ export const configSchema = z
     host: z.enum(["auto", "tmux", "pty", "macos-terminal"]).default("auto"),
     launch_timeout_sec: z.number().finite().positive().max(600).default(30),
     max_concurrent: z.number().int().positive().max(1000).default(4),
+    permissions: z.enum(["auto", "deny", "bypass"]).default("deny"),
     sandbox: z
-        .enum(["read-only", "workspace-write", "danger-full-access"])
+        .enum([
+        "read-only",
+        "workspace-write",
+        "full-access",
+        "danger-full-access",
+    ])
         .default("read-only"),
     allow_dangerous_flags: z.boolean().default(false),
 })
@@ -25,7 +31,9 @@ export async function loadConfig(home = musterHome()) {
             throw e;
     }
     const result = configSchema.parse(value);
-    if (result.sandbox === "danger-full-access" && !result.allow_dangerous_flags)
-        throw new Error("danger-full-access requires allow_dangerous_flags in config.toml");
+    if ((["danger-full-access", "full-access"].includes(result.sandbox) ||
+        result.permissions === "bypass") &&
+        !result.allow_dangerous_flags)
+        throw new Error("full-access or bypass requires allow_dangerous_flags in config.toml");
     return result;
 }

package/dist/format.js

@@ -36,8 +36,14 @@ function recordHuman(record, color) {
     if (record.canonical_id)
         lines.push(field("Address", clean(record.canonical_id)));
     lines.push(field("Directory", clean(record.cwd)));
+    if (record.permissions)
+        lines.push(field("Permissions", clean(record.permissions)));
+    if (record.sandbox)
+        lines.push(field("Sandbox", clean(record.sandbox)));
     if (record.host)
         lines.push(field("Host", `${clean(record.host)}${record.host === "pty" ? " (not watchable or attachable)" : ""}`));
+    if (record.terminal_opened)
+        lines.push(field("Terminal", `${record.terminal === "ghostty" ? "Ghostty" : record.terminal === "iterm2" ? "iTerm2" : "Terminal.app"} (opened at launch)`));
     if (record.exit_code !== undefined)
         lines.push(field("Exit code", badExit ? paint(clean(record.exit_code), 31) : clean(record.exit_code)));
     if (record.signal)

package/dist/guard.js

@@ -13,28 +13,32 @@ export const runSchema = z
         .transform((s) => resolve(s)),
     kind: z.enum(["session", "task"]).default("session"),
     host: z.enum(["auto", "tmux", "pty", "macos-terminal"]).optional(),
+    open: z.boolean().optional(),
+    terminal: z.enum(["auto", "terminal", "iterm2", "ghostty"]).optional(),
+    permissions: z.enum(["auto", "deny", "bypass"]).optional(),
+    sandbox: z.enum(["read-only", "workspace-write", "full-access"]).optional(),
     args: z.array(z.string()).default([]),
 })
     .strict();
-const danger = new Set([
-    "--dangerously-skip-permissions",
-    "--dangerously-bypass-approvals-and-sandbox",
-    "--approve-for-me",
-    "--allow-dangerously-skip-permissions",
-    "--dangerously-bypass-hook-trust",
-    "--yolo",
-    "-y",
-]);
-function extras(req, config) {
+export function resolvePermissions(req, config) {
+    const permissions = req.permissions ?? config.permissions;
+    const configuredSandbox = req.sandbox ?? config.sandbox;
+    const sandbox = configuredSandbox === "danger-full-access"
+        ? "full-access"
+        : configuredSandbox;
+    if ((permissions === "bypass" || sandbox === "full-access") &&
+        !config.allow_dangerous_flags)
+        throw new Error("bypass or full-access requires allow_dangerous_flags=true in config.toml");
+    if (permissions === "auto" && sandbox !== "workspace-write")
+        throw new Error("--permissions auto requires --sandbox workspace-write; no sandbox is widened automatically");
+    if (permissions === "bypass" && sandbox !== "full-access")
+        throw new Error("--permissions bypass requires --sandbox full-access");
+    return { permissions, sandbox };
+}
+function extras(req) {
     const result = [];
     for (let i = 0; i < req.args.length; i++) {
         const arg = req.args[i], flag = arg.split("=")[0].toLowerCase().replaceAll("_", "-");
-        if (danger.has(flag)) {
-            if (!config.allow_dangerous_flags)
-                throw new Error(`Dangerous flag refused: ${arg}; only config.toml can enable it`);
-            result.push(arg);
-            continue;
-        }
         if (!["--model", "-m", "--effort"].includes(flag) ||
             (flag === "--effort" && req.runtime !== "claude"))
             throw new Error(`Runtime option refused: ${arg}`);
@@ -50,30 +54,46 @@ function extras(req, config) {
     return result;
 }
 export function launchArgs(req, config) {
-    const extra = extras(req, config);
+    const extra = extras(req);
+    const policy = resolvePermissions(req, config);
     if (req.runtime === "codex")
         return [
             "codex",
             ...(req.kind === "task"
                 ? ["exec", "--ignore-user-config", "--skip-git-repo-check"]
                 : []),
-            "--sandbox",
-            config.sandbox,
-            ...(req.kind === "session" ? ["--ask-for-approval", "never"] : []),
+            ...(policy.permissions === "auto"
+                ? ["--approve-for-me"]
+                : policy.permissions === "bypass"
+                    ? ["--dangerously-bypass-approvals-and-sandbox"]
+                    : [
+                        "--sandbox",
+                        policy.sandbox === "full-access"
+                            ? "danger-full-access"
+                            : policy.sandbox,
+                        ...(req.kind === "session"
+                            ? ["--ask-for-approval", "never"]
+                            : ["-c", 'approval_policy="never"']),
+                    ]),
             ...extra,
             "--",
             req.prompt,
         ];
-    const readonly = config.sandbox === "read-only";
+    const readonly = policy.sandbox === "read-only";
+    const mode = policy.permissions === "auto"
+        ? "auto"
+        : policy.permissions === "bypass"
+            ? "bypassPermissions"
+            : "dontAsk";
     const settings = {
         disableAllHooks: true,
         permissions: {
-            defaultMode: "dontAsk",
+            defaultMode: mode,
             deny: readonly ? ["Edit", "Write", "NotebookEdit"] : [],
             additionalDirectories: [],
         },
         sandbox: {
-            enabled: config.sandbox !== "danger-full-access",
+            enabled: policy.sandbox !== "full-access",
             failIfUnavailable: true,
             autoAllowBashIfSandboxed: true,
             allowUnsandboxedCommands: false,
@@ -87,7 +107,7 @@ export function launchArgs(req, config) {
         "--tools",
         "default",
         "--permission-mode",
-        "dontAsk",
+        mode,
         "--setting-sources",
         "",
         "--strict-mcp-config",

package/dist/hosts/terminal.js

@@ -0,0 +1,92 @@
+import { access, realpath } from "node:fs/promises";
+import { homedir } from "node:os";
+import { constants } from "node:fs";
+import { delimiter, join } from "node:path";
+import { command } from "../identity/processes.js";
+export async function terminalAvailable(platform = process.platform, terminal = "terminal") {
+    if (platform !== "darwin")
+        return false;
+    try {
+        if (terminal === "terminal") {
+            await access("/System/Applications/Utilities/Terminal.app");
+        }
+        else {
+            const name = terminal === "ghostty" ? "Ghostty.app" : "iTerm.app";
+            const found = await Promise.all(["/Applications", join(homedir(), "Applications")].map(async (dir) => {
+                try {
+                    await access(join(dir, name));
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            }));
+            if (!found.some(Boolean))
+                return false;
+        }
+        await access(terminal === "ghostty" ? "/usr/bin/open" : "/usr/bin/osascript", constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function tmuxExecutable() {
+    for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+        if (!dir)
+            continue;
+        const path = join(dir, "tmux");
+        try {
+            await access(path, constants.X_OK);
+            return await realpath(path);
+        }
+        catch { }
+    }
+    throw new Error("Cannot locate tmux executable for terminal viewer");
+}
+export async function openTerminal(tmux, server, hostRef, deadline, terminal = "terminal") {
+    if (!/^[a-zA-Z0-9_-]+$/.test(server) || !/^@\d+$/.test(hostRef))
+        throw new Error("Invalid tmux terminal target");
+    if (Date.now() >= deadline)
+        throw new Error("Launch deadline expired before opening terminal");
+    const timeout = Math.max(1, Math.min(10000, deadline - Date.now()));
+    if (terminal === "ghostty") {
+        await command("/usr/bin/open", [
+            "-na",
+            "Ghostty",
+            "--args",
+            "--quit-after-last-window-closed=true",
+            "-e",
+            tmux,
+            "-L",
+            server,
+            "attach-session",
+            "-t",
+            "muster",
+            ";",
+            "select-window",
+            "-t",
+            hostRef,
+        ], timeout);
+        return;
+    }
+    const quoted = "'" + tmux.replaceAll("'", "'\\''") + "'";
+    const shellCommand = `${quoted} -L ${server} attach-session -t muster \\; select-window -t ${hostRef}`;
+    await command("/usr/bin/osascript", [
+        "-e",
+        terminal === "iterm2"
+            ? `on run argv
+  tell application "iTerm"
+    create window with default profile command (item 1 of argv)
+    activate
+  end tell
+end run`
+            : `on run argv
+  tell application "Terminal"
+    activate
+    do script (item 1 of argv)
+  end tell
+end run`,
+        shellCommand,
+    ], timeout);
+}

package/dist/hosts/tmux.js

@@ -3,6 +3,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { command, processRef, stopTree } from "../identity/processes.js";
+import { terminalAvailable, tmuxExecutable, openTerminal } from "./terminal.js";
 export class TmuxHost {
     server;
     id = "tmux";
@@ -23,6 +24,12 @@ export class TmuxHost {
             return false;
         }
     }
+    openAvailable(terminal = "terminal") {
+        return terminalAvailable(process.platform, terminal);
+    }
+    async open(hostRef, deadline, terminal = "terminal") {
+        await openTerminal(await tmuxExecutable(), this.server, hostRef, deadline, terminal);
+    }
     capabilities() {
         return { watchable: true, attachable: true, survivesParentExit: true };
     }

package/dist/identity/codex.js

@@ -5,7 +5,7 @@ import { readdir, realpath } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { command, descendants } from "./processes.js";
-export async function resolveCodex(root, env, deadline) {
+export async function resolveCodex(root, env, deadline, isDirectCli) {
     const family = new Set(await descendants(root, deadline));
     let dir = join(env.CODEX_HOME ?? join(env.HOME ?? homedir(), ".codex"), "thread-writer-locks");
     try {
@@ -46,8 +46,18 @@ export async function resolveCodex(root, env, deadline) {
                 matches.set(path.slice(dir.length + 1, -5), pid);
         }
     }
-    if (matches.size > 1)
-        throw new Error("Multiple Codex writer locks held by launched descendants");
-    const first = [...matches][0];
+    let candidates = [...matches];
+    if (candidates.length > 1 && isDirectCli) {
+        // Auto-review owns internal threads in the same process. Inspect only
+        // identities already tied to our descendants; never diff global sessions.
+        const selected = [];
+        for (const candidate of candidates)
+            if (await isDirectCli(candidate[0]))
+                selected.push(candidate);
+        candidates = selected;
+    }
+    if (candidates.length > 1)
+        throw new Error("Multiple Codex CLI writer locks held by launched descendants");
+    const first = candidates[0];
     return first ? { id: first[0], pid: first[1] } : undefined;
 }

package/dist/muster.js

@@ -13,13 +13,16 @@ const listSchema = z
     .strict();
 const idSchema = z.object({ id: z.string().min(1) }).strict();
 const help = `Usage:
-  muster run <codex|claude> --prompt TEXT [--cwd DIR] [--kind session|task] [--host ID] [-- RUNTIME_OPTIONS]
+  muster run <codex|claude> --prompt TEXT [--cwd DIR] [--kind session|task] [--host ID] [--open] [--terminal APP] [-- RUNTIME_OPTIONS]
   muster list [--kind session|task] [--format json|human]
   muster stop <id> [--format json|human]
   muster output <id>
   muster mcp
 
-run also accepts --format json|human before -- RUNTIME_OPTIONS.
+run also accepts --format json|human, --permissions auto|deny|bypass,
+and --sandbox read-only|workspace-write|full-access before -- RUNTIME_OPTIONS.
+--open displays a tmux session on macOS. --terminal accepts auto (Terminal.app),
+terminal, iterm2, or ghostty, and requires --open.
 run, list and stop default to JSON. output prints raw task text.
 
 pty launches print their record and keep this process running. Ctrl-C stops the
@@ -51,7 +54,7 @@ async function main() {
             });
         });
     if (mcp) {
-        const server = new Server({ name: "muster", version: "0.2.1" }, { capabilities: { tools: {} } });
+        const server = new Server({ name: "muster", version: "0.5.0" }, { capabilities: { tools: {} } });
         server.setRequestHandler(ListToolsRequestSchema, async () => ({
             tools: [
                 {
@@ -72,6 +75,25 @@ async function main() {
                                 type: "string",
                                 enum: ["auto", "tmux", "pty", "macos-terminal"],
                             },
+                            open: {
+                                type: "boolean",
+                                description: "Open the tmux session in a terminal viewer (macOS only).",
+                            },
+                            terminal: {
+                                type: "string",
+                                enum: ["auto", "terminal", "iterm2", "ghostty"],
+                                description: "Viewer app; requires open. Auto uses Terminal.app.",
+                            },
+                            permissions: {
+                                type: "string",
+                                enum: ["auto", "deny", "bypass"],
+                                description: "Defaults to config (deny). Auto requires workspace-write; bypass requires authorized full-access.",
+                            },
+                            sandbox: {
+                                type: "string",
+                                enum: ["read-only", "workspace-write", "full-access"],
+                                description: "Defaults to config (read-only). Full access requires config authorization.",
+                            },
                             args: { type: "array", items: { type: "string" } },
                         },
                         required: ["runtime", "prompt"],
@@ -153,7 +175,11 @@ async function main() {
                 cwd: { type: "string" },
                 kind: { type: "string" },
                 host: { type: "string" },
+                open: { type: "boolean" },
+                terminal: { type: "string" },
                 format: { type: "string" },
+                permissions: { type: "string" },
+                sandbox: { type: "string" },
             },
         });
         const { format = "json", ...values } = parsed;

package/dist/run.js

@@ -4,7 +4,7 @@ import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { loadConfig } from "./config.js";
-import { runSchema, launchArgs, launchEnv } from "./guard.js";
+import { runSchema, launchArgs, launchEnv, resolvePermissions, } from "./guard.js";
 import { Registry } from "./registry.js";
 import { LaunchLog } from "./log.js";
 import { hosts, selectHost } from "./hosts/index.js";
@@ -52,13 +52,24 @@ export class Muster {
             throw new Error("cwd is not a directory");
         if (req.kind === "task" && req.host)
             throw new Error("host applies only to session launches");
+        if (req.terminal && !req.open)
+            throw new Error("--terminal requires --open");
+        const terminal = !req.terminal || req.terminal === "auto" ? "terminal" : req.terminal;
+        const requestedHost = req.host ?? this.config.host;
+        if (req.open &&
+            (req.kind !== "session" || !["auto", "tmux"].includes(requestedHost)))
+            throw new Error("--open requires a tmux session on macOS");
+        const permissions = resolvePermissions(req, this.config);
         const argv = launchArgs(req, this.config), driver = req.kind === "session"
-            ? await selectHost(req.host ?? this.config.host, this.drivers)
+            ? await selectHost(req.open ? "tmux" : requestedHost, this.drivers)
             : undefined;
+        if (req.open &&
+            (!driver?.open || !(await driver.openAvailable?.(terminal))))
+            throw new Error(`--open requires the selected terminal (${terminal}) installed on macOS and tmux`);
         let policy = [];
         if (req.runtime === "claude")
             await assertClaudePolicy(this.env);
-        const reservation = await this.registry.reserve(req, this.config.max_concurrent);
+        const reservation = await this.registry.reserve({ runtime: req.runtime, kind: req.kind, cwd: req.cwd, ...permissions }, this.config.max_concurrent);
         this.owned.add(reservation.launchId);
         let entry = reservation;
         const startedAt = Date.now();
@@ -74,7 +85,9 @@ export class Muster {
                 prompt: req.prompt,
                 host: driver?.id ?? null,
                 requester,
+                ...(req.open ? { open: true, terminal } : {}),
                 args: req.args,
+                ...permissions,
             });
             if (req.runtime === "codex") {
                 policy = await codexPolicyArgs(this.env, req.cwd, deadline);
@@ -121,9 +134,21 @@ export class Muster {
                     throw new Error("Launch cancelled: Muster is closing");
                 if (!(await isSame(root)))
                     throw new Error(`process exited at ${((Date.now() - startedAt) / 1000).toFixed(2)}s`);
+                let openingTerminal = false;
                 try {
                     const identity = req.runtime === "codex"
-                        ? await resolveCodex(root.pid, this.env, deadline)
+                        ? await resolveCodex(root.pid, this.env, deadline, async (id) => {
+                            try {
+                                const { thread } = await rpc.call("thread/read", { threadId: id }, deadline);
+                                return (thread?.id === id &&
+                                    thread.source === "cli" &&
+                                    thread.ephemeral !== true &&
+                                    thread.canAcceptDirectInput !== false);
+                            }
+                            catch {
+                                return false;
+                            }
+                        })
                         : await resolveClaude(root.pid, this.env, deadline);
                     if (identity) {
                         diagnostic =
@@ -149,6 +174,7 @@ export class Muster {
                         ])[0];
                         const peer = {
                             kind: "session",
+                            ...permissions,
                             name: named.display,
                             canonical_id: named.canonicalId,
                             runtime,
@@ -162,6 +188,12 @@ export class Muster {
                             capabilities: driver.capabilities(),
                             attach_hint: driver.attachHint(launched.hostRef),
                         };
+                        if (req.open) {
+                            openingTerminal = true;
+                            await driver.open(launched.hostRef, deadline, terminal);
+                            peer.terminal_opened = true;
+                            peer.terminal = terminal;
+                        }
                         entry = await this.registry.update(entry.launchId, {
                             id: identity.id,
                             status: "running",
@@ -176,6 +208,8 @@ export class Muster {
                     }
                 }
                 catch (e) {
+                    if (openingTerminal)
+                        throw e;
                     if (Date.now() < deadline)
                         diagnostic = e.message;
                 }
@@ -237,6 +271,8 @@ export class Muster {
             child.unref();
             const handle = {
                 kind: "task",
+                permissions: entry.permissions,
+                sandbox: entry.sandbox,
                 id: entry.id,
                 runtime: entry.runtime,
                 state: "running",
@@ -364,6 +400,9 @@ export class Muster {
                 result.push({
                     ...e.peer,
                     kind: "session",
+                    ...(e.permissions
+                        ? { permissions: e.permissions, sandbox: e.sandbox }
+                        : {}),
                     id: e.id,
                     runtime: e.peer?.runtime ?? e.runtime,
                     state: e.status === "running" ? (e.peer?.state ?? "idle") : e.status,
@@ -378,6 +417,9 @@ export class Muster {
                 catch { }
                 result.push({
                     kind: "task",
+                    ...(e.permissions
+                        ? { permissions: e.permissions, sandbox: e.sandbox }
+                        : {}),
                     id: e.id,
                     runtime: e.runtime,
                     cwd: e.cwd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/muster",
-  "version": "0.2.1",
+  "version": "0.5.0",
   "description": "Launch instructed, reachable local agent sessions",
   "type": "module",
   "engines": {