@brutalsystems/muster 0.5.0 → 0.7.0

package/CONTRACT_PROVENANCE.md

@@ -38,6 +38,75 @@ with the keys `slugify`, `suffix`, `assign`, `resolve` in that order is:
 `a92936ef4b713641d29da3fbafccab0e6da79a54e27bfea3c6a779e801a925b3`.
 Both revisions produce this hash.
 
+## Privacy remediation edit — 2026-09-20
+
+`test/fixtures/canonical-id.json` originally copied a real internal project
+codename as an example `rawName`/`display`/`canonicalId` value. Tin Can made
+the same change to its own copy and asked Muster to match; both projects
+renamed the same two example strings to a neutral placeholder
+(`billing-api`).
+
+This is a **local text edit to the frozen 0.1.0 copy**, not a re-sync with
+Tin Can's current upstream fixture. By the time of this edit, Tin Can's
+fixture had moved to `tincan_version: 0.5.2` and gained real new content —
+`opencode` suffix rules, new fixture cases, and new `CANONICAL_ID.md`
+sections describing opencode session-id behavior. Muster's OpenCode
+integration explicitly defers Tin Can/address-format work (see
+`RELEASE_NOTES.md`), so adopting that upstream fixture wholesale would claim
+verification Muster does not have. Per this document's own earlier
+guidance — "their full-file hashes ... must not be compared to an entire
+newer upstream fixture to infer a format change" — only the two leaked
+strings were changed; every other byte of the 0.1.0-vintage fixture is
+unchanged, including its 31 cases and `tincan_version: 0.1.0`.
+
+New hash after this edit:
+
+| File | SHA-256 |
+| --- | --- |
+| `test/fixtures/canonical-id.json` | `974cef9e06370a562cef588f1cd6d5c1d83b49afdb64808487759d6280bffff2` |
+
+`CANONICAL_ID.md`'s hash is unchanged (`8cf4312d6af1c4d85ec0641d8739bec261be2feb35dd16bdd9d8be2b89551915`)
+— the codename never appeared there.
+
+Adopting Tin Can's opencode naming rules, if Muster's OpenCode/Tin Can
+integration is ever un-deferred, is a separate, deliberate compatibility
+check — not something this edit performs.
+
+The `at commit fbaaea5842fd4a5c86849d7f51c8e16b8683b058` provenance line
+above may no longer resolve in Tin Can's current history: Tin Can applied
+the same codename remediation via a history rewrite (`git filter-repo
+--replace-text`, force-pushed), which changes the hash of every commit
+whose content or ancestry it touched. This is a historical acquisition
+record, not a claim that the commit is still reachable.
+
+## Contract baseline moved to 0.5.2 — 2026-09-20
+
+`@brutalsystems/tincan@0.2.0`, this document's verified baseline, was
+withdrawn from the npm registry as part of Tin Can's own codename
+remediation (every version through 0.5.1 carried the same leaked string
+0.7.0's fixture did, in Tin Can's README and fixture). Withdrawn version
+numbers cannot be republished. This is a **registry availability problem,
+not a format change** — Tin Can diffed `src/naming.ts` between 0.2.0 and
+0.5.2 and found `slugify`, `suffixOf`, `assignNames`, and `resolvePeer`
+byte-identical; the only source change is the `RuntimeName` union widening
+to add `'opencode'`. `test/fixtures/canonical-id.json` gained new opencode
+cases with every pre-existing expectation unchanged.
+
+Muster's own contract suite was run against a real installed
+`@brutalsystems/tincan@0.5.2` and passed all four cases before this
+re-baseline was made.
+
+`0.3.0` through `0.5.1` were never verified by Muster's contract suite (see
+"Upgrade boundary" below) and have also been withdrawn from the registry.
+The verified, currently-available set is exactly `{0.5.2}`.
+
+One caveat for anyone reconstructing a baseline from Tin Can's git history
+rather than a published artifact: Tin Can's git tags predating 2026-09-20
+no longer match what npm ever served at that version number, because the
+history-rewrite in the section above applies retroactively to every commit,
+tagged ones included. Git content at an old tag is not evidence of what a
+withdrawn npm artifact actually contained.
+
 ## Upgrade boundary: listing and state
 
 The upstream release notes report that 0.3.0 expands

package/README.md

@@ -2,21 +2,24 @@
 
 [![license](https://img.shields.io/github/license/BrutalSystems/muster)](./LICENSE)
 
-Muster launches instructed Codex or Claude Code agents on this machine. A
+Muster launches instructed Codex, Claude Code, or OpenCode agents on this machine. A
 `session` returns an address only after its runtime is reachable. A `task`
 runs once, captures output, and never advertises a peer address.
 
 **Live launch verification:** Codex and Claude both launched and answered their
-initial prompts without terminal interaction. Claude requires a directory
-already trusted by the operator. The automated suite uses fake runtimes,
-not real models.
+initial prompts without terminal interaction. OpenCode 1.18.31 passed the
+loopback API and local-provider protocol checks. Claude requires a directory
+already trusted by the operator. The automated suite uses fake runtimes, not
+real models.
 
 ## Build and run locally
 
-Requires Node 22.12+ (tested with 24.16), TypeScript 5, and Codex 0.155.1 / Claude
-Code 2.1.267. Terminal drivers use tmux or node-pty. Process discovery currently
-requires a POSIX host with `ps` and `lsof`; the terminal interface itself is
-platform-neutral. The macOS Terminal driver is an unavailable v1 stub.
+Requires Node 22.12+ (tested with 24.16), TypeScript 5, Codex 0.155.1, Claude
+Code 2.1.267, and OpenCode 1.18.31 or newer. Newer OpenCode releases must retain
+the CLI and loopback HTTP API used by Muster. Terminal drivers use tmux or
+node-pty. Process discovery currently requires a POSIX host with `ps` and
+`lsof`; the terminal interface itself is platform-neutral. The macOS Terminal
+driver is an unavailable v1 stub.
 
 Before launching a Claude session, open Claude normally in the target directory
 and complete its workspace-trust review yourself, then exit that setup session.
@@ -29,7 +32,10 @@ npm ci
 npm run build
 node dist/muster.js run codex --prompt 'Review the authentication flow'
 node dist/muster.js run claude --prompt 'Summarize the project' --host tmux
+node dist/muster.js run opencode --prompt 'Review this project'
+node dist/muster.js run opencode --prompt 'Build a plan' -- --model coldfire-local/qwen3-30b-a3b
 node dist/muster.js run codex --kind task --prompt 'Explain the test layout'
+node dist/muster.js run opencode --kind task --prompt 'Summarize the tests'
 node dist/muster.js list
 node dist/muster.js list --format human
 node dist/muster.js list --kind task
@@ -64,11 +70,25 @@ red for failures or nonzero exit codes, and cyan for follow-up commands. IDs
 and paths retain the normal text color. Set `NO_COLOR=1` to disable colors;
 piped output and `TERM=dumb` are always uncolored. JSON never includes colors.
 
-`run` accepts an optional `--` followed by runtime arguments. The normal allowlist
-is `--model` / `-m`, plus Claude's `--effort`. Unknown options, bundled short
-options, config injection and raw permission overrides are refused, even with
-`allow_dangerous_flags` enabled. Use Muster's normalized permission flags. Prompt strings
-are passed as a single literal argument after the runtime's option terminator.
+`run` accepts an optional `--` followed by runtime arguments. The normal
+allowlist is `--model` / `-m`, plus Claude's `--effort` and OpenCode's `--agent`
+and `--variant`. Unknown options, bundled short options, config injection and
+raw permission overrides are refused, even with `allow_dangerous_flags`
+enabled. Use Muster's normalized permission flags. Prompt strings are always
+passed as one literal argument. Codex and Claude launches and OpenCode tasks put
+that value after `--`; OpenCode sessions use the dedicated `--prompt` value.
+
+OpenCode inherits the provider and model definitions from its normal user and
+project configuration, so configured local OpenAI-compatible providers such as
+`coldfire-local/qwen3-30b-a3b` remain available. Muster never rewrites those
+files. Put runtime options after `--`, as in the local-model example above.
+
+```sh
+muster run opencode --prompt 'Review this project'
+muster run opencode --prompt 'Build a plan' -- --model coldfire-local/qwen3-30b-a3b
+muster run opencode --kind task --prompt 'Summarize the tests'
+muster run opencode --mcp tincan --permissions auto --sandbox workspace-write --prompt 'Coordinate'
+```
 
 ## Terminal lifetime
 
@@ -77,6 +97,7 @@ Add `--open` to display the launched session in a new Terminal.app window on mac
 ```sh
 muster run codex --open --prompt "Review this project" --format human
 muster run claude --open --terminal ghostty --prompt "Review this project" --format human
+muster run opencode --open --terminal iterm2 --prompt "Review this project" --format human
 muster run codex --open --terminal iterm2 --prompt "Review this project" --format human
 ```
 
@@ -91,7 +112,10 @@ the resolved `terminal` (a launch event, not a live window-status check).
 Closing the Terminal window leaves the session running; use `muster stop <id>`
 to stop it. Terminal.app and iTerm2 may require macOS Automation permission.
 Ghostty opens a separate app instance that exits when its last window closes;
-it uses the [Ghostty macOS launch interface](https://github.com/ghostty-org/ghostty/discussions/9221).
+that instance disables saved-window restoration so previous tabs and windows
+are not duplicated. It uses the [Ghostty macOS launch interface](https://github.com/ghostty-org/ghostty/discussions/9221).
+Terminal.app creates the requested window before activation
+to avoid also opening a default shell window on startup.
 iTerm2 uses its [documented scripting interface](https://iterm2.com/documentation-scripting.html).
 If the launch request to the viewer fails,
 Muster stops the launched session and returns an error.
@@ -99,9 +123,10 @@ Muster stops the launched session and returns an error.
 Auto-selection tries tmux, then pty. Every peer includes `host`, `capabilities`
 and `attach_hint`. Watchability is separate from the runtime's idle/busy state.
 
-- **tmux:** a window in the dedicated `muster` session on the `muster` tmux
-  server. Watchable and attachable; survives the CLI or MCP server exiting.
-  Use the returned attach hint, or `tmux -L muster attach -t muster`.
+- **tmux:** each agent has its own session on the dedicated `muster` tmux
+  server. Opening or exiting one agent does not switch another agent's viewer.
+  Watchable and attachable; survives the CLI or MCP server exiting.
+  Use the returned attach hint to reconnect to that agent.
 - **pty:** not watchable or attachable. The CLI prints the peer record and stays
   running to own the terminal. Ctrl-C stops it. MCP-owned pty sessions stop when
   the MCP server disconnects. There is no persistent pty daemon.
@@ -112,6 +137,16 @@ and `attach_hint`. Watchability is separate from the runtime's idle/busy state.
 or startup failure cleans the process tree and host window, logs failure, and
 returns an error instead of a peer record.
 
+Each OpenCode session owns a separate HTTP server bound to `127.0.0.1` on a
+Muster-selected port. Muster verifies that the listener belongs to the launched
+process tree, stores its `server_url` and durable `session_id`, and never attaches
+to an existing personal OpenCode server. `list` refreshes the session through
+that endpoint; `stop` aborts it best-effort and still performs authoritative
+process-tree cleanup. The URL is local control metadata, not a public address.
+OpenCode sessions otherwise use the same tmux/pty, viewer, list, stop, and human
+output behavior described above; OpenCode tasks use the same detached output
+and exit-status lifecycle as other tasks.
+
 ## Configuration and permissions
 
 Muster reads `~/.muster/config.toml` once at startup and **never writes it**.
@@ -124,6 +159,7 @@ max_concurrent = 4
 permissions = "deny"
 sandbox = "read-only"
 allow_dangerous_flags = false
+default_mcp = []
 ```
 
 Choose `sandbox = "workspace-write"` yourself when agents should edit files.
@@ -141,11 +177,11 @@ muster run claude --permissions auto --sandbox workspace-write \
   --prompt 'Implement the change' --format human
 ```
 
-| Muster permissions | Codex translation | Claude Code translation |
-|---|---|---|
-| `deny` (default) | Approval policy `never` | Permission mode `dontAsk` |
-| `auto` | `--approve-for-me` | Permission mode `auto` |
-| `bypass` | Bypass approvals and sandbox | Permission mode `bypassPermissions` |
+| Muster permissions | Codex translation            | Claude Code translation             | OpenCode translation                                                            |
+| ------------------ | ---------------------------- | ----------------------------------- | ------------------------------------------------------------------------------- |
+| `deny` (default)   | Approval policy `never`      | Permission mode `dontAsk`           | Deny write, shell, task, external-directory, web, and unselected MCP operations |
+| `auto`             | `--approve-for-me`           | Permission mode `auto`              | `--auto` with explicit deny rules                                               |
+| `bypass`           | Bypass approvals and sandbox | Permission mode `bypassPermissions` | Allow supported operations                                                      |
 
 `deny` refuses actions that would require approval; it does not prohibit tools
 already allowed by the sandbox or permission rules. `auto` delegates permission
@@ -170,12 +206,18 @@ launch settings, not a continuous attestation of remote policy or user changes.
 See [Codex auto-review](https://learn.chatgpt.com/docs/sandboxing/auto-review) and
 [Claude permission modes](https://code.claude.com/docs/en/permission-modes).
 
+OpenCode permissions are tool policy, not an OS-level filesystem sandbox.
+Muster's read-only OpenCode policy denies editing, shell, subagent,
+external-directory, web, and MCP operations except explicitly selected MCP
+tools; it does not claim kernel-enforced isolation. Auto still requires
+`workspace-write`, and bypass still requires authorized `full-access`.
+
 The concurrency cap is shared by separate CLI/MCP processes, including pending
 launches. Settings apply to both kinds; tasks are read-only by default.
 
 Codex defaults to an explicit sandbox and never-ask approval policy. Muster enumerates
-and explicitly disables inherited MCP servers, then verifies the effective
-configuration. Hooks, plugins, app connectors, automatic skill-MCP installation
+and explicitly disables inherited MCP servers, enables only the selected
+operator definitions, then verifies the effective server selection. Hooks, plugins, app connectors, automatic skill-MCP installation
 and external notifications are disabled for the child. Unknown MCP names that
 cannot be addressed safely are refused.
 
@@ -189,9 +231,17 @@ arrive after startup; this v1 is not an enterprise policy-enforcement layer.
 Claude permissions and its command sandbox are different mechanisms; neither
 claim implies that every external tool is OS-sandboxed.
 
-These child restrictions deliberately prevent propagating spawn authority.
-Custom MCP tools—including Tin Can—are not automatically injected into the
-child. The child's runtime inbox remains reachable from an external Tin Can.
+OpenCode keeps normal provider/model configuration but launches with `--pure`,
+which disables inherited external plugins. Before launch, Muster inspects the
+effective OpenCode configuration, disables every inherited MCP server and tool
+family, enables only the selected Muster definitions, and fails closed if a
+higher-precedence managed policy prevents that isolation from being proven.
+
+These child restrictions prevent automatically propagating spawn authority.
+External tools are enabled only through the operator configuration and launch
+selection described below. Codex and Claude runtime inboxes remain reachable
+from an external Tin Can even when they have no MCP tools of their own. OpenCode
+delivery remains deferred as documented under Tin Can compatibility.
 No user-level runtime configuration is rewritten, and workspace-trust dialogs
 are never accepted automatically.
 
@@ -202,6 +252,69 @@ requester, runtime, kind and host. Registry and task outputs also live under
 closed: verify no Muster operation is running before removing that directory.
 There is no automatic time-based lock theft.
 
+## Optional tools for launched agents
+
+MCP servers are optional. Muster does not require or install Tin Can (or any
+other MCP server). Register only servers you want launched agents to use in
+`~/.muster/config.toml`. For example, to use an already-installed Tin Can:
+
+```toml
+# Optional personal defaults for sessions. Omit to keep launches MCP-free.
+default_mcp = ["tincan"]
+
+[mcp_servers.tincan]
+command = "tincan"
+tools = ["peers", "send_peer", "message_log"]
+required = false
+```
+
+Then any runtime can use it:
+
+```sh
+muster run codex --mcp tincan --prompt 'Coordinate with the other agent'
+muster run claude --mcp tincan --prompt 'Coordinate with the other agent'
+muster run opencode --mcp tincan --permissions auto --sandbox workspace-write \
+  --prompt 'Coordinate'
+muster run codex --no-mcp --prompt 'Work without external tools'
+```
+
+`--mcp NAME` is repeatable and **replaces** personal defaults. `--no-mcp` clears
+them and cannot be combined with `--mcp`. MCP `run` takes `mcp: ["tincan"]`;
+`mcp: []` disables all servers. Omitted selection uses `default_mcp` for sessions.
+Tasks have no defaults, but accept an explicit selection.
+
+Definitions support either `command` plus optional `args`, `env`, and `env_vars`
+for stdio, or `url` plus optional `bearer_token_env_var` for Streamable HTTP.
+`tools` is a required nonempty list of exact tool names. Use `env_vars` and
+`bearer_token_env_var` to reference credentials in the launch environment;
+credentials are not written to launch logs. HTTP OAuth setup shared across
+runtimes, plugin/app tools, MCP resources and prompts are outside this interface.
+Server and tool names must contain only letters, digits, underscores or hyphens.
+Relative stdio commands run from the requested working directory; prefer an
+absolute executable path or a command on PATH.
+
+Before agent launch, Muster initializes each selected server and checks its tool
+catalog. No tool is called during preflight. An explicit `--mcp` selection is
+required: a missing server, missing credential, or missing configured tool fails
+that launch. Defaults are optional unless their definition sets `required = true`;
+an unavailable optional default is skipped with `mcp_warnings`. Each preflight is
+bounded by `startup_timeout_sec` (default 10, maximum 60) and the launch deadline.
+JSON results and `list` report selected logical names in `mcp`; human output shows
+`MCP:` and any warnings. These describe launch configuration, not continuous
+server health.
+
+Codex receives isolated definitions, using a fresh runtime name when an inherited
+server has the same name, and its native tool allowlist. Claude receives a private
+Muster stdio connection that filters both tool discovery and calls; newly added
+upstream tools cannot bypass the selection. Only selected tools are preapproved.
+OpenCode disables inherited definitions and tool families in its verified
+per-launch overlay, then enables only selected definitions. It also uses
+`--pure`, so inherited plugins do not enter the child process.
+Claude connection specifications are stored with owner-only permissions under
+`~/.muster/mcp`, removed on stop, task completion, or when `list` observes an ended
+session. MCP server access is separate from filesystem sandbox permissions: a
+selected external tool may have its own write or network capabilities.
+
 ## MCP installation
 
 Installed deliberately, in the one session that should hold spawn authority —
@@ -242,6 +355,11 @@ Codex `idle` means reachable and not known to be busy, not guaranteed free.
 The querying app-server can report `notLoaded` for a live thread; Muster maps
 that to `idle`. Claude state comes from its session registry.
 
+OpenCode peers expose a durable `session_id` and loopback-only `server_url` so a
+future Tin Can adapter has a stable integration seam. Tin Can does not yet send
+to OpenCode through Muster: choosing native OpenCode messaging versus A2A, and
+updating Tin Can for that transport, are explicitly deferred follow-up work.
+
 ## Verification
 
 ```sh
@@ -261,7 +379,7 @@ For reproducible verification, install that exact release outside Muster:
 
 ```sh
 contract_dir=$(mktemp -d)
-npm install --prefix "$contract_dir" --no-save @brutalsystems/tincan@0.2.0
+npm install --prefix "$contract_dir" --no-save @brutalsystems/tincan@0.5.2
 MUSTER_TINCAN_BIN="$contract_dir/node_modules/.bin/tincan" npm run test:contract
 ```
 

package/dist/codex-policy.js

@@ -1,7 +1,9 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import TOML from "@iarna/toml";
+import { codexMcpConfig } from "./mcp.js";
 const exec = promisify(execFile);
-export async function codexPolicyArgs(env, cwd, deadline = Date.now() + 8000) {
+export async function codexPolicyArgs(env, cwd, deadline = Date.now() + 8000, selected = []) {
     const args = [
         "--disable",
         "hooks",
@@ -17,24 +19,48 @@ export async function codexPolicyArgs(env, cwd, deadline = Date.now() + 8000) {
         "notify=[]",
     ];
     async function list(extra) {
-        const { stdout } = await exec("codex", [...extra, "mcp", "list", "--json"], {
-            env,
-            cwd,
-            timeout: Math.max(1, Math.min(4000, deadline - Date.now())),
-            maxBuffer: 1024 * 1024,
-        });
-        const value = JSON.parse(stdout);
-        if (!Array.isArray(value))
+        try {
+            const { stdout } = await exec("codex", [...extra, "mcp", "list", "--json"], {
+                env,
+                cwd,
+                timeout: Math.max(1, Math.min(4000, deadline - Date.now())),
+                maxBuffer: 1024 * 1024,
+            });
+            const value = JSON.parse(stdout);
+            if (!Array.isArray(value))
+                throw new Error("Cannot verify effective Codex MCP configuration");
+            return value;
+        }
+        catch {
             throw new Error("Cannot verify effective Codex MCP configuration");
-        return value;
+        }
     }
-    for (const server of await list(args)) {
+    const inherited = await list(args);
+    const usedNames = new Set(inherited.map((s) => s.name));
+    for (const server of inherited) {
         if (typeof server.name !== "string" ||
             !/^[a-zA-Z0-9_-]+$/.test(server.name))
             throw new Error("Cannot safely disable an inherited MCP server with a non-simple name");
         args.push("-c", `mcp_servers.${server.name}.enabled=false`);
     }
-    if ((await list(args)).some((s) => s.enabled !== false))
-        throw new Error("Inherited Codex MCP servers remain enabled; refusing launch");
+    const expected = [];
+    for (const server of selected) {
+        let name = server.name;
+        let suffix = 0;
+        // Config layers merge nested maps. A fresh key prevents inherited env,
+        // credentials or per-tool policy from surviving the requested definition.
+        while (usedNames.has(name))
+            name = `muster_${server.name}_${++suffix}`;
+        usedNames.add(name);
+        expected.push(name);
+        args.push("-c", `mcp_servers.${name}=${TOML.stringify.value(codexMcpConfig(server))}`);
+    }
+    const enabled = (await list(args))
+        .filter((s) => s.enabled !== false)
+        .map((s) => s.name)
+        .sort();
+    expected.sort();
+    if (JSON.stringify(enabled) !== JSON.stringify(expected))
+        throw new Error("Inherited Codex MCP servers remain enabled or requested servers are missing; refusing launch");
     return args;
 }

package/dist/config.js

@@ -3,6 +3,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import TOML from "@iarna/toml";
 import { z } from "zod";
+import { mcpName, mcpServerSchema } from "./mcp.js";
 export const configSchema = z
     .object({
     host: z.enum(["auto", "tmux", "pty", "macos-terminal"]).default("auto"),
@@ -17,6 +18,8 @@ export const configSchema = z
         "danger-full-access",
     ])
         .default("read-only"),
+    default_mcp: z.array(mcpName).default([]),
+    mcp_servers: z.record(mcpName, mcpServerSchema).default({}),
     allow_dangerous_flags: z.boolean().default(false),
 })
     .strict();

package/dist/format.js

@@ -35,11 +35,17 @@ function recordHuman(record, color) {
     ];
     if (record.canonical_id)
         lines.push(field("Address", clean(record.canonical_id)));
+    if (record.runtime === "opencode" && record.server_url)
+        lines.push(field("Control URL", clean(record.server_url)));
     lines.push(field("Directory", clean(record.cwd)));
     if (record.permissions)
         lines.push(field("Permissions", clean(record.permissions)));
     if (record.sandbox)
         lines.push(field("Sandbox", clean(record.sandbox)));
+    if (record.mcp)
+        lines.push(field("MCP", record.mcp.length ? record.mcp.map(clean).join(", ") : "none"));
+    for (const warning of record.mcp_warnings ?? [])
+        lines.push(field("MCP warning", clean(warning)));
     if (record.host)
         lines.push(field("Host", `${clean(record.host)}${record.host === "pty" ? " (not watchable or attachable)" : ""}`));
     if (record.terminal_opened)

package/dist/guard.js

@@ -1,8 +1,9 @@
 import { z } from "zod";
 import { resolve } from "node:path";
+import { mcpName, claudeMcpConfig } from "./mcp.js";
 export const runSchema = z
     .object({
-    runtime: z.enum(["codex", "claude"]),
+    runtime: z.enum(["codex", "claude", "opencode"]),
     prompt: z
         .string()
         .refine((s) => s.trim().length > 0, "prompt must not be blank"),
@@ -17,6 +18,7 @@ export const runSchema = z
     terminal: z.enum(["auto", "terminal", "iterm2", "ghostty"]).optional(),
     permissions: z.enum(["auto", "deny", "bypass"]).optional(),
     sandbox: z.enum(["read-only", "workspace-write", "full-access"]).optional(),
+    mcp: z.array(mcpName).optional(),
     args: z.array(z.string()).default([]),
 })
     .strict();
@@ -35,12 +37,16 @@ export function resolvePermissions(req, config) {
         throw new Error("--permissions bypass requires --sandbox full-access");
     return { permissions, sandbox };
 }
-function extras(req) {
+export function runtimeArgs(req) {
     const result = [];
+    const allowed = req.runtime === "claude"
+        ? ["--model", "-m", "--effort"]
+        : req.runtime === "opencode"
+            ? ["--model", "-m", "--agent", "--variant"]
+            : ["--model", "-m"];
     for (let i = 0; i < req.args.length; i++) {
         const arg = req.args[i], flag = arg.split("=")[0].toLowerCase().replaceAll("_", "-");
-        if (!["--model", "-m", "--effort"].includes(flag) ||
-            (flag === "--effort" && req.runtime !== "claude"))
+        if (!allowed.includes(flag))
             throw new Error(`Runtime option refused: ${arg}`);
         if (arg.includes("="))
             result.push(arg);
@@ -53,8 +59,8 @@ function extras(req) {
     }
     return result;
 }
-export function launchArgs(req, config) {
-    const extra = extras(req);
+export function launchArgs(req, config, mcp = [], bridgePath) {
+    const extra = runtimeArgs(req);
     const policy = resolvePermissions(req, config);
     if (req.runtime === "codex")
         return [
@@ -89,7 +95,11 @@ export function launchArgs(req, config) {
         disableAllHooks: true,
         permissions: {
             defaultMode: mode,
-            deny: readonly ? ["Edit", "Write", "NotebookEdit"] : [],
+            allow: mcp.flatMap((s) => s.config.tools.map((t) => `mcp__${s.name}__${t}`)),
+            deny: [
+                ...(readonly ? ["Edit", "Write", "NotebookEdit"] : []),
+                ...mcp.flatMap((s) => s.excludedTools.map((t) => `mcp__${s.name}__${t}`)),
+            ],
             additionalDirectories: [],
         },
         sandbox: {
@@ -112,7 +122,7 @@ export function launchArgs(req, config) {
         "",
         "--strict-mcp-config",
         "--mcp-config",
-        '{"mcpServers":{}}',
+        JSON.stringify(claudeMcpConfig(mcp, bridgePath)),
         "--settings",
         JSON.stringify(settings),
         ...extra,

package/dist/hosts/terminal.js

@@ -56,22 +56,22 @@ export async function openTerminal(tmux, server, hostRef, deadline, terminal = "
             "Ghostty",
             "--args",
             "--quit-after-last-window-closed=true",
+            // A separate instance otherwise restores the user's saved tabs/windows.
+            "--window-save-state=never",
             "-e",
             tmux,
             "-L",
             server,
             "attach-session",
             "-t",
-            "muster",
-            ";",
-            "select-window",
-            "-t",
             hostRef,
         ], timeout);
         return;
     }
     const quoted = "'" + tmux.replaceAll("'", "'\\''") + "'";
-    const shellCommand = `${quoted} -L ${server} attach-session -t muster \\; select-window -t ${hostRef}`;
+    const shellCommand = `${quoted} -L ${server} attach-session -t ${hostRef}`;
+    // Terminal must create the requested window before activation. Activating
+    // a cold app first also creates its default shell window.
     await command("/usr/bin/osascript", [
         "-e",
         terminal === "iterm2"
@@ -83,8 +83,9 @@ export async function openTerminal(tmux, server, hostRef, deadline, terminal = "
 end run`
             : `on run argv
   tell application "Terminal"
-    activate
+    launch
     do script (item 1 of argv)
+    activate
   end tell
 end run`,
         shellCommand,

package/dist/hosts/tmux.js

@@ -1,4 +1,5 @@
 import { mkdtemp, writeFile, rm } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -52,13 +53,9 @@ export class TmuxHost {
             file,
         ];
         try {
-            let output;
-            try {
-                output = await this.call(["new-session", "-s", "muster", ...common], opts.deadline);
-            }
-            catch {
-                output = await this.call(["new-window", "-t", "muster", ...common], opts.deadline);
-            }
+            // Window selection is session-wide: sharing a session makes every
+            // attached terminal follow whichever agent was opened most recently.
+            const output = await this.call(["new-session", "-s", `muster-${randomUUID()}`, ...common], opts.deadline);
             const [hostRef, pid] = output.trim().split("\t");
             if (!hostRef || !/^@\d+$/.test(hostRef) || !Number(pid))
                 throw new Error("tmux returned an invalid window identity");
@@ -69,8 +66,7 @@ export class TmuxHost {
             try {
                 const windows = await this.call([
                     "list-windows",
-                    "-t",
-                    "muster",
+                    "-a",
                     "-F",
                     "#{window_id}\t#{pane_start_command}",
                 ]);
@@ -87,14 +83,16 @@ export class TmuxHost {
         try {
             return (await this.call([
                 "list-windows",
-                "-t",
-                "muster",
+                "-a",
                 "-F",
-                "#{window_id}\t#{pane_pid}\t#{window_name}",
+                "#{window_id}\t#{pane_pid}\t#{window_name}\t#{session_name}",
             ]))
                 .trim()
                 .split("\n")
-                .filter(Boolean)
+                .filter((l) => {
+                const session = l.split("\t")[3];
+                return (session === "muster" || /^muster-[0-9a-f-]{36}$/.test(session ?? ""));
+            })
                 .map((l) => {
                 const [hostRef, pid, label] = l.split("\t");
                 return { hostRef: hostRef, pid: Number(pid), label: label };
@@ -117,6 +115,6 @@ export class TmuxHost {
         }
     }
     attachHint(hostRef) {
-        return `tmux -L ${this.server} attach-session -t muster \\; select-window -t ${hostRef}`;
+        return `tmux -L ${this.server} attach-session -t ${hostRef}`;
     }
 }