@brutalsystems/muster 1.0.2 → 1.1.1

package/CONTRACT_PROVENANCE.md

@@ -527,3 +527,38 @@ convenient re-sync: `test/fixtures/canonical-id.json` is in `package.json`'s
 fixture moved `publish.yml`, `RELEASING.md` and `docs/verification.md` on
 their own. Only the two frozen hashes in `test/naming.test.ts` are hand-written,
 and those are the third site behaving as documented.
+
+## What the vendored copy covers, and what it deliberately does not
+
+The copies pin **the address format Muster generates** — slugify, suffix,
+assignment, resolution — and the refusals that resolution can produce:
+`ambiguous`, `self`, `unknown`. That is the whole surface, and the boundary is
+not an accident of what was convenient to copy.
+
+They do **not** cover Tin Can's send-path vocabulary, because Muster never calls
+`send_peer` in product code. Muster produces addresses; Tin Can does the
+sending. The only mentions of that call in this repository are a doc comment in
+`naming.ts` describing what an address is for, and the contract suite asserting
+`outcome === "accepted"` on the happy path. Neither enumerates a refusal, so
+there is no unknown-refusal path here for a new one to fall through.
+
+Tin Can 2.0.0 is the worked example. It added a `duplicate_peer_moved` refusal,
+splitting the retry-whose-name-has-moved case out of `duplicate_send`. A
+consumer of send outcomes had to act on that — birddog did, and it was a real
+change for them. Muster owed nothing, and the 2.0.0 re-sync above correctly
+shows no such edit. The asymmetry is clean: Muster produces addresses and never
+consumes send outcomes; birddog consumes send outcomes and never produces an
+address. Neither repository inherits the other's obligations, and a vendored
+contract that tried to cover both would be wrong in both directions.
+
+**So the question at each re-sync is not "did Tin Can change".** It is: did
+anything Muster *generates or parses* change. Copying more than that is not
+caution, it is over-vendoring — it pins a surface Muster does not use, and the
+frozen hashes in `test/naming.test.ts` then move for reasons that have nothing
+to do with Muster, which is how a freeze stops meaning anything.
+
+**If Muster ever grows a send path, this boundary moves and the copy must widen
+with it** — `duplicate_peer_moved` and the rest of the send vocabulary would
+become a genuine re-sync obligation, and a re-sync that kept ignoring them would
+be a defect. Recorded now, while the reasoning is fresh, rather than discovered
+by whoever adds that path.

package/README.md

@@ -59,7 +59,9 @@ models; behaviour against real ones is verified by hand and recorded in
 ## Quick start
 
 ```sh
-npm install -g @brutalsystems/muster
+# Allow the install scripts: muster's postinstall builds node-pty, and npm
+# skips install scripts by default — silently, so the pty host fails later.
+npm install -g --allow-scripts=@brutalsystems/muster,node-pty @brutalsystems/muster
 
 # A session: an agent you can reach, addressed once it is genuinely alive.
 muster run claude --prompt 'Review this project' --cwd . --level work

package/dist/guard.js

@@ -443,6 +443,14 @@ export function launchArgs(req, config, mcp = [], bridgePath, env = process.env)
     const settings = {
         ...profilePluginSettings(configDir),
         disableAllHooks: true,
+        // `--setting-sources ""` means an acceptance recorded in the profile's
+        // settings.json is never read, so without this the bypass warning stops
+        // every bypass launch before it registers (#45). Only on request, and
+        // `assertOptionsSupported` has already refused it outside bypass.
+        ...(req.options.includes("accept-bypass-warning") &&
+            policy.permissions === "bypass"
+            ? { skipDangerousModePermissionPrompt: true }
+            : {}),
         permissions: {
             defaultMode: mode,
             allow: mcp.flatMap((s) => s.config.tools.map((t) => `mcp__${s.name}__${t}`)),

package/dist/help.js

@@ -60,7 +60,7 @@ export const COMMANDS = [
             ["--mcp NAME", "repeatable; replaces configured defaults"],
             [
                 "--options NAME",
-                "repeatable; muster-side launch options — auto-approve-path records the launch directory as trusted so its one-time dialog does not block the launch (claude and codex only, and refused if the directory ships hooks or MCP servers)",
+                "repeatable; muster-side launch options — auto-approve-path records the launch directory as trusted so its one-time dialog does not block the launch (claude and codex only, and refused if the directory ships hooks or MCP servers); accept-bypass-warning accepts Claude's one-time Bypass Permissions warning so a --level open launch can start (claude with bypass permissions only)",
             ],
             ["--no-mcp", "launch with no MCP servers"],
             ["--plugin NAME", "repeatable; replaces configured defaults (OpenCode)"],

package/dist/identity/claude.js

@@ -64,22 +64,27 @@ export async function claudeWorkspaceTrusted(env, cwd) {
  * timeout looks identical to a hung or crashed launch. Several unrelated
  * screens can produce it, and the old message guessed at two of them together.
  * Trust is the one Muster can actually check, so it is either named or ruled
- * out. Nothing else is named: a first-use bypass-permissions confirmation was
- * a plausible account of one report, but no profile on this machine carries a
- * key for it the way they carry `hasSeenAutoModeEntryWarning` and its
- * siblings, so this says "another one-time confirmation" rather than sending
- * the reader after a screen nobody has demonstrated.
+ * out. The bypass-permissions warning is named only for a launch that ran in
+ * bypass without `accept-bypass-warning`: demonstrated in #45, and that launch
+ * is the only one it can stop. Anything else says "another one-time
+ * confirmation" rather than sending the reader after a screen nobody has
+ * demonstrated.
  *
  * A `--kind task` launch into the same directory is the cheap discriminator:
  * it runs headless and never sees the dialog, so it succeeds where a session
  * hangs.
  */
-export function claudeRegistryDiagnostic(trusted, cwd, configDir) {
+export function claudeRegistryDiagnostic(trusted, cwd, configDir, opts = {}) {
     if (!trusted)
         return (`no Claude session registry found: workspace trust has not been ` +
             `accepted for ${cwd} in ${configDir} — accept it once with ` +
             `\`cd ${cwd} && claude\`, then retry (trust is per-directory and is ` +
             `not inherited from a parent directory)`);
+    if (opts.bypassWarningPending)
+        return (`no Claude session registry found (${cwd} is trusted for this profile): ` +
+            `this launch runs in bypass permissions, and Claude stops on its ` +
+            `one-time "Bypass Permissions mode" warning until someone answers it — ` +
+            `relaunch with --options accept-bypass-warning to accept it for the launch`);
     return (`no Claude session registry found (${cwd} is trusted for this profile, ` +
         `so the session is stopped on something else — check the terminal for a ` +
         `login prompt or another one-time confirmation)`);

package/dist/mcp-tools.js

@@ -63,8 +63,11 @@ export const MCP_TOOLS = [
                 },
                 options: {
                     type: "array",
-                    items: { type: "string", enum: ["auto-approve-path"] },
-                    description: "Muster-side launch options. auto-approve-path records the launch directory as trusted in the profile the agent will use, so its one-time dialog does not block the launch; refused for a runtime with no trust gate, and refused if the directory ships hooks or MCP servers. Not expressible remotely.",
+                    items: {
+                        type: "string",
+                        enum: ["auto-approve-path", "accept-bypass-warning"],
+                    },
+                    description: "Muster-side launch options. auto-approve-path records the launch directory as trusted in the profile the agent will use, so its one-time dialog does not block the launch; refused for a runtime with no trust gate, and refused if the directory ships hooks or MCP servers. accept-bypass-warning accepts Claude's one-time Bypass Permissions warning for a bypass launch (level open); refused for other runtimes and without bypass permissions. Not expressible remotely.",
                 },
                 project: {
                     type: "string",

package/dist/options.js

@@ -10,17 +10,31 @@ import { AGENTS } from "./agents.js";
  * in its own way, or cannot express at all — so the set is closed, and naming
  * one an agent has no answer for is an error rather than a silent no-op.
  */
-export const LAUNCH_OPTIONS = ["auto-approve-path"];
+export const LAUNCH_OPTIONS = [
+    "auto-approve-path",
+    "accept-bypass-warning",
+];
 /**
  * Refuses an option the runtime cannot honour, before anything is reserved or
  * spawned. `auto-approve-path` records that the launch directory is trusted, so
  * it needs an agent with a trust gate to record it in; OpenCode has none, and
  * accepting the flag there would promise something muster cannot deliver.
+ *
+ * `accept-bypass-warning` answers Claude's one-time "Bypass Permissions mode"
+ * warning, which only Claude shows and only in bypass. Anywhere else there is
+ * no warning to accept, so it is refused rather than carried as a no-op that
+ * reads like consent to something.
  */
-export function assertOptionsSupported(runtime, options) {
-    for (const option of options)
+export function assertOptionsSupported(runtime, options, permissions) {
+    for (const option of options) {
         if (option === "auto-approve-path" && !AGENTS[runtime].trustWorkspace)
             throw new Error(`--options auto-approve-path is not supported for ${runtime}: it has no workspace-trust gate`);
+        if (option === "accept-bypass-warning" && runtime !== "claude")
+            throw new Error(`--options accept-bypass-warning is not supported for ${runtime}: only Claude shows a bypass-permissions warning`);
+        if (option === "accept-bypass-warning" &&
+            permissions.permissions !== "bypass")
+            throw new Error(`--options accept-bypass-warning requires bypass permissions (--level open or --permissions bypass); this launch resolves to ${permissions.permissions}`);
+    }
 }
 /**
  * What a directory ships that would configure a session it is trusted by.

package/dist/run.js

@@ -256,10 +256,10 @@ export class Muster {
         if (req.open &&
             (req.kind !== "session" || !["auto", "tmux"].includes(requestedHost)))
             throw new Error("--open requires a tmux session on macOS");
+        const permissions = resolvePermissions(effective, this.config);
         // Refused here, with the other checks that cost nothing to fail: an option
         // the runtime cannot honour must not leave a registry entry behind.
-        assertOptionsSupported(req.runtime, req.options);
-        const permissions = resolvePermissions(effective, this.config);
+        assertOptionsSupported(req.runtime, req.options, permissions);
         const enforcement = enforcementGrade(req.runtime, permissions);
         assertEnforcementMeetsMinimum(req.runtime, enforcement, policy);
         // Composed here, before any process of any kind is started — the version
@@ -373,7 +373,14 @@ export class Muster {
         const { req, identityName, identityMeta, credential, selectedMcp, agentBase, deadline, } = c;
         let entry = c.entry;
         const prepared = await prepareMcp(selectedMcp, mcpEnvironment(selectedMcp, agentBase, this.sourceEnv), req.cwd, deadline);
-        let runtimeEnv = mcpEnvironment(prepared.servers, agentBase, this.sourceEnv);
+        // PWD names the launch directory, not the caller's. The child is spawned
+        // in req.cwd, but an inherited PWD still names wherever muster was run
+        // from, and `opencode run` prefers PWD over its real cwd: its model's
+        // shell then ran in the caller's directory instead of --cwd.
+        let runtimeEnv = {
+            ...mcpEnvironment(prepared.servers, agentBase, this.sourceEnv),
+            PWD: req.cwd,
+        };
         entry = await this.registry.update(entry.launchId, prepared.summary);
         if (identityName && identityMeta) {
             // The launch id exists now, so the copy can be made and named after it.
@@ -736,7 +743,11 @@ export class Muster {
         // runs headless and never sees the dialog, so refusing an untrusted
         // directory up front would break task launches that work today.
         if (req.runtime === "claude" && diagnostic === neverRegistered)
-            diagnostic = claudeRegistryDiagnostic(await claudeWorkspaceTrusted(resolveEnv, req.cwd), req.cwd, claudeConfigDir(resolveEnv));
+            diagnostic = claudeRegistryDiagnostic(await claudeWorkspaceTrusted(resolveEnv, req.cwd), req.cwd, claudeConfigDir(resolveEnv), {
+                bypassWarningPending: req.kind === "session" &&
+                    permissions.permissions === "bypass" &&
+                    !req.options.includes("accept-bypass-warning"),
+            });
         throw new Error(`${diagnostic} after ${this.config.launch_timeout_sec}s`);
     }
     async launch(input, requester) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/muster",
-  "version": "1.0.2",
+  "version": "1.1.1",
   "description": "Launch instructed, reachable local agent sessions",
   "type": "module",
   "engines": {