@brutalsystems/muster 2.0.0 → 3.0.1

package/README.md

@@ -64,10 +64,10 @@ models; behaviour against real ones is verified by hand and recorded in
 npm install -g --allow-scripts=@brutalsystems/muster,node-pty @brutalsystems/muster
 
 # A session: an agent you can reach, addressed once it is genuinely alive.
-muster run claude --prompt 'Review this project' --cwd . --level work
+muster run claude --prompt 'Review this project' --cwd .
 
 # A task: runs once, captures output, advertises nothing.
-muster run codex --kind task --prompt 'Summarise the failing tests' --level read
+muster run codex --kind task --prompt 'Summarise the failing tests' --read-only
 muster output <id>
 
 # What is running, and stopping it.
@@ -75,15 +75,26 @@ muster list --format human
 muster stop <id>
 ```
 
-`--level` names a containment pair. `read` can look but not change; `work` can
-edit its working directory, except muster's own home (`~/.muster`); `open`
-removes the sandbox and needs `allow_dangerous_flags` in config.
-
-| Level  | The agent asks before acting | What it may touch           |
-| ------ | ---------------------------- | --------------------------- |
-| `read` | always                       | nothing on disk             |
-| `work` | no                           | its cwd, except `~/.muster` |
-| `open` | no                           | everything                  |
+**A Claude launch with no containment flag opens exactly as you would open it
+by hand** in that profile and folder. It gets your rules and CLAUDE.md, your
+permissions, hooks, status line, plugins, MCP servers and settings `env`.
+Muster adds nothing and replaces nothing. The one thing it refuses is a profile
+whose default permission mode is bypass. Codex and OpenCode stay read-only by
+default.
+
+When you want muster's guarantee instead, **seal** the launch. A sealed launch
+runs on muster's own settings in place of the profile's, so it loads no rules
+or CLAUDE.md:
+
+| Flag             | The agent asks before acting | What it may touch           |
+| ---------------- | ---------------------------- | --------------------------- |
+| `--read-only`    | always                       | nothing on disk             |
+| `--write-here`   | no                           | its cwd, except `~/.muster` |
+| `--unrestricted` | no                           | everything                  |
+
+`--unrestricted` removes the sandbox and needs `allow_dangerous_flags` in
+config. `--level read|work|open` is the older spelling of the same three and
+still works.
 
 Claude asks to trust a directory the first time. That is a one-time review you
 do yourself — or `--options auto-approve-path`, which records it for you after

package/dist/config.js

@@ -10,8 +10,13 @@ import { identityNameSchema } from "./identity-store.js";
 import { authoritySchema, subjectSchema } from "./requester.js";
 import { RequesterConfigError } from "./requester-policy.js";
 /**
- * What a remote requester is permitted here. Every default is the narrowest
- * value, so the shortest profile is the most restrictive one.
+ * What a remote requester is permitted here.
+ *
+ * `level` defaults to `normal`: an enrolled remote caller gets a launch like
+ * the operator's own, as a local one does (Mike, 2026-10-14). Naming `read` or
+ * `work` is how a profile caps it. `min_enforcement` follows the level it is
+ * written beside — `none` for a normal profile, which muster does not enforce,
+ * and `kernel` for a capped one — unless the profile names it.
  *
  * `allowed_roots` is the one key with no safe default: the global
  * `allowed_roots` defaults to empty, which `assertAllowedWorkspace` reads as
@@ -29,8 +34,8 @@ import { RequesterConfigError } from "./requester-policy.js";
 export const requesterProfileSchema = z
     .object({
     allowed_roots: z.array(z.string().min(1)).min(1),
-    level: z.enum(["read", "work"]).default("read"),
-    min_enforcement: z.enum(["kernel", "tool-policy"]).default("kernel"),
+    level: z.enum(["read", "work", "normal"]).default("normal"),
+    min_enforcement: z.enum(["kernel", "tool-policy", "none"]).optional(),
     env_allow: z.array(z.string().min(1)).default([]),
     /**
      * Baseline overrides, e.g. a PATH that does not depend on the accepting
@@ -42,7 +47,18 @@ export const requesterProfileSchema = z
     /** Which identities this requester may launch under. Empty refuses any. */
     identities: z.array(identityNameSchema).default([]),
 })
-    .strict();
+    .strict()
+    .transform((p) => ({
+    ...p,
+    min_enforcement: p.min_enforcement ?? (p.level === "normal" ? "none" : "kernel"),
+}))
+    // A normal launch is the profile's own settings with nothing of muster's on
+    // top, so its enforcement grade is `none`. A profile that grants it and keeps
+    // a stricter floor would refuse every launch at its own default level, which
+    // is a configuration error worth reporting at load rather than at launch.
+    .refine((p) => p.level !== "normal" || p.min_enforcement === "none", {
+    message: 'level = "normal" hands the launch to the agent\'s own settings, which muster does not enforce; set min_enforcement = "none" alongside it',
+});
 /** Binding an authenticated `(authority, subject)` to a profile. The grant. */
 export const requesterEnrolmentSchema = z
     .object({
@@ -90,7 +106,10 @@ export const configSchema = z
     projects: z
         .record(z.string().regex(/^[a-zA-Z0-9_-]+$/), z.string().min(1))
         .default({}),
-    permissions: z.enum(["auto", "deny", "bypass"]).default("deny"),
+    // No defaults: naming neither is how a Claude launch knows to open as a
+    // person would open it. `resolvePermissions` supplies deny/read-only for
+    // everything else.
+    permissions: z.enum(["auto", "deny", "bypass"]).optional(),
     sandbox: z
         .enum([
         "read-only",
@@ -98,7 +117,7 @@ export const configSchema = z
         "full-access",
         "danger-full-access",
     ])
-        .default("read-only"),
+        .optional(),
     default_mcp: z.array(mcpName).default([]),
     mcp_servers: z.record(mcpName, mcpServerSchema).default({}),
     default_plugins: z.array(pluginName).default([]),
@@ -164,7 +183,7 @@ export async function loadConfig(home = musterHome()) {
             throw new RequesterConfigError(`Duplicate requester enrolment for ${e.authority}/${e.subject}`);
         seen.add(key);
     }
-    if ((["danger-full-access", "full-access"].includes(result.sandbox) ||
+    if ((["danger-full-access", "full-access"].includes(result.sandbox ?? "") ||
         result.permissions === "bypass") &&
         !result.allow_dangerous_flags)
         throw new Error("full-access or bypass requires allow_dangerous_flags in config.toml");

package/dist/enforcement.js

@@ -1,6 +1,7 @@
 import { AGENTS } from "./agents.js";
 export function enforcementGrade(runtime, resolved) {
-    if (resolved.sandbox === "full-access")
+    // Normal: the agent's own settings decide, and muster imposes nothing.
+    if (resolved.sandbox === "full-access" || resolved.sandbox === "normal")
         return "none";
     return AGENTS[runtime].enforcement;
 }

package/dist/format.js

@@ -54,10 +54,16 @@ function recordHuman(record, color) {
     lines.push(field("Directory", clean(record.cwd)));
     if (record.identity)
         lines.push(field("Identity", clean(record.identity)));
-    if (record.permissions)
-        lines.push(field("Permissions", clean(record.permissions)));
-    if (record.sandbox)
-        lines.push(field("Sandbox", clean(record.sandbox)));
+    // A normal launch has no permissions or sandbox of muster's to report; one
+    // line saying whose settings apply reads better than "normal" twice.
+    if (record.permissions === "normal")
+        lines.push(field("Settings", "the profile's own, as if opened by hand"));
+    else {
+        if (record.permissions)
+            lines.push(field("Permissions", clean(record.permissions)));
+        if (record.sandbox)
+            lines.push(field("Sandbox", clean(record.sandbox)));
+    }
     // Only when known: a null means the child chose its own model, and "-" in a
     // human listing would read as a value rather than an absence. The source is
     // shown because "pinned by the caller" and "fell back to the configured

package/dist/guard.js

@@ -48,7 +48,7 @@ export const runSchema = z
         .regex(/^[a-zA-Z0-9_-]+$/)
         .optional(),
     requestKey: z.string().min(1).max(200).optional(),
-    level: z.enum(["read", "work", "open"]).optional(),
+    level: z.enum(["read", "work", "normal", "open"]).optional(),
     /**
      * Named things muster does on the caller's behalf. Closed set, unlike the
      * pass-through after `--`: see src/options.ts.
@@ -59,15 +59,32 @@ export const runSchema = z
     .strict();
 /**
  * A level is a spelling of a legal `permissions` + `sandbox` pair, not a second
- * policy path — `test/level.test.ts` asserts the equivalence for all three.
+ * policy path — `test/level.test.ts` asserts the equivalence for every level.
  * The two legal combinations no level names, `deny` + `workspace-write` and
  * `deny` + `full-access`, stay reachable through the flags.
+ *
+ * The CLI spells them `--read-only`, `--write-here` and `--unrestricted`;
+ * `normal` has no flag because it is what a Claude launch naming none gets.
  */
 export const LEVELS = {
     read: { permissions: "deny", sandbox: "read-only" },
     work: { permissions: "auto", sandbox: "workspace-write" },
+    normal: { permissions: "normal", sandbox: "normal" },
     open: { permissions: "bypass", sandbox: "full-access" },
 };
+/** The CLI's flag for each level, for messages that tell a caller what to type. */
+export const LEVEL_FLAGS = {
+    read: "--read-only",
+    work: "--write-here",
+    open: "--unrestricted",
+};
+/** Only Claude has a launch muster can leave entirely to the profile so far. */
+function assertNormalSupported(runtime) {
+    if (runtime !== "claude")
+        throw new Error(`a normal launch (the agent's own settings, as if opened by hand) is ` +
+            `supported for claude only; for ${runtime} pass --read-only, ` +
+            `--write-here or --unrestricted`);
+}
 /**
  * Checked against raw input before parsing, like `project` and `cwd`: once
  * defaults have been applied a caller's value is indistinguishable from one
@@ -83,14 +100,26 @@ export function assertLevelExclusive(input) {
 }
 export function resolvePermissions(req, config) {
     if (req.level) {
+        if (req.level === "normal")
+            assertNormalSupported(req.runtime);
         const pair = { ...LEVELS[req.level] };
         if ((pair.permissions === "bypass" || pair.sandbox === "full-access") &&
             !config.allow_dangerous_flags)
             throw new Error("bypass or full-access requires allow_dangerous_flags=true in config.toml");
         return pair;
     }
-    const permissions = req.permissions ?? config.permissions;
-    const configuredSandbox = req.sandbox ?? config.sandbox;
+    // Nothing named anywhere: a Claude launch opens as a person would open it.
+    // The other runtimes keep the sealed read-only default until they have a
+    // normal launch of their own. A config that names either key is an
+    // operator's explicit default and is honoured as before.
+    if (req.permissions === undefined &&
+        req.sandbox === undefined &&
+        config.permissions === undefined &&
+        config.sandbox === undefined &&
+        req.runtime === "claude")
+        return { ...LEVELS.normal };
+    const permissions = req.permissions ?? config.permissions ?? "deny";
+    const configuredSandbox = req.sandbox ?? config.sandbox ?? "read-only";
     const sandbox = configuredSandbox === "danger-full-access"
         ? "full-access"
         : configuredSandbox;
@@ -187,7 +216,7 @@ export function assertMusterHomeProtectable(runtime, cwd, policy, home) {
             `is inside muster's own home (${home}), which holds the config every ` +
             `later launch obeys. OpenCode's permissions are tool policy and cannot ` +
             `keep its shell out of one folder, so launch it in a folder that does ` +
-            `not contain muster's home, or at --level read.`);
+            `not contain muster's home, or with --read-only.`);
 }
 /** Whether `inner` is `outer` or below it, by path segments, not characters. */
 function contains(outer, inner) {
@@ -530,6 +559,12 @@ musterHome = defaultMusterHome(env)) {
     // builders, which carry the model in their config overlay.
     const model = resolved ? ["--model", resolved.model] : [];
     const policy = resolvePermissions(req, config);
+    if (policy.permissions === "normal") {
+        // `resolvePermissions` refuses this outside claude; restated so the codex
+        // branch below can never read `normal` as one of its own modes.
+        assertNormalSupported(req.runtime);
+        return normalClaudeArgs(req, mcp, bridgePath, env, model, extra);
+    }
     if (req.runtime === "codex")
         return [
             "codex",
@@ -658,6 +693,68 @@ musterHome = defaultMusterHome(env)) {
         req.prompt,
     ];
 }
+/**
+ * A Claude launch exactly as a person would start it in this profile and
+ * directory: every setting source (so rules, CLAUDE.md, the env and autoMode
+ * blocks, permissions, hooks, the status line, plugins and the profile's own
+ * MCP servers), no permission mode of muster's, no sandbox of muster's.
+ *
+ * Muster adds only what the caller named: `--mcp` servers ride alongside the
+ * profile's (not instead of them — no `--strict-mcp-config`), and configured
+ * `default_mcp` is not applied because the profile already brings its own.
+ *
+ * The one thing it refuses is a profile or project that makes bypass the
+ * default: a muster launch never starts in bypass unless `--unrestricted`
+ * asked for it.
+ */
+function normalClaudeArgs(req, mcp, bridgePath, env, model, extra) {
+    assertNoDefaultBypass(claudeConfigDir(env), req.cwd);
+    return [
+        "claude",
+        ...(req.kind === "task" ? ["-p"] : []),
+        ...(mcp.length
+            ? ["--mcp-config", JSON.stringify(claudeMcpConfig(mcp, bridgePath))]
+            : []),
+        ...model,
+        ...extra,
+        "--",
+        req.prompt,
+    ];
+}
+/**
+ * The setting files a hand launch reads for `permissions.defaultMode`, lowest
+ * precedence first. Managed policy is above all three and is the operator's
+ * organisation's to set, so it is not second-guessed here.
+ */
+export function claudeSettingFiles(configDir, cwd) {
+    return [
+        join(configDir, "settings.json"),
+        join(cwd, ".claude", "settings.json"),
+        join(cwd, ".claude", "settings.local.json"),
+    ];
+}
+/** Refuses a normal launch whose effective default mode is bypassPermissions. */
+export function assertNoDefaultBypass(configDir, cwd) {
+    let mode, from;
+    for (const file of claudeSettingFiles(configDir, cwd)) {
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(file, "utf8"));
+        }
+        catch {
+            // Missing or unreadable: Claude skips it too.
+            continue;
+        }
+        const value = parsed
+            ?.permissions?.defaultMode;
+        if (value !== undefined)
+            [mode, from] = [value, file];
+    }
+    if (mode === "bypassPermissions")
+        throw new Error(`${from} sets permissions.defaultMode to bypassPermissions; muster ` +
+            `will not start a launch in bypass by default. Pass --unrestricted ` +
+            `to ask for it.`);
+}
 /** A path as given and as resolved, once each. An unresolvable path (it does
  *  not exist yet) is denied as given — nothing can be written through a
  *  missing directory anyway. */

package/dist/help.js

@@ -51,16 +51,28 @@ export const COMMANDS = [
                 "--terminal APP",
                 "deprecated, removed in v2: pass the app to --open instead",
             ],
+            [
+                "--read-only",
+                "sealed: muster's own settings replace the profile's, and the agent can change nothing",
+            ],
+            [
+                "--write-here",
+                "sealed: muster's own settings replace the profile's, and the agent can write only inside the launch folder, never muster's own home",
+            ],
+            [
+                "--unrestricted",
+                "no sandbox and no permission checks; needs allow_dangerous_flags in config.toml",
+            ],
             [
                 "--level LEVEL",
-                "read, work, or open: a legal permissions and sandbox pair; work writes the launch folder except muster's own home",
+                "older spelling: read, work or open are the three flags above; normal is the claude default",
             ],
-            ["--permissions MODE", "auto, deny, or bypass"],
-            ["--sandbox MODE", "read-only, workspace-write, or full-access"],
+            ["--permissions MODE", "auto, deny, or bypass (sealed)"],
+            ["--sandbox MODE", "read-only, workspace-write, or full-access (sealed)"],
             ["--mcp NAME", "repeatable; replaces configured defaults"],
             [
                 "--options NAME",
-                "repeatable; muster-side launch options — auto-approve-path records the launch directory as trusted so its one-time dialog does not block the launch (claude and codex only, and refused if the directory ships hooks or MCP servers); accept-bypass-warning accepts Claude's one-time Bypass Permissions warning so a --level open launch can start (claude with bypass permissions only)",
+                "repeatable; muster-side launch options — auto-approve-path records the launch directory as trusted so its one-time dialog does not block the launch (claude and codex only, and refused if the directory ships hooks or MCP servers); accept-bypass-warning accepts Claude's one-time Bypass Permissions warning so an --unrestricted launch can start (claude with bypass permissions only)",
             ],
             ["--no-mcp", "launch with no MCP servers"],
             ["--plugin NAME", "repeatable; replaces configured defaults (OpenCode)"],
@@ -89,12 +101,15 @@ export const COMMANDS = [
             ["-- RUNTIME_OPTIONS", "everything after -- is passed to the runtime"],
         ],
         notes: [
-            "Naming both --level and --permissions or --sandbox is an error rather than a precedence rule.",
+            "With none of --read-only, --write-here or --unrestricted, claude opens exactly as you would open it by hand in that folder: your profile's rules, CLAUDE.md, permissions, hooks, plugins, MCP servers and env. Muster refuses only a profile whose default mode is bypass. codex and opencode stay read-only by default.",
+            "A sealed launch does not read your profile's or the project's settings, so it also loads no rules or CLAUDE.md.",
+            "Use one of the three flags, --level, or --permissions/--sandbox; naming two is an error rather than a precedence rule.",
             "A pty launch keeps this process running and Ctrl-C stops it; a tmux launch survives this process exiting.",
         ],
         examples: [
             "muster run claude --prompt 'Review this project' --cwd .",
-            "muster run codex --identity work --level work --prompt 'Ship it'",
+            "muster run claude --read-only --prompt 'Audit this' --cwd .",
+            "muster run codex --identity work --write-here --prompt 'Ship it'",
         ],
     },
     {

package/dist/hosts/tmux.js

@@ -102,6 +102,19 @@ export function titleOptions(session, title) {
  * TERM Ghostty, iTerm2 and Terminal.app report; a terminal that does not
  * support the request ignores it.
  *
+ * `progressbar` lets tmux pass a pane's progress (OSC 9;4, which Claude Code
+ * sends while it works) to the attached terminal, and it has to be declared
+ * here rather than left to tmux. Muster starts the agent before any terminal
+ * attaches, so its first turn has usually set progress by then; tmux learns
+ * Ghostty's `progressbar` only from the XTVERSION reply after attaching, and
+ * does not then send the progress it is already holding, so the pane shows no
+ * busy state for the whole of that turn. Declared up front, the held state is
+ * replayed on attach. It matches any client whose TERM is `xterm-ghostty`
+ * (what Ghostty and Scotty set), whether or not that client ever answers
+ * XTVERSION, rather than `xterm*`: Terminal.app has no progress bar and iTerm2
+ * has read OSC 9 as a notification. It reaches clients that attach after the
+ * next launch on a server, not clients already attached.
+ *
  * `-q` because these name options newer than some tmux still installed
  * (`extended-keys-format` arrived in 3.5, `terminal-features` in 3.2), and an
  * unknown option is an error that would abort the whole command list and with
@@ -113,6 +126,7 @@ export const SERVER_OPTIONS = [
     ["-s", "extended-keys", "always"],
     ["-s", "extended-keys-format", "csi-u"],
     ["-s", "terminal-features[90]", "xterm*:extkeys"],
+    ["-s", "terminal-features[91]", "xterm-ghostty:progressbar"],
 ];
 /** `SERVER_OPTIONS` as `;`-terminated `set-option` commands, to lead a
  *  command list. */

package/dist/mcp-tools.js

@@ -44,17 +44,17 @@ export const MCP_TOOLS = [
                 permissions: {
                     type: "string",
                     enum: ["auto", "deny", "bypass"],
-                    description: "Defaults to config (deny). Auto requires workspace-write; bypass requires authorized full-access.",
+                    description: "Seals the launch. Defaults to config, else deny (claude: normal when config names neither). Auto requires workspace-write; bypass requires authorized full-access.",
                 },
                 sandbox: {
                     type: "string",
                     enum: ["read-only", "workspace-write", "full-access"],
-                    description: "Defaults to config (read-only). Full access requires config authorization.",
+                    description: "Seals the launch. Defaults to config, else read-only (claude: normal when config names neither). Full access requires config authorization.",
                 },
                 level: {
                     type: "string",
-                    enum: ["read", "work", "open"],
-                    description: "A spelling of a legal permissions/sandbox pair: read is deny + read-only, work is auto + workspace-write, open is bypass + full-access. Naming a level and either flag is an error.",
+                    enum: ["read", "work", "normal", "open"],
+                    description: "normal (claude's default, claude only) opens the agent exactly as a person would by hand: the profile's rules, CLAUDE.md, permissions, hooks, plugins and MCP servers. read (deny + read-only), work (auto + workspace-write) and open (bypass + full-access) are sealed: muster's settings replace the profile's, so no rules or CLAUDE.md load. Naming a level and permissions or sandbox is an error.",
                 },
                 mcp: {
                     type: "array",

package/dist/mcp.js

@@ -55,8 +55,13 @@ export function toolGate(enabled) {
     };
 }
 export function selectMcp(req, config) {
-    // Personal defaults apply to sessions, not unattended one-shot tasks.
-    const names = req.mcp ?? (req.kind === "session" ? config.default_mcp : []);
+    // Personal defaults apply to sessions, not unattended one-shot tasks, and not
+    // to a normal launch: the profile already brings its own MCP servers, and a
+    // second copy of one under muster's bridge would register the session twice.
+    const names = req.mcp ??
+        (req.kind === "session" && req.level !== "normal"
+            ? config.default_mcp
+            : []);
     return [...new Set(names)].map((name) => {
         const server = Object.hasOwn(config.mcp_servers, name)
             ? config.mcp_servers[name]

package/dist/muster.js

@@ -203,6 +203,9 @@ async function main() {
                 permissions: { type: "string" },
                 sandbox: { type: "string" },
                 level: { type: "string" },
+                "read-only": { type: "boolean" },
+                "write-here": { type: "boolean" },
+                unrestricted: { type: "boolean" },
                 mcp: { type: "string", multiple: true },
                 options: { type: "string", multiple: true },
                 "no-mcp": { type: "boolean" },
@@ -223,7 +226,23 @@ async function main() {
                 interactive: { type: "boolean" },
             },
         });
-        const { format = "json", "no-mcp": noMcp, "no-plugin": noPlugin, "request-key": requestKey, "idle-timeout": idleTimeout, socket, home: homeFlag, "stop-now": stopNow, ...values } = parsed;
+        const { format = "json", "no-mcp": noMcp, "no-plugin": noPlugin, "request-key": requestKey, "idle-timeout": idleTimeout, socket, home: homeFlag, "stop-now": stopNow, "read-only": readOnly, "write-here": writeHere, unrestricted, ...values } = parsed;
+        // The plain spellings of the three sealed levels. Each is a level, so the
+        // existing exclusivity with --permissions/--sandbox applies unchanged once
+        // it is folded into `values.level`.
+        const levelFlags = [
+            ["--read-only", readOnly, "read"],
+            ["--write-here", writeHere, "work"],
+            ["--unrestricted", unrestricted, "open"],
+        ].filter(([, set]) => set);
+        if (levelFlags.length && command !== "run")
+            throw new Error(`${levelFlags[0][0]} applies only to run`);
+        if (levelFlags.length > 1)
+            throw new Error(`use one of ${levelFlags.map(([name]) => name).join(", ")}, not several`);
+        if (levelFlags.length && values.level !== undefined)
+            throw new Error(`use ${levelFlags[0][0]} or --level, not both`);
+        if (levelFlags.length)
+            values.level = levelFlags[0][2];
         // Guarded like --request-key and --no-mcp below: a flag that applies to one
         // command and is silently ignored elsewhere misleads, and --home silently
         // reading the real registry is the one that would mislead most.

package/dist/options.js

@@ -33,7 +33,7 @@ export function assertOptionsSupported(runtime, options, permissions) {
             throw new Error(`--options accept-bypass-warning is not supported for ${runtime}: only Claude shows a bypass-permissions warning`);
         if (option === "accept-bypass-warning" &&
             permissions.permissions !== "bypass")
-            throw new Error(`--options accept-bypass-warning requires bypass permissions (--level open or --permissions bypass); this launch resolves to ${permissions.permissions}`);
+            throw new Error(`--options accept-bypass-warning requires bypass permissions (--unrestricted or --permissions bypass); this launch resolves to ${permissions.permissions}`);
     }
 }
 /**

package/dist/requester-policy.js

@@ -30,7 +30,7 @@ export class RequesterConfigError extends Error {
     }
 }
 /** Ordered weakest to strongest, so a ceiling is one index comparison. */
-const LEVEL_ORDER = ["read", "work", "open"];
+const LEVEL_ORDER = ["read", "work", "normal", "open"];
 const GRADE_ORDER = ["none", "tool-policy", "kernel"];
 export function resolveRequesterPolicy(requester, config) {
     if (requester.kind === "local")

package/dist/run.js

@@ -188,7 +188,13 @@ export class Muster {
         // defaults. So the profile is the floor here as well as the ceiling. A
         // local requester has no `policy.level`, which leaves this undefined and
         // local behaviour untouched.
-        const level = req.level ?? policy.level;
+        // A profile's normal default applies to claude only, the one runtime with
+        // a normal launch; any other runtime gets the read default it would get
+        // locally, rather than a refusal for a level the caller never named.
+        const level = req.level ??
+            (policy.level === "normal" && req.runtime !== "claude"
+                ? "read"
+                : policy.level);
         if (level)
             assertLevelWithinCeiling(level, policy);
         return { req, policy, level };
@@ -250,7 +256,7 @@ export class Muster {
          * that happens, so there is one: nothing below derives containment from
          * `req`.
          */
-        const effective = level ? { ...req, level } : req;
+        const requested = level ? { ...req, level } : req;
         if (req.kind === "task" && req.host)
             throw new Error("host applies only to session launches");
         if (req.terminal && !req.open)
@@ -260,7 +266,13 @@ export class Muster {
         if (req.open &&
             (req.kind !== "session" || !["auto", "tmux"].includes(requestedHost)))
             throw new Error("--open requires a tmux session on macOS");
-        const permissions = resolvePermissions(effective, this.config);
+        const permissions = resolvePermissions(requested, this.config);
+        // A Claude launch naming nothing resolves to normal without having asked
+        // for it by name; spelled out here so everything below — MCP defaults,
+        // the argv, the record — sees one answer rather than re-deriving it.
+        const effective = permissions.permissions === "normal"
+            ? { ...requested, level: "normal" }
+            : requested;
         // Refused here, with the other checks that cost nothing to fail: an option
         // the runtime cannot honour must not leave a registry entry behind.
         assertOptionsSupported(req.runtime, req.options, permissions);
@@ -292,7 +304,10 @@ export class Muster {
         if (req.open &&
             (!driver?.open || !(await driver.openAvailable?.(terminal))))
             throw new Error(`--open requires the selected terminal (${terminal}) installed on macOS and tmux`);
-        if (req.runtime === "claude")
+        // Managed policy is refused because muster cannot prove its own inline
+        // settings win over it. A normal launch has no settings of muster's to
+        // prove, and obeys managed policy exactly as a hand launch does.
+        if (req.runtime === "claude" && permissions.permissions !== "normal")
             await assertClaudePolicy(this.hostEnv);
         if (req.runtime === "opencode")
             await assertOpenCodeVersion(this.hostEnv, "1.18.31", Date.now() + 4000);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/muster",
-  "version": "2.0.0",
+  "version": "3.0.1",
   "description": "Launch instructed, reachable local agent sessions",
   "type": "module",
   "engines": {