@saadnvd1/agent-os 0.3.752 → 0.3.756

package/README.md

@@ -17,7 +17,7 @@ and check on all of it from your phone.
 - **Each kind of work on the right model.** Planning, review, implementation and titles each run on their own model, set in Settings → Models. [More](docs/reference/model-routing.md)
 - **Nothing starts until you send.** ⌥N opens a draft with project, machine, agent and branch as chips. [More](docs/guides/sessions.md)
 - **Other machines in the same list.** Link another machine that runs AgentOS and start or move work there. [More](docs/reference/machines.md)
-- **Built for your phone.** The whole app works on a phone; pair it with a QR code. [More](docs/guides/phone.md)
+- **Built for your phone.** The whole app works on a phone; pair it with a QR code, or get the [iPhone app](https://apps.apple.com/us/app/agentos-coding-agents/id6820980797) from the App Store. [More](docs/guides/phone.md)
 - **Phone to orchestrator.** A paired phone can send a shake report or a shared page or file to a workspace's orchestrator (`POST /api/orchestrators/:workspaceId/intake`, saved under `intake/` beside the database, shared content marked untrusted), and fetch names to improve dictation (`GET /api/voice/vocab?workspace=`). [More](docs/guides/phone.md)
 - **An analyst beside your coding agent.** Pair a chat with a second one that reviews each turn, explains it in plain English, flags issues and drafts the next prompt, which you send, edit or dismiss. It runs on Claude unless you pick another model, local ones included. Side by side on a desktop, a switch on a phone. [More](docs/decisions/2026-10-21-analyst-sessions.md)
 - **Agents that talk to each other.** Sessions message each other with `aos`, and you see every conversation in Messages. [More](docs/guides/agent-network.md)
@@ -46,6 +46,10 @@ and check on all of it from your phone.
 
 ## Install
 
+[<img src="docs/assets/app-store-badge.svg" alt="Download on the App Store" height="40">](https://apps.apple.com/us/app/agentos-coding-agents/id6820980797)
+
+The iPhone app, [AgentOS: Coding Agents](https://apps.apple.com/us/app/agentos-coding-agents/id6820980797), is on the App Store.
+
 You need Node.js 22+, tmux, and at least one agent CLI (the installer offers to set up what's missing).
 
 ```bash
@@ -71,6 +75,8 @@ Connect (in development) lets you reach AgentOS from anywhere, without a tailnet
 agent-os connect   # links this machine with the code from runagentos.com
 ```
 
+Reach it from your phone with the [AgentOS iPhone app](https://apps.apple.com/us/app/agentos-coding-agents/id6820980797), now on the App Store.
+
 The machine gets its own address at `https://m-<id>.runagentos.com`, served through a Cloudflare tunnel that AgentOS starts and stops with itself. Its key is made on the machine and never leaves it, and a device still has to be paired before it gets in. Connect also hosts the read-only links made with Share. How it works, and what it does and doesn't trust, is in [docs/reference/security.md](docs/reference/security.md#connect).
 
 ## Security

package/components/Workspaces/WorkspaceSettings.tsx

@@ -61,7 +61,7 @@ export function WorkspaceSettings() {
           />
           <SettingToggle
             title="Orchestrator full access"
-            detail="Its shell and file writes aren't checked: it can push, commit, edit any repository or file on this machine, and merge a PR directly. Off: the deny list, write limits, quick-change cap and merge-only-through-the-gates apply."
+            detail="Its shell and file writes aren't checked: it can push, commit, edit any repository or file on this machine, and merge a PR directly, and edit .claude files (skills, settings, hooks). Applies when its conversation next restarts. Off: the deny list, write limits, quick-change cap and merge-only-through-the-gates apply."
             checked={w.orch_full_access}
             onChange={(on) => update.mutate({ id: w.id, orchFullAccess: on })}
           />

package/lib/health/env/classes.ts

@@ -78,9 +78,15 @@ export const ENV_CLASSES: readonly EnvClass[] = [
     id: "local-permission",
     label: "Local permission denied",
     scope: "shell",
-    match: [/Permission denied/, /\bEACCES\b/, /Operation not permitted/],
+    // A quoted phrase is source code (`error: "Permission denied"`), not an error.
+    match: [
+      /(?<!["'`])Permission denied/,
+      /(?<!["'`])\bEACCES\b/,
+      /(?<!["'`])Operation not permitted/,
+    ],
+    // Another machine or a container: not this machine's permissions.
     except: {
-      command: /\b(?:ssh|scp|sftp|rsync|kubectl|docker\s+exec)\b/,
+      command: /\b(?:ssh|scp|sftp|rsync|kubectl|docker|podman)\b/,
       output: /\(publickey/,
     },
     fix: null,

package/lib/health/env/classify.ts

@@ -28,11 +28,48 @@ function commandOf(tool: string, input: unknown): string {
   return typeof file === "string" ? `${tool} ${genericPath(file)}` : tool;
 }
 
+// The command's parts, split on pipes, `;`, `&&` and newlines outside quotes,
+// so `grep -E "a|b"` stays one part.
+function commandParts(command: string): string[] {
+  const parts: string[] = [];
+  let cur = "";
+  let quote = "";
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (ch === "\\" && quote === '"') cur += ch + (command[++i] ?? "");
+      else {
+        if (ch === quote) quote = "";
+        cur += ch;
+      }
+      continue;
+    }
+    if (ch === '"' || ch === "'") quote = ch;
+    // A lone `&` (`2>&1`, a background job) doesn't end a part.
+    const split =
+      ch === "\n" ||
+      ch === ";" ||
+      ch === "|" ||
+      (ch === "&" && command[i + 1] === "&");
+    if (split) {
+      if (command[i + 1] === ch && ch !== "\n" && ch !== ";") i++;
+      parts.push(cur);
+      cur = "";
+      continue;
+    }
+    cur += ch;
+  }
+  parts.push(cur);
+  return parts;
+}
+
+// Leading `VAR=value` assignments, as in `W=/path cd $W`.
+const ASSIGNMENTS = /^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|\S*)\s*)+/;
+
 // True when every part of the command only reads (after `cd`).
 function onlyReads(command: string): boolean {
-  const parts = command
-    .split(/\n|&&|\|\||;|\|/)
-    .map((p) => p.trim())
+  const parts = commandParts(command)
+    .map((p) => p.trim().replace(ASSIGNMENTS, ""))
     .filter((p) => p && !/^cd\s/.test(p));
   return parts.length > 0 && parts.every((p) => READERS.test(p));
 }

package/lib/orchestrator/mcp-servers.ts

@@ -10,6 +10,7 @@
  */
 
 import fs from "fs";
+import type { PermissionMode } from "@anthropic-ai/claude-agent-sdk";
 import os from "os";
 import path from "path";
 import { ORCHESTRATOR_PERMISSIONS } from "./tool-names";
@@ -26,12 +27,19 @@ export const toolPrefix = (server: string) =>
 
 // The permissions for an orchestrator whose workspace allows these servers:
 // a bare mcp__<server> rule allows all of that server's tools.
-export function orchestratorPermissions(servers: string[]) {
+//
+// With full access on, the mode is bypassPermissions: Claude Code always asks
+// before writing under .claude/ (skills, settings, hooks), and in dontAsk
+// mode that ask is a denial. Off keeps dontAsk and the write guard.
+export function orchestratorPermissions(servers: string[], fullAccess = false) {
   const rules = [...new Set(servers.map((s) => s.trim()).filter(Boolean))].map(
     toolPrefix
   );
   return {
     ...ORCHESTRATOR_PERMISSIONS,
+    permissionMode: (fullAccess
+      ? "bypassPermissions"
+      : ORCHESTRATOR_PERMISSIONS.permissionMode) as PermissionMode,
     allowedTools: [...ORCHESTRATOR_PERMISSIONS.allowedTools, ...rules],
   };
 }

package/lib/orchestrator/worker.ts

@@ -12,6 +12,7 @@ import {
 } from "./tools";
 import type { RoleExtras } from "../chat/worker/extras";
 import { refreshSettings } from "../chat/refresh";
+import { orchestratorFullAccess } from "./full-access";
 import { orchestratorToolRefusal } from "./write-guard";
 
 // What an orchestrator's chat worker starts with on top of any chat: its
@@ -22,7 +23,8 @@ export async function orchestratorExtras(
 ): Promise<RoleExtras> {
   const baseUrl = agentEnv(session.id).AGENTOS_URL;
   const permissions = orchestratorPermissions(
-    getWorkspace(session.workspace_id ?? "")?.orch_mcp_servers ?? []
+    getWorkspace(session.workspace_id ?? "")?.orch_mcp_servers ?? [],
+    orchestratorFullAccess(session)
   );
   return {
     systemAppend: await loadOrchestratorBrief(session),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.752",
+  "version": "0.3.756",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"