ai-agentmanager 1.11.1 → 1.13.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 1.13.0 (2026-11-01)
+
+- **Agents are built in an agent session.** **+ Build an agent** now starts an agent session that works in the new agent's folder (`~/.agentmanager/built/<name>/`) and goes straight to it. The session writes the analysis (`analysis.json`), `agent.yaml`, `instructions.md` and `tests.yaml`, and checks that the agent loads. You keep shaping the agent in that conversation, like any other session (terminal, resume, inbox).
+- The session's page has a panel for its agent: status, tests, **Run tests**, **Start**/**Stop**, its chat, **Details**. Failing tests go back to the session with **Ask this session to fix them**.
+- In the Built tab, each agent links to its session. The details dialog has a box that sends a change request to the session. Agents built before this get **Open a session for it**.
+- Test results and executables built before the agent's latest change are marked as out of date. Deleting a built agent closes its session; the conversation is kept.
+- **Fixes from building a real agent:**
+  - A permission prompt is now flagged when newer Claude Code blinks a ⏺ beside the pending tool call. The blinking used to keep the session looking busy, so the prompt never reached the Inbox. This affects every session, not just build sessions.
+  - agentkit agents can write files under a folder they're allowed: Claude Code ignores `Write(<path>)` allow rules, so each one now also gets its `Edit(<path>)` rule.
+  - The test judge sees the files each test run created or changed, not only the agent's reply, and the Tests list shows them.
+  - Build sessions read the agentkit reference without asking, and write the agent's files with their file tools.
+- The build dialog takes an optional name; otherwise the name comes from the task's first words. `POST /api/builder/:name/change` sends a change request to the session from scripts.
+
+## 1.12.0 (2026-11-01)
+
+- **agentkit (phase 1): agents you build and run.** An agent is a folder with `agent.yaml` (goal, instructions, engine, MCP tools, allow/approve lists, triggers, loop, memory, interfaces); `agentkit run <agent>` runs it continuously. Each input is a run of plan → act → check (acting again on what's left, up to `maxSteps`) → reflect into memory, through an engine's CLI (Claude Code, Codex, Muse Code or an ACP agent), self-contained (only its own MCP servers; none of your personal Claude settings). Triggers: `every`, `cron`, `webhook`, `watch`. Interfaces: a chat page and HTTP API, A2A (agent card and `message/send` / `tasks/get`), ACP on stdio (`agentkit acp`), and an MCP tool (`agentkit mcp`, one tool `ask_<name>`). `agentkit init`, `check`, `run --once`. See [docs/agentkit.md](docs/agentkit.md).
+- **Agent builder:** a **Built** tab with **+ Build an agent**: describe a task or workflow (attachments welcome) and pick an engine; one call designs the agent: an analysis (problem, inputs, outputs, risks), its `agent.yaml` and instructions, suggested MCP tools and 3–5 test cases. Review and edit the spec (checked on save), **Run tests** (each through the real runtime, judged against its expectation), **Start** it on this computer (its chat page and API), **Download** its folder. Built agents live in `~/.agentmanager/built/<name>/`; `/api/builder` for scripts.
+- **Single executables and background service for agents:** `agentkit package <agent> [--platform]` makes one file (macOS arm64/x64, Linux x64/arm64) that runs the agent with no Node or agentkit installed: a Node single executable with the agent's files embedded, built on the official Node binary (downloaded from nodejs.org, checksum-verified, cached). Linux ones build on a Mac. The executable unpacks to `~/.agentkit/<name>/` and takes the same commands (`--once`, `acp`, `mcp`, `check`). `service install|status|uninstall` keeps an agent running in the background (launchd or a systemd user service: started at login, restarted after a crash). In the Built tab: **Build executable** for a platform, with download links.
+- **Approvals and monitoring for agents:** tools on an agent's `approve` list now ask a person instead of being unavailable (Claude Code engine, through `--permission-prompt-tool` and the agent's own approver), on its chat page and in AI Agent Manager's **Inbox**; the first answer decides, silence past `approveTimeout` is a no, and the approve list wins over `allow`. Agents report to AI Agent Manager (runs, cost, results, open approvals; every 30s, at once after a run): the **Built** tab lists them under *Reporting in*. Agents started here report automatically; others connect with `AGENTKIT_REPORT_URL`, `AGENTKIT_REPORT_TOKEN` and, over remote access, `AGENTKIT_REPORT_CERT` (certificate pinning).
+
 ## 1.11.1 (2026-11-01)
 
 - **Copy and paste in terminals on phones:** **Copy** and **Paste** in the terminal's key bar (and in the Terminal's bar). A phone can't select the terminal's text or paste into it directly, so Copy opens its recent output as plain text you can select (or **Copy all**), and Paste reads the clipboard (the phone asks first) or offers a box to paste into, then inserts it as one paste without pressing Enter.

package/bin/agentkit.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// agentkit: run an agent described by agent.yaml (docs/agentkit.md).
+//   agentkit run <agent> [--once "<input>"] [--port N]   triggers, chat page, API and A2A; or one run
+//   agentkit acp <agent>                                  ACP on stdio
+//   agentkit mcp <agent>                                  MCP on stdio (one tool: ask_<name>)
+//   agentkit check <agent>                                validate agent.yaml
+//   agentkit init <folder>                                a starter agent to edit
+import { main } from '../src/agentkit/cli.js';
+
+main(process.argv.slice(2));

package/docs/agentkit.md

@@ -0,0 +1,175 @@
+# agentkit: agents you build, download and run
+
+Status: the runtime, the builder (AI Agent Manager's **Built** tab), single executables, the background service, approvals and reporting to AI Agent Manager are in.
+
+An **agentkit agent** is a folder (or one executable made from it) that does one job continuously: triage new
+support tickets, keep a dependency report current, answer questions about a codebase, run a
+release checklist. It is described by `agent.yaml`, runs its work through an engine's CLI (Claude
+Code, Codex, Muse Code or any ACP agent), uses tools through MCP servers, and can be reached by
+people (a chat page, an HTTP API), by other agents (A2A, MCP) and by editors (ACP).
+
+## agent.yaml
+
+```yaml
+name: ticket-triage                 # lowercase, used for files and URLs
+title: Support ticket triage
+description: Reads new tickets, labels and routes them, drafts a first reply.
+goal: |
+  Every new ticket is labelled, routed to the right team and has a drafted first reply
+  within 10 minutes, without closing or replying on its own.
+instructions: instructions.md       # or inline text: how to do the job, step by step
+engine: claude                      # claude | codex | muse | acp:<name>
+model: sonnet                       # optional, passed to the engine
+workdir: ./work                     # where it works (a repo, a folder); default ./work
+
+tools:                              # MCP servers the engine gets
+  jira:
+    command: npx
+    args: [-y, "@acme/jira-mcp"]
+    env: { JIRA_TOKEN: "${JIRA_TOKEN}" }  # "${VAR}" (quoted) comes from the environment, never stored
+allow: [Read, Grep, "mcp__jira__*"] # tools it may use without asking (engine names);
+                                    # "Edit(./out/**)" lets it write files under ./out only
+approve: ["mcp__jira__transition"]  # tools that need a person's yes (asked in chat / Inbox)
+approveTimeout: 30m                 # no answer by then counts as no
+report:                             # report to AI Agent Manager (or set AGENTKIT_REPORT_*)
+  url: "${AGENTMGR_URL}"
+  token: "${AGENTMGR_REPORT_TOKEN}"
+
+triggers:
+  - every: 10m                      # interval
+  - cron: "0 9 * * 1-5"             # schedule (minute hour day month weekday)
+  - webhook: /hooks/ticket          # POST here starts a run with the body as input
+  - watch: ./inbox                  # a new or changed file starts a run
+
+loop:
+  plan: true                        # think and write a plan before acting
+  check: true                       # verify the result against the goal after acting
+  maxSteps: 6                       # act/check rounds per run before stopping
+  budgetUsd: 0.50                   # per run (when the engine reports cost)
+
+memory: true                        # keep notes between runs (memory.md)
+
+interfaces:
+  http: { port: 7700 }              # chat page + API
+  a2a: true                         # agent card + tasks over HTTP
+  acp: true                         # `<agent> acp` speaks ACP on stdio
+  mcp: true                         # `<agent> mcp` exposes it as an MCP tool
+```
+
+## Building one in AI Agent Manager
+
+**Built → + Build an agent** takes a task or workflow (attachments welcome), the engine it runs on and an optional name. It starts an **agent session** whose folder is the new agent (`~/.agentmanager/built/<name>/`), and opens that session. The session writes the agent and checks that it loads (`agentkit check`):
+
+- `analysis.json`: the problem, inputs, outputs, risks and the MCP tools it chose
+- `agent.yaml`
+- `instructions.md`
+- `tests.yaml`: 3 to 8 `{input, expect}` cases
+
+It asks you what only you know: accounts, labels, teams. You keep developing the agent in that conversation.
+
+The session's page shows a panel for its agent: status and test results, with **Run tests** (each test runs through the real runtime and is judged against `expect`), **Start**/**Stop** (runs it continuously on this computer, with its chat page and API) and **Details**. Failing tests can go straight back to the session. The Built tab lists every built agent with a link to its session. Its details dialog sends change requests to the session and has the spec, executables and downloads. Results and executables from before the latest change are marked out of date.
+
+## A run
+
+1. **Input** arrives: a trigger fires (with its payload), someone chats, an A2A task or an MCP
+   call comes in.
+2. **Plan** (when `loop.plan`): the engine reads the goal, instructions, memory and input and
+   writes a short plan.
+3. **Act**: the engine carries out the plan with its tools (MCP), in `workdir`.
+4. **Check** (when `loop.check`): the engine is asked whether the goal is met for this input,
+   and what's left. If not and steps remain, it acts again on what's left.
+5. **Reflect** (when `memory`): one or two lessons for next time are appended to memory.
+6. **Result**: the final answer goes back to whoever asked; the run (steps, output, cost,
+   duration) is logged in `runs/<id>.jsonl`.
+
+The engine keeps one session per conversation (a chat, an A2A context), so follow-ups continue
+it. Runs from triggers start fresh sessions.
+
+## Interfaces
+
+- **HTTP**: `GET /` chat page; `POST /api/chat {message, conversation?}`; `POST /api/runs {input}`;
+  `GET /api/runs`, `GET /api/runs/:id`; `GET /api/health`.
+- **A2A**: agent card at `GET /.well-known/agent.json`; JSON-RPC at `POST /a2a` with
+  `message/send` and `tasks/get`.
+- **ACP**: `<agent> acp` runs an ACP agent on stdio (initialize, session/new, session/prompt,
+  streamed session/update), so editors (and AI Agent Manager's ACP engine) can drive it.
+- **MCP**: `<agent> mcp` runs an MCP server on stdio with one tool, `ask_<name>`, so other
+  agents can delegate to it.
+
+## Running
+
+`agentkit run ./ticket-triage` (or, packaged, `./ticket-triage`) starts it in the foreground:
+triggers, the HTTP server, the loop. `agentkit run … --once "<input>"` does one run and prints
+the result.
+
+In the background: `agentkit service install ./ticket-triage` (packaged: `./ticket-triage service
+install`) registers it with launchd (macOS) or systemd (Linux, a user service): it starts at login,
+restarts after a crash, and writes to `agent.log` in its folder. It runs through your login shell,
+so it finds the engine CLIs and tokens your terminal has. `service status` and `service uninstall`
+do the rest. On Linux, `loginctl enable-linger $USER` keeps it running while you're logged out.
+
+## One executable
+
+`agentkit package ./ticket-triage [--platform linux-x64] [-o dist]` makes one file that runs the
+agent with no Node or agentkit installed: `ticket-triage-macos-arm64`, `-macos-x64`,
+`-linux-x64` or `-linux-arm64` (about 110 MB; Windows isn't supported yet). It is a Node single
+executable application: the runtime bundled, the agent's files (`agent.yaml`, instructions,
+tests) embedded, injected into the official Node binary for that platform (downloaded once from
+nodejs.org, checked against its published checksums, cached in `~/.agentmanager/node-dist`).
+Linux executables build on any Mac or Linux machine; macOS ones are signed, so they build on a Mac.
+
+On its first run, the executable unpacks its files to `~/.agentkit/<name>/` (or `AGENTKIT_HOME`),
+where its memory and runs live too. Edits there stay until a newer build of the agent replaces the
+files it shipped. Everything else works as with the folder: `./ticket-triage` (run),
+`--once "<input>"`, `acp`, `mcp`, `check`, `service install`. Its engine's CLI (Claude Code, Codex
+or Muse Code) must be installed and signed in where it runs. ACP engines aren't packaged yet.
+
+In AI Agent Manager, a built agent's dialog has **Build executable** (pick the platform) and a
+download link for each one built. Editing the agent drops the old executables.
+
+## Approvals
+
+A tool on the `approve` list runs only after a person says yes. The approve list wins over
+`allow`: with `allow: ["mcp__jira__*"]` and `approve: ["mcp__jira__transition"]`, every Jira tool
+runs freely except transitions, which ask.
+
+With Claude Code as the engine, the agent passes `--permission-prompt-tool` to point Claude at a
+small MCP server of its own (the approver). Claude asks the approver before any tool it isn't
+allowed outright. The approver hands the question to the running agent over a private local
+address, and the agent asks whoever can answer:
+
+- **its chat page**, which shows *Approve …?* with the tool's input and Approve / Deny buttons
+  (`GET /api/approvals`, `POST /api/approvals/<id>` with `{"allow": true}`);
+- **AI Agent Manager**, when the agent reports there: the request shows up in the **Inbox** and the
+  **Built** tab, and the answer goes back with the agent's next check-in (every 2 seconds while
+  something waits).
+
+The first answer decides. No answer within `approveTimeout` (default 30m) counts as no, and so does
+having no one to ask (no chat page, not reporting). Tools on neither list are refused without
+asking. Other engines can't ask mid-run, so for them approval tools aren't available at all. Test
+runs in the builder never wait for anyone.
+
+## Reporting to AI Agent Manager
+
+An agent that reports sends AI Agent Manager who it is (name, host, engine, triggers, chat
+address), each run (status, source, cost, time, the start of its result) and the approvals it's
+waiting on. It checks in every 30 seconds, and right away after a run or a new approval. The
+**Built** tab lists these agents under *Reporting in*: online or last seen, idle or working, runs,
+failures and total cost, recent runs, and approvals to answer. Runs are counted once; the list is
+kept across restarts.
+
+Agents started from the Built tab report automatically. For one running elsewhere (a packaged
+executable on a server, a folder on another Mac), **Connect one from elsewhere** shows what to set
+in its environment (or its service):
+
+```
+AGENTKIT_REPORT_URL=https://192.168.1.20:4718     # AI Agent Manager's remote-access address
+AGENTKIT_REPORT_TOKEN=…                           # the report token (made on first use)
+AGENTKIT_REPORT_CERT=AB:CD:…                      # its certificate's SHA-256 fingerprint
+```
+
+Remote access uses a self-signed certificate, so the agent trusts exactly that certificate (by
+its fingerprint) and sends nothing until the fingerprint matches. The connection details are shown
+only on the computer AI Agent Manager runs on. The report token lets a program report as an agent
+and receive the decisions made for it, and nothing else in AI Agent Manager; keep it like a
+password (give each computer the same one, or rotate it by deleting `~/.agentmanager/agentkit-reports.json`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-agentmanager",
-  "version": "1.11.1",
+  "version": "1.13.0",
   "description": "Run background coding agents (Claude Code, Codex) per intent, and keep track of them from a web UI, your phone or the CLI",
   "keywords": [
     "claude",
@@ -23,7 +23,8 @@
   "license": "Apache-2.0",
   "type": "module",
   "bin": {
-    "agentmgr": "bin/agentmgr.js"
+    "agentmgr": "bin/agentmgr.js",
+    "agentkit": "bin/agentkit.js"
   },
   "files": [
     "bin",
@@ -51,11 +52,14 @@
     "@xterm/xterm": "^6.0.0",
     "commander": "^15.0.0",
     "dompurify": "^3.4.17",
+    "esbuild": "^0.25.12",
     "express": "^5.2.1",
     "marked": "^18.0.14",
     "mermaid": "^12.2.0",
     "node-pty": "^1.1.0",
+    "postject": "^1.0.0-alpha.6",
     "qrcode": "^1.5.4",
-    "ws": "^8.22.0"
+    "ws": "^8.22.0",
+    "yaml": "^2.9.1"
   }
 }

package/public/app.js

@@ -7,6 +7,7 @@ import { openStream, post, REMOTE } from '/transport.js';
 import { attachBox } from '/attach.js';
 import { initSide } from '/side.js';
 import { openCopy, pasteInto } from '/termclip.js';
+import { initBuilt } from '/built.js';
 import { addTools, download, htmlFile, initExport } from '/export.js';
 import { badgeHtml as scoreBadge, scorecardHtml, scorecardSpeech } from '/scorecard.js';
 import { bindListen, listenHtml, play, speakable, now as speaking, stop as stopSpeaking } from '/speak.js';
@@ -125,6 +126,15 @@ $('#new-playbook').onclick = () => {
   playbooksUi.open({ intent: f.intents.value.trim(), projects: f.project.value.trim() ? [f.project.value.trim()] : [], model: f.model.value.trim(), permissionMode: f.permissionMode.value });
 };
 $('#triggers-open').onclick = () => triggersUi.open();
+let builtReports = []; // agents built with agentkit that report here (runs, approvals)
+const builtUi = initBuilt({
+  api, esc, toast, $,
+  isOpen: () => sideTab === 'built',
+  setCount: (n) => ($('#built-count').textContent = n),
+  reports: () => builtReports,
+  openSession: (id) => (showTab('agents'), select(id)),
+  onPanel: () => agents.get(selectedId)?.builds && renderDetail(),
+});
 const landUi = initLand({ api, esc, toast, agents, $, scoreBadge, select: (id) => (showTab('agents'), select(id)), openReview: (id) => reviewUi.open(id), isOpen: () => sideTab === 'land' });
 
 function statusOf(a) {
@@ -710,7 +720,7 @@ function agentItem(a) {
   const idle = !isActive(a);
   return `<li data-id="${a.id}" ${a.kind === 'general' || a.kind === 'assistant' ? '' : 'draggable="true" '}class="agent pr${a.priority ?? 2} ${a.id === selectedId ? 'selected' : ''} ${idle ? 'idle' : ''}">
     <div class="line1">${prioChip(a.priority ?? 2)}${a.results?.outcome === 'blocked' ? '<span class="outcome-mark" title="Blocked">⛔</span>' : a.results?.outcome === 'done' ? '<span class="outcome-mark" title="Done">✅</span>' : ''}<span class="name">${esc(a.name)}</span>${flags(a)}<span class="pill ${st}">${pillText(st)}</span></div>
-    <div class="intent" title="${esc(describeTitle(a) ?? '')}">${a.kind === 'general' ? '<span class="tag">general</span> ' : a.kind === 'assistant' ? '<span class="tag assistant">assistant</span> ' : a.startedBy ? '<span class="tag assistant" title="Started by the assistant">🤖 by assistant</span> ' : a.trigger ? `<span class="tag assistant" title="Started from ${a.trigger.source === 'github' ? 'a labeled GitHub issue' : 'the webhook'}${a.trigger.url ? `: ${esc(a.trigger.url)}` : ''}">⚡ ${a.trigger.source === 'github' ? 'GitHub' : 'webhook'}</span> ` : a.playbook ? `<span class="tag assistant" title="Started by the playbook ${esc(a.playbook.name)}">▶ ${esc(a.playbook.name)}</span> ` : ''}${a.engine && a.engine !== 'claude' ? `<span class="tag engine">${esc(ENGINE_LABEL[a.engine] ?? a.engine)}</span> ` : ''}${a.isolation === 'container' ? '<span class="tag engine" title="Runs in its own Docker container: it sees only its own folder">📦 container</span> ' : ''}${esc(describe(a) || (a.kind === 'assistant' ? 'Finds new work and starts agents for it' : 'General session'))}</div>
+    <div class="intent" title="${esc(describeTitle(a) ?? '')}">${a.builds ? `<span class="tag assistant" title="Develops the agent ${esc(a.builds.name)} (Built tab)">⚙ builds agent</span> ` : ''}${a.kind === 'general' ? '<span class="tag">general</span> ' : a.kind === 'assistant' ? '<span class="tag assistant">assistant</span> ' : a.startedBy ? '<span class="tag assistant" title="Started by the assistant">🤖 by assistant</span> ' : a.trigger ? `<span class="tag assistant" title="Started from ${a.trigger.source === 'github' ? 'a labeled GitHub issue' : 'the webhook'}${a.trigger.url ? `: ${esc(a.trigger.url)}` : ''}">⚡ ${a.trigger.source === 'github' ? 'GitHub' : 'webhook'}</span> ` : a.playbook ? `<span class="tag assistant" title="Started by the playbook ${esc(a.playbook.name)}">▶ ${esc(a.playbook.name)}</span> ` : ''}${a.engine && a.engine !== 'claude' ? `<span class="tag engine">${esc(ENGINE_LABEL[a.engine] ?? a.engine)}</span> ` : ''}${a.isolation === 'container' ? '<span class="tag engine" title="Runs in its own Docker container: it sees only its own folder">📦 container</span> ' : ''}${esc(describe(a) || (a.kind === 'assistant' ? 'Finds new work and starts agents for it' : 'General session'))}</div>
     ${a.status === 'preparing' && a.progress ? `<div class="progress-line">${esc(progressText(a.progress))}</div>` : ''}
     <div class="meta">
       <span class="mono">${a.id}</span>
@@ -922,6 +932,8 @@ function showTab(tab) {
   $('#backlog-view').hidden = tab !== 'backlog';
   $('#inbox-view').hidden = tab !== 'inbox';
   $('#land-view').hidden = tab !== 'land';
+  $('#built-view').hidden = tab !== 'built';
+  if (tab === 'built') builtUi.load();
   if (tab === 'inbox') loadJudge();
   if (tab === 'land') landUi.load();
   renderBacklog();
@@ -1001,7 +1013,7 @@ function flags(a) {
 }
 
 const TRIAGED = { now: 'sent (AI: urgent)', digest: 'held for the digest', skip: 'dropped by the AI judge' };
-const NEED_ORDER = { prompt: 0, waiting: 1, plan: 1, question: 1, team: 1, review: 2, stuck: 3, conflict: 4 };
+const NEED_ORDER = { approval: 0, prompt: 0, waiting: 1, plan: 1, question: 1, team: 1, review: 2, stuck: 3, conflict: 4 };
 /** What an agent needs from the user. `both`: overlaps on both agents (detail), else only the one that should rebase (inbox). */
 function needsFor(a, { both = false } = {}) {
   const items = [];
@@ -1021,23 +1033,34 @@ function teamNeeds() {
     .filter((t) => ['ready', 'blocked'].includes(t.stage) && agents.has(teamOwner(t)))
     .map((t) => ({ a: agents.get(teamOwner(t)), kind: 'team', key: `team:${t.id}`, t }));
 }
+/** Tools that built agents (agentkit) wait to run until someone approves. */
+function approvalNeeds() {
+  return builtReports.flatMap((r) => r.pending.map((p) => ({ a: { id: r.key, name: r.title, priority: 1 }, kind: 'approval', key: `approval:${r.key}:${p.id}`, r, p })));
+}
 function inboxItems() {
-  return [...[...agents.values()].flatMap((a) => needsFor(a)), ...teamNeeds()]
+  return [...approvalNeeds(), ...[...agents.values()].flatMap((a) => needsFor(a)), ...teamNeeds()]
     .sort((x, y) => NEED_ORDER[x.kind] - NEED_ORDER[y.kind] || (x.a.priority ?? 2) - (y.a.priority ?? 2));
 }
 
-const NEED_LABEL = { team: 'Team', prompt: 'Needs input', waiting: 'Waiting on you', plan: 'Plan review', question: 'Question', review: 'AI review', stuck: 'Stuck?', conflict: 'Overlap' };
+const NEED_LABEL = { approval: 'Approval', team: 'Team', prompt: 'Needs input', waiting: 'Waiting on you', plan: 'Plan review', question: 'Question', review: 'AI review', stuck: 'Stuck?', conflict: 'Overlap' };
 /** Why the AI judge thinks so, as a small tag. */
 const aiTag = (confidence, what = 'AI') => `<span class="tag ai" title="Judged by a model from the agent's activity; your reactions tune later calls">🤖 ${what}${confidence != null ? ` ${Math.round(confidence * 100)}%` : ''}</span>`;
 function needCard(it, { inDetail = false } = {}) {
   const { a } = it;
   const who = inDetail
     ? ''
+    : it.kind === 'approval'
+    ? `<a href="#" class="need-agent" data-ib="built-open">⚙ ${esc(a.name)}</a> <span class="hint">${esc(it.r.host)}</span>`
     : `<a href="#${a.id}" class="need-agent" data-goto="${a.id}">${prioChip(a.priority ?? 2)}${esc(a.name)}</a>${a.projectInfo?.name ? ` <span class="hint">${esc(a.projectInfo.name)}</span>` : ''}`;
   const head = `<div class="need-head"><span class="need-kind ${it.kind}">${NEED_LABEL[it.kind]}</span>${who}</div>`;
   const draft = (k, fallback = '') => esc(needDrafts.get(`${it.key}:${k}`) ?? fallback);
   let body = '';
-  if (it.kind === 'prompt') {
+  if (it.kind === 'approval') {
+    const p = it.p;
+    body = `<p class="need-title">Wants to run <code>${esc(p.tool)}</code> <span class="hint">asked ${ago(p.at)}</span></p>
+      <pre class="need-input">${esc(JSON.stringify(p.input, null, 2).slice(0, 1500))}</pre>
+      <div class="need-actions"><button class="small primary" data-ib="approve" data-allow="1">Approve</button><button class="small" data-ib="approve">Deny</button>${it.r.chat ? `<a class="button small ghost" href="${esc(it.r.chat)}" target="_blank" rel="noopener">Its chat ↗</a>` : ''}</div>`;
+  } else if (it.kind === 'prompt') {
     const p = a.runtime.prompt;
     body = `<p class="need-title">${esc(p?.question || a.runtime.attention)}</p>
       <div class="need-actions">
@@ -1141,7 +1164,7 @@ function judgeLine() {
 
 function renderInbox() {
   const items = inboxItems();
-  const urgent = items.filter((i) => i.kind === 'prompt' || i.kind === 'question' || i.kind === 'waiting').length;
+  const urgent = items.filter((i) => i.kind === 'approval' || i.kind === 'prompt' || i.kind === 'question' || i.kind === 'waiting').length;
   $('#inbox-count').textContent = items.length ? String(items.length) : '';
   $('#inbox-count').className = `badge ${urgent ? 'attention' : ''}`;
   if (sideTab !== 'inbox') return;
@@ -1175,6 +1198,14 @@ async function onNeed(e) {
   const id = card.dataset.agent;
   const key = card.dataset.need;
   switch (el.dataset.ib) {
+    case 'built-open':
+      return showTab('built');
+    case 'approve': {
+      const [, , pid] = key.match(/^approval:(.+):([^:]+)$/);
+      return act(async () => {
+        await api('POST', `/agentkit/agents/${encodeURIComponent(id)}/approvals/${encodeURIComponent(pid)}`, { allow: el.dataset.allow === '1' });
+      }, el.dataset.allow === '1' ? 'Approved; the agent goes on' : 'Declined');
+    }
     case 'key':
       return act(() => api('POST', `/agents/${id}/prompt-key`, { key: el.dataset.key }), 'Sent');
     case 'terminal':
@@ -1719,6 +1750,7 @@ function renderDetail() {
     ${a.runtime.attention ? `<div class="error-box">${esc(a.runtime.attention)}: the agent is waiting for an answer. Open its terminal to respond.</div>` : ''}
     ${raceBanner(a)}
     ${teamBanner(a)}
+    ${a.builds ? builtUi.panel(a) : ''}
     ${a.forkOf ? `<div class="bl-banner">⑂ Forked from <a href="#${a.forkOf.agentId}" data-goto="${a.forkOf.agentId}">${esc(a.forkOf.name)}</a>${a.forkOf.checkpoint ? ` at checkpoint ${a.forkOf.checkpoint}` : ''} ${ago(a.forkOf.at)}</div>` : ''}
     ${(() => {
       const items = needsFor(a, { both: true });
@@ -3604,6 +3636,8 @@ function handleEvent(msg) {
     for (const r of msg.races ?? []) races.set(r.id, r);
     teams.clear();
     for (const t of msg.teams ?? []) teams.set(t.id, t);
+    builtReports = msg.built ?? [];
+    builtUi.render();
     msg.agents.forEach(watchDocs);
     if (selectedId && !agents.has(selectedId)) selectedId = null;
     if (openTermOnLoad && selectedId) {
@@ -3615,6 +3649,7 @@ function handleEvent(msg) {
     agents.set(msg.agent.id, msg.agent);
     watchDocs(msg.agent);
     agentChanged(msg.agent);
+    if (msg.agent.builds) builtUi.sessionChanged(msg.agent);
   } else if (msg.t === 'removed') {
     agents.delete(msg.id);
     if (selectedId === msg.id) select(null);
@@ -3626,6 +3661,9 @@ function handleEvent(msg) {
     teams.set(msg.team.id, msg.team);
   } else if (msg.t === 'team-removed') {
     teams.delete(msg.id);
+  } else if (msg.t === 'built') {
+    builtReports = msg.reports;
+    builtUi.render();
   } else if (msg.t === 'backlog') {
     backlogState = msg.backlog;
   } else if (msg.t === 'projects') {