ai-agentmanager 1.13.0 → 1.14.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.14.0 (2026-11-02)
+
+- **Fewer questions: approval rules.** When you allow the same command 3 times in a repo (`npm test`, an MCP tool, fetching from a site), the inbox offers **Always allow**. Allowed rules go to every Claude Code agent in that repo at launch and answer its open prompts, including the ones waiting when you allow it. Never offered for compound commands or ones that delete, escalate, publish or reach the network. Settings → Approval rules and `agentmgr rules` list them, with how many prompts each answered, and remove them.
+- **Prompt cards say what they ask about:** "Wants to run `npm test`" (from the session's transcript) instead of only "Do you want to proceed?".
+- **Yes to all:** several agents waiting on the same command get one card that answers them together.
+- **Built agents' tests run in a throwaway copy** of the agent's folder: what a run writes (summaries, changed fixtures, memory) no longer stays in the agent or changes the next test's starting point. The copy keeps the agent's memory, not its engine sessions or run logs. A `workdir` outside the agent's folder is still used in place.
+
 ## 1.13.0 (2026-11-01)
 
 - **Agents are built in an agent session.** **+ Build an agent** now starts an agent session that works in the new agent's folder (`~/.agentmanager/built/<name>/`) and goes straight to it. The session writes the analysis (`analysis.json`), `agent.yaml`, `instructions.md` and `tests.yaml`, and checks that the agent loads. You keep shaping the agent in that conversation, like any other session (terminal, resume, inbox).

package/README.md

@@ -541,13 +541,16 @@ The **Inbox** tab (and `agentmgr inbox`) lists what needs you, across all agents
 
 | Kind | What it is | How you answer |
 | --- | --- | --- |
-| Needs input | A permission prompt or question menu is open in the agent's terminal | Click a choice (1, 2, 3, Esc); no need to open the terminal |
+| Needs input | A permission prompt or question menu is open in the agent's terminal; for Claude Code, the card shows the command or file it asks about | Click a choice (1, 2, 3, Esc); no need to open the terminal. Several agents waiting on the same command: **Yes to all** |
+| Always allow? | You allowed the same command 3 times in a repo | **Always allow** (agents there stop asking) or **Not now** |
 | Waiting on you | The AI judge read an idle screen and saw a question (or an error) no rule recognized | Click a choice or type an answer; **Not waiting** if it misread |
 | Question | The agent asked something without stopping | Click an option or type an answer |
 | AI review | The agent said it was done and the judge checked the work against the intent and brief | **Send back to finish** (types the missing items in) or **Looks good** |
 | Stuck? | The agent seems to be going in circles | Send the suggested nudge (edit it first if you like) or dismiss |
 | Overlap | It changes the same files as another agent | Tell one or both agents; see the suggested merge order |
 
+**Fewer questions: approval rules.** Each yes you give a permission prompt counts toward the command, per repo (`npm test`, `pytest`, `git status`; an MCP tool; fetching from a site). After 3, the inbox offers to always allow it there. An allowed rule goes to every agent in that repo when it starts (Claude Code's `--allowedTools`), and answers its prompts that are already open, so you aren't asked again. Rules are never offered for commands that chain, redirect or substitute (`&&`, `|`, `>`, `$(…)`), or that delete, escalate, publish or reach the network (`rm`, `sudo`, `git push`, `npm publish`, `curl`…). Settings → Approval rules (or `agentmgr rules`) lists them with how many prompts each answered; **Remove** to be asked again. Stored in `~/.agentmanager/rules.json`; In config.json, `"rules": { "auto": false }` stops rules answering open prompts and `"rules": { "suggestAfter": 5 }` changes the count. Claude Code agents only for now.
+
 **Questions without stopping.** Task agents are told to write questions that don't block all their work to `QUESTIONS.md` next to their brief, with options and the default they'll assume meanwhile, and then keep going:
 
 ```markdown

package/docs/agentkit.md

@@ -67,7 +67,7 @@ interfaces:
 
 It asks you what only you know: accounts, labels, teams. You keep developing the agent in that conversation.
 
-The session's page shows a panel for its agent: status and test results, with **Run tests** (each test runs through the real runtime and is judged against `expect`), **Start**/**Stop** (runs it continuously on this computer, with its chat page and API) and **Details**. Failing tests can go straight back to the session. The Built tab lists every built agent with a link to its session. Its details dialog sends change requests to the session and has the spec, executables and downloads. Results and executables from before the latest change are marked out of date.
+The session's page shows a panel for its agent: status and test results, with **Run tests** (each test runs through the real runtime in a throwaway copy of the agent's folder, so what one run writes doesn't change the agent or the next test, and is judged against `expect` and the files it wrote), **Start**/**Stop** (runs it continuously on this computer, with its chat page and API) and **Details**. Failing tests can go straight back to the session. The Built tab lists every built agent with a link to its session. Its details dialog sends change requests to the session and has the spec, executables and downloads. Results and executables from before the latest change are marked out of date.
 
 ## A run
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-agentmanager",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Run background coding agents (Claude Code, Codex) per intent, and keep track of them from a web UI, your phone or the CLI",
   "keywords": [
     "claude",

package/public/app.js

@@ -127,6 +127,7 @@ $('#new-playbook').onclick = () => {
 };
 $('#triggers-open').onclick = () => triggersUi.open();
 let builtReports = []; // agents built with agentkit that report here (runs, approvals)
+let rulesState = { allowed: [], suggestions: [] }; // approval rules learned from your answers (src/rules.js)
 const builtUi = initBuilt({
   api, esc, toast, $,
   isOpen: () => sideTab === 'built',
@@ -1013,7 +1014,7 @@ function flags(a) {
 }
 
 const TRIAGED = { now: 'sent (AI: urgent)', digest: 'held for the digest', skip: 'dropped by the AI judge' };
-const NEED_ORDER = { approval: 0, prompt: 0, waiting: 1, plan: 1, question: 1, team: 1, review: 2, stuck: 3, conflict: 4 };
+const NEED_ORDER = { approval: 0, prompt: 0, waiting: 1, plan: 1, question: 1, team: 1, rule: 2, review: 2, stuck: 3, conflict: 4 };
 /** What an agent needs from the user. `both`: overlaps on both agents (detail), else only the one that should rebase (inbox). */
 function needsFor(a, { both = false } = {}) {
   const items = [];
@@ -1037,20 +1038,49 @@ function teamNeeds() {
 function approvalNeeds() {
   return builtReports.flatMap((r) => r.pending.map((p) => ({ a: { id: r.key, name: r.title, priority: 1 }, kind: 'approval', key: `approval:${r.key}:${p.id}`, r, p })));
 }
+/** The repo a rule belongs to, short: its last two path parts. */
+const repoLabel = (k) => String(k).replace(/^dir:/, '').split('/').filter(Boolean).slice(-2).join('/');
+/** Commands you keep allowing in a repo, offered as a standing rule. */
+function ruleNeeds() {
+  return rulesState.suggestions.map((r) => ({ a: { id: 'rules', name: repoLabel(r.repo), priority: 2 }, kind: 'rule', key: `rule:${r.repo}:${r.rule}`, r }));
+}
 function inboxItems() {
-  return [...approvalNeeds(), ...[...agents.values()].flatMap((a) => needsFor(a)), ...teamNeeds()]
+  return [...approvalNeeds(), ...[...agents.values()].flatMap((a) => needsFor(a)), ...teamNeeds(), ...ruleNeeds()]
     .sort((x, y) => NEED_ORDER[x.kind] - NEED_ORDER[y.kind] || (x.a.priority ?? 2) - (y.a.priority ?? 2));
 }
 
-const NEED_LABEL = { approval: 'Approval', team: 'Team', prompt: 'Needs input', waiting: 'Waiting on you', plan: 'Plan review', question: 'Question', review: 'AI review', stuck: 'Stuck?', conflict: 'Overlap' };
+const NEED_LABEL = { rule: 'Always allow?', approval: 'Approval', team: 'Team', prompt: 'Needs input', waiting: 'Waiting on you', plan: 'Plan review', question: 'Question', review: 'AI review', stuck: 'Stuck?', conflict: 'Overlap' };
 /** Why the AI judge thinks so, as a small tag. */
 const aiTag = (confidence, what = 'AI') => `<span class="tag ai" title="Judged by a model from the agent's activity; your reactions tune later calls">🤖 ${what}${confidence != null ? ` ${Math.round(confidence * 100)}%` : ''}</span>`;
+/** What a permission prompt asks about: the command, file or tool. */
+const toolLine = (t) => (t.name === 'Bash' ? `Wants to run <code>${esc(t.text)}</code>` : `Wants to use ${esc(t.name)}${t.text ? ` <code>${esc(t.text)}</code>` : ''}`);
+/** Agents waiting on the same command, answered together. */
+function promptGroups(items) {
+  const groups = new Map();
+  for (const it of items) {
+    const p = it.kind === 'prompt' && it.a.runtime.prompt;
+    if (!p?.tool || p.choices?.[0]?.key !== '1' || !/^yes\b/i.test(p.choices[0].label)) continue;
+    const k = `${p.tool.name}\0${p.tool.text}`;
+    (groups.get(k) ?? groups.set(k, []).get(k)).push(it);
+  }
+  return [...groups.values()].filter((g) => g.length > 1);
+}
+function groupCard(g) {
+  const t = g[0].a.runtime.prompt.tool;
+  const names = g.map((it) => `<a href="#${it.a.id}" data-goto="${it.a.id}">${esc(it.a.name)}</a>`).join(', ');
+  return `<div class="need prompt group" data-need="group:${esc(g.map((it) => it.a.id).join(','))}" data-agents="${esc(g.map((it) => it.a.id).join(','))}">
+    <div class="need-head"><span class="need-kind prompt">${g.length} agents</span></div>
+    <p class="need-title">${toolLine(t)}</p><p class="hint">${names}</p>
+    <div class="need-actions"><button class="small primary" data-ib="yes-all">Yes to all ${g.length}</button></div></div>`;
+}
 function needCard(it, { inDetail = false } = {}) {
   const { a } = it;
   const who = inDetail
     ? ''
     : it.kind === 'approval'
     ? `<a href="#" class="need-agent" data-ib="built-open">⚙ ${esc(a.name)}</a> <span class="hint">${esc(it.r.host)}</span>`
+    : it.kind === 'rule'
+    ? `<span class="need-agent" title="${esc(it.r.repo)}">${esc(a.name)}</span>`
     : `<a href="#${a.id}" class="need-agent" data-goto="${a.id}">${prioChip(a.priority ?? 2)}${esc(a.name)}</a>${a.projectInfo?.name ? ` <span class="hint">${esc(a.projectInfo.name)}</span>` : ''}`;
   const head = `<div class="need-head"><span class="need-kind ${it.kind}">${NEED_LABEL[it.kind]}</span>${who}</div>`;
   const draft = (k, fallback = '') => esc(needDrafts.get(`${it.key}:${k}`) ?? fallback);
@@ -1060,9 +1090,13 @@ function needCard(it, { inDetail = false } = {}) {
     body = `<p class="need-title">Wants to run <code>${esc(p.tool)}</code> <span class="hint">asked ${ago(p.at)}</span></p>
       <pre class="need-input">${esc(JSON.stringify(p.input, null, 2).slice(0, 1500))}</pre>
       <div class="need-actions"><button class="small primary" data-ib="approve" data-allow="1">Approve</button><button class="small" data-ib="approve">Deny</button>${it.r.chat ? `<a class="button small ghost" href="${esc(it.r.chat)}" target="_blank" rel="noopener">Its chat ↗</a>` : ''}</div>`;
+  } else if (it.kind === 'rule') {
+    body = `<p class="need-title">You've allowed <code>${esc(it.r.label)}</code> ${it.r.n} times in this repo. Always allow it here?</p>
+      <p class="hint">Agents in ${esc(a.name)} won't ask about it again. Remove it any time in Settings → Approval rules.</p>
+      <div class="need-actions"><button class="small primary" data-ib="rule-accept">Always allow</button><button class="small" data-ib="rule-dismiss">Not now</button></div>`;
   } else if (it.kind === 'prompt') {
     const p = a.runtime.prompt;
-    body = `<p class="need-title">${esc(p?.question || a.runtime.attention)}</p>
+    body = `${p?.tool ? `<p class="need-title">${toolLine(p.tool)}</p><p class="hint">${esc(p.question || a.runtime.attention)}</p>` : `<p class="need-title">${esc(p?.question || a.runtime.attention)}</p>`}
       <div class="need-actions">
         ${(p?.choices ?? []).map((c) => `<button class="small ${c.key === '1' ? 'primary' : ''}" data-ib="key" data-key="${c.key}">${c.key}. ${esc(c.label)}</button>`).join('')}
         <button class="small" data-ib="key" data-key="esc" title="Escape">Esc</button>
@@ -1171,7 +1205,7 @@ function renderInbox() {
   const view = $('#inbox-view');
   if (view.contains(document.activeElement) && document.activeElement.dataset.draft) return; // don't yank the field being typed in
   view.innerHTML = items.length
-    ? `<div class="counts"><span>${items.length} waiting on you</span></div><div class="needs inbox">${items.map((it) => needCard(it)).join('')}</div>`
+    ? `<div class="counts"><span>${items.length} waiting on you</span></div><div class="needs inbox">${promptGroups(items).map(groupCard).join('')}${items.map((it) => needCard(it)).join('')}</div>`
     : `<div class="empty"><p>Nothing needs you right now.</p><p>Prompts waiting for an answer, questions agents ask, agents that seem stuck and agents editing the same files show up here.</p></div>`;
   view.insertAdjacentHTML('beforeend', judgeLine());
 }
@@ -1208,6 +1242,19 @@ async function onNeed(e) {
     }
     case 'key':
       return act(() => api('POST', `/agents/${id}/prompt-key`, { key: el.dataset.key }), 'Sent');
+    case 'yes-all': {
+      const ids = card.dataset.agents.split(',');
+      return act(() => Promise.all(ids.map((x) => api('POST', `/agents/${x}/prompt-key`, { key: '1' }))), `Allowed for ${ids.length} agents`);
+    }
+    case 'rule-accept':
+    case 'rule-dismiss': {
+      const [, repo, rule] = key.match(/^rule:(.+?):((?:Bash|WebFetch|mcp__).*)$/) ?? [];
+      const accept = el.dataset.ib === 'rule-accept';
+      return act(async () => {
+        rulesState = await api('POST', `/rules/${accept ? 'accept' : 'dismiss'}`, { repo, rule });
+        renderInbox();
+      }, accept ? 'Allowed in this repo; agents there won\'t ask again' : 'Won\'t suggest it again');
+    }
     case 'terminal':
       showTab('agents');
       select(id);
@@ -3637,6 +3684,7 @@ function handleEvent(msg) {
     teams.clear();
     for (const t of msg.teams ?? []) teams.set(t.id, t);
     builtReports = msg.built ?? [];
+    if (msg.rules) rulesState = msg.rules;
     builtUi.render();
     msg.agents.forEach(watchDocs);
     if (selectedId && !agents.has(selectedId)) selectedId = null;
@@ -3661,6 +3709,8 @@ function handleEvent(msg) {
     teams.set(msg.team.id, msg.team);
   } else if (msg.t === 'team-removed') {
     teams.delete(msg.id);
+  } else if (msg.t === 'rules') {
+    rulesState = msg.rules;
   } else if (msg.t === 'built') {
     builtReports = msg.reports;
     builtUi.render();

package/public/index.html

@@ -745,6 +745,11 @@
           <label class="check">Keep at most <input type="number" name="maxRunning" min="1" max="500" placeholder="no limit" class="num" /> agents open at once</label>
           <p class="hint">Above it, the agents idle longest are closed (they resume when you open them), so the machine stays responsive. Never closed: agents working, waiting for your answer, active in the last 5 minutes, marked Keep, or in a team that is still going. <span id="settings-running"></span></p>
         </fieldset>
+        <fieldset id="settings-rules">
+          <legend>Approval rules</legend>
+          <p class="hint">Commands you chose to always allow in a repo. Agents there run them without asking. After you allow the same command 3 times, the inbox offers a rule.</p>
+          <ul id="settings-rules-list" class="rules-list"></ul>
+        </fieldset>
         <fieldset class="local-only" id="settings-service">
           <legend>Start at login</legend>
           <label class="check"><input type="checkbox" name="startAtLogin" /> Start AI Agent Manager when I log in</label>

package/public/menu.js

@@ -92,6 +92,7 @@ export function initMenu({ api, esc, toast, $ }) {
       form.maxRunning.value = c.maxRunning ?? '';
       $('#settings-running').textContent = `Open now: ${c.running}.`;
       service = null;
+      showRules(await api('GET', '/rules').catch(() => null));
       const u = await api('GET', '/update').catch(() => null);
       form.updateCheck.checked = u?.check !== false;
       if (!remote()) {
@@ -115,6 +116,23 @@ export function initMenu({ api, esc, toast, $ }) {
       toast(`Error: ${err.message}`, 5000);
     }
   };
+  /** Allowed rules, newest first, each with what it has saved and a Remove button. */
+  const showRules = (r) => {
+    const list = [...(r?.allowed ?? [])].sort((a, b) => String(b.at).localeCompare(String(a.at)));
+    $('#settings-rules-list').innerHTML = list.length
+      ? list.map((x) => `<li><code>${esc(x.label)}</code> <span class="hint">in ${esc(String(x.repo).replace(/^dir:/, '').split('/').filter(Boolean).slice(-2).join('/'))}${x.uses ? ` · answered ${x.uses} prompt${x.uses === 1 ? '' : 's'}` : ''}</span> <button type="button" class="small ghost" data-rule-remove="${esc(x.rule)}" data-repo="${esc(x.repo)}">Remove</button></li>`).join('')
+      : '<li class="hint">None yet.</li>';
+  };
+  $('#settings-rules-list').addEventListener('click', async (e) => {
+    const b = e.target.closest('[data-rule-remove]');
+    if (!b) return;
+    try {
+      showRules(await api('POST', '/rules/remove', { repo: b.dataset.repo, rule: b.dataset.ruleRemove }));
+      toast('Rule removed; agents there will ask again');
+    } catch (err) {
+      toast(`Error: ${err.message}`, 5000);
+    }
+  });
   $('#settings-cancel').onclick = () => dialog.close();
   dialog.addEventListener('click', (e) => {
     const go = e.target.closest('[data-open]');

package/public/style.css

@@ -979,3 +979,9 @@ body.remote .settings-links .local-only { display: none; }
 .built-tests pre, .built-runs div { white-space: pre-wrap; font-size: 12.5px; }
 .code-area { width: 100%; font: 12.5px/1.45 var(--mono); margin-top: 6px; }
 .built-runs { list-style: none; padding: 0; } .built-runs li { padding: 6px 0; border-bottom: 1px solid var(--border); }
+
+/* Approval rules (Settings) and agents waiting on the same command (inbox) */
+.rules-list { list-style: none; padding: 0; margin: 6px 0 0; display: grid; gap: 6px; }
+.rules-list li { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; }
+.rules-list li button { margin-left: auto; }
+.need.group { border-style: dashed; }

package/src/builder.js

@@ -4,6 +4,7 @@
 // downloads it here. Built agents live in ~/.agentmanager/built/<name>/ as ordinary agentkit folders.
 import { spawn } from 'node:child_process';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import YAML from 'yaml';
@@ -127,6 +128,19 @@ export function filesWritten(dir, before, { root = dir, limit = 6, bytes = 4000
   return out;
 }
 
+/**
+ * A throwaway copy of the agent's folder for one test run, so what a run writes (outputs, memory,
+ * changed fixtures) doesn't change the agent or the next test. It keeps the agent's memory, not its
+ * engine sessions, run logs, executables, dependencies or git data.
+ */
+export function testCopy(dir) {
+  const copy = fs.mkdtempSync(path.join(os.tmpdir(), `agentkit-test-${path.basename(dir)}-`));
+  const state = path.join(dir, '.agentkit');
+  const keep = (src) => src === dir || (path.dirname(src) === state ? path.basename(src) === 'memory.md' : src === state || !SKIP.has(path.basename(src)));
+  fs.cpSync(dir, copy, { recursive: true, filter: keep });
+  return copy;
+}
+
 export class Builder {
   /** `oneShot(prompt)` answers a judge prompt (the daemon's writer engine). */
   /** `sessions`: the daemon's agent sessions ({ create, get, tell, stop }); each built agent is developed in one. */
@@ -324,25 +338,32 @@ export class Builder {
     this.pending.set(name, 'testing');
     this.saveMeta(name, { status: 'testing' });
     try {
-      // Tests don't wait for people: approval tools are simply not available in them.
-      const agent = new Agent({ ...spec, triggers: [], report: null }, { env: this.env, engineTurn: this.runTurn, approvals: 'deny' });
+      // Each test runs in its own copy of the agent's folder (a workdir outside it is used in place),
+      // and the judge sees what the run wrote there, not only what it says it did. Tests don't wait
+      // for people: approval tools are simply not available in them.
       const results = [];
-      // The judge sees what each run wrote in the agent's folders, not only what it says it did.
-      const roots = [...new Set([dir, spec.workdir])].filter((d, i, all) => !all.some((o, j) => j !== i && d.startsWith(o + path.sep)));
       for (const t of tests) {
-        const before = roots.map((d) => snapshot(d));
-        const r = await agent.run(t.input, { source: 'test' });
-        const files = roots.flatMap((d, i) => filesWritten(d, before[i], { root: dir })).slice(0, 6);
-        let verdict = { pass: false, why: 'The run failed' };
-        if (r.status !== 'failed') {
-          try {
-            const v = parseJsonReply(await this.oneShot(judgePrompt({ goal: spec.goal, input: t.input, expect: t.expect, result: r.result, files })));
-            verdict = { pass: v.pass === true, why: String(v.why ?? '') };
-          } catch (e) {
-            verdict = { pass: false, why: `Could not judge: ${e.message}` };
+        const copy = testCopy(dir);
+        try {
+          const run = loadAgent(copy, { env: this.env });
+          const agent = new Agent({ ...run, triggers: [], report: null }, { env: this.env, engineTurn: this.runTurn, approvals: 'deny' });
+          const roots = [...new Set([copy, run.workdir])].filter((d, i, all) => !all.some((o, j) => j !== i && d.startsWith(o + path.sep)));
+          const before = roots.map((d) => snapshot(d));
+          const r = await agent.run(t.input, { source: 'test' });
+          const files = roots.flatMap((d, i) => filesWritten(d, before[i], { root: copy })).slice(0, 6);
+          let verdict = { pass: false, why: 'The run failed' };
+          if (r.status !== 'failed') {
+            try {
+              const v = parseJsonReply(await this.oneShot(judgePrompt({ goal: spec.goal, input: t.input, expect: t.expect, result: r.result, files })));
+              verdict = { pass: v.pass === true, why: String(v.why ?? '') };
+            } catch (e) {
+              verdict = { pass: false, why: `Could not judge: ${e.message}` };
+            }
           }
+          results.push({ input: t.input, expect: t.expect, result: r.result, status: r.status, costUsd: r.costUsd, files: files.map((f) => f.path), ...verdict });
+        } finally {
+          fs.rmSync(copy, { recursive: true, force: true });
         }
-        results.push({ input: t.input, expect: t.expect, result: r.result, status: r.status, costUsd: r.costUsd, files: files.map((f) => f.path), ...verdict });
       }
       const passed = results.filter((r) => r.pass).length;
       this.saveMeta(name, { results: { at: now(), passed, total: results.length, list: results }, status: passed === results.length ? 'tested' : 'failing' });

package/src/cli.js

@@ -879,6 +879,8 @@ export async function main(argv) {
       await attach(ref, { kind: `shell:${n}` });
     });
 
+  const repoLabel = (k) => String(k).replace(/^dir:/, '').split('/').filter(Boolean).slice(-2).join('/');
+
   program
     .command('inbox')
     .description('Everything waiting on you: prompts, questions, stuck agents, overlapping changes')
@@ -888,6 +890,11 @@ export async function main(argv) {
       if (!items.length) return console.log(dim('Nothing needs you right now.'));
       const label = { prompt: red('needs input'), waiting: red('waiting'), question: cyan('question'), review: cyan('AI review'), stuck: yellow('stuck?'), conflict: yellow('overlap') };
       for (const it of items) {
+        if (it.kind === 'rule') {
+          console.log(`${cyan('always allow?')}  ${bold(repoLabel(it.repo))}  ${it.title} ${dim(`(allowed ${it.n} times)`)}`);
+          console.log(dim('    agentmgr rules'));
+          continue;
+        }
         console.log(`${label[it.kind]}  ${bold(it.agentName)} ${dim(it.agentId)}  ${it.title}`);
         if (it.kind === 'prompt') console.log(dim(`    ${(it.prompt?.choices ?? []).map((c) => `${c.key}. ${c.label}`).join('   ')}  → agentmgr attach ${it.agentId}`));
         if (it.kind === 'question') {
@@ -901,6 +908,32 @@ export async function main(argv) {
       }
     });
 
+  program
+    .command('rules')
+    .description('Approval rules: commands always allowed per repo, and the ones the inbox suggests')
+    .argument('[action]', 'allow <n> | no <n> (suggestions), rm <n> (allowed)')
+    .argument('[n]')
+    .action(async (action, n) => {
+      await daemon();
+      let r = await api('GET', '/rules');
+      const pick = (list) => {
+        const x = list[Number(n) - 1];
+        if (!x) throw new Error(`No rule ${n ?? ''}; see agentmgr rules`);
+        return { repo: x.repo, rule: x.rule };
+      };
+      if (action === 'allow') r = await api('POST', '/rules/accept', pick(r.suggestions));
+      else if (action === 'no') r = await api('POST', '/rules/dismiss', pick(r.suggestions));
+      else if (action === 'rm') r = await api('POST', '/rules/remove', pick(r.allowed));
+      else if (action) throw new Error('Use: agentmgr rules [allow <n> | no <n> | rm <n>]');
+      if (r.suggestions.length) {
+        console.log(bold('Suggested') + dim(`  (you allowed these ${r.suggestAfter}+ times; agentmgr rules allow <n> | no <n>)`));
+        r.suggestions.forEach((x, i) => console.log(`  ${i + 1}. ${x.label}  ${dim(`in ${repoLabel(x.repo)}, allowed ${x.n} times`)}`));
+      }
+      console.log(bold('Allowed') + dim('  (agents in the repo run these without asking; agentmgr rules rm <n>)'));
+      if (!r.allowed.length) console.log(dim('  none yet'));
+      r.allowed.forEach((x, i) => console.log(`  ${i + 1}. ${x.label}  ${dim(`in ${repoLabel(x.repo)}${x.uses ? `, answered ${x.uses} prompts` : ''}`)}`));
+    });
+
   program
     .command('answer')
     .description('Answer a question an agent asked in the inbox')

package/src/manager.js

@@ -112,6 +112,7 @@ import { Plugins } from './plugins.js';
 import { leadPrompt, subagents, teamDir, teamPrompt } from './teams.js';
 import { assistantDir, assistantPrompt, assistantSettings } from './assistant.js';
 import { learnCommand, memoryKey, memoryPrompt, memoryText } from './memory.js';
+import { Rules, describeTool } from './rules.js';
 import { runningClaude, scanClaudeSessions } from './sessions.js';
 import { builderAllowedTools, builderPrompt } from './builder.js';
 import {
@@ -149,6 +150,8 @@ const ANSI = /\x1b(\[[0-9;?<>=]*[ -\/]*[@-~]|\][^\x07\x1b]*(\x07|\x1b\\)|[()][0-
 // When a link is found from several sources, the higher-ranked source is kept.
 const SOURCE_RANK = { manual: 5, intent: 4, session: 3, branch: 2, mentioned: 1 };
 const BUSY_IDLE_MS = 3000;
+// The attention label engines give a tool permission menu (what rules can answer).
+const PERMISSION = 'Permission prompt';
 /** Looser stuck thresholds: candidates the judge looks at before anyone is bothered. */
 const loosen = (o) => ({
   repeatFailures: Math.max(2, Math.ceil(o.repeatFailures / 2)),
@@ -282,6 +285,7 @@ export class AgentManager extends EventEmitter {
     this.stuck = new Map(); // agent id -> [finding]
     this.outbox = new Map(); // agent id -> [message] waiting to be typed into its session
     // The AI judge: rules decide when to look, a model decides what is going on (see judge.js).
+    this.rules = new Rules({ suggestAfter: config.rules?.suggestAfter });
     this.judge = new Judge({ config, call: (agent, prompt, { timeoutMs }) => this.oneShot(agent, prompt, { ...this.judgeModel(agent), timeoutMs }) });
     this.stuckVerdicts = new Map(); // agent id -> Map(finding key -> { at, since, data })
     this.signIns = new Map(); // agent id -> { url, port, callback, terminal, at, finished } from a CLI's sign-in link
@@ -373,7 +377,7 @@ export class AgentManager extends EventEmitter {
         shell: this.shellNumbers(agent.id).length > 0,
         shells: this.shellNumbers(agent.id),
         lastOutputAt: rt?.lastOutputAt ? new Date(rt.lastOutputAt).toISOString() : null,
-        prompt: rt?.pty && !rt.busy && rt.attention ? engineOf(agent).promptChoices(rt.tail) : null,
+        prompt: rt?.pty && !rt.busy && rt.attention ? this.promptView(agent, rt) : null,
       },
     };
   }
@@ -1066,6 +1070,9 @@ export class AgentManager extends EventEmitter {
       prompts.push(memoryPrompt(memoryText(memoryKey(agent))));
       allowedTools = [`Bash(${learnCommand()}:*)`];
     }
+    // Commands you chose to always allow in this repo.
+    const ruled = agent.workdir ? this.rules.allowed(memoryKey(agent)) : [];
+    if (ruled.length) allowedTools = [...(allowedTools ?? []), ...ruled];
     if (agent.builds && agent.workdir) {
       prompts.push(builderPrompt({ dir: agent.workdir, name: agent.builds.name, engine: agent.builds.engine }));
       // Checking the agent loads and reading the reference need no permission prompt.
@@ -2866,16 +2873,66 @@ export class AgentManager extends EventEmitter {
         items.push({ ...base, kind: 'conflict', key: `conflict:${agent.id}:${g.agent.id}`, title: `Overlaps with ${g.agent.name}`, conflict: g });
       }
     }
-    const order = { prompt: 0, waiting: 1, question: 1, review: 2, stuck: 3, conflict: 4 };
+    // Commands you keep allowing in a repo: offer to always allow them there.
+    for (const r of this.rules.view().suggestions) items.push({ kind: 'rule', key: `rule:${r.repo}:${r.rule}`, title: `Always allow ${r.label}?`, priority: 2, ...r });
+    const order = { prompt: 0, waiting: 1, question: 1, rule: 2, review: 2, stuck: 3, conflict: 4 };
     return items.sort((a, b) => order[a.kind] - order[b.kind] || a.priority - b.priority);
   }
 
+  /** A live prompt's question and choices, and the tool call it asks about when the transcript says. */
+  promptView(agent, rt) {
+    const p = engineOf(agent).promptChoices(rt.tail);
+    const call = rt.attention === PERMISSION ? this.pendingCall(agent) : null;
+    return call ? { ...p, tool: describeTool(call) } : p;
+  }
+
+  /** The one tool call a live prompt is waiting on, from the transcript (Claude Code); null when unsure. */
+  pendingCall(agent) {
+    const engine = engineOf(agent);
+    if (engine.id !== 'claude' || !agent.workdir || !agent.sessionId) return null;
+    const key = `${agent.sessionId}:${agent.workdir}`;
+    const state = this.activity.get(key) ?? {};
+    this.activity.set(key, engine.activity(engine.sessionFile(agent.workdir, agent.sessionId), state));
+    return state.calls?.size === 1 ? [...state.calls.values()][0] : null;
+  }
+
+  /** A permission prompt for a call one of the repo's allowed rules covers is answered yes by itself. */
+  autoAllow(agent, rt) {
+    if (this.config.rules?.auto === false) return false;
+    const call = this.pendingCall(agent);
+    const repo = call ? memoryKey(agent) : null;
+    const rule = call && this.rules.allows(repo, call);
+    if (!rule) return false;
+    const first = engineOf(agent).promptChoices(rt.tail)?.choices?.[0];
+    if (first?.key !== '1' || !/^yes\b/i.test(first.label)) return false;
+    this.write(agent.id, '1');
+    rt.attention = null;
+    this.rules.used(repo, rule);
+    this.plugins.emit('agent.prompt.allowed', { agent: this.auditView(agent), rule, tool: describeTool(call) });
+    return true;
+  }
+
+  /** After a rule is allowed: prompts already waiting on a call it covers are answered too. */
+  applyRules() {
+    for (const [id, rt] of this.runtimes) {
+      const agent = this.store.get(id);
+      if (agent && rt.pty && !rt.busy && rt.attention === PERMISSION && this.autoAllow(agent, rt)) this.changed(agent);
+    }
+  }
+
   /** Send keys to a live prompt (e.g. "1" to pick the first option). */
   answerPrompt(ref, key) {
     const agent = this.mustGet(ref);
     const keys = { esc: '\x1b', enter: '\r', up: '\x1b[A', down: '\x1b[B' };
     const data = keys[key] ?? (/^\d$/.test(key) ? key : null);
     if (!data) throw Object.assign(new Error('Unsupported key'), { status: 400 });
+    // A yes to a permission prompt counts toward offering a rule for it in this repo.
+    const rt = this.runtimes.get(agent.id);
+    if (rt?.pty && !rt.busy && rt.attention === PERMISSION) {
+      const choice = engineOf(agent).promptChoices(rt.tail)?.choices?.find((c) => c.key === key);
+      const call = /^yes\b/i.test(choice?.label ?? '') ? this.pendingCall(agent) : null;
+      if (call) this.rules.approved(memoryKey(agent), call);
+    }
     // Menus that read a line (the ACP client's) take Enter after the choice.
     this.write(agent.id, engineOf(agent).promptKeyEnter && key !== 'enter' ? `${data}\r` : data);
     return { ok: true };
@@ -2985,6 +3042,7 @@ export class AgentManager extends EventEmitter {
         const screen = rt.tail.slice(-1500).replace(ANSI, '').replace(/\s+/g, '');
         const a0 = this.store.get(id);
         rt.attention = (a0 ? engineOf(a0).attention : []).find(([re]) => re.test(screen))?.[1] ?? null;
+        if (a0 && rt.attention === PERMISSION) this.autoAllow(a0, rt);
         const a = this.store.get(id);
         if (a) this.changed(a);
         // A turn just ended: remember the code and conversation at this point.

package/src/rules.js

@@ -0,0 +1,161 @@
+// Approval rules learned from your answers: when you keep saying yes to the same command in a repo
+// ("npm test", three times), the inbox offers to always allow it there. Allowed rules go to every
+// agent in that repo at launch (Claude Code's --allowedTools) and answer its live prompts, so the
+// same question isn't asked again. Kept in ~/.agentmanager/rules.json, per repo (the repo-memory key).
+import { EventEmitter } from 'node:events';
+import fs from 'node:fs';
+import path from 'node:path';
+import { paths } from './config.js';
+
+export const SUGGEST_AFTER = 3;
+// Commands whose first words name a subcommand: "npm test" is a rule, "npm" alone would allow anything npm does.
+const SUBCOMMANDS = new Set(['npm', 'pnpm', 'yarn', 'bun', 'npx', 'node', 'deno', 'git', 'gh', 'cargo', 'go', 'make', 'python', 'python3', 'uv', 'pip', 'poetry', 'pytest', 'mvn', 'gradle', './gradlew', 'dotnet', 'swift', 'xcodebuild', 'bundle', 'rake', 'rails', 'mix', 'composer', 'php', 'docker', 'kubectl', 'terraform', 'just', 'task']);
+// Never offered as a standing rule, however often approved: they delete, escalate, publish or reach out.
+const NEVER = /^(rm|sudo|su|chmod|chown|dd|mkfs|kill|killall|pkill|shutdown|reboot|curl|wget|ssh|scp|rsync|eval|exec|sh|bash|zsh|env|xargs|find|git (push|reset|clean|rebase|checkout|branch|tag)|gh (pr merge|release|repo|api|secret)|npm (publish|unpublish|login|adduser|token)|docker (rm|rmi|system|push|login)|kubectl (delete|apply)|terraform (apply|destroy))$/;
+// Anything that chains, redirects or substitutes isn't one command, so no rule covers it.
+const COMPOUND = /[;&|<>`$(){}\n\\]/;
+
+/** The words of a plain command, or null when it chains, redirects, substitutes or sets variables. */
+function words(command) {
+  const cmd = String(command ?? '').trim();
+  if (!cmd || COMPOUND.test(cmd)) return null;
+  const w = cmd.split(/\s+/);
+  return /^\w+=/.test(w[0]) ? null : w;
+}
+
+/**
+ * The rule that would allow a tool call, as Claude Code writes it, with a label for people:
+ * Bash → "Bash(npm test:*)", WebFetch → "WebFetch(domain:docs.x.com)", an MCP tool → its name.
+ * Null for calls that shouldn't become a standing rule (file edits: use Accept edits instead).
+ */
+export function ruleFor(tool) {
+  const input = tool?.input ?? {};
+  if (tool?.name === 'Bash') {
+    const w = words(input.command);
+    if (!w) return null;
+    const prefix = (SUBCOMMANDS.has(w[0]) && w[1] && !w[1].startsWith('-') ? w.slice(0, 2) : w.slice(0, 1)).join(' ');
+    if (NEVER.test(prefix) || NEVER.test(w[0])) return null;
+    return { rule: `Bash(${prefix}:*)`, label: prefix };
+  }
+  if (tool?.name === 'WebFetch') {
+    try {
+      const host = new URL(input.url).hostname;
+      return host ? { rule: `WebFetch(domain:${host})`, label: `fetch from ${host}` } : null;
+    } catch {
+      return null;
+    }
+  }
+  if (/^mcp__[\w-]+__[\w-]+$/.test(tool?.name ?? '')) return { rule: tool.name, label: tool.name.replace(/^mcp__/, '').replace('__', ': ') };
+  return null;
+}
+
+/** Whether an allowed rule covers this tool call. */
+export function covers(rule, tool) {
+  const m = /^Bash\((.+):\*\)$/.exec(rule);
+  if (m) {
+    const w = words(tool?.input?.command);
+    return tool?.name === 'Bash' && Boolean(w) && (w.join(' ') === m[1] || w.join(' ').startsWith(`${m[1]} `));
+  }
+  return ruleFor(tool)?.rule === rule;
+}
+
+/** What a pending tool call is, in a few words for an inbox card. */
+export function describeTool(tool) {
+  const input = tool?.input ?? {};
+  if (tool?.name === 'Bash') return { name: 'Bash', text: String(input.command ?? '').slice(0, 300) };
+  if (['Edit', 'Write', 'MultiEdit', 'NotebookEdit', 'Read'].includes(tool?.name)) return { name: tool.name, text: String(input.file_path ?? input.notebook_path ?? '') };
+  if (tool?.name === 'WebFetch') return { name: 'WebFetch', text: String(input.url ?? '') };
+  return { name: String(tool?.name ?? ''), text: JSON.stringify(input).slice(0, 300) };
+}
+
+export class Rules extends EventEmitter {
+  constructor({ file = path.join(paths.home, 'rules.json'), suggestAfter = SUGGEST_AFTER } = {}) {
+    super();
+    this.file = file;
+    this.suggestAfter = suggestAfter;
+    try {
+      this.data = JSON.parse(fs.readFileSync(file, 'utf8'));
+    } catch {
+      this.data = {};
+    }
+    this.data.repos ??= {};
+  }
+
+  save() {
+    fs.mkdirSync(path.dirname(this.file), { recursive: true });
+    fs.writeFileSync(this.file, JSON.stringify(this.data, null, 2));
+    this.emit('change', this.view());
+  }
+
+  repo(key) {
+    return (this.data.repos[key] ??= { allow: [], dismissed: [], seen: {} });
+  }
+
+  /** The rules allowed in a repo, as Claude Code allow rules. */
+  allowed(key) {
+    return (this.data.repos[key]?.allow ?? []).map((r) => r.rule);
+  }
+
+  /** The allowed rule that covers this call in this repo, if any. */
+  allows(key, tool) {
+    return this.allowed(key).find((r) => covers(r, tool)) ?? null;
+  }
+
+  /** An allowed rule answered a prompt by itself: count it, so the list shows what it saves. */
+  used(key, rule) {
+    const a = this.data.repos[key]?.allow.find((x) => x.rule === rule);
+    if (!a) return;
+    a.uses = (a.uses ?? 0) + 1;
+    a.lastUsedAt = new Date().toISOString();
+    this.save();
+  }
+
+  /** You said yes to this call in this repo; count it toward a suggestion. */
+  approved(key, tool) {
+    const r = ruleFor(tool);
+    if (!r) return null;
+    const repo = this.repo(key);
+    if (repo.allow.some((x) => x.rule === r.rule)) return null;
+    const seen = (repo.seen[r.rule] ??= { label: r.label, n: 0 });
+    seen.n++;
+    seen.at = new Date().toISOString();
+    this.save();
+    return { ...r, n: seen.n };
+  }
+
+  accept(key, rule) {
+    const repo = this.data.repos[key];
+    const seen = repo?.seen[rule];
+    if (!seen && !repo?.allow.some((x) => x.rule === rule)) throw Object.assign(new Error('No such suggestion'), { status: 404 });
+    if (!repo.allow.some((x) => x.rule === rule)) repo.allow.push({ rule, label: seen.label, at: new Date().toISOString() });
+    delete repo.seen[rule];
+    this.save();
+  }
+
+  /** "Not now": stop suggesting it (it can still be allowed later from the list). */
+  dismiss(key, rule) {
+    const repo = this.data.repos[key];
+    if (!repo?.seen[rule]) throw Object.assign(new Error('No such suggestion'), { status: 404 });
+    if (!repo.dismissed.includes(rule)) repo.dismissed.push(rule);
+    this.save();
+  }
+
+  remove(key, rule) {
+    const repo = this.data.repos[key];
+    if (!repo?.allow.some((x) => x.rule === rule)) throw Object.assign(new Error('No such rule'), { status: 404 });
+    repo.allow = repo.allow.filter((x) => x.rule !== rule);
+    repo.dismissed = repo.dismissed.filter((x) => x !== rule);
+    this.save();
+  }
+
+  /** Every repo's allowed rules and the suggestions waiting for an answer. */
+  view() {
+    const allowed = [];
+    const suggestions = [];
+    for (const [repo, r] of Object.entries(this.data.repos)) {
+      for (const a of r.allow) allowed.push({ repo, ...a });
+      for (const [rule, s] of Object.entries(r.seen)) if (s.n >= this.suggestAfter && !r.dismissed.includes(rule)) suggestions.push({ repo, rule, label: s.label, n: s.n, at: s.at });
+    }
+    return { allowed, suggestions, suggestAfter: this.suggestAfter };
+  }
+}

package/src/server.js

@@ -448,6 +448,16 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
   );
   // Everything waiting on the user: live prompts, agents' questions, stuck agents, overlaps.
   api.get('/inbox', wrap(() => manager.inbox()));
+  // Approval rules learned from your answers (src/rules.js): allowed per repo, and suggestions.
+  const ruleArgs = (req) => {
+    const { repo, rule } = req.body ?? {};
+    if (typeof repo !== 'string' || typeof rule !== 'string') throw Object.assign(new Error('repo and rule are required'), { status: 400 });
+    return [repo, rule];
+  };
+  api.get('/rules', wrap(() => manager.rules.view()));
+  api.post('/rules/accept', wrap((req) => (manager.rules.accept(...ruleArgs(req)), manager.applyRules(), manager.rules.view())));
+  api.post('/rules/dismiss', wrap((req) => (manager.rules.dismiss(...ruleArgs(req)), manager.rules.view())));
+  api.post('/rules/remove', wrap((req) => (manager.rules.remove(...ruleArgs(req)), manager.rules.view())));
   api.post('/agents/:id/tell', wrap((req) => manager.tell(req.params.id, req.body?.text)));
   api.post('/agents/:id/answer', wrap((req) => manager.answerQuestion(req.params.id, req.body?.question, req.body?.text)));
   api.post('/agents/:id/prompt-key', wrap((req) => manager.answerPrompt(req.params.id, String(req.body?.key ?? ''))));
@@ -912,6 +922,7 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
   };
   manager.on('change', (agent) => broadcast({ t: 'agent', agent }));
   reports.on('change', () => broadcast({ t: 'built', reports: reports.list() }));
+  manager.rules.on('change', (rules) => broadcast({ t: 'rules', rules }));
   manager.on('removed', (id) => {
     broadcast({ t: 'removed', id });
     live.closeAgent(id).catch(() => {});
@@ -948,7 +959,7 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
     const url = new URL(req.url, 'http://x');
     if (url.pathname === '/ws/events') {
       eventClients.add(ws);
-      ws.send(JSON.stringify({ t: 'snapshot', agents: manager.list(), backlog: backlog.view(), projects: manager.listProjects(), races: races.list(), teams: teams.list(), built: reports.list() }));
+      ws.send(JSON.stringify({ t: 'snapshot', agents: manager.list(), backlog: backlog.view(), projects: manager.listProjects(), races: races.list(), teams: teams.list(), built: reports.list(), rules: manager.rules.view() }));
       ws.on('close', () => eventClients.delete(ws));
       return;
     }

package/src/stuck.js

@@ -20,12 +20,14 @@ const textOf = (c) => (typeof c === 'string' ? c : Array.isArray(c) ? c.map((b)
 
 /**
  * Incrementally read new transcript lines into `state.events` (tool calls with their results).
- * state: { offset, events: [{ t, kind: 'cmd'|'edit'|'other', ... }], pending: Map(id -> event) }.
+ * state: { offset, events: [{ t, kind: 'cmd'|'edit'|'other', ... }], pending: Map(id -> event),
+ *   calls: Map(id -> { name, input }) for the tool calls still waiting for a result (what a prompt asks about) }.
  */
 export function scanActivity(file, state) {
   state.offset ??= 0;
   state.events ??= [];
   state.pending ??= new Map();
+  state.calls ??= new Map();
   let fd;
   try {
     fd = fs.openSync(file, 'r');
@@ -34,7 +36,7 @@ export function scanActivity(file, state) {
   }
   try {
     const { size } = fs.fstatSync(fd);
-    if (size < state.offset) Object.assign(state, { offset: 0, events: [], pending: new Map() });
+    if (size < state.offset) Object.assign(state, { offset: 0, events: [], pending: new Map(), calls: new Map() });
     if (size === state.offset) return state;
     const buf = Buffer.alloc(size - state.offset);
     fs.readSync(fd, buf, 0, buf.length, state.offset);
@@ -56,7 +58,12 @@ export function scanActivity(file, state) {
           const ev = eventFor(b, t);
           state.events.push(ev);
           state.pending.set(b.id, ev);
+          // Calls left without a result by an earlier response (interrupted) aren't what's asked now.
+          if (rec.message?.id && rec.message.id !== state.callsMsg) state.calls.clear();
+          state.callsMsg = rec.message?.id;
+          state.calls.set(b.id, { name: b.name, input: b.input ?? {} });
         } else if (rec.type === 'user' && b.type === 'tool_result') {
+          state.calls.delete(b.tool_use_id);
           const ev = state.pending.get(b.tool_use_id);
           if (!ev) continue;
           state.pending.delete(b.tool_use_id);