wisp-agents 0.15.0 → 0.17.0

package/server/mentions.js

@@ -0,0 +1,39 @@
+// Task mentions: a prompt can point at another wisp task. The web app stores one as
+// `@[Title](wisp:<id>)` (pasting a copied task id in a prompt box makes one); the agent gets
+// `@Title (wisp task <id>)` plus a note on how to read it: the wisp_session tool, or the task's
+// report inline for runs that can't take wisp's MCP tools.
+
+import { sessionToMarkdown } from './render.js';
+import { truncate } from './util.js';
+
+export const MENTION = /@\[([^\]\n]{1,200})\]\(wisp:([a-z0-9]{6,40})\)/g;
+const INLINE_MAX = 8_000; // characters of a mentioned task's report, when it goes in the prompt
+
+export const mentionsIn = (text = '') => [...new Map([...String(text).matchAll(MENTION)].map((m) => [m[2], { id: m[2], title: m[1] }])).values()];
+
+// What a person reads: titles, no ids (session titles, notifications).
+export const plainMentions = (text = '') => String(text).replace(MENTION, '@$1');
+
+// What an agent reads in place of each mention.
+export const textMentions = (text = '') => String(text).replace(MENTION, '@$1 (wisp task $2)');
+
+// The prompt for an agent run. tool: how this harness names the wisp_session tool, or null when
+// it has none (then each mentioned task's latest report goes in the prompt).
+export function agentPrompt(prompt, store, { tool = 'wisp_session', self } = {}) {
+  const found = mentionsIn(prompt).filter((m) => m.id !== self);
+  if (!found.length) return textMentions(prompt);
+  const line = (m) => {
+    const s = store.get(m.id);
+    if (!s) return `- \`${m.id}\` (${m.title}): not on this computer; it may have been deleted or run on another machine.`;
+    return `- \`${s.id}\` **${s.title}**: ${s.state}, ${s.agent}, ${s.turns.length} turn${s.turns.length === 1 ? '' : 's'}, in \`${s.worktree?.path || s.cwd}\``;
+  };
+  const note = tool
+    ? `The user mentions other wisp tasks. Read one with \`wisp_session\` (${tool}) before relying on it; \`wisp_sessions\` lists the rest.\n${found.map(line).join('\n')}`
+    : `The user mentions other wisp tasks. Their latest reports:\n\n${found
+        .map((m) => {
+          const s = store.get(m.id);
+          return s ? `### ${s.title} (\`${s.id}\`)\n\n${truncate(sessionToMarkdown(s), INLINE_MAX)}` : line(m);
+        })
+        .join('\n\n')}`;
+  return `${textMentions(prompt)}\n\n<wisp-tasks>\n${note}\n</wisp-tasks>`;
+}

package/server/openapi.js

@@ -50,6 +50,13 @@ export function openapi({ version, port }) {
         patch: { summary: 'Auto settings', requestBody: body({ type: 'object', properties: { goal: { enum: ['cheap', 'balanced', 'best'] }, explore: { type: 'boolean', description: 'Let Auto try new models on a few tasks' }, allowed: { type: 'array', items: { type: 'string' }, description: 'Harness ids Auto may pick; empty or null = all' } } }), responses: { 200: json({ type: 'object' }) } },
       },
       '/router/reset': { post: { summary: 'Forget what Auto learned here (the shipped starting point stays)', responses: { 200: json({ type: 'object' }) } } },
+      '/agents/install': {
+        post: {
+          summary: 'Install a harness into ~/.wisp/tools with npm (only opencode: its free models need no account), then detect again',
+          requestBody: body({ type: 'object', required: ['id'], properties: { id: { type: 'string', enum: ['opencode'] } } }),
+          responses: { 200: json({ type: 'array', items: ref('Agent') }), 400: err[400] },
+        },
+      },
       '/agents/recheck': { post: { summary: 'Detect harnesses and models again, here and on every online machine', responses: { 200: json({ type: 'array', items: ref('Agent') }) } } },
       '/feedback': {
         post: {
@@ -129,6 +136,16 @@ export function openapi({ version, port }) {
         parameters: [id],
         post: { summary: 'Mark the PR ready if draft, squash-merge it with --match-head-commit, fast-forward the local base branch, remove the worktree', responses: { 200: json({ type: 'object', properties: { pr: ref('PullRequest'), sync: { type: 'object', properties: { ok: { type: 'boolean' }, text: { type: 'string' } } } } }), 400: err[400] } },
       },
+      '/teams': {
+        get: { summary: 'Saved subagent presets: a team the lead can delegate to', responses: { 200: json({ type: 'array', items: ref('Team') }) } },
+        post: { summary: 'Save a subagent preset', requestBody: body(ref('Team')), responses: { 201: json(ref('Team')), 400: err[400] } },
+      },
+      '/teams/{tid}': {
+        parameters: [{ name: 'tid', in: 'path', required: true, schema: { type: 'string' } }],
+        get: { summary: 'One subagent preset', responses: { 200: json(ref('Team')), 404: err[404] } },
+        patch: { summary: 'Edit a subagent preset', requestBody: body(ref('Team')), responses: { 200: json(ref('Team')), 400: err[400], 404: err[404] } },
+        delete: { summary: 'Delete a subagent preset', responses: { 200: ok, 404: err[404] } },
+      },
       '/recipes': {
         get: { summary: 'Saved recipes, with the {params} found in each prompt', responses: { 200: json({ type: 'array', items: ref('Recipe') }) } },
         post: { summary: 'Save a recipe', requestBody: body(ref('Recipe')), responses: { 201: json(ref('Recipe')), 400: err[400] } },
@@ -205,11 +222,12 @@ export function openapi({ version, port }) {
         parameters: [id],
         post: {
           summary: 'Follow up (answers a pending ask_user question if there is one)',
-          requestBody: body({ type: 'object', required: ['text'], properties: { text: { type: 'string' }, attachments: { type: 'array', items: { type: 'string' } }, queue: { type: 'boolean', description: 'Wait for the current run instead of interrupting it' }, mode: { enum: ['plan', 'edits', 'auto'], description: 'Switch the session to this mode from this follow-up on' } } }),
+          requestBody: body({ type: 'object', required: ['text'], properties: { text: { type: 'string' }, attachments: { type: 'array', items: { type: 'string' } }, queue: { type: 'boolean', description: 'Wait for the current run instead of interrupting it' }, mode: { enum: ['plan', 'edits', 'auto'], description: 'Switch the session to this mode from this follow-up on' }, agent: { type: 'string', description: 'Switch to this harness from this follow-up on; it is handed the turns it has not seen' }, model: { type: 'string', description: 'Switch model (empty: the harness default)' }, effort: { type: 'string', description: 'Switch thinking level (empty: the default)' } } }),
           responses: { 200: json({ type: 'object', properties: { answered: { type: 'boolean' }, queued: { type: 'boolean' }, interrupted: { type: 'boolean' }, ahead: { type: 'integer' } } }), 400: err[400] },
         },
       },
-      '/sessions/{id}/answer': { parameters: [id], post: { summary: 'Answer the pending ask_user question', requestBody: body({ type: 'object', required: ['text'], properties: { text: { type: 'string' } } }), responses: { 200: ok } } },
+      '/sessions/{id}/answer': { parameters: [id], post: { summary: 'Answer the pending ask_user question (or approval: Allow, Always allow in this task, Deny, or what to do instead)', requestBody: body({ type: 'object', required: ['text'], properties: { text: { type: 'string' } } }), responses: { 200: ok } } },
+      '/sessions/{id}/approve': { parameters: [id], post: { summary: 'Allow and retry (or deny) what a finished turn’s permissions blocked', requestBody: body({ type: 'object', properties: { turnId: { type: 'string' }, allow: { type: 'boolean', description: 'Default true' } } }), responses: { 200: ok } } },
       '/sessions/{id}/revert': {
         parameters: [id],
         post: {
@@ -249,9 +267,13 @@ export function openapi({ version, port }) {
           responses: { 201: json({ type: 'object', properties: { id: { type: 'string' }, name: { type: 'string' }, size: { type: 'integer' }, mime: { type: 'string' } } }) },
         },
       },
+      '/uploads/{uid}': {
+        parameters: [{ name: 'uid', in: 'path', required: true, schema: { type: 'string' }, description: 'Upload id (<id>@<machine> for one on a machine)' }],
+        get: { summary: 'The uploaded file, with its MIME type', responses: { 200: { description: 'The file' }, 404: err[404] } },
+      },
       '/events': {
         get: {
-          summary: 'Server-sent events: summary, activity, turn, finished, removed, config, preferences, ping',
+          summary: 'Server-sent events: summary, activity, turn, finished, removed, config, preferences, agents, ping',
           responses: { 200: { description: 'text/event-stream', content: { 'text/event-stream': { schema: { type: 'string' } } } } },
         },
       },
@@ -271,7 +293,7 @@ export function openapi({ version, port }) {
             cwd: { type: 'string', description: 'Project folder (absolute; ~ allowed). Default: the server’s cwd' },
             agent: { enum: ['auto', 'claude', 'codex', 'opencode', 'cursor', 'antigravity', 'grok'], default: 'auto', description: 'auto: wisp picks the harness and model from what worked before; model is then the goal (cheap, balanced, best)' },
             important: { type: 'boolean', description: 'With agent auto: no exploring, take the pick with the best record' },
-            mode: { enum: ['plan', 'edits', 'auto'], default: 'edits' },
+            mode: { enum: ['plan', 'edits', 'auto'], default: 'auto' },
             model: { type: 'string' },
             effort: { type: 'string', description: 'Thinking level: low, medium, high, xhigh, max (per harness)' },
             attachments: { type: 'array', items: { type: 'string' }, description: 'Upload ids' },
@@ -294,6 +316,16 @@ export function openapi({ version, port }) {
             base: { type: 'string' },
           },
         },
+        Team: {
+          type: 'object',
+          required: ['name', 'members'],
+          properties: {
+            id: { type: 'string', readOnly: true },
+            name: { type: 'string' },
+            members: { type: 'array', items: { type: 'object', properties: { name: { type: 'string' }, agent: { type: 'string', description: 'Harness id, or auto' }, model: { type: 'string' }, effort: { type: 'string' }, use: { type: 'string', description: 'What the lead should use it for' }, count: { type: 'integer', minimum: 1 } } } },
+            updatedAt: { type: 'integer', readOnly: true },
+          },
+        },
         Recipe: {
           type: 'object',
           required: ['name', 'prompt'],

package/server/paths.js

@@ -0,0 +1,32 @@
+// Project-relative paths and the size cap for the file contents wisp keeps (diffs, checkpoints).
+// Shared by the adapters (what a harness changed) and checkpoint.js (reverting it).
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+// Larger files are tracked as changed, but their contents aren't kept.
+export const MAX_SNAPSHOT = 256 * 1024;
+
+const realDirs = new Map();
+function realDir(dir) {
+  if (!realDirs.has(dir)) {
+    try {
+      realDirs.set(dir, fs.realpathSync(dir));
+    } catch {
+      realDirs.set(dir, dir);
+    }
+  }
+  return realDirs.get(dir);
+}
+
+// Path relative to cwd, or the path as given if it lies outside. Harnesses may report paths
+// through the resolved cwd (/private/tmp vs /tmp on macOS), so both spellings count.
+export function rel(file, cwd) {
+  if (!file) return '';
+  const abs = path.resolve(cwd, file);
+  for (const base of [cwd, realDir(cwd)]) {
+    const r = path.relative(base, abs);
+    if (r && !r.startsWith('..') && !path.isAbsolute(r)) return r;
+  }
+  return file;
+}

package/server/preferences.js

@@ -14,6 +14,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { adapters } from './adapters/index.js';
 import { heroOf } from './protocol.js';
+import { clip, writeJsonAtomic } from './util.js';
 
 export const KINDS = ['preferences', 'lessons'];
 export const MAX_ITEMS = 10; // per list
@@ -23,10 +24,6 @@ const MAX_HISTORY = 30; // retro runs kept for Settings, newest last
 const RETRO_TIMEOUT_MS = 3 * 60_000;
 const IDLE_MS = Number(process.env.WISP_RETRO_IDLE_MS ?? 90_000); // quiet time before a retro runs
 
-const clip = (s, n) => {
-  s = String(s ?? '').replace(/\s+/g, ' ').trim();
-  return s.length > n ? `${s.slice(0, n - 1)}…` : s;
-};
 const emptyScope = () => ({ preferences: [], lessons: [], updatedAt: 0 });
 
 // Trim, dedupe (case-insensitively), cap length and count. Newest items win the cap.
@@ -66,8 +63,7 @@ export class Preferences {
   }
 
   #save() {
-    fs.writeFileSync(`${this.file}.tmp`, JSON.stringify(this.data, null, 2));
-    fs.renameSync(`${this.file}.tmp`, this.file);
+    writeJsonAtomic(this.file, this.data, 2);
   }
 
   // scope: 'global' or a project path; kind: 'preferences' | 'lessons'.

package/server/proc.js

@@ -7,6 +7,7 @@
 import { spawn as nodeSpawn, execFile as nodeExecFile, spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { bad } from './util.js';
 
 // Find `bin` on PATH the way cmd.exe would (PATHEXT). Returns an absolute path or null.
 // A copied env object loses Windows' case-insensitive keys, so PATH may be spelled "Path".
@@ -125,3 +126,56 @@ export function onPath(bin, env = process.env) {
     }
   });
 }
+
+const MAX_EXEC_OUTPUT = 32 * 1024;
+const EXEC_TIMEOUT_MS = 60_000;
+
+// Run a shell command from an actionable presentation block inside `cwd`.
+export function execCommand(cwd, command, { timeoutMs = EXEC_TIMEOUT_MS } = {}) {
+  const cmd = String(command || '').trim();
+  if (!cmd) return Promise.reject(bad('command required'));
+  const t0 = Date.now();
+
+  return new Promise((resolve) => {
+    const child = nodeSpawn(cmd, {
+      cwd,
+      env: { ...process.env, PAGER: 'cat', GIT_TERMINAL_PROMPT: '0', CI: '1' },
+      shell: true,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let out = '';
+    const append = (chunk) => {
+      if (out.length < MAX_EXEC_OUTPUT) out += chunk.toString('utf8').slice(0, MAX_EXEC_OUTPUT - out.length);
+    };
+    child.stdout.on('data', append);
+    child.stderr.on('data', append);
+
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      killTree(child);
+    }, timeoutMs);
+
+    child.on('error', (err) => {
+      clearTimeout(timer);
+      resolve({
+        command: cmd,
+        output: (out ? `${out}\n` : '') + err.message,
+        exitCode: 1,
+        durationMs: Date.now() - t0,
+      });
+    });
+
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      const suffix = timedOut ? `\n[timed out after ${Math.round(timeoutMs / 1000)}s]` : '';
+      resolve({
+        command: cmd,
+        output: (out.replace(/\s+$/, '') + suffix).trim(),
+        exitCode: timedOut ? 124 : (code ?? 1),
+        durationMs: Date.now() - t0,
+      });
+    });
+  });
+}

package/server/protocol.js

@@ -69,6 +69,9 @@ diff, the test run, the command output — over prose. Use file paths relative t
   A screenshot or generated image on disk.
 - {"type":"question","question":"…","options":[{"label":"Short choice","reply":"full message sent back to you"}]}
   When you need a decision. The user's click resumes you with the reply.
+- {"type":"blocked","items":[{"tool":"shell","detail":"npm publish","why":"needs network access"}]}
+  Actions your permissions or sandbox refused (a denied tool call, a command that failed for lack of
+  network or write access). wisp shows them with an Allow & retry button. Not for ordinary failures.
 - {"type":"actions","title":"…","items":[{"label":"Run tests","command":"npm test"},{"label":"Follow up","reply":"…"}]}
   One-click shell commands (executed in the project root) or follow-up actions the user may want to trigger.
 - {"type":"next","items":["Suggested follow-up the user might send", "…"]}
@@ -89,7 +92,11 @@ Strings must be valid JSON (escape newlines as \\n and quotes as \\"). Example:
 
 const ASK_TOOL = (tool) => `- If a decision would change the rest of the work (ambiguous requirement, destructive or risky step,
   two very different approaches), call the \`ask_user\` tool (${tool}). It pauses you until
-  the user answers in wisp — you keep all your context. Ask one crisp question with 2–4 options.`;
+  the user answers in wisp — you keep all your context. Ask one crisp question with 2–4 options.
+- If the user asks about their past wisp tasks (which tools or harnesses they use, cost, success rate),
+  call \`wisp_stats\` (${tool.replace(/ask_user$/, 'wisp_stats')}) instead of digging through files.
+- If the prompt mentions another wisp task ("@Title (wisp task <id>)") or the user asks what another task
+  did, read it with \`wisp_session\` (${tool.replace(/ask_user$/, 'wisp_session')}); \`wisp_sessions\` lists them.`;
 const ASK_BLOCK = `- If a decision would change the rest of the work (ambiguous requirement, destructive or risky step,
   two very different approaches), stop before acting on it and end with a "question" block (2–4 options).
   The user's answer comes back as a follow-up in this same session.`;

package/server/recipes.js

@@ -2,10 +2,9 @@
 // parameter, filled in when the recipe runs (the run dialog, `wisp run release 0.8.0`, a trigger).
 
 import path from 'node:path';
-import { newId } from './runner.js';
+import { bad, MODES, newId } from './util.js';
 
 const PARAM = /\{([a-zA-Z][\w-]{0,30})\}/g;
-const MODES = new Set(['plan', 'edits', 'auto']);
 
 export const params = (prompt) => [...new Set([...String(prompt || '').matchAll(PARAM)].map((m) => m[1]))];
 
@@ -14,7 +13,7 @@ export const params = (prompt) => [...new Set([...String(prompt || '').matchAll(
 export function fill(prompt, values = {}, { strict = true } = {}) {
   const has = (k) => values[k] !== undefined && values[k] !== null && String(values[k]).trim() !== '';
   const missing = params(prompt).filter((k) => !has(k));
-  if (strict && missing.length) throw Object.assign(new Error(`Missing ${missing.map((k) => `{${k}}`).join(', ')}`), { status: 400 });
+  if (strict && missing.length) throw bad(`Missing ${missing.map((k) => `{${k}}`).join(', ')}`);
   return String(prompt).replace(PARAM, (_, k) => (has(k) ? String(values[k]) : ''));
 }
 
@@ -25,7 +24,6 @@ export function positional(prompt, words = []) {
   return out;
 }
 
-const bad = (msg) => Object.assign(new Error(msg), { status: 400 });
 
 export function normalizeRecipe(body, prev = null) {
   const name = String(body.name ?? prev?.name ?? '').trim().slice(0, 60);

package/server/remote.js

@@ -8,13 +8,13 @@
 //             /new [@project] <task> starts a task and /projects lists where it can run.
 
 import { createHmac, randomBytes, randomInt, timingSafeEqual } from 'node:crypto';
+import { bad, truncate } from './util.js';
 
 const KIND = { a: 'answer', r: 'reply', d: 'done' };
 const CODE = { answer: 'a', reply: 'r', done: 'd' };
 const MAX_TG_IDS = 20;
 const STALE_S = 10 * 60;
 const sleep = (ms, signal) => new Promise((r) => (signal?.aborted ? r() : (setTimeout(r, ms).unref?.(), signal?.addEventListener('abort', r, { once: true }))));
-const clip = (s, n) => (String(s || '').length > n ? `${String(s).slice(0, n - 1)}…` : String(s || ''));
 // /new @name: exact name, then name prefix, then anywhere in the name or path.
 export function findProject(projects, q) {
   const n = String(q || '').toLowerCase();
@@ -76,7 +76,7 @@ export class Remote {
     if (s.ask) {
       return {
         title: `❓ ${where}`,
-        text: [s.ask.question, s.ask.context && clip(s.ask.context, 600)].filter(Boolean).join('\n\n'),
+        text: [s.ask.question, s.ask.context && truncate(s.ask.context, 600)].filter(Boolean).join('\n\n'),
         actions: (s.ask.options || []).map((label, index) => ({ label, kind: 'answer', ref: s.ask.id, index })),
       };
     }
@@ -139,12 +139,12 @@ export class Remote {
     const { server, topic, headers } = this.#ntfy();
     const actions = (s ? msg.actions : []).slice(0, 3).map((a) => {
       const k = CODE[a.kind];
-      return { action: 'http', label: clip(a.label, 40), url: `${server}/${topic}-reply`, method: 'POST', headers, body: JSON.stringify({ s: s.id, k, r: a.ref, i: a.index, sig: this.sign(s.id, a.kind, a.ref, a.index) }), clear: true };
+      return { action: 'http', label: truncate(a.label, 40), url: `${server}/${topic}-reply`, method: 'POST', headers, body: JSON.stringify({ s: s.id, k, r: a.ref, i: a.index, sig: this.sign(s.id, a.kind, a.ref, a.index) }), clear: true };
     });
     const r = await fetch(server, {
       method: 'POST',
       headers: { 'content-type': 'application/json', ...headers },
-      body: JSON.stringify({ topic, title: clip(msg.title, 200), message: clip(msg.text, 3000), tags: ['wisp'], ...(actions.length && { actions }) }),
+      body: JSON.stringify({ topic, title: truncate(msg.title, 200), message: truncate(msg.text, 3000), tags: ['wisp'], ...(actions.length && { actions }) }),
       signal: AbortSignal.timeout(10_000),
     });
     if (!r.ok) throw new Error(`ntfy: ${r.status} ${(await r.text().catch(() => '')).slice(0, 120)}`);
@@ -194,10 +194,10 @@ export class Remote {
   }
 
   async #tgPublish(msg, s) {
-    const buttons = (s ? msg.actions : []).map((a) => [{ text: clip(a.label, 60), callback_data: `${CODE[a.kind]}:${s.id}:${a.ref}:${a.index}` }]);
+    const buttons = (s ? msg.actions : []).map((a) => [{ text: truncate(a.label, 60), callback_data: `${CODE[a.kind]}:${s.id}:${a.ref}:${a.index}` }]);
     const sent = await this.#tg('sendMessage', {
       chat_id: this.cfg.telegram.chatId,
-      text: clip(`${msg.title}\n\n${msg.text}${s ? '\n\n↩ Reply to this message to answer or follow up.' : ''}`, 4000),
+      text: truncate(`${msg.title}\n\n${msg.text}${s ? '\n\n↩ Reply to this message to answer or follow up.' : ''}`, 4000),
       ...(buttons.length && { reply_markup: { inline_keyboard: buttons } }),
     });
     if (s && sent?.message_id) this.#tgLink(s.id, sent.message_id);
@@ -231,7 +231,7 @@ export class Remote {
       if (!t.chatId || String(q.message?.chat?.id) !== String(t.chatId)) return;
       const [k, sessionId, ref, i] = String(q.data || '').split(':');
       const result = KIND[k] ? await this.act({ sessionId, kind: KIND[k], ref, index: Number(i) }) : 'Unknown button.';
-      await this.#tg('answerCallbackQuery', { callback_query_id: q.id, text: clip(result, 190) }).catch(() => {});
+      await this.#tg('answerCallbackQuery', { callback_query_id: q.id, text: truncate(result, 190) }).catch(() => {});
       await this.#tg('editMessageReplyMarkup', { chat_id: t.chatId, message_id: q.message.message_id, reply_markup: { inline_keyboard: [] } }).catch(() => {});
       return;
     }
@@ -274,14 +274,14 @@ export class Remote {
       const def = this.defaultProject();
       const where = (id) => (this.store.config.machines || []).find((x) => x.id === id)?.name || id;
       const lines = projects.map((p) => `• ${p.name}${p.machine ? ` (on ${where(p.machine)})` : ''}${p === def ? '  ← default' : ''}`);
-      return say(clip(`Projects:\n${lines.join('\n')}\n\n/new @name <task> runs in one of them.`, 4000));
+      return say(truncate(`Projects:\n${lines.join('\n')}\n\n/new @name <task> runs in one of them.`, 4000));
     }
     let prompt = arg;
     let project = this.defaultProject();
     const at = arg.match(/^@(\S+)\s*([\s\S]*)$/);
     if (at) {
       project = findProject(projects, at[1]);
-      if (!project) return say(`No project matches “${clip(at[1], 60)}”. Send /projects to see them.`);
+      if (!project) return say(`No project matches “${truncate(at[1], 60)}”. Send /projects to see them.`);
       prompt = at[2].trim();
     }
     if (!prompt) return say('What should it do? Send /new <task>, or /new @project <task>.');
@@ -290,9 +290,9 @@ export class Remote {
     try {
       s = await this.launch({ project, prompt });
     } catch (err) {
-      return say(`Couldn’t start it: ${clip(err.message, 300)}`, { reply_to_message_id: m.message_id });
+      return say(`Couldn’t start it: ${truncate(err.message, 300)}`, { reply_to_message_id: m.message_id });
     }
-    const sent = await say(clip(`▶ Started in ${project.name}: ${s?.title || prompt}\n\nwisp will message you when it needs you or is done. Reply to this message to follow up.`, 4000), { reply_to_message_id: m.message_id });
+    const sent = await say(truncate(`▶ Started in ${project.name}: ${s?.title || prompt}\n\nwisp will message you when it needs you or is done. Reply to this message to follow up.`, 4000), { reply_to_message_id: m.message_id });
     if (s?.id && sent?.message_id) this.#tgLink(s.id, sent.message_id);
   }
 
@@ -342,8 +342,8 @@ export class Remote {
     if (body.ntfy) {
       const n = { ...c.ntfy, ...body.ntfy };
       n.token = keep(body.ntfy.token, c.ntfy?.token) || '';
-      if (n.server && !/^https?:\/\/\S+$/.test(n.server)) throw Object.assign(new Error('ntfy server must be an http(s) URL'), { status: 400 });
-      if (n.topic && !/^[\w-]{1,64}$/.test(n.topic)) throw Object.assign(new Error('ntfy topic: letters, digits, - and _ only'), { status: 400 });
+      if (n.server && !/^https?:\/\/\S+$/.test(n.server)) throw bad('ntfy server must be an http(s) URL');
+      if (n.topic && !/^[\w-]{1,64}$/.test(n.topic)) throw bad('ntfy topic: letters, digits, - and _ only');
       c.ntfy = { enabled: !!n.enabled, server: n.server || 'https://ntfy.sh', topic: n.topic || '', token: n.token };
     }
     if (body.telegram) {
@@ -352,7 +352,7 @@ export class Remote {
       const relink = body.telegram.unlink || token !== prev.token;
       if (token !== prev.token) this.tgOffset = 0; // another bot, another update counter
       const project = body.telegram.project ?? prev.project ?? '';
-      if (project && !this.store.config.projects.some((p) => p.id === project)) throw Object.assign(new Error('Unknown project'), { status: 400 });
+      if (project && !this.store.config.projects.some((p) => p.id === project)) throw bad('Unknown project');
       c.telegram = {
         ...prev,
         enabled: !!(body.telegram.enabled ?? prev.enabled),

package/server/render.js

@@ -80,6 +80,8 @@ const R = {
   callout: (b) => `> **${b.tone === 'danger' ? '⛔' : b.tone === 'warn' ? '⚠️' : b.tone === 'success' ? '✅' : 'ℹ️'} ${str(b.title)}**\n> ${str(b.text).replace(/\n/g, '\n> ')}`,
   image: (b) => `🖼️ \`${str(b.path || b.src)}\`${b.caption ? ` — ${b.caption}` : ''}`,
   question: (b) => `**❓ ${str(b.question)}**\n${list(b.options).map((o, i) => `${i + 1}. ${str(o.label || o)}`).join('\n')}`,
+  blocked: (b, turn) =>
+    `**🔒 Blocked by permissions**${turn?.approval ? ` _(${turn.approval})_` : ''}\n${list(b.items).map((i) => `- ${str(i.tool)}${i.detail ? `: \`${str(i.detail)}\`` : ''}${i.why ? ` — ${i.why}` : ''}`).join('\n')}`,
   actions: (b) =>
     `${b.title ? `**${b.title}**\n` : '**Actions**\n'}${list(b.items)
       .map((a) => (typeof a === 'string' ? `- ${a}` : `- **${str(a.label || a.command)}**${a.command ? ` — \`$ ${str(a.command)}\`` : a.reply ? ` — _${str(a.reply)}_` : ''}${a.detail ? ` (${str(a.detail)})` : ''}`))
@@ -109,7 +111,7 @@ export function sessionToMarkdown(session) {
   if (turn?.status === 'running') out.push(`_Working… (${turn.activity?.findLast?.((a) => a.kind !== 'text')?.label || 'starting up'})_`);
   else if (turn?.presentation) out.push(blocksToMarkdown(turn.presentation.blocks, turn));
   if (session.ask) {
-    out.push(`**❓ The agent is waiting for your answer:** ${session.ask.question}${session.ask.context ? `\n\n${session.ask.context}` : ''}`);
+    out.push(`**${session.ask.permission ? '🔒 The agent needs your approval' : '❓ The agent is waiting for your answer'}:** ${session.ask.question}${session.ask.context ? `\n\n${session.ask.context}` : ''}`);
     if (session.ask.options?.length) out.push(session.ask.options.map((o, i) => `${i + 1}. ${o}`).join('\n'));
   }
   // Worktree sessions: say where the changes are, since they aren't in the caller's checkout.

package/server/router.js

@@ -7,7 +7,8 @@
 // sampling: arms with little data sometimes draw high and get tried) and picks the best value
 // for the goal: value × chance − expected $ − a price on your waiting time.
 //
-// What happened afterwards is the reward, strongest signal first: merged (1) / PR closed (0.2),
+// What happened afterwards is the reward, strongest signal first: switched to another harness or
+// model in a follow-up (0.1), merged (1) / PR closed (0.2),
 // 👍 (1) / 👎 (0), rolled back (0.1), else the presentation's hero (done 0.6, partial 0.3,
 // blocked 0.1, error 0) less 0.1 per follow-up. A later, stronger signal replaces an earlier one.
 //
@@ -17,6 +18,7 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import { writeJsonAtomic } from './util.js';
 
 const PRIORS = JSON.parse(fs.readFileSync(new URL('./router-priors.json', import.meta.url), 'utf8'));
 
@@ -97,7 +99,7 @@ export class Router {
 
   save() {
     try {
-      fs.writeFileSync(this.file, JSON.stringify(this.state));
+      writeJsonAtomic(this.file, this.state); // a cut-off file would load as nothing learned
     } catch (err) {
       console.warn(`wisp: router: ${err.message}`);
     }
@@ -226,7 +228,7 @@ export class Router {
   }
 
   // Something happened to a routed session: { hero, error, followups, feedback, merged, closed,
-  // rolledBack, costUsd, ms }. The reward is recomputed and the stats move by the difference.
+  // rolledBack, switched, costUsd, ms }. The reward is recomputed and the stats move by the difference.
   signal(id, patch) {
     const route = this.state.routes[id];
     if (!route) return null;
@@ -291,6 +293,8 @@ export class Router {
 }
 
 export function reward(sig) {
+  // The user moved the task to another harness or model: whatever happens next isn't this arm's.
+  if (sig.switched) return 0.1;
   if (sig.merged) return 1;
   if (sig.feedback === 'up') return 1;
   if (sig.feedback === 'down') return 0;

package/server/routes/auto.js

@@ -0,0 +1,29 @@
+// Auto: what the router learned, and its settings (goal, trying new models, allowed harnesses).
+
+import { adapters } from '../adapters/index.js';
+import { GOALS } from '../router.js';
+
+export function register(r, app) {
+  const { store, auto } = app;
+
+  r.route('GET', '/router', async (c) => c.send(200, await auto.view()));
+  r.route('PATCH', '/router', async (c) => {
+    const body = await c.body();
+    const d = store.config.defaults;
+    if (body.goal !== undefined) {
+      if (!GOALS[body.goal]) return c.send(400, { error: `goal must be one of ${Object.keys(GOALS).join(', ')}` });
+      d.models = { ...d.models, auto: body.goal };
+      if (d.agent === 'auto') d.model = body.goal;
+    }
+    d.router = { ...d.router };
+    if (body.explore !== undefined) d.router.explore = body.explore ? 'on' : 'off';
+    if (body.allowed !== undefined) d.router.allowed = Array.isArray(body.allowed) ? body.allowed.filter((a) => adapters[a]) : null;
+    app.configChanged();
+    c.send(200, await auto.view());
+  });
+  r.route('POST', '/router/reset', async (c) => {
+    app.router.reset();
+    app.broadcast('router', {});
+    c.send(200, await auto.view());
+  });
+}

package/server/routes/automations.js

@@ -0,0 +1,92 @@
+// Recipes (saved prompts with {params}) and triggers (schedules and GitHub watchers).
+
+import { normalizeRecipe, findRecipe, recipeView } from '../recipes.js';
+import { normalizeTrigger, triggerView } from '../triggers.js';
+
+export function register(r, app) {
+  const { store } = app;
+
+  r.route('GET', '/recipes', (c) => c.send(200, store.config.recipes.map(recipeView)));
+  r.route('POST', '/recipes', async (c) => {
+    const x = normalizeRecipe(await c.body());
+    store.config.recipes.push(x);
+    app.configChanged();
+    c.send(201, recipeView(x));
+  });
+  // A recipe by id or by name (loosely: "Fix Bug" finds fix-bug).
+  const recipe = (fn) => async (c) => {
+    const x = findRecipe(store.config.recipes, c.params.key);
+    if (!x) return c.send(404, { error: 'no such recipe' });
+    return fn(c, x);
+  };
+  r.route('GET', '/recipes/:key', recipe((c, x) => c.send(200, recipeView(x))));
+  r.route(
+    'PATCH',
+    '/recipes/:key',
+    recipe(async (c, x) => {
+      Object.assign(x, normalizeRecipe(await c.body(), x));
+      app.configChanged();
+      c.send(200, recipeView(x));
+    }),
+  );
+  r.route(
+    'DELETE',
+    '/recipes/:key',
+    recipe((c, x) => {
+      store.config.recipes = store.config.recipes.filter((y) => y !== x);
+      app.configChanged();
+      c.send(200, { ok: true });
+    }),
+  );
+  // POST /recipes/:key/run { params | words, cwd, … }. machine: run it in a project there
+  // (r.cwd empty, or a path on that machine).
+  r.route(
+    'POST',
+    '/recipes/:key/run',
+    recipe(async (c, x) => {
+      const body = await c.body();
+      const s = await app.launcher.runRecipe(x, { params: body.params || {}, words: Array.isArray(body.words) ? body.words.map(String) : undefined, cwd: body.cwd, machine: body.machine || undefined, agent: body.agent, model: body.model, effort: body.effort, mode: body.mode });
+      c.send(201, s);
+    }),
+  );
+
+  r.route('GET', '/triggers', (c) => c.send(200, store.config.triggers.map(triggerView)));
+  r.route('POST', '/triggers', async (c) => {
+    const t = normalizeTrigger(await c.body(), null, { recipes: store.config.recipes });
+    store.config.triggers.push(t);
+    app.configChanged();
+    c.send(201, triggerView(t));
+  });
+  const trigger = (fn) => async (c) => {
+    const t = store.config.triggers.find((x) => x.id === c.params.id);
+    if (!t) return c.send(404, { error: 'no such trigger' });
+    return fn(c, t);
+  };
+  r.route(
+    'PATCH',
+    '/triggers/:id',
+    trigger(async (c, t) => {
+      Object.assign(t, normalizeTrigger(await c.body(), t, { recipes: store.config.recipes }));
+      app.configChanged();
+      c.send(200, triggerView(t));
+    }),
+  );
+  r.route(
+    'DELETE',
+    '/triggers/:id',
+    trigger((c, t) => {
+      store.config.triggers = store.config.triggers.filter((x) => x !== t);
+      app.configChanged();
+      c.send(200, { ok: true });
+    }),
+  );
+  r.route(
+    'POST',
+    '/triggers/:id/run',
+    trigger(async (c, t) => {
+      const out = await app.triggers.runNow(t);
+      const started = Array.isArray(out) ? out : out ? [out] : [];
+      c.send(200, { started, trigger: triggerView(t) });
+    }),
+  );
+}