wisp-agents 0.16.0 → 0.17.0

package/CHANGELOG.md

@@ -5,6 +5,21 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ## [Unreleased]
 
+## [0.17.0] - 2026-10-19
+
+### Added
+
+- **Approve what an agent's permissions block, from wisp.** In Edits mode a coding agent used to be refused quietly when it wanted something its permissions don't cover, like `npm publish`, a write outside the project or a network call from Codex's sandbox. You only found out from a half-done report. Now:
+  - **Claude Code waits for you.** wisp sends Claude's permission prompts to its own `approve` tool (`--permission-prompt-tool`). The task card shows *Needs your approval*: *Allow Claude Code to run `npm publish`?*, with **Allow**, **Always allow in this task** and **Deny**. The number keys pick an option. You can also type what to do instead: that denies the call and passes your words to Claude. Claude keeps its context, and the desktop notification says *needs your approval*. *Always allow* lets the same command or file through for the rest of the task without asking again.
+  - **Every other harness gets an Allow & retry card.** When Codex, opencode, Grok, Cursor or Antigravity is refused, the report shows *Blocked by permissions* under its headline, listing each refused action. wisp reads these refusals from the harness itself: opencode's and Grok's stderr, Cursor's rejected tool calls, Antigravity's `PERMISSION_DENIED` steps and Claude's `permission_denials`. A new `blocked` block in the wisp protocol lets an agent report a refusal it can only see in a command's output, such as Codex's sandbox. **Allow & retry** sends a follow-up that runs those actions. For Claude and opencode only the exact actions are allowed (`--allowedTools "Bash(npm publish)"` or an opencode permission rule). Codex, Grok, Cursor and Antigravity can't allow a single action from the command line, so that one follow-up runs in Full auto, and the card says so. The task stays in Edits. **Deny** closes the card. API: `POST /api/sessions/:id/approve {"turnId","allow"}`. A live approval is answered like a question, through `POST /api/sessions/:id/answer {"text":"Allow"}`, `wisp reply` or the phone buttons.
+- **Mention another task in a prompt.** Right-click a task (or open its ⋯ menu) and pick **Copy task ID**, then paste the ID into the launcher, a follow-up box or the Rerun dialog. It shows as a chip with the task's title, like pasting an issue link in Linear, and stays a chip in the sent prompt, where clicking it opens that task. Backspace removes the whole chip and Cmd+Z brings it back. Pasting several IDs at once makes a chip for each. The agent gets the title and ID, and two new read-only tools sit next to `ask_user`: `wisp_session` reads a task (its title, state, harness, folder and branch, every request made in it, and a turn's report as markdown) and `wisp_sessions` lists your other tasks (filter by `query`, `state`, `project`, `archived`). Cursor and Antigravity runs can't take injected tools, so for them wisp puts each mentioned task's latest report in the prompt instead. Prompts store a mention as `@[Title](wisp:<id>)`, so API and CLI callers can write one too. Task titles show `@Title`. The bridge routes (`GET /api/internal/sessions/:id`, `GET /api/internal/session/:id?of=<id>`) only take the per-run token.
+- **Agents can answer questions about your wisp usage.** Every task now gets a read-only `wisp_stats` tool next to `ask_user`. Ask a task "which tools do my tasks use?" or "what did Codex cost me this week?" and the agent gets a table of tool calls by kind (shell, read, edit, search, web, subagents, other MCP tools, questions), by harness, by project and by day. It also gets turns, cost, tokens and success rate, taken from the same numbers as Settings → Usage. Agents can narrow it with `days` (1–365, default 30), `agent` (a harness id) and `project` (a name or id, or `current` for the task's own project). Before, an agent had no tool for this and would either say it had no access or dig through `~/.wisp/sessions` by hand. Kinds are wisp's categories, not each harness's own tool names. The bridge route (`GET /api/internal/stats/:id`) only takes the per-run token, like `ask_user`. Cursor and Antigravity runs can't take injected MCP tools, so they don't get it.
+
+### Changed
+
+- **Mark done and the PR row are where you look.** An opened task now has Mark done (or Reopen) in its top bar, next to Ship it, so you can close it out without scrolling to the composer. The PR row (checks, GitHub, Merge) moved from the top of the card to right above the composer, so after reading the result it's in view without scrolling back up.
+- **Full auto is the default mode.** New launches, API and CLI calls without a mode, scheduled and CI triggers, and recipes run with no permission prompts; tasks in git repos still get their own worktree and a checkpoint before every turn. If your saved launcher mode was Edits (the old default), wisp switches it to Full auto once; a Plan pick, or anything you choose afterwards, sticks. Issue triggers still start in Plan. The mode button now shows just an icon for Full auto and spells out Plan and Edits.
+
 ## [0.16.0] - 2026-10-19
 
 ### Added
@@ -299,7 +314,8 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 - Session queue with follow-ups, answers to agent questions, terminal takeover and mark-as-done.
 - Older turns are folded, with a floating collapse-all button and back-to-top.
 
-[Unreleased]: https://github.com/M0xoo/wisp/compare/v0.16.0...HEAD
+[Unreleased]: https://github.com/M0xoo/wisp/compare/v0.17.0...HEAD
+[0.17.0]: https://github.com/M0xoo/wisp/compare/v0.16.0...v0.17.0
 [0.16.0]: https://github.com/M0xoo/wisp/compare/v0.15.0...v0.16.0
 [0.15.0]: https://github.com/M0xoo/wisp/compare/v0.14.0...v0.15.0
 [0.14.0]: https://github.com/M0xoo/wisp/compare/v0.13.0...v0.14.0

package/README.md

@@ -54,10 +54,10 @@ From there you can **follow up**, **answer its questions**, **take it over** in
 | 🤝 **Subagents** | Give the lead agent a team on other harnesses (e.g. Claude Code hands tests to Codex ×3). It delegates through a `delegate` tool; their edits land in its worktree. See [Subagents](#subagents). |
 | ⏪ **Checkpoints & rollback** | Every turn is snapshotted first. Restore to before any turn, revert a single file, or re-run a command block from the presentation. |
 | ⚖️ **Compare** | Run one task on two harnesses side by side, and keep the better run. |
-| 🧾 **Recipes & triggers** | Saved prompts with `{params}` (`wisp run release 0.16.0`), run by hand, on a schedule, when CI fails, or when an issue is labelled. |
+| 🧾 **Recipes & triggers** | Saved prompts with `{params}` (`wisp run release 0.17.0`), run by hand, on a schedule, when CI fails, or when an issue is labelled. |
 | 📊 **Usage** | Spend, success rate and questions per project and per harness · model. |
 | 📱 **Phone** | Questions and finished tasks on ntfy or Telegram; answer from there, or start a task with `/new`. |
-| 🔐 **Permission modes** | Choose **Plan** (read-only), **Edits** (file edits auto-accepted), or **Full auto** for each launch. `Shift+Tab` in the prompt cycles modes. |
+| 🔐 **Permission modes** | Choose **Plan** (read-only), **Edits** (file edits auto-accepted), or **Full auto** (no permission prompts, the default) for each launch. `Shift+Tab` in the prompt cycles modes. In Edits mode, anything the permissions block comes to you: Claude Code waits for **Allow / Always / Deny**, and the other harnesses show an **Allow & retry** card. |
 | 🔌 **Integrations** | An MCP server (`wisp mcp`), an agent skill, a scriptable CLI, a JS SDK, an OpenAPI-described HTTP API, and webhooks. Hand tasks to wisp from Claude Code, Codex, opencode, Cursor, scripts or CI. |
 | 🪶 **No runtime dependencies** | The server uses only Node built-ins. Electron is needed only for the desktop app. |
 
@@ -83,7 +83,7 @@ brew install m0xoo/tap/wisp-agents             # Homebrew: CLI and browser mode,
 wisp "fix the flaky auth test"
 ```
 
-The Homebrew formula lives in [M0xoo/homebrew-tap](https://github.com/M0xoo/homebrew-tap). `install.sh` honors `WISP_VERSION` to pin a release (`curl -fsSL https://mokh.xyz/install.sh | WISP_VERSION=0.16.0 bash`).
+The Homebrew formula lives in [M0xoo/homebrew-tap](https://github.com/M0xoo/homebrew-tap). `install.sh` honors `WISP_VERSION` to pin a release (`curl -fsSL https://mokh.xyz/install.sh | WISP_VERSION=0.17.0 bash`).
 
 From source:
 
@@ -131,7 +131,7 @@ wisp reply <id> "also do X"       # follow up (answers a pending question; --mod
 wisp stop <id>
 wisp ship <id> [--draft]          # commit, push and open a PR for a worktree task
 wisp merge <id>                   # squash-merge its PR, fast-forward your local main
-wisp run release 0.16.0            # run a recipe; values fill its {params} (or version=0.16.0)
+wisp run release 0.17.0            # run a recipe; values fill its {params} (or version=0.17.0)
 wisp recipes                      # list recipes
 wisp usage [--days 7]             # spend and outcomes
 wisp mcp                          # MCP server for other agents and editors
@@ -334,7 +334,7 @@ Before each turn, wisp snapshots the git working tree (pinned at `refs/wisp/chec
 Prepare release {version}: update CHANGELOG, README and docs/, bump package.json, tag v{version}.
 ```
 
-Make one from ⌘K → *Recipes*, or *Save as recipe…* on any card. A recipe may pin a project, harness, model and mode. Run it from ⌘K (*Run: Release*), from the Recipes view, or from a terminal: `wisp run release 0.16.0` fills the fields in order, `wisp run release version=0.16.0` by name.
+Make one from ⌘K → *Recipes*, or *Save as recipe…* on any card. A recipe may pin a project, harness, model and mode. Run it from ⌘K (*Run: Release*), from the Recipes view, or from a terminal: `wisp run release 0.17.0` fills the fields in order, `wisp run release version=0.17.0` by name.
 
 **Triggers** launch sessions on their own while wisp is open (⌘K → *Triggers*):
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wisp-agents",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Launch coding agents, skip the transcript, read the presentation.",
   "type": "module",
   "bin": {
@@ -20,7 +20,7 @@
     "app": "node bin/wisp.js",
     "dev": "WISP_DEV=1 node bin/wisp.js",
     "dev:web": "node --watch-path=server bin/wisp.js --no-open",
-    "test": "node --test test/proc.test.js test/terminal.test.js test/adapters.test.js test/e2e.test.js test/fuzzy.test.js test/integrations.test.js test/update.test.js test/learn.test.js test/ship.test.js test/subagents.test.js test/machines.test.js test/feedback.test.js test/router.test.js test/routes.test.js test/adapters-exit.test.js test/web-pure.test.js test/install.test.js test/install-script.test.js",
+    "test": "node --test test/proc.test.js test/terminal.test.js test/adapters.test.js test/e2e.test.js test/fuzzy.test.js test/integrations.test.js test/update.test.js test/learn.test.js test/ship.test.js test/subagents.test.js test/machines.test.js test/feedback.test.js test/router.test.js test/routes.test.js test/adapters-exit.test.js test/web-pure.test.js test/install.test.js test/install-script.test.js test/mentions.test.js",
     "test:real": "node test/real-clis.mjs",
     "prepublishOnly": "node --check bin/wisp.js && node --check bin/mac-app.js && node -e \"import('./server/index.js').then(() => import('./server/mcp-wisp.js'))\" && node --check electron/main.js"
   },

package/server/adapters/antigravity.js

@@ -105,7 +105,11 @@ export default {
               onEvent({ type: 'tool', ...describeTool(name, params, cwd) });
             }
             if (!done) return;
-            if (info.error) onEvent({ type: 'tool_error', name, text: clip(info.error.message || info.error.type || 'failed', 400) });
+            if (info.error) {
+              onEvent({ type: 'tool_error', name, text: clip(info.error.message || info.error.type || 'failed', 400) });
+              // Refused by its permissions (no --dangerously-skip-permissions): the card offers a retry.
+              if (/PERMISSION/i.test(info.error.type || '')) onEvent({ type: 'blocked', tool: name, detail: String(params.CommandLine ?? fileOf(params) ?? params.Url ?? '') });
+            }
             else if (editing) {
               const change = files.change(file);
               if (change) onEvent({ type: 'change', ...change });

package/server/adapters/claude.js

@@ -29,6 +29,8 @@ const PERMISSION_MODES = {
 export default {
   id: 'claude',
   name: 'Claude Code',
+  // Asks wisp before a tool call its permission mode won't allow on its own (Edits mode).
+  approveTool: 'mcp__wisp__approve',
   models: [
     { id: '', label: 'Default', hint: 'Whatever Claude Code is set to' },
     { id: 'opus', label: 'Opus', hint: 'Most capable, for hard problems' },
@@ -46,8 +48,14 @@ export default {
     return detectVersion(BIN);
   },
 
+  // What a permission prompt is about, for the approval card and for matching "always allow".
+  permission(tool, input, cwd) {
+    return { tool, action: actionOf(tool, input, cwd), detail: detailOf(tool, input, cwd), why: tool === 'Bash' ? input.description || '' : '' };
+  },
+
   // Returns { stop(), done: Promise<void> }. Everything else is reported through onEvent.
-  run({ prompt, attachments = [], cwd, resumeId, mode, model, effort, systemPrompt, mcpServers = {}, delegating = false, onEvent }) {
+  // grants: --allowedTools rules (Bash(npm publish)) for what the user allowed after a denial.
+  run({ prompt, attachments = [], cwd, resumeId, mode, model, effort, systemPrompt, mcpServers = {}, delegating = false, grants = [], onEvent }) {
     const args = [
       '-p',
       '--output-format', 'stream-json',
@@ -58,10 +66,11 @@ export default {
     if (effort) args.push('--effort', effort);
     if (chromeEnabled()) args.push('--chrome');
     if (resumeId) args.push('--resume', resumeId);
-    if (Object.keys(mcpServers).length) {
-      args.push('--mcp-config', JSON.stringify({ mcpServers }));
-      args.push('--allowedTools', ...Object.keys(mcpServers).map((n) => `mcp__${n}`));
-    }
+    if (Object.keys(mcpServers).length) args.push('--mcp-config', JSON.stringify({ mcpServers }));
+    // In Edits mode, what would prompt goes to wisp's approve tool (the user decides) instead of being denied.
+    if (mcpServers.wisp && mode === 'edits') args.push('--permission-prompt-tool', this.approveTool);
+    const allowed = [...Object.keys(mcpServers).map((n) => `mcp__${n}`), ...grants.filter((g) => typeof g === 'string')];
+    if (allowed.length) args.push('--allowedTools', ...allowed);
     // Its built-in subagents (Task, or Agent in newer versions) would bypass the user's team.
     if (delegating) args.push('--disallowedTools', 'Task', 'Agent', 'Workflow');
     const dirs = [...new Set(attachments.map((a) => path.dirname(a.path)))];
@@ -132,6 +141,11 @@ export default {
           return;
         }
         sawResult = true;
+        // Refused tool calls (no approve tool here, or the user said no): the card offers a retry.
+        for (const d of msg.permission_denials || []) {
+          const input = d.tool_input || {};
+          onEvent({ type: 'blocked', tool: d.tool_name, detail: detailOf(d.tool_name, input, cwd), rule: ruleOf(d.tool_name, input) });
+        }
         onEvent({ ...ev, background: background.size }); // > 0: another turn and result follow when they finish
       }
     };
@@ -207,11 +221,40 @@ function describeTool(name, input, cwd) {
       return { kind: 'agent', label: `Delegating to ${clip([...new Set((input.tasks || []).map((t) => t.subagent))].join(', ') || 'subagents', 60)}` };
     case 'mcp__wisp__subagent_results':
       return { kind: 'agent', label: 'Waiting on subagents' };
+    case 'mcp__wisp__wisp_stats':
+      return { kind: 'tool', label: 'Reading wisp stats' };
+    case 'mcp__wisp__wisp_sessions':
+      return { kind: 'tool', label: 'Listing wisp tasks' };
+    case 'mcp__wisp__wisp_session':
+      return { kind: 'tool', label: `Reading wisp task ${clip(input?.id || '', 40)}` };
     default:
       return { kind: 'tool', label: name.startsWith('mcp__') ? `Using ${name.split('__').slice(1).join(' · ')}` : `Using ${name}` };
   }
 }
 
+// A permission prompt's subject: "run `npm publish`", "edit src/a.ts", "fetch https://…".
+function actionOf(tool, input, cwd) {
+  const f = rel(input.file_path || input.notebook_path || input.path, cwd);
+  if (tool === 'Bash') return `run \`${clip(input.command, 200)}\``;
+  if (/^(Edit|MultiEdit|Write|NotebookEdit)$/.test(tool) && f) return `${tool === 'Write' ? 'write' : 'edit'} ${f}`;
+  if (tool === 'WebFetch') return `fetch ${clip(input.url, 120)}`;
+  if (tool === 'WebSearch') return `search the web for “${clip(input.query, 80)}”`;
+  if (tool === 'ExitPlanMode') return 'leave plan mode and start making changes';
+  if (tool.startsWith('mcp__')) return `use ${tool.split('__').slice(1).join(' · ')}`;
+  return `use ${tool}`;
+}
+
+// The exact thing being allowed, so "always allow" matches only the same command or file.
+function detailOf(tool, input, cwd) {
+  if (tool === 'Bash') return String(input.command ?? '');
+  const f = input.file_path || input.notebook_path || input.path;
+  if (f) return rel(f, cwd);
+  return String(input.url ?? input.query ?? input.pattern ?? '');
+}
+
+// An --allowedTools rule for a retry: the exact command for Bash, the tool for the rest.
+const ruleOf = (tool, input) => (tool === 'Bash' && input.command ? `Bash(${input.command})` : tool);
+
 // Capture edit inputs so wisp can show real diffs without asking the agent for them.
 function captureChange(name, input, cwd) {
   const file = input.file_path;

package/server/adapters/codex.js

@@ -187,5 +187,8 @@ export function unwrapShell(cmd) {
 function describeMcp(item) {
   if (item.server === 'wisp' && item.tool === 'ask_user') return { kind: 'wait', label: 'Waiting for your answer' };
   if (item.server === 'wisp' && (item.tool === 'delegate' || item.tool === 'subagent_results')) return { kind: 'agent', label: 'Waiting on subagents' };
+  if (item.server === 'wisp' && item.tool === 'wisp_stats') return { kind: 'tool', label: 'Reading wisp stats' };
+  if (item.server === 'wisp' && item.tool === 'wisp_sessions') return { kind: 'tool', label: 'Listing wisp tasks' };
+  if (item.server === 'wisp' && item.tool === 'wisp_session') return { kind: 'tool', label: 'Reading a wisp task' };
   return { kind: 'tool', label: `Using ${item.server} · ${item.tool}` };
 }

package/server/adapters/cursor.js

@@ -71,6 +71,8 @@ export default {
               const [outcome, value = {}] = resultOf(body.result);
               if (outcome && outcome !== 'success') {
                 onEvent({ type: 'tool_error', name: name.replace(/ToolCall$/, ''), text: clip(value.error || value.message || value.reason || value.stderr || outcome, 400) });
+                // Refused by its permissions (no --force): the card offers to retry it.
+                if (/reject|denied|permission/i.test(outcome)) onEvent({ type: 'blocked', tool: name.replace(/ToolCall$/, ''), detail: String(args.command ?? args.path ?? args.url ?? '') });
               } else if (name === 'editToolCall' || name === 'deleteToolCall') {
                 const change = editChange(args.path || value.path, value, cwd, files);
                 if (change) onEvent({ type: 'change', ...change });

package/server/adapters/grok.js

@@ -19,6 +19,9 @@ const PERMISSION_MODES = {
   auto: 'bypassPermissions',
 };
 const EFFORT_ORDER = ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'];
+// A headless run refuses what would need approval and names it on stderr, once per call:
+// "permission required: Edit calc.py was not run, as a headless run cannot ask for approval".
+const REFUSED = /permission required: (\S+) ?(.*?) was not run\b/g;
 
 export default {
   id: 'grok',
@@ -75,6 +78,7 @@ export default {
     let session = null;
     let sawResult = false;
     let error = null;
+    let carry = ''; // a stderr line still being written
 
     const handle = spawnJsonl({
       bin: BIN,
@@ -82,6 +86,11 @@ export default {
       cwd,
       env: { ...process.env, GROK_DISABLE_AUTOUPDATER: '1' },
       onEvent,
+      onStderr(chunk) {
+        const lines = (carry + chunk).split('\n');
+        carry = lines.pop();
+        for (const [, tool, detail] of lines.join('\n').matchAll(REFUSED)) onEvent({ type: 'blocked', tool, detail: detail.replace(/ \(workflow .*\)$/, '') });
+      },
       onJson(msg) {
         if (msg.session_id && msg.session_id !== session) onEvent({ type: 'session', id: (session = msg.session_id) });
         // Subagent traffic carries its parent's tool id; only the main conversation is shown.
@@ -232,6 +241,12 @@ function describeMcp(tool, input) {
       return { kind: 'agent', label: `Delegating to ${clip([...new Set((input.tasks || []).map((t) => t.subagent))].join(', ') || 'subagents', 60)}` };
     case 'wisp__subagent_results':
       return { kind: 'agent', label: 'Waiting on subagents' };
+    case 'wisp__wisp_stats':
+      return { kind: 'tool', label: 'Reading wisp stats' };
+    case 'wisp__wisp_sessions':
+      return { kind: 'tool', label: 'Listing wisp tasks' };
+    case 'wisp__wisp_session':
+      return { kind: 'tool', label: `Reading wisp task ${clip(input?.id || '', 40)}` };
     default:
       return { kind: 'tool', label: `Using ${tool.split('__').join(' · ') || 'an integration'}` };
   }

package/server/adapters/index.js

@@ -7,9 +7,14 @@
 //                                                  efforts list wins); omit if the CLI has none
 //     askTool: string | null | undefined           how the agent sees wisp's ask_user MCP tool;
 //                                                  null = can't inject MCP, ask via a question block
+//     approveTool?: string                         its permission prompts go to wisp's `approve` MCP
+//                                                  tool (live approval); omit if it can't route them
+//     permission?(tool, input, cwd): { tool, action, detail, why? }   what a live approval is about
 //     detect(): Promise<{ available, version?, error?, models? }>   models overrides the static list
 //     resumeCommand({ resumeId, model, effort }): string[]   argv to continue the session interactively
-//     run({ prompt, cwd, resumeId, mode, model, effort, systemPrompt, onEvent }): { stop(), done: Promise }
+//     run({ prompt, cwd, resumeId, mode, model, effort, systemPrompt, grants, onEvent }): { stop(), done: Promise }
+//                                                  grants: `rule`s from its own blocked events the
+//                                                  user allowed, for this turn only
 //   }
 //
 // onEvent receives normalized events:
@@ -19,6 +24,8 @@
 //   { type: 'text', text }                          intermediate assistant prose
 //   { type: 'thinking' }
 //   { type: 'change', file, op, edits: [{ before, after }] }
+//   { type: 'blocked', tool, detail, rule? }        a call its permissions refused; rule: what allows
+//                                                  exactly that on a retry (none: retry in Full auto)
 //   { type: 'result', text, isError, stopped?, stats? }   exactly once, at the end
 //
 // mode is one of: plan (read-only), edits (auto-accept file edits), auto (no permission prompts).
@@ -38,6 +45,7 @@ function checked(a) {
     typeof a.name !== 'string' && 'name',
     !Array.isArray(a.models) && 'models',
     a.askTool !== null && a.askTool !== undefined && typeof a.askTool !== 'string' && 'askTool',
+    a.approveTool !== undefined && (typeof a.approveTool !== 'string' || typeof a.permission !== 'function') && 'approveTool + permission()',
     typeof a.detect !== 'function' && 'detect()',
     typeof a.run !== 'function' && 'run()',
     a.resumeCommand !== undefined && typeof a.resumeCommand !== 'function' && 'resumeCommand()',

package/server/adapters/opencode.js

@@ -17,6 +17,10 @@ let BIN = process.env.WISP_OPENCODE_BIN || 'opencode';
 // through, then stop and tell the user what to do.
 const rateLimitGrace = () => Number(process.env.WISP_RATE_LIMIT_GRACE_MS) || 60_000;
 const RATE_LIMITED = /Rate limit exceeded|Too Many Requests|status(?:Code)?[=: ]+429\b/i;
+// `run` answers every permission prompt itself and says so on stderr (cli/cmd/run.ts):
+// "! permission requested: bash (npm publish); auto-rejecting".
+const REJECTED = /permission requested: ([\w.-]+) \((.*?)\); auto-rejecting/g;
+const ANSI = /\x1b\[[0-9;]*m/g;
 
 export default {
   id: 'opencode',
@@ -61,7 +65,8 @@ export default {
     return { ...found, models: [this.models[0], ...models] };
   },
 
-  run({ prompt, attachments = [], cwd, resumeId, mode, model, effort, systemPrompt, mcpServers = {}, delegating = false, onEvent }) {
+  // grants: { permission, patterns } the user allowed after `run` rejected them, for this turn.
+  run({ prompt, attachments = [], cwd, resumeId, mode, model, effort, systemPrompt, mcpServers = {}, delegating = false, grants = [], onEvent }) {
     // The prompt goes on stdin; `run` appends piped stdin to the (empty) message.
     // Errors to stderr: the only place a rate limit shows up (see RATE_LIMITED).
     const args = ['run', '--format', 'json', '--print-logs', '--log-level', 'ERROR'];
@@ -78,14 +83,20 @@ export default {
       mcp[name] = { type: 'local', command: [srv.command, ...(srv.args || [])], environment: srv.env || {}, enabled: true, timeout: ASK_TIMEOUT_MS };
     }
     const env = { ...process.env };
-    if (Object.keys(mcp).length) {
+    const allow = grants.filter((g) => g && typeof g.permission === 'string' && Array.isArray(g.patterns));
+    if (Object.keys(mcp).length || allow.length) {
       const inline = env.OPENCODE_CONFIG_CONTENT ? safeJson(env.OPENCODE_CONFIG_CONTENT) : {};
+      const permission = typeof inline.permission === 'object' ? { ...inline.permission } : inline.permission ? { '*': inline.permission } : {};
+      // Its built-in `task` subagents would bypass the user's team.
+      if (delegating) permission.task = 'deny';
+      for (const g of allow) {
+        const was = permission[g.permission];
+        permission[g.permission] = { ...(typeof was === 'object' ? was : was && { '*': was }), ...Object.fromEntries(g.patterns.map((p) => [String(p), 'allow'])) };
+      }
       env.OPENCODE_CONFIG_CONTENT = JSON.stringify({
         ...inline,
-        mcp: { ...inline.mcp, ...mcp },
-        experimental: { ...inline.experimental, mcp_timeout: ASK_TIMEOUT_MS },
-        // Its built-in `task` subagents would bypass the user's team.
-        ...(delegating && { permission: { ...(typeof inline.permission === 'object' ? inline.permission : inline.permission && { '*': inline.permission }), task: 'deny' } }),
+        ...(Object.keys(mcp).length && { mcp: { ...inline.mcp, ...mcp }, experimental: { ...inline.experimental, mcp_timeout: ASK_TIMEOUT_MS } }),
+        ...(Object.keys(permission).length && { permission }),
       });
     }
 
@@ -101,6 +112,7 @@ export default {
 
     let limitTimer = null;
     let limited = false;
+    let carry = ''; // a stderr line still being written
     const proc = spawnJsonl({
       bin: BIN,
       args,
@@ -109,6 +121,13 @@ export default {
       input,
       onEvent,
       onStderr(chunk) {
+        // Whole lines only: a chunk can end mid-line.
+        const lines = (carry + chunk).split('\n');
+        carry = lines.pop();
+        for (const [, permission, list] of lines.join('\n').replace(ANSI, '').matchAll(REJECTED)) {
+          const patterns = list.split(', ').filter(Boolean);
+          onEvent({ type: 'blocked', tool: permission, detail: patterns.join(', '), rule: { permission, patterns } });
+        }
         if (limitTimer || limited || !RATE_LIMITED.test(chunk)) return;
         limitTimer = setTimeout(() => ((limited = true), proc.stop()), rateLimitGrace());
       },
@@ -216,6 +235,12 @@ function describeTool(name, input, cwd) {
       return { kind: 'agent', label: `Delegated to ${clip([...new Set((input.tasks || []).map((t) => t.subagent))].join(', ') || 'subagents', 60)}` };
     case 'wisp_subagent_results':
       return { kind: 'agent', label: 'Collected subagent reports' };
+    case 'wisp_wisp_stats':
+      return { kind: 'tool', label: 'Reading wisp stats' };
+    case 'wisp_wisp_sessions':
+      return { kind: 'tool', label: 'Listing wisp tasks' };
+    case 'wisp_wisp_session':
+      return { kind: 'tool', label: `Reading wisp task ${clip(input?.id || '', 40)}` };
     default:
       return { kind: 'tool', label: `Using ${name.replace(/_/g, ' ')}` };
   }

package/server/client.js

@@ -136,7 +136,7 @@ export class WispClient {
     if (!agent || !mode || model === undefined) {
       const { defaults = {} } = await this.config();
       agent ||= defaults.agent || 'auto';
-      mode ||= defaults.mode || 'edits';
+      mode ||= defaults.mode || 'auto';
       model ??= defaults.models?.[agent] ?? (agent === defaults.agent ? defaults.model || '' : '');
     }
     return this.request('POST', '/sessions', { prompt, cwd: path.resolve(cwd), agent, mode, model, effort, attachments, worktree, compare, subagents, preset });

package/server/handoff.js

@@ -3,6 +3,7 @@
 // those turns out (requests, reports, files touched) and goes ahead of the follow-up's prompt.
 // A harness that ran earlier in the task resumes its own session and only hears what it missed.
 
+import { textMentions } from './mentions.js';
 import { blocksToMarkdown } from './render.js';
 import { clip, truncate } from './util.js';
 
@@ -27,7 +28,7 @@ function turnText(t, n, name) {
   return truncate(
     [
       `### Turn ${n} · ${name(t)}${t.model ? ` (${t.model})` : ''}${t.status === 'stopped' ? ' · stopped' : t.status === 'error' ? ' · failed' : ''}${t.rolledBackAt ? ' · rolled back, its edits were undone' : ''}`,
-      `**User:** ${t.prompt}`,
+      `**User:** ${textMentions(t.prompt)}`,
       report && `**Report:**\n\n${report}`,
       files.length && `**Files it edited:** ${files.join(', ')}`,
     ]

package/server/mcp-ask.js

@@ -1,13 +1,18 @@
 #!/usr/bin/env node
-// Minimal stdio MCP server exposing `ask_user`, injected into every agent wisp launches.
+// Minimal stdio MCP server exposing `ask_user`, `wisp_stats`, `wisp_sessions` and `wisp_session`, injected into every agent wisp launches.
 // The call is relayed to the wisp server, which surfaces it in the queue and blocks
 // (by polling) until the user answers — so the agent keeps its full context.
 // With a team (WISP_TEAM), it also offers `delegate` and `subagent_results`: tasks for the
 // subagents the user picked, which wisp runs as child sessions while this call waits.
+// With WISP_APPROVE, it offers `approve`: the harness's permission prompt (Claude's
+// --permission-prompt-tool), answered by the user in wisp.
+// `wisp_stats` is read-only: tool counts, spend and success rate across the user's wisp sessions.
+// `wisp_sessions` and `wisp_session` are read-only too: list the user's other tasks and read one's
+// reports, e.g. a task the user mentioned in the prompt.
 
 import readline from 'node:readline';
 
-const { WISP_URL, WISP_TOKEN, WISP_SESSION } = process.env;
+const { WISP_URL, WISP_TOKEN, WISP_SESSION, WISP_APPROVE } = process.env;
 let TEAM = [];
 try {
   TEAM = JSON.parse(process.env.WISP_TEAM || '[]');
@@ -30,6 +35,83 @@ const TOOL = {
   },
 };
 
+// Claude's permission-prompt contract: { tool_name, input, tool_use_id } in, a JSON
+// { behavior: 'allow', updatedInput } or { behavior: 'deny', message } back as text.
+const APPROVE = {
+  name: 'approve',
+  description: 'Internal: wisp asks the user to approve a tool call your permissions do not allow on their own. Never call this yourself.',
+  inputSchema: {
+    type: 'object',
+    properties: { tool_name: { type: 'string' }, input: { type: 'object' }, tool_use_id: { type: 'string' } },
+    required: ['tool_name'],
+  },
+};
+
+const STATS = {
+  name: 'wisp_stats',
+  description:
+    'Read-only stats about the user\'s past wisp tasks: how many tool calls each kind of action made (run = shell, read, edit, ' +
+    'search, web, agent, tool = other MCP tools, ask), broken down by harness, project and day, plus turns, cost, tokens and ' +
+    'success rate. Use when the user asks about their wisp usage, which tools or harnesses their tasks use, or what tasks cost.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      days: { type: 'number', description: 'How many days back, 1–365. Default 30.' },
+      agent: { type: 'string', description: 'Only this harness, e.g. claude, codex, opencode.' },
+      project: { type: 'string', description: 'Only this project (name or id); "current" = the project of this task.' },
+    },
+  },
+};
+
+const SESSIONS = {
+  name: 'wisp_sessions',
+  description:
+    'List the user\'s other wisp tasks, newest first: id, title, state (running | waiting | review | done), harness, project, ' +
+    'last update and a one-line summary. Read-only. Use it to find a task the user refers to; read one with wisp_session.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      query: { type: 'string', description: 'Only tasks whose title or summary has all these words.' },
+      state: { type: 'string', description: 'Comma-separated, e.g. "running,waiting".' },
+      project: { type: 'string', description: 'Only this project (name or id); "current" = the project of this task.' },
+      archived: { type: 'boolean', description: 'Include archived tasks. Default false.' },
+      limit: { type: 'number', description: 'Default 20, at most 100.' },
+    },
+  },
+};
+
+const SESSION = {
+  name: 'wisp_session',
+  description:
+    'Read another wisp task by id: its title, state, harness, folder and branch, every request the user made in it, and a ' +
+    'turn\'s report as markdown (summary, diffs, tests, next steps). Read-only. Use it when the prompt mentions a wisp task ' +
+    '("@Title (wisp task <id>)") or the user asks what another task did.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      id: { type: 'string', description: 'The task id.' },
+      turn: { type: 'number', description: 'Which turn\'s report, 1 = first. Default: the latest.' },
+    },
+    required: ['id'],
+  },
+};
+
+async function sessions(args = {}) {
+  const q = new URLSearchParams(Object.entries(args).filter(([, v]) => v !== undefined && v !== '').map(([k, v]) => [k, String(v)]));
+  return (await call(`/api/internal/sessions/${WISP_SESSION}?${q}`)).text;
+}
+
+async function session({ id, turn } = {}) {
+  if (!id) throw new Error('id is required');
+  const q = new URLSearchParams({ of: String(id), ...(turn !== undefined && { turn: String(turn) }) });
+  return (await call(`/api/internal/session/${WISP_SESSION}?${q}`)).text;
+}
+
+async function stats({ days, agent, project } = {}) {
+  const q = new URLSearchParams(Object.entries({ days, agent, project }).filter(([, v]) => v !== undefined && v !== ''));
+  return (await call(`/api/internal/stats/${WISP_SESSION}?${q}`)).text;
+}
+
 const roster = TEAM.map((m) => `- ${m.name}${m.count > 1 ? ` ×${m.count} (parallel copies ${m.copies.join(', ')})` : ''}: ${[m.agent, m.model || 'default model', m.effort && `${m.effort} thinking`].filter(Boolean).join(' · ')}${m.use ? ` — use for: ${m.use}` : ''}`).join('\n');
 const TEAM_TOOLS = [
   {
@@ -104,8 +186,8 @@ async function call(path, body) {
   return res.json();
 }
 
-async function askUser(args) {
-  const { id } = await call(`/api/internal/ask`, { session: WISP_SESSION, ...args });
+// Poll a question until it's answered ({ answer, … }) or cancelled (null).
+async function waitFor(id) {
   for (;;) {
     await sleep(1500);
     let r;
@@ -114,11 +196,24 @@ async function askUser(args) {
     } catch {
       continue; // wisp restarting — keep waiting
     }
-    if (r.answer !== undefined) return r.answer;
+    if (r.answer !== undefined) return r;
     if (r.cancelled) return null;
   }
 }
 
+async function askUser(args) {
+  const { id } = await call(`/api/internal/ask`, { session: WISP_SESSION, ...args });
+  return (await waitFor(id))?.answer ?? null;
+}
+
+async function approve({ tool_name: tool, input = {} }) {
+  let r = await call(`/api/internal/approve`, { session: WISP_SESSION, tool, input });
+  if (r.id) r = await waitFor(r.id);
+  if (r?.decision === 'allow') return { behavior: 'allow', updatedInput: input };
+  if (!r) return { behavior: 'deny', message: 'The user did not answer (the request was cancelled). Do not retry it; carry on without it and say what was skipped.' };
+  return { behavior: 'deny', message: r.message ? `The user denied this and said: ${r.message}` : 'The user denied this. Do not retry it; carry on without it or ask how to proceed.' };
+}
+
 readline.createInterface({ input: process.stdin }).on('line', async (line) => {
   let msg;
   try {
@@ -133,11 +228,19 @@ readline.createInterface({ input: process.stdin }).on('line', async (line) => {
     if (method === 'initialize') {
       send({ id, result: { protocolVersion: params?.protocolVersion || '2025-06-18', capabilities: { tools: {} }, serverInfo: { name: 'wisp', version: '0.1.0' } } });
     } else if (method === 'tools/list') {
-      send({ id, result: { tools: TEAM.length ? [TOOL, ...TEAM_TOOLS] : [TOOL] } });
+      send({ id, result: { tools: [TOOL, STATS, SESSIONS, SESSION, ...(WISP_APPROVE ? [APPROVE] : []), ...(TEAM.length ? TEAM_TOOLS : [])] } });
     } else if (method === 'tools/call' && params?.name === 'ask_user') {
       const answer = await askUser(params.arguments || {});
       const text = answer === null ? 'The user did not answer (the question was cancelled). Use your best judgment and note the assumption.' : `The user answered: ${answer}`;
       send({ id, result: { content: [{ type: 'text', text }] } });
+    } else if (method === 'tools/call' && WISP_APPROVE && params?.name === 'approve') {
+      send({ id, result: { content: [{ type: 'text', text: JSON.stringify(await approve(params.arguments || {})) }] } });
+    } else if (method === 'tools/call' && params?.name === 'wisp_stats') {
+      send({ id, result: { content: [{ type: 'text', text: await stats(params.arguments || {}) }] } });
+    } else if (method === 'tools/call' && params?.name === 'wisp_sessions') {
+      send({ id, result: { content: [{ type: 'text', text: await sessions(params.arguments || {}) }] } });
+    } else if (method === 'tools/call' && params?.name === 'wisp_session') {
+      send({ id, result: { content: [{ type: 'text', text: await session(params.arguments || {}) }] } });
     } else if (method === 'tools/call' && TEAM.length && params?.name === 'delegate') {
       send({ id, result: { content: [{ type: 'text', text: await delegate(params.arguments || {}) }] } });
     } else if (method === 'tools/call' && TEAM.length && params?.name === 'subagent_results') {
@@ -149,7 +252,9 @@ readline.createInterface({ input: process.stdin }).on('line', async (line) => {
       send({ id, error: { code: -32601, message: `Method not found: ${method}` } });
     }
   } catch (err) {
-    const what = params?.name === 'ask_user' ? 'wisp could not reach the user' : 'wisp';
-    send({ id, result: { isError: true, content: [{ type: 'text', text: `${what}: ${err.message}` }] } });
+    const what = params?.name === 'ask_user' || params?.name === 'approve' ? 'wisp could not reach the user' : 'wisp';
+    // A permission prompt that errors would leave the harness guessing: deny, and say why.
+    if (params?.name === 'approve') send({ id, result: { content: [{ type: 'text', text: JSON.stringify({ behavior: 'deny', message: `${what}: ${err.message}` }) }] } });
+    else send({ id, result: { isError: true, content: [{ type: 'text', text: `${what}: ${err.message}` }] } });
   }
 });

package/server/mentions.js

@@ -0,0 +1,39 @@
+// Task mentions: a prompt can point at another wisp task. The web app stores one as
+// `@[Title](wisp:<id>)` (pasting a copied task id in a prompt box makes one); the agent gets
+// `@Title (wisp task <id>)` plus a note on how to read it: the wisp_session tool, or the task's
+// report inline for runs that can't take wisp's MCP tools.
+
+import { sessionToMarkdown } from './render.js';
+import { truncate } from './util.js';
+
+export const MENTION = /@\[([^\]\n]{1,200})\]\(wisp:([a-z0-9]{6,40})\)/g;
+const INLINE_MAX = 8_000; // characters of a mentioned task's report, when it goes in the prompt
+
+export const mentionsIn = (text = '') => [...new Map([...String(text).matchAll(MENTION)].map((m) => [m[2], { id: m[2], title: m[1] }])).values()];
+
+// What a person reads: titles, no ids (session titles, notifications).
+export const plainMentions = (text = '') => String(text).replace(MENTION, '@$1');
+
+// What an agent reads in place of each mention.
+export const textMentions = (text = '') => String(text).replace(MENTION, '@$1 (wisp task $2)');
+
+// The prompt for an agent run. tool: how this harness names the wisp_session tool, or null when
+// it has none (then each mentioned task's latest report goes in the prompt).
+export function agentPrompt(prompt, store, { tool = 'wisp_session', self } = {}) {
+  const found = mentionsIn(prompt).filter((m) => m.id !== self);
+  if (!found.length) return textMentions(prompt);
+  const line = (m) => {
+    const s = store.get(m.id);
+    if (!s) return `- \`${m.id}\` (${m.title}): not on this computer; it may have been deleted or run on another machine.`;
+    return `- \`${s.id}\` **${s.title}**: ${s.state}, ${s.agent}, ${s.turns.length} turn${s.turns.length === 1 ? '' : 's'}, in \`${s.worktree?.path || s.cwd}\``;
+  };
+  const note = tool
+    ? `The user mentions other wisp tasks. Read one with \`wisp_session\` (${tool}) before relying on it; \`wisp_sessions\` lists the rest.\n${found.map(line).join('\n')}`
+    : `The user mentions other wisp tasks. Their latest reports:\n\n${found
+        .map((m) => {
+          const s = store.get(m.id);
+          return s ? `### ${s.title} (\`${s.id}\`)\n\n${truncate(sessionToMarkdown(s), INLINE_MAX)}` : line(m);
+        })
+        .join('\n\n')}`;
+  return `${textMentions(prompt)}\n\n<wisp-tasks>\n${note}\n</wisp-tasks>`;
+}