wisp-agents 0.16.0 → 0.17.0

package/server/openapi.js

@@ -226,7 +226,8 @@ export function openapi({ version, port }) {
           responses: { 200: json({ type: 'object', properties: { answered: { type: 'boolean' }, queued: { type: 'boolean' }, interrupted: { type: 'boolean' }, ahead: { type: 'integer' } } }), 400: err[400] },
         },
       },
-      '/sessions/{id}/answer': { parameters: [id], post: { summary: 'Answer the pending ask_user question', requestBody: body({ type: 'object', required: ['text'], properties: { text: { type: 'string' } } }), responses: { 200: ok } } },
+      '/sessions/{id}/answer': { parameters: [id], post: { summary: 'Answer the pending ask_user question (or approval: Allow, Always allow in this task, Deny, or what to do instead)', requestBody: body({ type: 'object', required: ['text'], properties: { text: { type: 'string' } } }), responses: { 200: ok } } },
+      '/sessions/{id}/approve': { parameters: [id], post: { summary: 'Allow and retry (or deny) what a finished turn’s permissions blocked', requestBody: body({ type: 'object', properties: { turnId: { type: 'string' }, allow: { type: 'boolean', description: 'Default true' } } }), responses: { 200: ok } } },
       '/sessions/{id}/revert': {
         parameters: [id],
         post: {
@@ -292,7 +293,7 @@ export function openapi({ version, port }) {
             cwd: { type: 'string', description: 'Project folder (absolute; ~ allowed). Default: the server’s cwd' },
             agent: { enum: ['auto', 'claude', 'codex', 'opencode', 'cursor', 'antigravity', 'grok'], default: 'auto', description: 'auto: wisp picks the harness and model from what worked before; model is then the goal (cheap, balanced, best)' },
             important: { type: 'boolean', description: 'With agent auto: no exploring, take the pick with the best record' },
-            mode: { enum: ['plan', 'edits', 'auto'], default: 'edits' },
+            mode: { enum: ['plan', 'edits', 'auto'], default: 'auto' },
             model: { type: 'string' },
             effort: { type: 'string', description: 'Thinking level: low, medium, high, xhigh, max (per harness)' },
             attachments: { type: 'array', items: { type: 'string' }, description: 'Upload ids' },

package/server/protocol.js

@@ -69,6 +69,9 @@ diff, the test run, the command output — over prose. Use file paths relative t
   A screenshot or generated image on disk.
 - {"type":"question","question":"…","options":[{"label":"Short choice","reply":"full message sent back to you"}]}
   When you need a decision. The user's click resumes you with the reply.
+- {"type":"blocked","items":[{"tool":"shell","detail":"npm publish","why":"needs network access"}]}
+  Actions your permissions or sandbox refused (a denied tool call, a command that failed for lack of
+  network or write access). wisp shows them with an Allow & retry button. Not for ordinary failures.
 - {"type":"actions","title":"…","items":[{"label":"Run tests","command":"npm test"},{"label":"Follow up","reply":"…"}]}
   One-click shell commands (executed in the project root) or follow-up actions the user may want to trigger.
 - {"type":"next","items":["Suggested follow-up the user might send", "…"]}
@@ -89,7 +92,11 @@ Strings must be valid JSON (escape newlines as \\n and quotes as \\"). Example:
 
 const ASK_TOOL = (tool) => `- If a decision would change the rest of the work (ambiguous requirement, destructive or risky step,
   two very different approaches), call the \`ask_user\` tool (${tool}). It pauses you until
-  the user answers in wisp — you keep all your context. Ask one crisp question with 2–4 options.`;
+  the user answers in wisp — you keep all your context. Ask one crisp question with 2–4 options.
+- If the user asks about their past wisp tasks (which tools or harnesses they use, cost, success rate),
+  call \`wisp_stats\` (${tool.replace(/ask_user$/, 'wisp_stats')}) instead of digging through files.
+- If the prompt mentions another wisp task ("@Title (wisp task <id>)") or the user asks what another task
+  did, read it with \`wisp_session\` (${tool.replace(/ask_user$/, 'wisp_session')}); \`wisp_sessions\` lists them.`;
 const ASK_BLOCK = `- If a decision would change the rest of the work (ambiguous requirement, destructive or risky step,
   two very different approaches), stop before acting on it and end with a "question" block (2–4 options).
   The user's answer comes back as a follow-up in this same session.`;

package/server/render.js

@@ -80,6 +80,8 @@ const R = {
   callout: (b) => `> **${b.tone === 'danger' ? '⛔' : b.tone === 'warn' ? '⚠️' : b.tone === 'success' ? '✅' : 'ℹ️'} ${str(b.title)}**\n> ${str(b.text).replace(/\n/g, '\n> ')}`,
   image: (b) => `🖼️ \`${str(b.path || b.src)}\`${b.caption ? ` — ${b.caption}` : ''}`,
   question: (b) => `**❓ ${str(b.question)}**\n${list(b.options).map((o, i) => `${i + 1}. ${str(o.label || o)}`).join('\n')}`,
+  blocked: (b, turn) =>
+    `**🔒 Blocked by permissions**${turn?.approval ? ` _(${turn.approval})_` : ''}\n${list(b.items).map((i) => `- ${str(i.tool)}${i.detail ? `: \`${str(i.detail)}\`` : ''}${i.why ? ` — ${i.why}` : ''}`).join('\n')}`,
   actions: (b) =>
     `${b.title ? `**${b.title}**\n` : '**Actions**\n'}${list(b.items)
       .map((a) => (typeof a === 'string' ? `- ${a}` : `- **${str(a.label || a.command)}**${a.command ? ` — \`$ ${str(a.command)}\`` : a.reply ? ` — _${str(a.reply)}_` : ''}${a.detail ? ` (${str(a.detail)})` : ''}`))
@@ -109,7 +111,7 @@ export function sessionToMarkdown(session) {
   if (turn?.status === 'running') out.push(`_Working… (${turn.activity?.findLast?.((a) => a.kind !== 'text')?.label || 'starting up'})_`);
   else if (turn?.presentation) out.push(blocksToMarkdown(turn.presentation.blocks, turn));
   if (session.ask) {
-    out.push(`**❓ The agent is waiting for your answer:** ${session.ask.question}${session.ask.context ? `\n\n${session.ask.context}` : ''}`);
+    out.push(`**${session.ask.permission ? '🔒 The agent needs your approval' : '❓ The agent is waiting for your answer'}:** ${session.ask.question}${session.ask.context ? `\n\n${session.ask.context}` : ''}`);
     if (session.ask.options?.length) out.push(session.ask.options.map((o, i) => `${i + 1}. ${o}`).join('\n'));
   }
   // Worktree sessions: say where the changes are, since they aren't in the caller's checkout.

package/server/routes/internal.js

@@ -1,8 +1,14 @@
-// Bridge for the MCP servers running inside an agent process (ask_user, delegate). Every call
+// Bridge for the MCP servers running inside an agent process (ask_user, approve, delegate, wisp_stats,
+// wisp_sessions, wisp_session). Every call
 // carries the per-run token wisp handed the agent; nothing else may use these.
 
 import { adapters } from '../adapters/index.js';
+import { plainMentions } from '../mentions.js';
+import { blocksToMarkdown, sessionToMarkdown } from '../render.js';
+import { summarize } from '../runner.js';
 import { delegationReport } from '../subagents.js';
+import { toolStats, toolStatsText } from '../usage.js';
+import { clip } from '../util.js';
 
 export function register(r, app) {
   const { store, runner, telemetry } = app;
@@ -25,6 +31,22 @@ export function register(r, app) {
   );
   r.route('GET', '/internal/ask/:id', guarded((c) => c.send(200, runner.pollAnswer(c.params.id))), opts);
 
+  // A live approval (the harness's permission prompt): { decision } at once, or an { id } to poll
+  // like ask_user, whose answer carries the decision.
+  r.route(
+    'POST',
+    '/internal/approve',
+    guarded(async (c) => {
+      const body = await c.body();
+      const s = store.get(body.session);
+      if (!s) return c.send(404, { error: 'no such session' });
+      const out = runner.requestApproval(s, body);
+      if (out.id) telemetry.track('approval', { agent: s.agent });
+      c.send(200, out);
+    }),
+    opts,
+  );
+
   // delegate: POST starts tasks on the lead's subagents; GET reports on them (done once all finished).
   r.route(
     'POST',
@@ -53,4 +75,102 @@ export function register(r, app) {
     }),
     opts,
   );
+
+  // wisp_stats: read-only tool counts, spend and success across sessions. project=current is the
+  // asking session's project.
+  r.route(
+    'GET',
+    '/internal/stats/:id',
+    guarded((c) => {
+      const s = lead(c);
+      if (!s) return c.send(404, { error: 'no such session' });
+      const projectFor = (x) => store.projectFor(x.cwd);
+      let project = c.query.get('project') || '';
+      if (project === 'current') project = projectFor(s)?.id || String(s.cwd || '').split(/[\\/]/).pop();
+      const stats = toolStats(store.all(), { days: Number(c.query.get('days')) || 30, project: projectFor, filter: { agent: c.query.get('agent') || '', project } });
+      telemetry.track('wisp_stats', { agent: s.agent });
+      c.send(200, { stats, text: toolStatsText(stats) });
+    }),
+    opts,
+  );
+  // wisp_sessions: the user's other tasks (not the asker, its subagents or the tour), newest first.
+  r.route(
+    'GET',
+    '/internal/sessions/:id',
+    guarded((c) => {
+      const s = lead(c);
+      if (!s) return c.send(404, { error: 'no such session' });
+      const q = Object.fromEntries(c.query);
+      let project = q.project || '';
+      if (project === 'current') project = store.projectFor(s.cwd)?.id || String(s.cwd || '').split(/[\\/]/).pop();
+      const states = q.state ? q.state.split(',').map((x) => x.trim()) : null;
+      const words = String(q.query || '').toLowerCase().split(/\s+/).filter(Boolean);
+      const all = store
+        .all()
+        .filter((x) => x.id !== s.id && !x.parentId && x.agent !== 'wisp' && x.id !== s.parentId)
+        .map((x) => summarize(x, store))
+        .filter((x) => (q.archived === 'true' || !x.archived) && (!states || states.includes(x.state)))
+        .filter((x) => !project || x.projectId === project || x.project === project)
+        .filter((x) => words.every((w) => `${x.title} ${x.preview}`.toLowerCase().includes(w)))
+        .sort((a, b) => b.updatedAt - a.updatedAt);
+      const list = all.slice(0, Math.min(Math.max(Number(q.limit) || 20, 1), 100));
+      telemetry.track('wisp_sessions', { agent: s.agent });
+      const text = list.length
+        ? `${all.length} task${all.length === 1 ? '' : 's'}${all.length > list.length ? `, the newest ${list.length}` : ''}. Read one with wisp_session.\n\n${list.map(sessionLine).join('\n')}`
+        : 'No tasks match.';
+      c.send(200, { text });
+    }),
+    opts,
+  );
+
+  // wisp_session: one task's requests and a turn's report (?of=<id>&turn=<1-based>).
+  r.route(
+    'GET',
+    '/internal/session/:id',
+    guarded((c) => {
+      const s = lead(c);
+      if (!s) return c.send(404, { error: 'no such session' });
+      const id = String(c.query.get('of') || '').trim().replace(/^wisp:/, '');
+      const x = store.get(id);
+      telemetry.track('wisp_session', { agent: s.agent });
+      if (!x) return c.send(200, { text: `No wisp task \`${id}\` on this computer. It may have been deleted, or it ran on another machine. List tasks with wisp_sessions.` });
+      c.send(200, { text: sessionText(x, store, c.query.get('turn')) });
+    }),
+    opts,
+  );
+}
+
+const age = (t) => {
+  const m = Math.round((Date.now() - t) / 60_000);
+  return m < 1 ? 'just now' : m < 60 ? `${m}m ago` : m < 48 * 60 ? `${Math.round(m / 60)}h ago` : `${Math.round(m / 1440)}d ago`;
+};
+
+const sessionLine = (x) =>
+  `- \`${x.id}\` **${x.title}** — ${x.archived ? 'archived, ' : ''}${x.state}, ${x.agent}${x.model ? ` (${x.model})` : ''}, ${x.project}, ${age(x.updatedAt)}${x.state === 'running' && x.live ? `: ${x.live}` : x.preview ? `: ${clip(x.preview, 160)}` : ''}`;
+
+export function sessionText(x, store, turnArg) {
+  const sum = summarize(x, store);
+  const n = Number(turnArg);
+  const turn = turnArg === null || turnArg === undefined || turnArg === '' || !n ? x.turns.at(-1) : x.turns[n - 1];
+  const head = [
+    `# ${x.title}`,
+    `Task \`${x.id}\` · ${sum.archived ? 'archived · ' : ''}${x.state} · ${x.agent}${x.model ? ` (${x.model})` : ''} · project ${sum.project} · updated ${age(x.updatedAt)}`,
+    `Folder: \`${x.worktree?.path || x.cwd}\`${x.worktree ? ` (worktree, branch \`${x.worktree.branch}\`)` : ''}${x.pr ? ` · PR #${x.pr.number} (${String(x.pr.state).toLowerCase()}): ${x.pr.url}` : ''}`,
+  ];
+  const asks = x.turns.map((t, i) => `${i + 1}. ${clip(plainMentions(t.prompt).replace(/\s+/g, ' '), 300)}${t.status === 'running' ? ' _(running)_' : t.status === 'error' ? ' _(failed)_' : t.status === 'stopped' ? ' _(stopped)_' : ''}`);
+  if (!turn) return [...head, '', `Turn ${turnArg} doesn't exist; this task has ${x.turns.length}.`, '', '## Requests', ...asks].join('\n');
+  const i = x.turns.indexOf(turn);
+  const report = turn === x.turns.at(-1) ? sessionToMarkdown(x) : blocksToMarkdown(turn.presentation?.blocks, turn);
+  const files = (turn.changes || []).filter((ch) => !ch.reverted).map((ch) => `\`${ch.file}\``);
+  return [
+    ...head,
+    '',
+    `## Requests (${x.turns.length})`,
+    ...asks,
+    '',
+    `## Report for turn ${i + 1}${x.turns.length > 1 ? ` of ${x.turns.length} (pass turn to read another)` : ''}`,
+    '',
+    report || '_No report yet._',
+    ...(files.length ? ['', `Files edited in this turn: ${files.join(', ')}`] : []),
+  ].join('\n');
 }

package/server/routes/sessions.js

@@ -206,6 +206,18 @@ export function register(r, app) {
     }),
   );
 
+  // The card under a turn whose permissions blocked something: allow retries it, deny closes it.
+  r.route(
+    'POST',
+    '/sessions/:id/approve',
+    one(async (c, s) => {
+      const { turnId, allow } = await c.body();
+      notTour(s, 'approve');
+      await ensureWorktree(s.worktree);
+      c.send(200, runner.approveBlocked(s, { turnId, allow: allow !== false }));
+    }),
+  );
+
   // Revert (or re-apply) a single file's edits from a turn, or roll back (or re-apply) the
   // project's working tree to the checkpoint before a turn. Both note it on the turn and tell
   // the cards; Ship it may have something new (or nothing left) to ship.

package/server/runner.js

@@ -11,6 +11,7 @@ import { systemPrompt, parsePresentation, heroOf } from './protocol.js';
 import { captureCheckpoint, freshCheckpoint, readGitFile } from './checkpoint.js';
 import { teamNote, copies, SUBAGENT_ASK } from './subagents.js';
 import { handoffNote } from './handoff.js';
+import { agentPrompt, plainMentions } from './mentions.js';
 import { bad, MODES, newId } from './util.js';
 
 const MAX_ACTIVITY = 400;
@@ -19,6 +20,26 @@ const BACKGROUND_MAX_MS = 60 * 60_000; // how long a turn may wait on its backgr
 const ASK_SERVER = path.join(path.dirname(fileURLToPath(import.meta.url)), 'mcp-ask.js');
 // The delegate tool lives on the same injected server, so harnesses name it like ask_user.
 const delegateTool = (askTool) => askTool && askTool.replace(/ask_user$/, 'delegate');
+// The answers a live approval offers. Typed text instead is a "no, do this instead".
+export const APPROVAL = { allow: 'Allow', always: 'Always allow in this task', deny: 'Deny' };
+const sameAction = (a, b) => a.tool === b.tool && a.detail === b.detail;
+
+// A live approval's answer: the button the user clicked, a yes/no typed out, or anything else,
+// which denies the call and hands the agent the user's words.
+export function approvalDecision(text) {
+  const t = String(text || '').trim();
+  if (t === APPROVAL.always || /^(always\b|2$)/i.test(t)) return { decision: 'allow', always: true };
+  if (t === APPROVAL.allow || /^(y|yes|ok|allow|approve|go ahead|1)$/i.test(t)) return { decision: 'allow' };
+  if (t === APPROVAL.deny || /^(n|no|deny|reject|3)$/i.test(t)) return { decision: 'deny' };
+  return { decision: 'deny', message: t };
+}
+
+// The follow-up that retries what a turn's permissions refused, once the user allowed it.
+function retryPrompt(items, scoped) {
+  const list = items.map((b) => `- ${b.tool}${b.detail ? `: \`${b.detail}\`` : ''}`).join('\n');
+  const how = scoped ? 'I allowed exactly these for this follow-up' : 'This follow-up runs in Full auto, so nothing is blocked';
+  return `These actions were blocked by your permissions last turn:\n${list}\n\n${how}. Run them now and finish the task.`;
+}
 
 export { newId };
 
@@ -43,7 +64,7 @@ function changedRun(session, run) {
 }
 
 function autoTitle(prompt) {
-  const line = prompt.trim().split('\n')[0].replace(/\s+/g, ' ');
+  const line = plainMentions(prompt).trim().split('\n')[0].replace(/\s+/g, ' ');
   return line.length > 64 ? `${line.slice(0, 63)}…` : line;
 }
 
@@ -78,6 +99,7 @@ export function summarize(s, store) {
     live: s.ask ? `Asks: ${s.ask.question}` : last?.status === 'running' ? waitingOn || lastAct?.label || 'Starting up' : '',
     asks: !!s.ask || !!last?.presentation?.blocks?.some((b) => b.type === 'question'),
     question: s.ask?.question || '',
+    approval: !!s.ask?.permission, // the question is a live approval (Allow / Deny)
     branch: s.worktree?.branch || '',
     toShip: s.toShip || null, // { dirty, ahead, unpushed } of the worktree, null until checked
     pr: s.pr ? { number: s.pr.number, url: s.pr.url, state: s.pr.state, draft: s.pr.draft, review: s.pr.review, checks: s.pr.checks } : null,
@@ -122,7 +144,7 @@ export class Runner extends EventEmitter {
   }
 
   // subagents: the team a lead may delegate to. parentId/member: this session is one of them.
-  create({ id = newId(), prompt, cwd, agent = 'claude', mode = 'edits', model = '', effort = '', attachments = [], worktree = null, groupId = null, origin = null, subagents = [], parentId = null, member = '', route = null }) {
+  create({ id = newId(), prompt, cwd, agent = 'claude', mode = 'auto', model = '', effort = '', attachments = [], worktree = null, groupId = null, origin = null, subagents = [], parentId = null, member = '', route = null }) {
     if (!adapters[agent]) throw new Error(`Unknown agent: ${agent}`);
     const now = Date.now();
     const session = {
@@ -158,11 +180,12 @@ export class Runner extends EventEmitter {
   // mode: switch the permission mode (plan / edits / auto) from this follow-up on. A queued
   // follow-up keeps its own, so the run before it isn't affected. run: { agent, model, effort }
   // switches the harness, model and thinking level the same way (see #switchRun).
-  reply(session, text, attachments = [], { queue = false, mode, run } = {}) {
+  // grants / once: a retry of what the last turn's permissions blocked (see approveBlocked).
+  reply(session, text, attachments = [], { queue = false, mode, run, grants, once } = {}) {
     if (!MODES.has(mode) || mode === session.mode) mode = undefined;
     run = changedRun(session, run);
-    const extra = { ...(mode && { mode }), ...(run && { run }) };
-    if (session.ask && !mode && !run) {
+    const extra = { ...(mode && { mode }), ...(run && { run }), ...(grants?.length && { grants }), ...(MODES.has(once) && { once }) };
+    if (session.ask && !Object.keys(extra).length) {
       this.answer(session, text);
       return { answered: true };
     }
@@ -190,10 +213,29 @@ export class Runner extends EventEmitter {
     }
     if (mode) session.mode = mode;
     if (run) this.#switchRun(session, run);
-    this.#startTurn(session, text, attachments);
+    this.#startTurn(session, text, attachments, extra);
     return { queued: false };
   }
 
+  // The card under a turn whose permissions refused something: allow retries it as a follow-up,
+  // with exactly those actions allowed where the harness can scope a grant, else in Full auto for
+  // that one follow-up. Deny just closes the card.
+  approveBlocked(session, { turnId, allow }) {
+    const turn = turnId ? session.turns.find((t) => t.id === turnId) : session.turns.at(-1);
+    if (!turn?.blocked?.length) throw bad('Nothing on that turn is waiting for approval.', 404);
+    if (turn.approval) throw bad(`Already ${turn.approval}.`, 409);
+    if (turn !== session.turns.at(-1) || this.live.has(session.id)) throw bad('The task has moved on since; send a follow-up instead.', 409);
+    turn.approval = allow ? 'allowed' : 'denied';
+    if (!allow) {
+      this.#touch(session, { turn: turn.id });
+      return { denied: true };
+    }
+    const scoped = turn.blocked.every((b) => b.rule !== undefined);
+    const out = this.reply(session, retryPrompt(turn.blocked, scoped), [], scoped ? { grants: turn.blocked.map((b) => b.rule) } : { once: 'auto' });
+    this.#touch(session, { turn: turn.id });
+    return { ...out, scoped };
+  }
+
   // A follow-up on another harness, model or thinking level. A model or level change resumes the
   // same conversation; a harness change resumes that harness's own one (if it ran earlier in this
   // task) or starts it fresh, and #startTurn hands it the turns it missed.
@@ -222,7 +264,8 @@ export class Runner extends EventEmitter {
   }
 
   // ask_user: the agent is blocked inside a tool call until answer() is called.
-  ask(session, { question, context, options }) {
+  // permission: set for a live approval ({ tool, action, detail }), see requestApproval().
+  ask(session, { question, context, options, permission }) {
     const turn = session.turns.at(-1);
     session.ask = {
       id: newId(),
@@ -230,34 +273,66 @@ export class Runner extends EventEmitter {
       context: context ? String(context) : '',
       options: Array.isArray(options) ? options.map(String).slice(0, 6) : [],
       askedAt: Date.now(),
+      ...(permission && { permission }),
     };
     session.state = 'waiting';
     session.unread = true;
     delete session.archived; // a question needs the user, so it comes back to the feed
-    if (turn) this.#onEvent(session, turn, { type: 'tool', kind: 'ask', label: `Asked you: ${session.ask.question}` });
+    const label = permission ? `Needs your OK to ${permission.action}` : `Asked you: ${session.ask.question}`;
+    if (turn) this.#onEvent(session, turn, { type: 'tool', kind: 'ask', label });
     this.#touch(session, { turn: turn?.id });
     this.emit('finished', { session: summarize(session, this.store) });
     return session.ask.id;
   }
 
+  // Live approval: the harness asks before a tool call its permission mode doesn't allow on its
+  // own (Claude's --permission-prompt-tool). It waits on the answer like ask_user; something the
+  // user said "always" to earlier in this task goes through at once.
+  requestApproval(session, { tool, input }) {
+    const adapter = adapters[session.agent];
+    const p = adapter.permission?.(String(tool || ''), input && typeof input === 'object' ? input : {}, workdir(session)) || { tool: String(tool || 'tool'), action: `use ${tool}`, detail: '' };
+    const turn = session.turns.at(-1);
+    if ((session.grants || []).some((g) => sameAction(g, p))) {
+      if (turn) this.#onEvent(session, turn, { type: 'tool', kind: 'answer', label: `Allowed (always in this task): ${p.action}` });
+      return { decision: 'allow' };
+    }
+    const id = this.ask(session, {
+      question: `Allow ${adapter.name} to ${p.action}?`,
+      context: p.why || '',
+      options: [APPROVAL.allow, APPROVAL.always, APPROVAL.deny],
+      permission: { tool: p.tool, action: p.action, detail: p.detail },
+    });
+    return { id };
+  }
+
   answer(session, text) {
     const ask = session.ask;
     if (!ask) return false;
     ask.answer = text;
-    this.answers.set(ask.id, text);
+    const turn = session.turns.at(-1);
+    let label = `You answered: ${text}`;
+    if (ask.permission) {
+      const d = approvalDecision(text);
+      this.answers.set(ask.id, { answer: text, ...d });
+      const p = ask.permission;
+      if (d.always) (session.grants ||= []).push({ tool: p.tool, detail: p.detail });
+      // Denied here, so the turn's "blocked" card shouldn't offer it again.
+      if (d.decision === 'deny' && turn) (turn.denied ||= []).push({ tool: p.tool, detail: p.detail });
+      label = d.decision === 'allow' ? `You allowed${d.always ? ' (always in this task)' : ''}: ${p.action}` : `You denied: ${p.action}${d.message ? ` (“${d.message}”)` : ''}`;
+    } else this.answers.set(ask.id, { answer: text });
     delete session.ask;
     session.state = this.live.has(session.id) ? 'running' : 'review';
-    const turn = session.turns.at(-1);
-    if (turn) this.#onEvent(session, turn, { type: 'tool', kind: 'answer', label: `You answered: ${text}` });
+    if (turn) this.#onEvent(session, turn, { type: 'tool', kind: 'answer', label });
     this.#touch(session, { turn: turn?.id });
     return true;
   }
 
+  // { answer } once answered (plus { decision, message? } for an approval), { pending }, or { cancelled }.
   pollAnswer(askId) {
     if (this.answers.has(askId)) {
-      const answer = this.answers.get(askId);
+      const out = this.answers.get(askId);
       this.answers.delete(askId);
-      return { answer };
+      return out;
     }
     const open = this.store.all().some((s) => s.ask?.id === askId);
     return open ? { pending: true } : { cancelled: true };
@@ -354,7 +429,7 @@ export class Runner extends EventEmitter {
   }
 
   // The record of a new turn, with the checkpoint taken before the agent touches anything.
-  #newTurn(session, prompt, attachments) {
+  #newTurn(session, prompt, attachments, mode = session.mode) {
     const id = newId();
     // A subagent's edits land in the lead's turn, whose checkpoint already covers them.
     const checkpoint =
@@ -369,7 +444,7 @@ export class Runner extends EventEmitter {
       agent: session.agent,
       model: session.model,
       effort: session.effort || '',
-      mode: session.mode,
+      mode,
       attachments: attachments.map(({ id, name, mime, size }) => ({ id, name, mime, size })),
       startedAt: Date.now(),
       endedAt: null,
@@ -404,14 +479,18 @@ export class Runner extends EventEmitter {
           WISP_URL: this.bridge.url,
           WISP_TOKEN: this.bridge.token,
           WISP_SESSION: session.id,
+          ...(adapter.approveTool && { WISP_APPROVE: '1' }),
           ...(team.length && { WISP_TEAM: JSON.stringify(team.map((m) => ({ name: m.name, agent: adapters[m.agent]?.name || m.agent, model: m.model, effort: m.effort, use: m.use, count: m.count || 1, copies: copies(m) }))) }),
         },
       },
     };
   }
 
-  #startTurn(session, prompt, attachments = []) {
-    const turn = this.#newTurn(session, prompt, attachments);
+  // grants: harness rules allowing what the user approved, for this turn only. once: a mode for
+  // this turn only (an approved retry the harness can't scope runs in Full auto).
+  #startTurn(session, prompt, attachments = [], { grants = [], once } = {}) {
+    const mode = MODES.has(once) ? once : session.mode;
+    const turn = this.#newTurn(session, prompt, attachments, mode);
     session.turns.push(turn);
     session.state = 'running';
     session.unread = false;
@@ -427,12 +506,16 @@ export class Runner extends EventEmitter {
     const team = adapter.askTool !== null ? session.subagents || [] : [];
     // A harness that hasn't seen every earlier turn (the user switched to it) gets them first.
     const handoff = session.parentId ? '' : handoffNote(session, session.agent, session.agentSessionId, (t) => adapters[t.agent]?.name || t.agent);
+    // Mentioned tasks: a lead reads them with wisp_session; a run without wisp's tools gets their reports.
+    const tools = !session.parentId && adapter.askTool !== null && this.bridge;
+    const text = agentPrompt(prompt, this.store, { tool: tools ? (adapter.askTool ?? 'mcp__wisp__ask_user').replace(/ask_user$/, 'wisp_session') : null, self: session.id });
     const handle = adapter.run({
-      prompt: handoff ? `${handoff}\n\n${prompt}` : prompt,
+      prompt: handoff ? `${handoff}\n\n${text}` : text,
       attachments,
       cwd: workdir(session),
       resumeId: session.agentSessionId,
-      mode: session.mode,
+      mode,
+      grants,
       model: session.model,
       effort: session.effort || '',
       systemPrompt: this.#systemPrompt(session, adapter, team),
@@ -467,7 +550,7 @@ export class Runner extends EventEmitter {
       const next = session.queue.shift();
       if (next?.mode) session.mode = next.mode;
       if (next?.run && adapters[next.run.agent]) this.#switchRun(session, next.run);
-      if (next && this.store.get(session.id)) this.#startTurn(session, next.text, next.attachments);
+      if (next && this.store.get(session.id)) this.#startTurn(session, next.text, next.attachments, next);
       else this.#touch(session);
     };
     handle.release = release;
@@ -516,6 +599,14 @@ export class Runner extends EventEmitter {
         if (leadTurn?.status === 'running') this.#onEvent(lead, leadTurn, { ...ev, by: session.member });
         return;
       }
+      case 'blocked': {
+        // A tool call the harness's permissions refused. The card after the turn offers to retry it.
+        const item = { tool: String(ev.tool || 'tool'), detail: String(ev.detail ?? ''), ...(ev.rule !== undefined && { rule: ev.rule }) };
+        const list = (turn.blocked ||= []);
+        if (!list.some((b) => sameAction(b, item))) list.push(item);
+        this.store.save(session);
+        return;
+      }
       case 'background': {
         turn.background = ev.tasks;
         if (turn.interim) this.#waitItem(session, turn);
@@ -583,6 +674,7 @@ export class Runner extends EventEmitter {
       // Compare runs keep the prompt's title: they're one task, and one run's headline shouldn't name it.
       if (hero?.title && session.titleAuto && session.turns.length === 1 && !session.groupId) session.title = hero.title;
     }
+    if (!ev.stopped) blockedCard(turn);
     session.state = 'review';
     session.unread = !interrupted;
     this.store.save(session, { now: true });
@@ -601,3 +693,27 @@ export class Runner extends EventEmitter {
     if (turn) this.emit('turn', { sessionId: session.id, turnId: turn });
   }
 }
+
+// What the turn's permissions refused, as one "blocked" block after the hero: the harness's own
+// reports (which can carry a rule to allow exactly that) merged with the agent's "blocked" block,
+// minus anything the user already denied. turn.blocked keeps the list for the retry.
+function blockedCard(turn) {
+  const blocks = turn.presentation?.blocks || [];
+  const own = blocks.filter((b) => b.type === 'blocked').flatMap((b) => (Array.isArray(b.items) ? b.items : []));
+  const items = [...(turn.blocked || [])];
+  for (const i of own) {
+    if (!i || typeof i !== 'object') continue;
+    const item = { tool: String(i.tool || 'tool'), detail: String(i.detail ?? i.command ?? i.path ?? ''), ...(i.why && { why: String(i.why) }) };
+    const known = items.find((b) => sameAction(b, item) || (item.detail && b.detail === item.detail));
+    if (known) known.why ||= item.why;
+    else items.push(item);
+  }
+  // The agent may name a tool its own way (shell for Bash): the same command still counts.
+  const left = items.filter((b) => !(turn.denied || []).some((d) => sameAction(d, b) || (b.detail && d.detail === b.detail))).slice(0, 12);
+  if (left.length) turn.blocked = left;
+  else delete turn.blocked;
+  if (!turn.presentation) return;
+  const rest = blocks.filter((b) => b.type !== 'blocked');
+  if (left.length) rest.splice(rest[0]?.type === 'hero' ? 1 : 0, 0, { type: 'blocked', items: left.map(({ rule, ...b }) => b) });
+  turn.presentation.blocks = rest;
+}

package/server/services/launch.js

@@ -33,7 +33,7 @@ export function createLaunch(app) {
       if (!adapters[agent]) throw bad(`unknown agent: ${agent}`);
       return { agent, model: r.model ?? (i ? d.models?.[agent] || '' : ''), effort: /^[\w-]{1,20}$/.test(r.effort || '') ? r.effort : '', ...(r.route && { route: r.route }) };
     });
-    const mode = MODES.has(body.mode) ? body.mode : 'edits';
+    const mode = MODES.has(body.mode) ? body.mode : 'auto';
     // Worktrees are on by default in git repos (off in Plan mode: nothing gets written). Compare
     // runs need one each, or the harnesses would edit the same files.
     const comparing = runners.length > 1;

package/server/services/phone.js

@@ -27,7 +27,7 @@ export function phoneActions(app) {
       const d = store.config.defaults;
       const agent = d.agent || 'claude';
       const model = d.models?.[agent] ?? d.model ?? '';
-      const [s] = await app.launcher.launchAny({ prompt, cwd: project.path, machine: project.machine || undefined, agent, model, mode: d.mode || 'edits' }, { kind: 'telegram', name: 'Telegram' });
+      const [s] = await app.launcher.launchAny({ prompt, cwd: project.path, machine: project.machine || undefined, agent, model, mode: d.mode || 'auto' }, { kind: 'telegram', name: 'Telegram' });
       app.broadcast('config', {});
       return s;
     },

package/server/store.js

@@ -9,7 +9,7 @@ import { writeJsonAtomic } from './util.js';
 
 const DEFAULT_CONFIG = {
   projects: [], // [{ id, name, path, color, addedAt, machine? }]; machine: the server/machines.js id it lives on
-  defaults: { agent: 'auto', mode: 'edits', model: '', effort: '' }, // auto: wisp picks harness and model (server/router.js)
+  defaults: { agent: 'auto', mode: 'auto', model: '', effort: '' }, // agent auto: wisp picks harness and model (server/router.js)
   recipes: [], // saved prompts with {params}: server/recipes.js
   triggers: [], // schedules and GitHub watchers: server/triggers.js
   teams: [], // saved subagent presets: server/subagents.js
@@ -66,9 +66,15 @@ export class Store {
         cfg.defaults.effort = '';
         cfg.autoIntroduced = true;
       }
+      // Full auto became the default mode: switch once from Edits (the old default); Plan and
+      // any later pick stick.
+      if (!cfg.fullAutoIntroduced) {
+        if (cfg.defaults.mode === 'edits') cfg.defaults.mode = 'auto';
+        cfg.fullAutoIntroduced = true;
+      }
       return cfg;
     } catch {
-      return { ...structuredClone(DEFAULT_CONFIG), autoIntroduced: true };
+      return { ...structuredClone(DEFAULT_CONFIG), autoIntroduced: true, fullAutoIntroduced: true };
     }
   }
 

package/server/triggers.js

@@ -100,7 +100,7 @@ export function normalizeTrigger(body, prev = null, { recipes = [] } = {}) {
   if (kind === 'schedule') parseCron(cron);
   const label = kind === 'issues' ? String(v('label', 'wisp')).trim() : '';
   if (kind === 'issues' && !label) throw bad('Pick the issue label to watch.');
-  const mode = String(v('mode', kind === 'issues' ? 'plan' : 'edits'));
+  const mode = String(v('mode', kind === 'issues' ? 'plan' : 'auto'));
   if (!MODES.has(mode)) throw bad('mode must be plan, edits or auto.');
   const changedSource = prev && (kind !== prev.kind || cwd !== prev.cwd || label !== prev.label || String(v('branch')) !== prev.branch);
   return {