wisp-agents 0.16.0 → 0.18.0

package/CHANGELOG.md

@@ -5,6 +5,41 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ## [Unreleased]
 
+## [0.18.0] - 2026-10-19
+
+### Added
+
+- **Merge conflicts on shipped PRs fix themselves.** When something lands on `main` and your shipped PR no longer merges, the task used to sit there until you noticed on GitHub. Now wisp sees it on its PR check (every minute, or when you press refresh): GitHub reports the PR as conflicting, and wisp confirms it locally with `git merge-tree` against a fresh fetch of the base, so a stale GitHub answer can't start a run. The task then gets a follow-up asking it to merge `origin/main` in (no rebase, since the branch is pushed), resolve each conflict keeping both sides' intent, run the cheap checks and commit. When that run ends, wisp checks the merge is complete: no unmerged files, the base is in the branch, no leftover `<<<<<<<` markers. Then it pushes to the PR, and the card shows the usual Push → PR track. While it works, the PR row reads *Fixing merge conflicts* and hides Merge. If the agent stops halfway, nothing is pushed: the card comes back unread with *Conflicts not fixed* and the reason, plus a **Fix conflicts** button to try again. wisp tries once per PR head and at most 3 times per task, so a base that keeps moving can't run up the bill. On by default; turn it off in Settings → General → **Fix PR conflicts** (`defaults.fixConflicts: "off"`). API: `conflict` on the PR, `conflictFix` on the session summary, `POST /api/sessions/:id/fix-conflicts`.
+
+- **Tasks without a folder.** The launcher has a **No folder** chip next to your projects, for general asks that have nothing to do with a repo (explain a concept, draft a message, research something). The agent runs in an empty scratch directory under `~/.wisp/scratch`, with no worktree, and the task shows under *General*. The folder is not added to your projects. The Worktree toggle hides while No folder is picked, and deleting the task deletes its scratch folder. API: `POST /api/sessions {"prompt","scratch":true}`.
+
+- **Add a project from a GitHub URL.** Paste `https://github.com/owner/repo` (or `git@github.com:owner/repo.git`, a link to any page inside the repo, or any other git URL) into Projects and the button turns into **Clone**. Click it and the dialog closes: the launcher already points at the repo (a chip with a spinner, *cloning…*) and the prompt has focus, so you write the task while it clones. Send it before the clone finishes and the task card shows *Cloning owner/repo*, then starts in the clone. If the clone fails, a toast says why, the launcher goes back to the project you had picked and your task comes back into the box. A feed filtered to another project switches to All, so the launcher isn't pulled back to that project. GitHub repos go through `gh repo clone` when gh is installed, so private repos work with your gh login; otherwise plain `git clone`. Repos land in `~/code` (or the first of `~/dev`, `~/Developer`, `~/projects`, `~/src`, `~/repos`… that exists). Click the path in the hint to change it (`defaults.cloneDir`). If the folder there already is that repo, wisp reuses it; another folder with that name gets a `-2` suffix. When gh is signed in, the dialog also lists **Your GitHub repos**, newest push first and minus ones already added, so cloning one is a single click. On a machine tab the clone happens on that machine. CLI: `wisp add https://github.com/owner/repo`. API: `POST /api/projects {"repo":"…"}`; a URL in `path` works too.
+
+### Changed
+
+- **Project chips stay on one row with tens of projects.** The launcher's *in* row used to show every project as a chip (30 projects meant 6 rows on desktop and 14 on a phone), and the top bar cut off whatever didn't fit with no way to scroll to it. Now both show your most recent projects as chips, and the rest go behind a **+N** chip. Fewer chips show when the space is narrow, and a chip is never cut in half. The project you picked, the one you're filtering by, and projects with tasks that need you always keep their chip. **+N** opens a searchable list of every project: type to filter by name or path, use ↑/↓ and Enter to pick. It also has *No folder* and *Other folder…* in the launcher, and *All projects* and *Manage projects…* in the top bar. In the top bar, **+N** shows a badge counting the tasks that need you in the projects it hides. When a phone is too narrow even for *All*, the top bar shows one chip with the current filter that opens the list.
+
+- **Ship it no longer holds you in its dialog.** Clicking *Commit, push & open PR* used to leave the dialog open with a disabled *Shipping…* button until the push and `gh pr create` were done. Now the dialog closes right away, and the card's PR row (just above the composer) shows a live track: **Commit → Push → Open PR**, with a spinner on the step that's running and a check on each one that's done. The server reports each step as `shipping` on the session summary, so other tabs see it too, and the card head shows a *Shipping* pill while the card is collapsed. When the PR is up, the row turns into the PR row with a short highlight, and a toast links to it. If a step fails, the row turns red and says which step failed and why, with **Retry**, which reopens the dialog with your commit message and description still filled in. A second ship while one is running is refused with 409.
+
+### Fixed
+
+- **The launcher is there from the first frame.** On start, the launcher used to sit as an empty strip for one to five seconds, because the page waited for harness detection (`GET /api/agents` runs every CLI, and opencode lists its models) before drawing it. Now `index.html` draws the launcher's shape with a prompt box that already has focus, so you can start typing before the scripts load. The full launcher fills in about 50 ms later, at the same height, and keeps what you typed. Harnesses come from the last list seen (kept in the browser) and refresh when detection answers. `GET /api/agents` now answers from the last detection right away and checks again in the background, sending an `agents` event if anything changed. Warm calls dropped from about 1.2 s to 2 ms. `?fresh=1` and Re-check still wait for a full detection. Empty feed sections no longer flash their headings before the feed loads.
+
+## [0.17.0] - 2026-10-19
+
+### Added
+
+- **Approve what an agent's permissions block, from wisp.** In Edits mode a coding agent used to be refused quietly when it wanted something its permissions don't cover, like `npm publish`, a write outside the project or a network call from Codex's sandbox. You only found out from a half-done report. Now:
+  - **Claude Code waits for you.** wisp sends Claude's permission prompts to its own `approve` tool (`--permission-prompt-tool`). The task card shows *Needs your approval*: *Allow Claude Code to run `npm publish`?*, with **Allow**, **Always allow in this task** and **Deny**. The number keys pick an option. You can also type what to do instead: that denies the call and passes your words to Claude. Claude keeps its context, and the desktop notification says *needs your approval*. *Always allow* lets the same command or file through for the rest of the task without asking again.
+  - **Every other harness gets an Allow & retry card.** When Codex, opencode, Grok, Cursor or Antigravity is refused, the report shows *Blocked by permissions* under its headline, listing each refused action. wisp reads these refusals from the harness itself: opencode's and Grok's stderr, Cursor's rejected tool calls, Antigravity's `PERMISSION_DENIED` steps and Claude's `permission_denials`. A new `blocked` block in the wisp protocol lets an agent report a refusal it can only see in a command's output, such as Codex's sandbox. **Allow & retry** sends a follow-up that runs those actions. For Claude and opencode only the exact actions are allowed (`--allowedTools "Bash(npm publish)"` or an opencode permission rule). Codex, Grok, Cursor and Antigravity can't allow a single action from the command line, so that one follow-up runs in Full auto, and the card says so. The task stays in Edits. **Deny** closes the card. API: `POST /api/sessions/:id/approve {"turnId","allow"}`. A live approval is answered like a question, through `POST /api/sessions/:id/answer {"text":"Allow"}`, `wisp reply` or the phone buttons.
+- **Mention another task in a prompt.** Right-click a task (or open its ⋯ menu) and pick **Copy task ID**, then paste the ID into the launcher, a follow-up box or the Rerun dialog. It shows as a chip with the task's title, like pasting an issue link in Linear, and stays a chip in the sent prompt, where clicking it opens that task. Backspace removes the whole chip and Cmd+Z brings it back. Pasting several IDs at once makes a chip for each. The agent gets the title and ID, and two new read-only tools sit next to `ask_user`: `wisp_session` reads a task (its title, state, harness, folder and branch, every request made in it, and a turn's report as markdown) and `wisp_sessions` lists your other tasks (filter by `query`, `state`, `project`, `archived`). Cursor and Antigravity runs can't take injected tools, so for them wisp puts each mentioned task's latest report in the prompt instead. Prompts store a mention as `@[Title](wisp:<id>)`, so API and CLI callers can write one too. Task titles show `@Title`. The bridge routes (`GET /api/internal/sessions/:id`, `GET /api/internal/session/:id?of=<id>`) only take the per-run token.
+- **Agents can answer questions about your wisp usage.** Every task now gets a read-only `wisp_stats` tool next to `ask_user`. Ask a task "which tools do my tasks use?" or "what did Codex cost me this week?" and the agent gets a table of tool calls by kind (shell, read, edit, search, web, subagents, other MCP tools, questions), by harness, by project and by day. It also gets turns, cost, tokens and success rate, taken from the same numbers as Settings → Usage. Agents can narrow it with `days` (1–365, default 30), `agent` (a harness id) and `project` (a name or id, or `current` for the task's own project). Before, an agent had no tool for this and would either say it had no access or dig through `~/.wisp/sessions` by hand. Kinds are wisp's categories, not each harness's own tool names. The bridge route (`GET /api/internal/stats/:id`) only takes the per-run token, like `ask_user`. Cursor and Antigravity runs can't take injected MCP tools, so they don't get it.
+
+### Changed
+
+- **Mark done and the PR row are where you look.** An opened task now has Mark done (or Reopen) in its top bar, next to Ship it, so you can close it out without scrolling to the composer. The PR row (checks, GitHub, Merge) moved from the top of the card to right above the composer, so after reading the result it's in view without scrolling back up.
+- **Full auto is the default mode.** New launches, API and CLI calls without a mode, scheduled and CI triggers, and recipes run with no permission prompts; tasks in git repos still get their own worktree and a checkpoint before every turn. If your saved launcher mode was Edits (the old default), wisp switches it to Full auto once; a Plan pick, or anything you choose afterwards, sticks. Issue triggers still start in Plan. The mode button now shows just an icon for Full auto and spells out Plan and Edits.
+
 ## [0.16.0] - 2026-10-19
 
 ### Added
@@ -299,7 +334,9 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 - Session queue with follow-ups, answers to agent questions, terminal takeover and mark-as-done.
 - Older turns are folded, with a floating collapse-all button and back-to-top.
 
-[Unreleased]: https://github.com/M0xoo/wisp/compare/v0.16.0...HEAD
+[Unreleased]: https://github.com/M0xoo/wisp/compare/v0.18.0...HEAD
+[0.18.0]: https://github.com/M0xoo/wisp/compare/v0.17.0...v0.18.0
+[0.17.0]: https://github.com/M0xoo/wisp/compare/v0.16.0...v0.17.0
 [0.16.0]: https://github.com/M0xoo/wisp/compare/v0.15.0...v0.16.0
 [0.15.0]: https://github.com/M0xoo/wisp/compare/v0.14.0...v0.15.0
 [0.14.0]: https://github.com/M0xoo/wisp/compare/v0.13.0...v0.14.0

package/README.md

@@ -54,10 +54,10 @@ From there you can **follow up**, **answer its questions**, **take it over** in
 | 🤝 **Subagents** | Give the lead agent a team on other harnesses (e.g. Claude Code hands tests to Codex ×3). It delegates through a `delegate` tool; their edits land in its worktree. See [Subagents](#subagents). |
 | ⏪ **Checkpoints & rollback** | Every turn is snapshotted first. Restore to before any turn, revert a single file, or re-run a command block from the presentation. |
 | ⚖️ **Compare** | Run one task on two harnesses side by side, and keep the better run. |
-| 🧾 **Recipes & triggers** | Saved prompts with `{params}` (`wisp run release 0.16.0`), run by hand, on a schedule, when CI fails, or when an issue is labelled. |
+| 🧾 **Recipes & triggers** | Saved prompts with `{params}` (`wisp run release 0.18.0`), run by hand, on a schedule, when CI fails, or when an issue is labelled. |
 | 📊 **Usage** | Spend, success rate and questions per project and per harness · model. |
 | 📱 **Phone** | Questions and finished tasks on ntfy or Telegram; answer from there, or start a task with `/new`. |
-| 🔐 **Permission modes** | Choose **Plan** (read-only), **Edits** (file edits auto-accepted), or **Full auto** for each launch. `Shift+Tab` in the prompt cycles modes. |
+| 🔐 **Permission modes** | Choose **Plan** (read-only), **Edits** (file edits auto-accepted), or **Full auto** (no permission prompts, the default) for each launch. `Shift+Tab` in the prompt cycles modes. In Edits mode, anything the permissions block comes to you: Claude Code waits for **Allow / Always / Deny**, and the other harnesses show an **Allow & retry** card. |
 | 🔌 **Integrations** | An MCP server (`wisp mcp`), an agent skill, a scriptable CLI, a JS SDK, an OpenAPI-described HTTP API, and webhooks. Hand tasks to wisp from Claude Code, Codex, opencode, Cursor, scripts or CI. |
 | 🪶 **No runtime dependencies** | The server uses only Node built-ins. Electron is needed only for the desktop app. |
 
@@ -83,7 +83,7 @@ brew install m0xoo/tap/wisp-agents             # Homebrew: CLI and browser mode,
 wisp "fix the flaky auth test"
 ```
 
-The Homebrew formula lives in [M0xoo/homebrew-tap](https://github.com/M0xoo/homebrew-tap). `install.sh` honors `WISP_VERSION` to pin a release (`curl -fsSL https://mokh.xyz/install.sh | WISP_VERSION=0.16.0 bash`).
+The Homebrew formula lives in [M0xoo/homebrew-tap](https://github.com/M0xoo/homebrew-tap). `install.sh` honors `WISP_VERSION` to pin a release (`curl -fsSL https://mokh.xyz/install.sh | WISP_VERSION=0.18.0 bash`).
 
 From source:
 
@@ -116,6 +116,7 @@ The CLI talks to a running wisp, or starts one if none is running. It works from
 wisp                              # open wisp (or focus the running one)
 wisp "fix the flaky auth test"    # launch a task in this folder (it becomes a project)
 wisp add [path]                   # add a folder as a project (default: cwd)
+wisp add <repo-url>               # clone a repo (GitHub URL, git@…, any git URL) into ~/code, then add it
 wisp --mode plan "audit deps"     # permission mode: plan | edits | auto
 wisp --agent codex "add a test"   # harness: claude | codex | opencode | cursor | antigravity | grok
 ```
@@ -131,7 +132,7 @@ wisp reply <id> "also do X"       # follow up (answers a pending question; --mod
 wisp stop <id>
 wisp ship <id> [--draft]          # commit, push and open a PR for a worktree task
 wisp merge <id>                   # squash-merge its PR, fast-forward your local main
-wisp run release 0.16.0            # run a recipe; values fill its {params} (or version=0.16.0)
+wisp run release 0.18.0            # run a recipe; values fill its {params} (or version=0.18.0)
 wisp recipes                      # list recipes
 wisp usage [--days 7]             # spend and outcomes
 wisp mcp                          # MCP server for other agents and editors
@@ -334,7 +335,7 @@ Before each turn, wisp snapshots the git working tree (pinned at `refs/wisp/chec
 Prepare release {version}: update CHANGELOG, README and docs/, bump package.json, tag v{version}.
 ```
 
-Make one from ⌘K → *Recipes*, or *Save as recipe…* on any card. A recipe may pin a project, harness, model and mode. Run it from ⌘K (*Run: Release*), from the Recipes view, or from a terminal: `wisp run release 0.16.0` fills the fields in order, `wisp run release version=0.16.0` by name.
+Make one from ⌘K → *Recipes*, or *Save as recipe…* on any card. A recipe may pin a project, harness, model and mode. Run it from ⌘K (*Run: Release*), from the Recipes view, or from a terminal: `wisp run release 0.18.0` fills the fields in order, `wisp run release version=0.18.0` by name.
 
 **Triggers** launch sessions on their own while wisp is open (⌘K → *Triggers*):
 

package/bin/wisp.js

@@ -236,8 +236,10 @@ async function interactive() {
 
   let openPath = '/';
   if (command === 'add') {
-    const dir = path.resolve(words[1] || process.cwd());
-    const p = await api('/projects', { path: dir }).catch((e) => console.error(`  ✗ ${e.message}`));
+    // A repo URL is cloned by the server (into ~/code unless defaults.cloneDir says otherwise).
+    const url = /^(https?:|ssh:|git:|git@|(www\.)?github\.com\/)/i.test(words[1] || '');
+    if (url) console.log(`  ◌ cloning ${words[1]}…`);
+    const p = await api('/projects', url ? { repo: words[1] } : { path: path.resolve(words[1] || process.cwd()) }).catch((e) => console.error(`  ✗ ${e.message}`));
     if (p) console.log(`  ✓ project added: ${p.name}  (${p.path})`);
     if (running || electron) process.exit(0);
   } else if (words.length) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wisp-agents",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Launch coding agents, skip the transcript, read the presentation.",
   "type": "module",
   "bin": {
@@ -20,7 +20,7 @@
     "app": "node bin/wisp.js",
     "dev": "WISP_DEV=1 node bin/wisp.js",
     "dev:web": "node --watch-path=server bin/wisp.js --no-open",
-    "test": "node --test test/proc.test.js test/terminal.test.js test/adapters.test.js test/e2e.test.js test/fuzzy.test.js test/integrations.test.js test/update.test.js test/learn.test.js test/ship.test.js test/subagents.test.js test/machines.test.js test/feedback.test.js test/router.test.js test/routes.test.js test/adapters-exit.test.js test/web-pure.test.js test/install.test.js test/install-script.test.js",
+    "test": "node --test test/proc.test.js test/terminal.test.js test/adapters.test.js test/e2e.test.js test/fuzzy.test.js test/integrations.test.js test/update.test.js test/learn.test.js test/ship.test.js test/subagents.test.js test/machines.test.js test/feedback.test.js test/router.test.js test/routes.test.js test/adapters-exit.test.js test/web-pure.test.js test/install.test.js test/install-script.test.js test/mentions.test.js test/clone.test.js",
     "test:real": "node test/real-clis.mjs",
     "prepublishOnly": "node --check bin/wisp.js && node --check bin/mac-app.js && node -e \"import('./server/index.js').then(() => import('./server/mcp-wisp.js'))\" && node --check electron/main.js"
   },

package/server/adapters/antigravity.js

@@ -105,7 +105,11 @@ export default {
               onEvent({ type: 'tool', ...describeTool(name, params, cwd) });
             }
             if (!done) return;
-            if (info.error) onEvent({ type: 'tool_error', name, text: clip(info.error.message || info.error.type || 'failed', 400) });
+            if (info.error) {
+              onEvent({ type: 'tool_error', name, text: clip(info.error.message || info.error.type || 'failed', 400) });
+              // Refused by its permissions (no --dangerously-skip-permissions): the card offers a retry.
+              if (/PERMISSION/i.test(info.error.type || '')) onEvent({ type: 'blocked', tool: name, detail: String(params.CommandLine ?? fileOf(params) ?? params.Url ?? '') });
+            }
             else if (editing) {
               const change = files.change(file);
               if (change) onEvent({ type: 'change', ...change });

package/server/adapters/claude.js

@@ -29,6 +29,8 @@ const PERMISSION_MODES = {
 export default {
   id: 'claude',
   name: 'Claude Code',
+  // Asks wisp before a tool call its permission mode won't allow on its own (Edits mode).
+  approveTool: 'mcp__wisp__approve',
   models: [
     { id: '', label: 'Default', hint: 'Whatever Claude Code is set to' },
     { id: 'opus', label: 'Opus', hint: 'Most capable, for hard problems' },
@@ -46,8 +48,14 @@ export default {
     return detectVersion(BIN);
   },
 
+  // What a permission prompt is about, for the approval card and for matching "always allow".
+  permission(tool, input, cwd) {
+    return { tool, action: actionOf(tool, input, cwd), detail: detailOf(tool, input, cwd), why: tool === 'Bash' ? input.description || '' : '' };
+  },
+
   // Returns { stop(), done: Promise<void> }. Everything else is reported through onEvent.
-  run({ prompt, attachments = [], cwd, resumeId, mode, model, effort, systemPrompt, mcpServers = {}, delegating = false, onEvent }) {
+  // grants: --allowedTools rules (Bash(npm publish)) for what the user allowed after a denial.
+  run({ prompt, attachments = [], cwd, resumeId, mode, model, effort, systemPrompt, mcpServers = {}, delegating = false, grants = [], onEvent }) {
     const args = [
       '-p',
       '--output-format', 'stream-json',
@@ -58,10 +66,11 @@ export default {
     if (effort) args.push('--effort', effort);
     if (chromeEnabled()) args.push('--chrome');
     if (resumeId) args.push('--resume', resumeId);
-    if (Object.keys(mcpServers).length) {
-      args.push('--mcp-config', JSON.stringify({ mcpServers }));
-      args.push('--allowedTools', ...Object.keys(mcpServers).map((n) => `mcp__${n}`));
-    }
+    if (Object.keys(mcpServers).length) args.push('--mcp-config', JSON.stringify({ mcpServers }));
+    // In Edits mode, what would prompt goes to wisp's approve tool (the user decides) instead of being denied.
+    if (mcpServers.wisp && mode === 'edits') args.push('--permission-prompt-tool', this.approveTool);
+    const allowed = [...Object.keys(mcpServers).map((n) => `mcp__${n}`), ...grants.filter((g) => typeof g === 'string')];
+    if (allowed.length) args.push('--allowedTools', ...allowed);
     // Its built-in subagents (Task, or Agent in newer versions) would bypass the user's team.
     if (delegating) args.push('--disallowedTools', 'Task', 'Agent', 'Workflow');
     const dirs = [...new Set(attachments.map((a) => path.dirname(a.path)))];
@@ -132,6 +141,11 @@ export default {
           return;
         }
         sawResult = true;
+        // Refused tool calls (no approve tool here, or the user said no): the card offers a retry.
+        for (const d of msg.permission_denials || []) {
+          const input = d.tool_input || {};
+          onEvent({ type: 'blocked', tool: d.tool_name, detail: detailOf(d.tool_name, input, cwd), rule: ruleOf(d.tool_name, input) });
+        }
         onEvent({ ...ev, background: background.size }); // > 0: another turn and result follow when they finish
       }
     };
@@ -207,11 +221,40 @@ function describeTool(name, input, cwd) {
       return { kind: 'agent', label: `Delegating to ${clip([...new Set((input.tasks || []).map((t) => t.subagent))].join(', ') || 'subagents', 60)}` };
     case 'mcp__wisp__subagent_results':
       return { kind: 'agent', label: 'Waiting on subagents' };
+    case 'mcp__wisp__wisp_stats':
+      return { kind: 'tool', label: 'Reading wisp stats' };
+    case 'mcp__wisp__wisp_sessions':
+      return { kind: 'tool', label: 'Listing wisp tasks' };
+    case 'mcp__wisp__wisp_session':
+      return { kind: 'tool', label: `Reading wisp task ${clip(input?.id || '', 40)}` };
     default:
       return { kind: 'tool', label: name.startsWith('mcp__') ? `Using ${name.split('__').slice(1).join(' · ')}` : `Using ${name}` };
   }
 }
 
+// A permission prompt's subject: "run `npm publish`", "edit src/a.ts", "fetch https://…".
+function actionOf(tool, input, cwd) {
+  const f = rel(input.file_path || input.notebook_path || input.path, cwd);
+  if (tool === 'Bash') return `run \`${clip(input.command, 200)}\``;
+  if (/^(Edit|MultiEdit|Write|NotebookEdit)$/.test(tool) && f) return `${tool === 'Write' ? 'write' : 'edit'} ${f}`;
+  if (tool === 'WebFetch') return `fetch ${clip(input.url, 120)}`;
+  if (tool === 'WebSearch') return `search the web for “${clip(input.query, 80)}”`;
+  if (tool === 'ExitPlanMode') return 'leave plan mode and start making changes';
+  if (tool.startsWith('mcp__')) return `use ${tool.split('__').slice(1).join(' · ')}`;
+  return `use ${tool}`;
+}
+
+// The exact thing being allowed, so "always allow" matches only the same command or file.
+function detailOf(tool, input, cwd) {
+  if (tool === 'Bash') return String(input.command ?? '');
+  const f = input.file_path || input.notebook_path || input.path;
+  if (f) return rel(f, cwd);
+  return String(input.url ?? input.query ?? input.pattern ?? '');
+}
+
+// An --allowedTools rule for a retry: the exact command for Bash, the tool for the rest.
+const ruleOf = (tool, input) => (tool === 'Bash' && input.command ? `Bash(${input.command})` : tool);
+
 // Capture edit inputs so wisp can show real diffs without asking the agent for them.
 function captureChange(name, input, cwd) {
   const file = input.file_path;

package/server/adapters/codex.js

@@ -187,5 +187,8 @@ export function unwrapShell(cmd) {
 function describeMcp(item) {
   if (item.server === 'wisp' && item.tool === 'ask_user') return { kind: 'wait', label: 'Waiting for your answer' };
   if (item.server === 'wisp' && (item.tool === 'delegate' || item.tool === 'subagent_results')) return { kind: 'agent', label: 'Waiting on subagents' };
+  if (item.server === 'wisp' && item.tool === 'wisp_stats') return { kind: 'tool', label: 'Reading wisp stats' };
+  if (item.server === 'wisp' && item.tool === 'wisp_sessions') return { kind: 'tool', label: 'Listing wisp tasks' };
+  if (item.server === 'wisp' && item.tool === 'wisp_session') return { kind: 'tool', label: 'Reading a wisp task' };
   return { kind: 'tool', label: `Using ${item.server} · ${item.tool}` };
 }

package/server/adapters/cursor.js

@@ -71,6 +71,8 @@ export default {
               const [outcome, value = {}] = resultOf(body.result);
               if (outcome && outcome !== 'success') {
                 onEvent({ type: 'tool_error', name: name.replace(/ToolCall$/, ''), text: clip(value.error || value.message || value.reason || value.stderr || outcome, 400) });
+                // Refused by its permissions (no --force): the card offers to retry it.
+                if (/reject|denied|permission/i.test(outcome)) onEvent({ type: 'blocked', tool: name.replace(/ToolCall$/, ''), detail: String(args.command ?? args.path ?? args.url ?? '') });
               } else if (name === 'editToolCall' || name === 'deleteToolCall') {
                 const change = editChange(args.path || value.path, value, cwd, files);
                 if (change) onEvent({ type: 'change', ...change });

package/server/adapters/grok.js

@@ -19,6 +19,9 @@ const PERMISSION_MODES = {
   auto: 'bypassPermissions',
 };
 const EFFORT_ORDER = ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'];
+// A headless run refuses what would need approval and names it on stderr, once per call:
+// "permission required: Edit calc.py was not run, as a headless run cannot ask for approval".
+const REFUSED = /permission required: (\S+) ?(.*?) was not run\b/g;
 
 export default {
   id: 'grok',
@@ -75,6 +78,7 @@ export default {
     let session = null;
     let sawResult = false;
     let error = null;
+    let carry = ''; // a stderr line still being written
 
     const handle = spawnJsonl({
       bin: BIN,
@@ -82,6 +86,11 @@ export default {
       cwd,
       env: { ...process.env, GROK_DISABLE_AUTOUPDATER: '1' },
       onEvent,
+      onStderr(chunk) {
+        const lines = (carry + chunk).split('\n');
+        carry = lines.pop();
+        for (const [, tool, detail] of lines.join('\n').matchAll(REFUSED)) onEvent({ type: 'blocked', tool, detail: detail.replace(/ \(workflow .*\)$/, '') });
+      },
       onJson(msg) {
         if (msg.session_id && msg.session_id !== session) onEvent({ type: 'session', id: (session = msg.session_id) });
         // Subagent traffic carries its parent's tool id; only the main conversation is shown.
@@ -232,6 +241,12 @@ function describeMcp(tool, input) {
       return { kind: 'agent', label: `Delegating to ${clip([...new Set((input.tasks || []).map((t) => t.subagent))].join(', ') || 'subagents', 60)}` };
     case 'wisp__subagent_results':
       return { kind: 'agent', label: 'Waiting on subagents' };
+    case 'wisp__wisp_stats':
+      return { kind: 'tool', label: 'Reading wisp stats' };
+    case 'wisp__wisp_sessions':
+      return { kind: 'tool', label: 'Listing wisp tasks' };
+    case 'wisp__wisp_session':
+      return { kind: 'tool', label: `Reading wisp task ${clip(input?.id || '', 40)}` };
     default:
       return { kind: 'tool', label: `Using ${tool.split('__').join(' · ') || 'an integration'}` };
   }

package/server/adapters/index.js

@@ -7,9 +7,14 @@
 //                                                  efforts list wins); omit if the CLI has none
 //     askTool: string | null | undefined           how the agent sees wisp's ask_user MCP tool;
 //                                                  null = can't inject MCP, ask via a question block
+//     approveTool?: string                         its permission prompts go to wisp's `approve` MCP
+//                                                  tool (live approval); omit if it can't route them
+//     permission?(tool, input, cwd): { tool, action, detail, why? }   what a live approval is about
 //     detect(): Promise<{ available, version?, error?, models? }>   models overrides the static list
 //     resumeCommand({ resumeId, model, effort }): string[]   argv to continue the session interactively
-//     run({ prompt, cwd, resumeId, mode, model, effort, systemPrompt, onEvent }): { stop(), done: Promise }
+//     run({ prompt, cwd, resumeId, mode, model, effort, systemPrompt, grants, onEvent }): { stop(), done: Promise }
+//                                                  grants: `rule`s from its own blocked events the
+//                                                  user allowed, for this turn only
 //   }
 //
 // onEvent receives normalized events:
@@ -19,6 +24,8 @@
 //   { type: 'text', text }                          intermediate assistant prose
 //   { type: 'thinking' }
 //   { type: 'change', file, op, edits: [{ before, after }] }
+//   { type: 'blocked', tool, detail, rule? }        a call its permissions refused; rule: what allows
+//                                                  exactly that on a retry (none: retry in Full auto)
 //   { type: 'result', text, isError, stopped?, stats? }   exactly once, at the end
 //
 // mode is one of: plan (read-only), edits (auto-accept file edits), auto (no permission prompts).
@@ -38,6 +45,7 @@ function checked(a) {
     typeof a.name !== 'string' && 'name',
     !Array.isArray(a.models) && 'models',
     a.askTool !== null && a.askTool !== undefined && typeof a.askTool !== 'string' && 'askTool',
+    a.approveTool !== undefined && (typeof a.approveTool !== 'string' || typeof a.permission !== 'function') && 'approveTool + permission()',
     typeof a.detect !== 'function' && 'detect()',
     typeof a.run !== 'function' && 'run()',
     a.resumeCommand !== undefined && typeof a.resumeCommand !== 'function' && 'resumeCommand()',

package/server/adapters/opencode.js

@@ -17,6 +17,10 @@ let BIN = process.env.WISP_OPENCODE_BIN || 'opencode';
 // through, then stop and tell the user what to do.
 const rateLimitGrace = () => Number(process.env.WISP_RATE_LIMIT_GRACE_MS) || 60_000;
 const RATE_LIMITED = /Rate limit exceeded|Too Many Requests|status(?:Code)?[=: ]+429\b/i;
+// `run` answers every permission prompt itself and says so on stderr (cli/cmd/run.ts):
+// "! permission requested: bash (npm publish); auto-rejecting".
+const REJECTED = /permission requested: ([\w.-]+) \((.*?)\); auto-rejecting/g;
+const ANSI = /\x1b\[[0-9;]*m/g;
 
 export default {
   id: 'opencode',
@@ -61,7 +65,8 @@ export default {
     return { ...found, models: [this.models[0], ...models] };
   },
 
-  run({ prompt, attachments = [], cwd, resumeId, mode, model, effort, systemPrompt, mcpServers = {}, delegating = false, onEvent }) {
+  // grants: { permission, patterns } the user allowed after `run` rejected them, for this turn.
+  run({ prompt, attachments = [], cwd, resumeId, mode, model, effort, systemPrompt, mcpServers = {}, delegating = false, grants = [], onEvent }) {
     // The prompt goes on stdin; `run` appends piped stdin to the (empty) message.
     // Errors to stderr: the only place a rate limit shows up (see RATE_LIMITED).
     const args = ['run', '--format', 'json', '--print-logs', '--log-level', 'ERROR'];
@@ -78,14 +83,20 @@ export default {
       mcp[name] = { type: 'local', command: [srv.command, ...(srv.args || [])], environment: srv.env || {}, enabled: true, timeout: ASK_TIMEOUT_MS };
     }
     const env = { ...process.env };
-    if (Object.keys(mcp).length) {
+    const allow = grants.filter((g) => g && typeof g.permission === 'string' && Array.isArray(g.patterns));
+    if (Object.keys(mcp).length || allow.length) {
       const inline = env.OPENCODE_CONFIG_CONTENT ? safeJson(env.OPENCODE_CONFIG_CONTENT) : {};
+      const permission = typeof inline.permission === 'object' ? { ...inline.permission } : inline.permission ? { '*': inline.permission } : {};
+      // Its built-in `task` subagents would bypass the user's team.
+      if (delegating) permission.task = 'deny';
+      for (const g of allow) {
+        const was = permission[g.permission];
+        permission[g.permission] = { ...(typeof was === 'object' ? was : was && { '*': was }), ...Object.fromEntries(g.patterns.map((p) => [String(p), 'allow'])) };
+      }
       env.OPENCODE_CONFIG_CONTENT = JSON.stringify({
         ...inline,
-        mcp: { ...inline.mcp, ...mcp },
-        experimental: { ...inline.experimental, mcp_timeout: ASK_TIMEOUT_MS },
-        // Its built-in `task` subagents would bypass the user's team.
-        ...(delegating && { permission: { ...(typeof inline.permission === 'object' ? inline.permission : inline.permission && { '*': inline.permission }), task: 'deny' } }),
+        ...(Object.keys(mcp).length && { mcp: { ...inline.mcp, ...mcp }, experimental: { ...inline.experimental, mcp_timeout: ASK_TIMEOUT_MS } }),
+        ...(Object.keys(permission).length && { permission }),
       });
     }
 
@@ -101,6 +112,7 @@ export default {
 
     let limitTimer = null;
     let limited = false;
+    let carry = ''; // a stderr line still being written
     const proc = spawnJsonl({
       bin: BIN,
       args,
@@ -109,6 +121,13 @@ export default {
       input,
       onEvent,
       onStderr(chunk) {
+        // Whole lines only: a chunk can end mid-line.
+        const lines = (carry + chunk).split('\n');
+        carry = lines.pop();
+        for (const [, permission, list] of lines.join('\n').replace(ANSI, '').matchAll(REJECTED)) {
+          const patterns = list.split(', ').filter(Boolean);
+          onEvent({ type: 'blocked', tool: permission, detail: patterns.join(', '), rule: { permission, patterns } });
+        }
         if (limitTimer || limited || !RATE_LIMITED.test(chunk)) return;
         limitTimer = setTimeout(() => ((limited = true), proc.stop()), rateLimitGrace());
       },
@@ -216,6 +235,12 @@ function describeTool(name, input, cwd) {
       return { kind: 'agent', label: `Delegated to ${clip([...new Set((input.tasks || []).map((t) => t.subagent))].join(', ') || 'subagents', 60)}` };
     case 'wisp_subagent_results':
       return { kind: 'agent', label: 'Collected subagent reports' };
+    case 'wisp_wisp_stats':
+      return { kind: 'tool', label: 'Reading wisp stats' };
+    case 'wisp_wisp_sessions':
+      return { kind: 'tool', label: 'Listing wisp tasks' };
+    case 'wisp_wisp_session':
+      return { kind: 'tool', label: `Reading wisp task ${clip(input?.id || '', 40)}` };
     default:
       return { kind: 'tool', label: `Using ${name.replace(/_/g, ' ')}` };
   }

package/server/client.js

@@ -136,7 +136,7 @@ export class WispClient {
     if (!agent || !mode || model === undefined) {
       const { defaults = {} } = await this.config();
       agent ||= defaults.agent || 'auto';
-      mode ||= defaults.mode || 'edits';
+      mode ||= defaults.mode || 'auto';
       model ??= defaults.models?.[agent] ?? (agent === defaults.agent ? defaults.model || '' : '');
     }
     return this.request('POST', '/sessions', { prompt, cwd: path.resolve(cwd), agent, mode, model, effort, attachments, worktree, compare, subagents, preset });

package/server/git.js

@@ -129,7 +129,7 @@ export async function removeWorktree(wt, { force = false, branch = false } = {})
 
 // --- Ship it: commit, push, open a PR, follow it, merge it -----------------------------------
 
-const PR_FIELDS = 'number,url,title,state,isDraft,reviewDecision,mergeStateStatus,statusCheckRollup,headRefOid,baseRefName,mergedAt';
+const PR_FIELDS = 'number,url,title,state,isDraft,reviewDecision,mergeable,mergeStateStatus,statusCheckRollup,headRefOid,baseRefName,mergedAt';
 const PASS = new Set(['SUCCESS', 'NEUTRAL', 'SKIPPED']);
 const FAIL = new Set(['FAILURE', 'ERROR', 'TIMED_OUT', 'CANCELLED', 'ACTION_REQUIRED', 'STARTUP_FAILURE', 'STALE']);
 
@@ -149,6 +149,8 @@ export function prSummary(j) {
     draft: !!j.isDraft,
     review: j.reviewDecision || '', // APPROVED | CHANGES_REQUESTED | REVIEW_REQUIRED | ''
     mergeState: j.mergeStateStatus || '',
+    // GitHub can't merge it into its base: both sides changed the same lines (UNKNOWN while it computes).
+    conflict: j.mergeable === 'CONFLICTING' || j.mergeStateStatus === 'DIRTY',
     head: j.headRefOid,
     base: j.baseRefName,
     mergedAt: j.mergedAt || null,
@@ -162,23 +164,58 @@ export async function prView(cwd, ref) {
 }
 
 // Commit whatever the session left uncommitted, push its branch and open (or update) its PR.
-export async function ship(wt, { title, body = '', draft = false, pr }) {
+// `onStep` hears each stage as it starts ('commit', 'push', 'pr'), so the card can follow along.
+export async function ship(wt, { title, body = '', draft = false, pr, onStep = () => {} }) {
   await ensureWorktree(wt);
   const dir = wt.path;
   if (await quiet(git(dir, ['status', '--porcelain']))) {
     if (!String(title || '').trim()) throw bad('A commit message is required.');
+    onStep('commit');
     await git(dir, ['add', '-A']);
     await git(dir, ['commit', '--quiet', '--no-verify', '-m', title.trim(), ...(body.trim() ? ['-m', body.trim()] : [])]);
   }
   const { ahead } = await worktreeStatus(wt);
   if (!ahead) throw bad('Nothing to ship: this branch has no changes.');
   if (!wt.remote) throw bad('This repo has no origin remote to push to.');
+  onStep('push');
   await git(dir, ['push', '--quiet', '-u', wt.remote, `HEAD:refs/heads/${wt.branch}`], { timeout: 120_000 });
+  onStep('pr');
   if (pr?.state === 'OPEN') return prView(dir, pr.number);
   const url = (await gh(dir, ['pr', 'create', '--base', wt.base, '--head', wt.branch, '--title', title.trim(), '--body', body.trim() || ' ', ...(draft ? ['--draft'] : [])])).split('\n').pop();
   return prView(dir, url);
 }
 
+// Does the branch really conflict with its freshly fetched base? Checked before spending an agent
+// run on GitHub's word, which can lag a push. true / false, or null when this git can't tell (< 2.38).
+export async function conflictsWithBase(wt) {
+  if (!wt?.remote || !fs.existsSync(wt.path)) return null;
+  await quiet(git(wt.path, ['fetch', '--quiet', wt.remote, wt.base], { timeout: 30_000 }));
+  return new Promise((resolve) => {
+    execFile(GIT(), ['merge-tree', '--write-tree', '--name-only', '--no-messages', `refs/remotes/${wt.remote}/${wt.base}`, 'HEAD'], { cwd: wt.path, timeout: 30_000, env: { ...process.env, ...QUIET_ENV } }, (err) =>
+      resolve(!err ? false : err.code === 1 ? true : null),
+    );
+  });
+}
+
+// After an agent was asked to merge the base into its branch: is it in, with nothing left half
+// done? A merge it resolved but left uncommitted is committed here. { ok } or { ok: false, why }.
+export async function baseMerged(wt) {
+  const dir = wt.path;
+  const unmerged = await quiet(git(dir, ['diff', '--name-only', '--diff-filter=U']));
+  if (unmerged) return { ok: false, why: `Still conflicted: ${unmerged.split('\n').join(', ')}` };
+  if (await quiet(git(dir, ['rev-parse', '--quiet', '--verify', 'MERGE_HEAD']))) {
+    await git(dir, ['add', '-A']);
+    await git(dir, ['commit', '--quiet', '--no-verify', '--no-edit']);
+  }
+  const base = `refs/remotes/${wt.remote}/${wt.base}`;
+  const merged = await git(dir, ['merge-base', '--is-ancestor', base, 'HEAD']).then(() => true, () => false);
+  if (!merged) return { ok: false, why: `${wt.remote}/${wt.base} is not merged into the branch.` };
+  // Conflict markers staged as if resolved: git no longer sees them, so look in the PR's diff.
+  const marked = await quiet(git(dir, ['diff', '--name-only', '-G^<<<<<<< ', `${base}...HEAD`]));
+  if (marked) return { ok: false, why: `Conflict markers left in ${marked.split('\n').join(', ')}` };
+  return { ok: true };
+}
+
 // Squash-merge the exact head that was reviewed, then tidy up and catch the user's checkout up.
 export async function merge(wt, number) {
   const dir = fs.existsSync(wt.path) ? wt.path : wt.root;
@@ -205,3 +242,78 @@ export async function syncBase(root, base) {
     return { ok: false, text: `Local ${base} was not updated: ${err.message}` };
   }
 }
+
+// --- cloning: "add a project" from a repo URL instead of a folder ---
+
+// A repo the user pasted: https://github.com/o/r(/tree/…), github.com/o/r, git@host:o/r.git,
+// ssh:// git:// file:// URLs, and (shorthand) o/r for GitHub. Null when it's not a repo, e.g. a path.
+export function parseRepo(input, { shorthand = false } = {}) {
+  const s = String(input || '').trim();
+  const strip = (p) => p.replace(/\/+$/, '').replace(/\.git$/i, '');
+  const of = (url, host, repoPath) => {
+    const parts = strip(repoPath).split('/').filter(Boolean);
+    if (!parts.length) return null;
+    const gh = host === 'github.com' && parts.length >= 2 ? `${parts[0]}/${parts[1]}` : null;
+    return { url, host, name: gh ? parts[1] : parts.at(-1), gh, path: parts.join('/') };
+  };
+  let m;
+  if (/^(https?|ssh|git|file):\/\//i.test(s) || /^(www\.)?github\.com\//i.test(s)) {
+    let u;
+    try {
+      u = new URL(/^\w+:\/\//.test(s) ? s : `https://${s}`);
+    } catch {
+      return null;
+    }
+    const host = u.hostname.replace(/^www\./, '').toLowerCase();
+    if (u.protocol === 'file:') return of(u.href, '', u.pathname);
+    if (!host) return null;
+    // A GitHub page inside the repo (/tree/main, /pull/3) still means the repo.
+    if (host === 'github.com') {
+      const [o, r] = u.pathname.split('/').filter(Boolean);
+      return o && r ? of(`https://github.com/${o}/${strip(r)}.git`, host, `${o}/${r}`) : null;
+    }
+    return u.pathname.split('/').filter(Boolean).length >= 2 || u.protocol !== 'https:' ? of(s, host, u.pathname) : null;
+  }
+  if ((m = s.match(/^[\w.-]+@([\w.-]+):(?!\/\/)(.+)$/))) return of(s, m[1].toLowerCase(), m[2]);
+  if (shorthand && (m = s.match(/^([\w-]+)\/([\w.-]+)$/))) return of(`https://github.com/${m[1]}/${strip(m[2])}.git`, 'github.com', `${m[1]}/${m[2]}`);
+  return null;
+}
+
+// The same repo, however it was spelled (https vs ssh, .git or not, case of the host).
+const sameRepo = (a, b) => {
+  const key = (u) => {
+    const r = parseRepo(u);
+    return r && (r.gh ? `github.com/${r.gh.toLowerCase()}` : `${r.host}/${r.path}`);
+  };
+  return !!key(a) && key(a) === key(b);
+};
+
+// Clone `repo` (from parseRepo) into `parent`/<name>. A folder there that already is this repo is
+// reused; any other one gets a -2, -3… suffix. GitHub repos go through `gh repo clone` when gh is
+// there, so private repos work with the user's gh login; otherwise (or if gh fails) plain git.
+export async function cloneRepo(repo, parent, { timeout = 10 * 60_000 } = {}) {
+  fs.mkdirSync(parent, { recursive: true });
+  let dir = path.join(parent, repo.name);
+  for (let n = 2; fs.existsSync(dir); n++) {
+    const origin = await quiet(git(dir, ['remote', 'get-url', 'origin']));
+    if (origin && (await repoRoot(dir)) === fs.realpathSync(dir) && sameRepo(origin, repo.url)) return { dir, existed: true };
+    dir = path.join(parent, `${repo.name}-${n}`);
+  }
+  const attempts = [];
+  if (repo.gh) attempts.push(() => gh(parent, ['repo', 'clone', repo.gh, dir], { timeout }));
+  attempts.push(() => run(GIT(), ['clone', '--quiet', repo.url, dir], { cwd: parent, timeout }));
+  let last;
+  for (const attempt of attempts) {
+    try {
+      await attempt();
+      return { dir, existed: false };
+    } catch (err) {
+      last = err;
+      fs.rmSync(dir, { recursive: true, force: true }); // a half clone would block the next try
+    }
+  }
+  const what = repo.gh || repo.url;
+  if (/not found|does not exist|could not read username|authentication|permission denied|403/i.test(last.message))
+    throw bad(`Couldn’t clone ${what}: it doesn’t exist, or this login can’t see it.${repo.gh ? ' Private repo? Check `gh auth status`.' : ''}`);
+  throw bad(`Couldn’t clone ${what}: ${last.message}`);
+}

package/server/handoff.js

@@ -3,6 +3,7 @@
 // those turns out (requests, reports, files touched) and goes ahead of the follow-up's prompt.
 // A harness that ran earlier in the task resumes its own session and only hears what it missed.
 
+import { textMentions } from './mentions.js';
 import { blocksToMarkdown } from './render.js';
 import { clip, truncate } from './util.js';
 
@@ -27,7 +28,7 @@ function turnText(t, n, name) {
   return truncate(
     [
       `### Turn ${n} · ${name(t)}${t.model ? ` (${t.model})` : ''}${t.status === 'stopped' ? ' · stopped' : t.status === 'error' ? ' · failed' : ''}${t.rolledBackAt ? ' · rolled back, its edits were undone' : ''}`,
-      `**User:** ${t.prompt}`,
+      `**User:** ${textMentions(t.prompt)}`,
       report && `**Report:**\n\n${report}`,
       files.length && `**Files it edited:** ${files.join(', ')}`,
     ]