wisp-agents 0.16.0 → 0.18.0

package/server/machines.js

@@ -500,7 +500,7 @@ export class Machines extends EventEmitter {
   summary(mid, s) {
     const m = this.get(mid);
     const q = (id) => qualify(id, mid);
-    const p = this.store.projectFor(s.cwd || '', mid);
+    const p = s.scratch ? null : this.store.projectFor(s.cwd || '', mid);
     return {
       ...s,
       id: q(s.id),
@@ -578,7 +578,7 @@ export class Machines extends EventEmitter {
   }
 
   async addProject(mid, dir, name) {
-    const p = await this.json(mid, 'POST', '/projects', { path: dir });
+    const p = await this.json(mid, 'POST', '/projects', { path: dir }, { timeout: 10 * 60_000 }); // dir may be a repo URL to clone
     const local = this.store.addProject(p.path, { name: name || p.name, machine: mid });
     return local;
   }

package/server/mcp-ask.js

@@ -1,13 +1,18 @@
 #!/usr/bin/env node
-// Minimal stdio MCP server exposing `ask_user`, injected into every agent wisp launches.
+// Minimal stdio MCP server exposing `ask_user`, `wisp_stats`, `wisp_sessions` and `wisp_session`, injected into every agent wisp launches.
 // The call is relayed to the wisp server, which surfaces it in the queue and blocks
 // (by polling) until the user answers — so the agent keeps its full context.
 // With a team (WISP_TEAM), it also offers `delegate` and `subagent_results`: tasks for the
 // subagents the user picked, which wisp runs as child sessions while this call waits.
+// With WISP_APPROVE, it offers `approve`: the harness's permission prompt (Claude's
+// --permission-prompt-tool), answered by the user in wisp.
+// `wisp_stats` is read-only: tool counts, spend and success rate across the user's wisp sessions.
+// `wisp_sessions` and `wisp_session` are read-only too: list the user's other tasks and read one's
+// reports, e.g. a task the user mentioned in the prompt.
 
 import readline from 'node:readline';
 
-const { WISP_URL, WISP_TOKEN, WISP_SESSION } = process.env;
+const { WISP_URL, WISP_TOKEN, WISP_SESSION, WISP_APPROVE } = process.env;
 let TEAM = [];
 try {
   TEAM = JSON.parse(process.env.WISP_TEAM || '[]');
@@ -30,6 +35,83 @@ const TOOL = {
   },
 };
 
+// Claude's permission-prompt contract: { tool_name, input, tool_use_id } in, a JSON
+// { behavior: 'allow', updatedInput } or { behavior: 'deny', message } back as text.
+const APPROVE = {
+  name: 'approve',
+  description: 'Internal: wisp asks the user to approve a tool call your permissions do not allow on their own. Never call this yourself.',
+  inputSchema: {
+    type: 'object',
+    properties: { tool_name: { type: 'string' }, input: { type: 'object' }, tool_use_id: { type: 'string' } },
+    required: ['tool_name'],
+  },
+};
+
+const STATS = {
+  name: 'wisp_stats',
+  description:
+    'Read-only stats about the user\'s past wisp tasks: how many tool calls each kind of action made (run = shell, read, edit, ' +
+    'search, web, agent, tool = other MCP tools, ask), broken down by harness, project and day, plus turns, cost, tokens and ' +
+    'success rate. Use when the user asks about their wisp usage, which tools or harnesses their tasks use, or what tasks cost.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      days: { type: 'number', description: 'How many days back, 1–365. Default 30.' },
+      agent: { type: 'string', description: 'Only this harness, e.g. claude, codex, opencode.' },
+      project: { type: 'string', description: 'Only this project (name or id); "current" = the project of this task.' },
+    },
+  },
+};
+
+const SESSIONS = {
+  name: 'wisp_sessions',
+  description:
+    'List the user\'s other wisp tasks, newest first: id, title, state (running | waiting | review | done), harness, project, ' +
+    'last update and a one-line summary. Read-only. Use it to find a task the user refers to; read one with wisp_session.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      query: { type: 'string', description: 'Only tasks whose title or summary has all these words.' },
+      state: { type: 'string', description: 'Comma-separated, e.g. "running,waiting".' },
+      project: { type: 'string', description: 'Only this project (name or id); "current" = the project of this task.' },
+      archived: { type: 'boolean', description: 'Include archived tasks. Default false.' },
+      limit: { type: 'number', description: 'Default 20, at most 100.' },
+    },
+  },
+};
+
+const SESSION = {
+  name: 'wisp_session',
+  description:
+    'Read another wisp task by id: its title, state, harness, folder and branch, every request the user made in it, and a ' +
+    'turn\'s report as markdown (summary, diffs, tests, next steps). Read-only. Use it when the prompt mentions a wisp task ' +
+    '("@Title (wisp task <id>)") or the user asks what another task did.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      id: { type: 'string', description: 'The task id.' },
+      turn: { type: 'number', description: 'Which turn\'s report, 1 = first. Default: the latest.' },
+    },
+    required: ['id'],
+  },
+};
+
+async function sessions(args = {}) {
+  const q = new URLSearchParams(Object.entries(args).filter(([, v]) => v !== undefined && v !== '').map(([k, v]) => [k, String(v)]));
+  return (await call(`/api/internal/sessions/${WISP_SESSION}?${q}`)).text;
+}
+
+async function session({ id, turn } = {}) {
+  if (!id) throw new Error('id is required');
+  const q = new URLSearchParams({ of: String(id), ...(turn !== undefined && { turn: String(turn) }) });
+  return (await call(`/api/internal/session/${WISP_SESSION}?${q}`)).text;
+}
+
+async function stats({ days, agent, project } = {}) {
+  const q = new URLSearchParams(Object.entries({ days, agent, project }).filter(([, v]) => v !== undefined && v !== ''));
+  return (await call(`/api/internal/stats/${WISP_SESSION}?${q}`)).text;
+}
+
 const roster = TEAM.map((m) => `- ${m.name}${m.count > 1 ? ` ×${m.count} (parallel copies ${m.copies.join(', ')})` : ''}: ${[m.agent, m.model || 'default model', m.effort && `${m.effort} thinking`].filter(Boolean).join(' · ')}${m.use ? ` — use for: ${m.use}` : ''}`).join('\n');
 const TEAM_TOOLS = [
   {
@@ -104,8 +186,8 @@ async function call(path, body) {
   return res.json();
 }
 
-async function askUser(args) {
-  const { id } = await call(`/api/internal/ask`, { session: WISP_SESSION, ...args });
+// Poll a question until it's answered ({ answer, … }) or cancelled (null).
+async function waitFor(id) {
   for (;;) {
     await sleep(1500);
     let r;
@@ -114,11 +196,24 @@ async function askUser(args) {
     } catch {
       continue; // wisp restarting — keep waiting
     }
-    if (r.answer !== undefined) return r.answer;
+    if (r.answer !== undefined) return r;
     if (r.cancelled) return null;
   }
 }
 
+async function askUser(args) {
+  const { id } = await call(`/api/internal/ask`, { session: WISP_SESSION, ...args });
+  return (await waitFor(id))?.answer ?? null;
+}
+
+async function approve({ tool_name: tool, input = {} }) {
+  let r = await call(`/api/internal/approve`, { session: WISP_SESSION, tool, input });
+  if (r.id) r = await waitFor(r.id);
+  if (r?.decision === 'allow') return { behavior: 'allow', updatedInput: input };
+  if (!r) return { behavior: 'deny', message: 'The user did not answer (the request was cancelled). Do not retry it; carry on without it and say what was skipped.' };
+  return { behavior: 'deny', message: r.message ? `The user denied this and said: ${r.message}` : 'The user denied this. Do not retry it; carry on without it or ask how to proceed.' };
+}
+
 readline.createInterface({ input: process.stdin }).on('line', async (line) => {
   let msg;
   try {
@@ -133,11 +228,19 @@ readline.createInterface({ input: process.stdin }).on('line', async (line) => {
     if (method === 'initialize') {
       send({ id, result: { protocolVersion: params?.protocolVersion || '2025-06-18', capabilities: { tools: {} }, serverInfo: { name: 'wisp', version: '0.1.0' } } });
     } else if (method === 'tools/list') {
-      send({ id, result: { tools: TEAM.length ? [TOOL, ...TEAM_TOOLS] : [TOOL] } });
+      send({ id, result: { tools: [TOOL, STATS, SESSIONS, SESSION, ...(WISP_APPROVE ? [APPROVE] : []), ...(TEAM.length ? TEAM_TOOLS : [])] } });
     } else if (method === 'tools/call' && params?.name === 'ask_user') {
       const answer = await askUser(params.arguments || {});
       const text = answer === null ? 'The user did not answer (the question was cancelled). Use your best judgment and note the assumption.' : `The user answered: ${answer}`;
       send({ id, result: { content: [{ type: 'text', text }] } });
+    } else if (method === 'tools/call' && WISP_APPROVE && params?.name === 'approve') {
+      send({ id, result: { content: [{ type: 'text', text: JSON.stringify(await approve(params.arguments || {})) }] } });
+    } else if (method === 'tools/call' && params?.name === 'wisp_stats') {
+      send({ id, result: { content: [{ type: 'text', text: await stats(params.arguments || {}) }] } });
+    } else if (method === 'tools/call' && params?.name === 'wisp_sessions') {
+      send({ id, result: { content: [{ type: 'text', text: await sessions(params.arguments || {}) }] } });
+    } else if (method === 'tools/call' && params?.name === 'wisp_session') {
+      send({ id, result: { content: [{ type: 'text', text: await session(params.arguments || {}) }] } });
     } else if (method === 'tools/call' && TEAM.length && params?.name === 'delegate') {
       send({ id, result: { content: [{ type: 'text', text: await delegate(params.arguments || {}) }] } });
     } else if (method === 'tools/call' && TEAM.length && params?.name === 'subagent_results') {
@@ -149,7 +252,9 @@ readline.createInterface({ input: process.stdin }).on('line', async (line) => {
       send({ id, error: { code: -32601, message: `Method not found: ${method}` } });
     }
   } catch (err) {
-    const what = params?.name === 'ask_user' ? 'wisp could not reach the user' : 'wisp';
-    send({ id, result: { isError: true, content: [{ type: 'text', text: `${what}: ${err.message}` }] } });
+    const what = params?.name === 'ask_user' || params?.name === 'approve' ? 'wisp could not reach the user' : 'wisp';
+    // A permission prompt that errors would leave the harness guessing: deny, and say why.
+    if (params?.name === 'approve') send({ id, result: { content: [{ type: 'text', text: JSON.stringify({ behavior: 'deny', message: `${what}: ${err.message}` }) }] } });
+    else send({ id, result: { isError: true, content: [{ type: 'text', text: `${what}: ${err.message}` }] } });
   }
 });

package/server/mentions.js

@@ -0,0 +1,39 @@
+// Task mentions: a prompt can point at another wisp task. The web app stores one as
+// `@[Title](wisp:<id>)` (pasting a copied task id in a prompt box makes one); the agent gets
+// `@Title (wisp task <id>)` plus a note on how to read it: the wisp_session tool, or the task's
+// report inline for runs that can't take wisp's MCP tools.
+
+import { sessionToMarkdown } from './render.js';
+import { truncate } from './util.js';
+
+export const MENTION = /@\[([^\]\n]{1,200})\]\(wisp:([a-z0-9]{6,40})\)/g;
+const INLINE_MAX = 8_000; // characters of a mentioned task's report, when it goes in the prompt
+
+export const mentionsIn = (text = '') => [...new Map([...String(text).matchAll(MENTION)].map((m) => [m[2], { id: m[2], title: m[1] }])).values()];
+
+// What a person reads: titles, no ids (session titles, notifications).
+export const plainMentions = (text = '') => String(text).replace(MENTION, '@$1');
+
+// What an agent reads in place of each mention.
+export const textMentions = (text = '') => String(text).replace(MENTION, '@$1 (wisp task $2)');
+
+// The prompt for an agent run. tool: how this harness names the wisp_session tool, or null when
+// it has none (then each mentioned task's latest report goes in the prompt).
+export function agentPrompt(prompt, store, { tool = 'wisp_session', self } = {}) {
+  const found = mentionsIn(prompt).filter((m) => m.id !== self);
+  if (!found.length) return textMentions(prompt);
+  const line = (m) => {
+    const s = store.get(m.id);
+    if (!s) return `- \`${m.id}\` (${m.title}): not on this computer; it may have been deleted or run on another machine.`;
+    return `- \`${s.id}\` **${s.title}**: ${s.state}, ${s.agent}, ${s.turns.length} turn${s.turns.length === 1 ? '' : 's'}, in \`${s.worktree?.path || s.cwd}\``;
+  };
+  const note = tool
+    ? `The user mentions other wisp tasks. Read one with \`wisp_session\` (${tool}) before relying on it; \`wisp_sessions\` lists the rest.\n${found.map(line).join('\n')}`
+    : `The user mentions other wisp tasks. Their latest reports:\n\n${found
+        .map((m) => {
+          const s = store.get(m.id);
+          return s ? `### ${s.title} (\`${s.id}\`)\n\n${truncate(sessionToMarkdown(s), INLINE_MAX)}` : line(m);
+        })
+        .join('\n\n')}`;
+  return `${textMentions(prompt)}\n\n<wisp-tasks>\n${note}\n</wisp-tasks>`;
+}

package/server/openapi.js

@@ -90,7 +90,19 @@ export function openapi({ version, port }) {
       },
       '/projects': {
         get: { summary: 'List projects', responses: { 200: json({ type: 'array', items: ref('Project') }) } },
-        post: { summary: 'Add a folder as a project', requestBody: body({ type: 'object', required: ['path'], properties: { path: { type: 'string' }, name: { type: 'string' } } }), responses: { 201: json(ref('Project')), 400: err[400] } },
+        post: {
+          summary: 'Add a folder as a project, or clone a repo URL and add the clone',
+          requestBody: body({
+            type: 'object',
+            properties: {
+              path: { type: 'string', description: 'A folder, or a repo URL (https://github.com/o/r, git@host:o/r.git, o/r)' },
+              repo: { type: 'string', description: 'A repo URL to clone into defaults.cloneDir (default ~/code), then add' },
+              name: { type: 'string' },
+              machine: { type: 'string', description: 'Add (or clone) it on this machine' },
+            },
+          }),
+          responses: { 201: json(ref('Project')), 400: err[400] },
+        },
       },
       '/projects/{pid}': {
         parameters: [{ name: 'pid', in: 'path', required: true, schema: { type: 'string' } }],
@@ -132,6 +144,7 @@ export function openapi({ version, port }) {
         },
       },
       '/sessions/{id}/pr': { parameters: [id], post: { summary: 'Refresh the PR status (checks, review, state) now; it is also polled every minute', responses: { 200: json(ref('PullRequest')), 404: err[404] } } },
+      '/sessions/{id}/fix-conflicts': { parameters: [id], post: { summary: 'Retry the automatic merge-conflict fix after it gave up: a follow-up merges the base in, then wisp pushes to the PR', responses: { 200: json({ type: 'object' }), 400: err[400] } } },
       '/sessions/{id}/merge': {
         parameters: [id],
         post: { summary: 'Mark the PR ready if draft, squash-merge it with --match-head-commit, fast-forward the local base branch, remove the worktree', responses: { 200: json({ type: 'object', properties: { pr: ref('PullRequest'), sync: { type: 'object', properties: { ok: { type: 'boolean' }, text: { type: 'string' } } } } }), 400: err[400] } },
@@ -226,7 +239,8 @@ export function openapi({ version, port }) {
           responses: { 200: json({ type: 'object', properties: { answered: { type: 'boolean' }, queued: { type: 'boolean' }, interrupted: { type: 'boolean' }, ahead: { type: 'integer' } } }), 400: err[400] },
         },
       },
-      '/sessions/{id}/answer': { parameters: [id], post: { summary: 'Answer the pending ask_user question', requestBody: body({ type: 'object', required: ['text'], properties: { text: { type: 'string' } } }), responses: { 200: ok } } },
+      '/sessions/{id}/answer': { parameters: [id], post: { summary: 'Answer the pending ask_user question (or approval: Allow, Always allow in this task, Deny, or what to do instead)', requestBody: body({ type: 'object', required: ['text'], properties: { text: { type: 'string' } } }), responses: { 200: ok } } },
+      '/sessions/{id}/approve': { parameters: [id], post: { summary: 'Allow and retry (or deny) what a finished turn’s permissions blocked', requestBody: body({ type: 'object', properties: { turnId: { type: 'string' }, allow: { type: 'boolean', description: 'Default true' } } }), responses: { 200: ok } } },
       '/sessions/{id}/revert': {
         parameters: [id],
         post: {
@@ -290,9 +304,10 @@ export function openapi({ version, port }) {
           properties: {
             prompt: { type: 'string' },
             cwd: { type: 'string', description: 'Project folder (absolute; ~ allowed). Default: the server’s cwd' },
+            scratch: { type: 'boolean', description: 'No project folder: run in an empty scratch directory (no worktree). Overrides cwd' },
             agent: { enum: ['auto', 'claude', 'codex', 'opencode', 'cursor', 'antigravity', 'grok'], default: 'auto', description: 'auto: wisp picks the harness and model from what worked before; model is then the goal (cheap, balanced, best)' },
             important: { type: 'boolean', description: 'With agent auto: no exploring, take the pick with the best record' },
-            mode: { enum: ['plan', 'edits', 'auto'], default: 'edits' },
+            mode: { enum: ['plan', 'edits', 'auto'], default: 'auto' },
             model: { type: 'string' },
             effort: { type: 'string', description: 'Thinking level: low, medium, high, xhigh, max (per harness)' },
             attachments: { type: 'array', items: { type: 'string' }, description: 'Upload ids' },
@@ -311,6 +326,7 @@ export function openapi({ version, port }) {
             draft: { type: 'boolean' },
             review: { type: 'string', description: 'APPROVED | CHANGES_REQUESTED | REVIEW_REQUIRED | ""' },
             checks: { type: 'object', properties: { pass: { type: 'integer' }, fail: { type: 'integer' }, pending: { type: 'integer' } } },
+            conflict: { type: 'boolean', description: 'GitHub cannot merge it into its base: merge conflicts' },
             head: { type: 'string' },
             base: { type: 'string' },
           },
@@ -392,6 +408,8 @@ export function openapi({ version, port }) {
             updatedAt: { type: 'integer' },
             branch: { type: 'string', description: 'Worktree branch, if it has one' },
             pr: { type: ['object', 'null'], description: 'Its pull request, once shipped' },
+            shipping: { type: ['object', 'null'], description: "{ step: start | commit | push | pr, update } while Ship it runs" },
+            conflictFix: { type: ['object', 'null'], description: "{ step: fixing | pushing | done | failed, why } while wisp fixes the PR's merge conflicts on its own (defaults.fixConflicts: 'off' turns it off)" },
             groupId: { type: ['string', 'null'], description: 'Shared by sessions launched together with compare' },
             origin: { type: ['object', 'null'], description: '{ kind: recipe | trigger, id, name } when not launched by hand' },
           },

package/server/protocol.js

@@ -69,6 +69,9 @@ diff, the test run, the command output — over prose. Use file paths relative t
   A screenshot or generated image on disk.
 - {"type":"question","question":"…","options":[{"label":"Short choice","reply":"full message sent back to you"}]}
   When you need a decision. The user's click resumes you with the reply.
+- {"type":"blocked","items":[{"tool":"shell","detail":"npm publish","why":"needs network access"}]}
+  Actions your permissions or sandbox refused (a denied tool call, a command that failed for lack of
+  network or write access). wisp shows them with an Allow & retry button. Not for ordinary failures.
 - {"type":"actions","title":"…","items":[{"label":"Run tests","command":"npm test"},{"label":"Follow up","reply":"…"}]}
   One-click shell commands (executed in the project root) or follow-up actions the user may want to trigger.
 - {"type":"next","items":["Suggested follow-up the user might send", "…"]}
@@ -89,7 +92,11 @@ Strings must be valid JSON (escape newlines as \\n and quotes as \\"). Example:
 
 const ASK_TOOL = (tool) => `- If a decision would change the rest of the work (ambiguous requirement, destructive or risky step,
   two very different approaches), call the \`ask_user\` tool (${tool}). It pauses you until
-  the user answers in wisp — you keep all your context. Ask one crisp question with 2–4 options.`;
+  the user answers in wisp — you keep all your context. Ask one crisp question with 2–4 options.
+- If the user asks about their past wisp tasks (which tools or harnesses they use, cost, success rate),
+  call \`wisp_stats\` (${tool.replace(/ask_user$/, 'wisp_stats')}) instead of digging through files.
+- If the prompt mentions another wisp task ("@Title (wisp task <id>)") or the user asks what another task
+  did, read it with \`wisp_session\` (${tool.replace(/ask_user$/, 'wisp_session')}); \`wisp_sessions\` lists them.`;
 const ASK_BLOCK = `- If a decision would change the rest of the work (ambiguous requirement, destructive or risky step,
   two very different approaches), stop before acting on it and end with a "question" block (2–4 options).
   The user's answer comes back as a follow-up in this same session.`;

package/server/render.js

@@ -80,6 +80,8 @@ const R = {
   callout: (b) => `> **${b.tone === 'danger' ? '⛔' : b.tone === 'warn' ? '⚠️' : b.tone === 'success' ? '✅' : 'ℹ️'} ${str(b.title)}**\n> ${str(b.text).replace(/\n/g, '\n> ')}`,
   image: (b) => `🖼️ \`${str(b.path || b.src)}\`${b.caption ? ` — ${b.caption}` : ''}`,
   question: (b) => `**❓ ${str(b.question)}**\n${list(b.options).map((o, i) => `${i + 1}. ${str(o.label || o)}`).join('\n')}`,
+  blocked: (b, turn) =>
+    `**🔒 Blocked by permissions**${turn?.approval ? ` _(${turn.approval})_` : ''}\n${list(b.items).map((i) => `- ${str(i.tool)}${i.detail ? `: \`${str(i.detail)}\`` : ''}${i.why ? ` — ${i.why}` : ''}`).join('\n')}`,
   actions: (b) =>
     `${b.title ? `**${b.title}**\n` : '**Actions**\n'}${list(b.items)
       .map((a) => (typeof a === 'string' ? `- ${a}` : `- **${str(a.label || a.command)}**${a.command ? ` — \`$ ${str(a.command)}\`` : a.reply ? ` — _${str(a.reply)}_` : ''}${a.detail ? ` (${str(a.detail)})` : ''}`))
@@ -109,7 +111,7 @@ export function sessionToMarkdown(session) {
   if (turn?.status === 'running') out.push(`_Working… (${turn.activity?.findLast?.((a) => a.kind !== 'text')?.label || 'starting up'})_`);
   else if (turn?.presentation) out.push(blocksToMarkdown(turn.presentation.blocks, turn));
   if (session.ask) {
-    out.push(`**❓ The agent is waiting for your answer:** ${session.ask.question}${session.ask.context ? `\n\n${session.ask.context}` : ''}`);
+    out.push(`**${session.ask.permission ? '🔒 The agent needs your approval' : '❓ The agent is waiting for your answer'}:** ${session.ask.question}${session.ask.context ? `\n\n${session.ask.context}` : ''}`);
     if (session.ask.options?.length) out.push(session.ask.options.map((o, i) => `${i + 1}. ${o}`).join('\n'));
   }
   // Worktree sessions: say where the changes are, since they aren't in the caller's checkout.

package/server/routes/internal.js

@@ -1,8 +1,14 @@
-// Bridge for the MCP servers running inside an agent process (ask_user, delegate). Every call
+// Bridge for the MCP servers running inside an agent process (ask_user, approve, delegate, wisp_stats,
+// wisp_sessions, wisp_session). Every call
 // carries the per-run token wisp handed the agent; nothing else may use these.
 
 import { adapters } from '../adapters/index.js';
+import { plainMentions } from '../mentions.js';
+import { blocksToMarkdown, sessionToMarkdown } from '../render.js';
+import { summarize } from '../runner.js';
 import { delegationReport } from '../subagents.js';
+import { toolStats, toolStatsText } from '../usage.js';
+import { clip } from '../util.js';
 
 export function register(r, app) {
   const { store, runner, telemetry } = app;
@@ -25,6 +31,22 @@ export function register(r, app) {
   );
   r.route('GET', '/internal/ask/:id', guarded((c) => c.send(200, runner.pollAnswer(c.params.id))), opts);
 
+  // A live approval (the harness's permission prompt): { decision } at once, or an { id } to poll
+  // like ask_user, whose answer carries the decision.
+  r.route(
+    'POST',
+    '/internal/approve',
+    guarded(async (c) => {
+      const body = await c.body();
+      const s = store.get(body.session);
+      if (!s) return c.send(404, { error: 'no such session' });
+      const out = runner.requestApproval(s, body);
+      if (out.id) telemetry.track('approval', { agent: s.agent });
+      c.send(200, out);
+    }),
+    opts,
+  );
+
   // delegate: POST starts tasks on the lead's subagents; GET reports on them (done once all finished).
   r.route(
     'POST',
@@ -53,4 +75,102 @@ export function register(r, app) {
     }),
     opts,
   );
+
+  // wisp_stats: read-only tool counts, spend and success across sessions. project=current is the
+  // asking session's project.
+  r.route(
+    'GET',
+    '/internal/stats/:id',
+    guarded((c) => {
+      const s = lead(c);
+      if (!s) return c.send(404, { error: 'no such session' });
+      const projectFor = (x) => store.projectFor(x.cwd);
+      let project = c.query.get('project') || '';
+      if (project === 'current') project = projectFor(s)?.id || String(s.cwd || '').split(/[\\/]/).pop();
+      const stats = toolStats(store.all(), { days: Number(c.query.get('days')) || 30, project: projectFor, filter: { agent: c.query.get('agent') || '', project } });
+      telemetry.track('wisp_stats', { agent: s.agent });
+      c.send(200, { stats, text: toolStatsText(stats) });
+    }),
+    opts,
+  );
+  // wisp_sessions: the user's other tasks (not the asker, its subagents or the tour), newest first.
+  r.route(
+    'GET',
+    '/internal/sessions/:id',
+    guarded((c) => {
+      const s = lead(c);
+      if (!s) return c.send(404, { error: 'no such session' });
+      const q = Object.fromEntries(c.query);
+      let project = q.project || '';
+      if (project === 'current') project = store.projectFor(s.cwd)?.id || String(s.cwd || '').split(/[\\/]/).pop();
+      const states = q.state ? q.state.split(',').map((x) => x.trim()) : null;
+      const words = String(q.query || '').toLowerCase().split(/\s+/).filter(Boolean);
+      const all = store
+        .all()
+        .filter((x) => x.id !== s.id && !x.parentId && x.agent !== 'wisp' && x.id !== s.parentId)
+        .map((x) => summarize(x, store))
+        .filter((x) => (q.archived === 'true' || !x.archived) && (!states || states.includes(x.state)))
+        .filter((x) => !project || x.projectId === project || x.project === project)
+        .filter((x) => words.every((w) => `${x.title} ${x.preview}`.toLowerCase().includes(w)))
+        .sort((a, b) => b.updatedAt - a.updatedAt);
+      const list = all.slice(0, Math.min(Math.max(Number(q.limit) || 20, 1), 100));
+      telemetry.track('wisp_sessions', { agent: s.agent });
+      const text = list.length
+        ? `${all.length} task${all.length === 1 ? '' : 's'}${all.length > list.length ? `, the newest ${list.length}` : ''}. Read one with wisp_session.\n\n${list.map(sessionLine).join('\n')}`
+        : 'No tasks match.';
+      c.send(200, { text });
+    }),
+    opts,
+  );
+
+  // wisp_session: one task's requests and a turn's report (?of=<id>&turn=<1-based>).
+  r.route(
+    'GET',
+    '/internal/session/:id',
+    guarded((c) => {
+      const s = lead(c);
+      if (!s) return c.send(404, { error: 'no such session' });
+      const id = String(c.query.get('of') || '').trim().replace(/^wisp:/, '');
+      const x = store.get(id);
+      telemetry.track('wisp_session', { agent: s.agent });
+      if (!x) return c.send(200, { text: `No wisp task \`${id}\` on this computer. It may have been deleted, or it ran on another machine. List tasks with wisp_sessions.` });
+      c.send(200, { text: sessionText(x, store, c.query.get('turn')) });
+    }),
+    opts,
+  );
+}
+
+const age = (t) => {
+  const m = Math.round((Date.now() - t) / 60_000);
+  return m < 1 ? 'just now' : m < 60 ? `${m}m ago` : m < 48 * 60 ? `${Math.round(m / 60)}h ago` : `${Math.round(m / 1440)}d ago`;
+};
+
+const sessionLine = (x) =>
+  `- \`${x.id}\` **${x.title}** — ${x.archived ? 'archived, ' : ''}${x.state}, ${x.agent}${x.model ? ` (${x.model})` : ''}, ${x.project}, ${age(x.updatedAt)}${x.state === 'running' && x.live ? `: ${x.live}` : x.preview ? `: ${clip(x.preview, 160)}` : ''}`;
+
+export function sessionText(x, store, turnArg) {
+  const sum = summarize(x, store);
+  const n = Number(turnArg);
+  const turn = turnArg === null || turnArg === undefined || turnArg === '' || !n ? x.turns.at(-1) : x.turns[n - 1];
+  const head = [
+    `# ${x.title}`,
+    `Task \`${x.id}\` · ${sum.archived ? 'archived · ' : ''}${x.state} · ${x.agent}${x.model ? ` (${x.model})` : ''} · project ${sum.project} · updated ${age(x.updatedAt)}`,
+    `Folder: \`${x.worktree?.path || x.cwd}\`${x.worktree ? ` (worktree, branch \`${x.worktree.branch}\`)` : ''}${x.pr ? ` · PR #${x.pr.number} (${String(x.pr.state).toLowerCase()}): ${x.pr.url}` : ''}`,
+  ];
+  const asks = x.turns.map((t, i) => `${i + 1}. ${clip(plainMentions(t.prompt).replace(/\s+/g, ' '), 300)}${t.status === 'running' ? ' _(running)_' : t.status === 'error' ? ' _(failed)_' : t.status === 'stopped' ? ' _(stopped)_' : ''}`);
+  if (!turn) return [...head, '', `Turn ${turnArg} doesn't exist; this task has ${x.turns.length}.`, '', '## Requests', ...asks].join('\n');
+  const i = x.turns.indexOf(turn);
+  const report = turn === x.turns.at(-1) ? sessionToMarkdown(x) : blocksToMarkdown(turn.presentation?.blocks, turn);
+  const files = (turn.changes || []).filter((ch) => !ch.reverted).map((ch) => `\`${ch.file}\``);
+  return [
+    ...head,
+    '',
+    `## Requests (${x.turns.length})`,
+    ...asks,
+    '',
+    `## Report for turn ${i + 1}${x.turns.length > 1 ? ` of ${x.turns.length} (pass turn to read another)` : ''}`,
+    '',
+    report || '_No report yet._',
+    ...(files.length ? ['', `Files edited in this turn: ${files.join(', ')}`] : []),
+  ].join('\n');
 }

package/server/routes/meta.js

@@ -34,7 +34,7 @@ export function register(r, app) {
 
   r.route('GET', '/openapi.json', (c) => c.send(200, openapi({ version: VERSION, port })), { doc: false });
 
-  r.route('GET', '/agents', async (c) => c.send(200, await app.auto.detect({ fresh: c.query.has('fresh') })));
+  r.route('GET', '/agents', async (c) => c.send(200, await (c.query.has('fresh') ? app.auto.detect({ fresh: true }) : app.auto.listed())));
   // Re-check: detect harnesses and models again, here and on every online machine.
   r.route('POST', '/agents/recheck', async (c) => {
     const [agents] = await Promise.all([app.auto.detect({ fresh: true }), machines.recheckAgents()]);

package/server/routes/sessions.js

@@ -206,6 +206,18 @@ export function register(r, app) {
     }),
   );
 
+  // The card under a turn whose permissions blocked something: allow retries it, deny closes it.
+  r.route(
+    'POST',
+    '/sessions/:id/approve',
+    one(async (c, s) => {
+      const { turnId, allow } = await c.body();
+      notTour(s, 'approve');
+      await ensureWorktree(s.worktree);
+      c.send(200, runner.approveBlocked(s, { turnId, allow: allow !== false }));
+    }),
+  );
+
   // Revert (or re-apply) a single file's edits from a turn, or roll back (or re-apply) the
   // project's working tree to the checkpoint before a turn. Both note it on the turn and tell
   // the cards; Ship it may have something new (or nothing left) to ship.

package/server/routes/settings.js

@@ -9,16 +9,27 @@ import { normalizePreset } from '../subagents.js';
 import { envDisabled, feedbackAvailable } from '../telemetry.js';
 import { TERMINALS } from '../terminal.js';
 import { normalizeWebhooks } from '../services/webhooks.js';
+import { cloneRepo, gh, git, parseRepo } from '../git.js';
 import { expand } from '../util.js';
 
 // Where people keep their repos, for one-click "add project".
 const REPO_ROOTS = ['code', 'Code', 'dev', 'Developer', 'projects', 'Projects', 'src', 'repos', 'work', 'git', 'GitHub', 'Documents', 'Downloads', 'Desktop'];
 
+// Where a pasted repo URL is cloned: defaults.cloneDir, else the first usual repo folder that
+// exists (not Documents/Downloads/Desktop), else ~/code.
+export function cloneRoot(config) {
+  if (config.defaults?.cloneDir) return expand(config.defaults.cloneDir);
+  const dir = REPO_ROOTS.slice(0, -3)
+    .map((r) => path.join(os.homedir(), r))
+    .find((d) => fs.existsSync(d) && fs.statSync(d).isDirectory());
+  return dir || path.join(os.homedir(), 'code');
+}
+
 export function register(r, app) {
   const { store, telemetry, prefs, retro, remote, machines } = app;
 
   r.route('GET', '/config', (c) =>
-    c.send(200, { ...store.config, remote: undefined, home: os.homedir(), cwd: process.cwd(), terminals: TERMINALS, telemetry: { available: !envDisabled(), enabled: telemetry.enabled }, feedback: feedbackAvailable() }),
+    c.send(200, { ...store.config, remote: undefined, home: os.homedir(), cwd: process.cwd(), cloneDir: cloneRoot(store.config), terminals: TERMINALS, telemetry: { available: !envDisabled(), enabled: telemetry.enabled }, feedback: feedbackAvailable() }),
   );
   r.route('PATCH', '/config', async (c) => {
     const body = await c.body();
@@ -91,18 +102,54 @@ export function register(r, app) {
   r.route('POST', '/projects', async (c) => {
     const body = await c.body();
     if (body.machine) {
-      const p = await machines.addProject(String(body.machine), String(body.path || '').trim(), body.name);
+      const p = await machines.addProject(String(body.machine), String(body.repo || body.path || '').trim(), body.name);
       app.broadcast('config', {});
       return c.send(201, p);
     }
-    const dir = expand(body.path || '');
+    // A repo URL (in `repo`, or pasted into `path`): clone it, then add the clone.
+    const typed = String(body.repo || body.path || '').trim();
+    const local = !body.repo && (/^[~./\\]|^[a-z]:/i.test(typed) || fs.existsSync(expand(typed)));
+    const repo = !local && parseRepo(typed, { shorthand: true });
+    if (body.repo && !repo) return c.send(400, { error: `Not a repo URL: ${typed}` });
+    let dir = expand(typed);
+    let cloned = null;
+    if (repo) {
+      const out = await cloneRepo(repo, cloneRoot(store.config));
+      dir = out.dir;
+      cloned = { url: repo.url, existed: out.existed };
+    }
     if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory()) return c.send(400, { error: `Not a folder: ${dir}` });
     const p = store.addProject(dir, { name: body.name });
     app.broadcast('config', {});
-    c.send(201, p);
+    c.send(201, cloned ? { ...p, cloned } : p);
   });
   // Find git repos in the usual places so adding projects is one click.
   r.route('GET', '/projects/discover', (c) => c.send(200, discoverRepos(new Set(store.config.projects.map((p) => p.path)))), { doc: false });
+  // The user's GitHub repos (gh's login), newest first, minus ones already added: one click clones.
+  // Empty when gh isn't installed or signed in.
+  r.route(
+    'GET',
+    '/projects/github',
+    async (c) => {
+      const list = await gh(os.homedir(), ['repo', 'list', '--limit', '40', '--json', 'nameWithOwner,description,isPrivate,isFork,pushedAt,url'], { timeout: 20_000 })
+        .then((out) => JSON.parse(out || '[]'))
+        .catch(() => null);
+      if (!list) return c.send(200, []);
+      const origins = await Promise.all(
+        store.config.projects.filter((p) => !p.machine).map((p) => git(p.path, ['remote', 'get-url', 'origin'], { timeout: 5000 }).catch(() => '')),
+      );
+      const have = new Set(origins.map((o) => parseRepo(o)?.gh?.toLowerCase()).filter(Boolean));
+      c.send(
+        200,
+        list
+          .filter((x) => !have.has(x.nameWithOwner.toLowerCase()))
+          .sort((a, b) => String(b.pushedAt).localeCompare(String(a.pushedAt)))
+          .slice(0, 24)
+          .map((x) => ({ repo: x.nameWithOwner, url: x.url, description: x.description || '', private: !!x.isPrivate, fork: !!x.isFork, pushedAt: x.pushedAt })),
+      );
+    },
+    { doc: false },
+  );
   const project = (c) => store.config.projects.find((x) => x.id === c.params.id);
   r.route('PATCH', '/projects/:id', async (c) => {
     const p = project(c);