tsugite-cli 0.25.4__tar.gz → 0.27.0__tar.gz

{tsugite_cli-0.25.4 → tsugite_cli-0.27.0}/.gitignore

@@ -183,7 +183,6 @@ benchmarks/
 docker-compose.test.yml
 #### TODO ^^^
 
-plugins/tsugite-daemon/frontend/node_modules/
 # Vite dep-optimizer cache. Normally under node_modules/.vite, but lands at the
 # cwd's `.vite/` when vite/vitest is run from the repo root, so ignore it anywhere.
 .vite/
@@ -197,3 +196,6 @@ plugins/tsugite-daemon/tsugite_daemon/web/
 # Per-job git worktrees provisioned by the daemon.
 .tsugite-jobs/
 /packaging/runtime/.cache/
+# Corporate CA certs dropped in for docker build.
+/docker/ca-certificates/*
+!/docker/ca-certificates/.gitkeep

{tsugite_cli-0.25.4 → tsugite_cli-0.27.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tsugite-cli
-Version: 0.25.4
+Version: 0.27.0
 Summary: Micro-agent runner for task automation using markdown definitions
 Author: Justyn Shull
 License: GNU AFFERO GENERAL PUBLIC LICENSE
@@ -261,6 +261,7 @@ Provides-Extra: all
 Requires-Dist: tsugite-acp; extra == 'all'
 Requires-Dist: tsugite-claude-code; extra == 'all'
 Requires-Dist: tsugite-codex-cli; extra == 'all'
+Requires-Dist: tsugite-cursor; extra == 'all'
 Requires-Dist: tsugite-daemon; extra == 'all'
 Requires-Dist: tsugite-discord; extra == 'all'
 Requires-Dist: tsugite-pty; extra == 'all'
@@ -339,7 +340,7 @@ pip install tsugite-cli                  # or plain pip
 | --- | --- |
 | `tsugite-cli[daemon]` | Daemon: HTTP API, web UI, scheduler, jobs, terminals (pty), sandbox, Discord |
 | `tsugite-cli[web]` | `web_search` + YouTube transcripts |
-| `tsugite-cli[sandbox]` | bwrap sandbox backend (also needs the `bwrap` binary) |
+| `tsugite-cli[sandbox]` | [Hozo](https://github.com/justyns/hozo) sandbox backend (needs `bwrap` on Linux; macOS uses the built-in `sandbox-exec`) |
 | `tsugite-cli[all]` | Everything above plus the optional tmux + provider plugins |
 
 ```bash
@@ -348,6 +349,16 @@ uv tool install "tsugite-cli[daemon]"    # full server install
 
 The package is `tsugite-cli`, the command is `tsugite` (or `tsu` for short).
 
+### Desktop app
+
+On Apple Silicon Macs (macOS 13 or later), install the desktop app from the Homebrew tap:
+
+```bash
+brew install --cask justyns/tap/tsugite
+```
+
+Linux builds ship as an AppImage on the [releases page](https://github.com/justyns/tsugite/releases).
+
 ## Quick start
 
 ```bash
@@ -384,7 +395,7 @@ in nested tmux / non-Rich-friendly shells. Pick a richer or quieter mode when yo
 - **Sub-agents** that can spawn other agents for specific subtasks
 - **Skills** directory-based knowledge modules (mostly) following the [agentskills.io](https://agentskills.io/) SKILL.md format
 - **Hooks** that fire shell commands on lifecycle events (post-tool, pre-message, pre/post-compact)
-- **Sandbox** (linux only) via bubblewrap with filesystem and network isolation
+- **Sandbox** (Linux and macOS) via [Hozo](https://github.com/justyns/hozo) with filesystem and network isolation
 
 ## Agents in more detail
 
@@ -417,7 +428,7 @@ For a complete example, check the built-in [default agent](tsugite/builtin_agent
 
 ## Sandbox
 
-On Linux only (for now), agent code runs inside a [bubblewrap](https://github.com/containers/bubblewrap) sandbox when you pass `--sandbox`:
+Agent code runs inside a [Hozo](https://github.com/justyns/hozo) sandbox (bubblewrap on Linux, `sandbox-exec` on macOS) when you pass `--sandbox`:
 
 ```bash
 tsu run +default "task" --sandbox --allow-domain "github.com"

{tsugite_cli-0.25.4 → tsugite_cli-0.27.0}/README.md

@@ -55,7 +55,7 @@ pip install tsugite-cli                  # or plain pip
 | --- | --- |
 | `tsugite-cli[daemon]` | Daemon: HTTP API, web UI, scheduler, jobs, terminals (pty), sandbox, Discord |
 | `tsugite-cli[web]` | `web_search` + YouTube transcripts |
-| `tsugite-cli[sandbox]` | bwrap sandbox backend (also needs the `bwrap` binary) |
+| `tsugite-cli[sandbox]` | [Hozo](https://github.com/justyns/hozo) sandbox backend (needs `bwrap` on Linux; macOS uses the built-in `sandbox-exec`) |
 | `tsugite-cli[all]` | Everything above plus the optional tmux + provider plugins |
 
 ```bash
@@ -64,6 +64,16 @@ uv tool install "tsugite-cli[daemon]"    # full server install
 
 The package is `tsugite-cli`, the command is `tsugite` (or `tsu` for short).
 
+### Desktop app
+
+On Apple Silicon Macs (macOS 13 or later), install the desktop app from the Homebrew tap:
+
+```bash
+brew install --cask justyns/tap/tsugite
+```
+
+Linux builds ship as an AppImage on the [releases page](https://github.com/justyns/tsugite/releases).
+
 ## Quick start
 
 ```bash
@@ -100,7 +110,7 @@ in nested tmux / non-Rich-friendly shells. Pick a richer or quieter mode when yo
 - **Sub-agents** that can spawn other agents for specific subtasks
 - **Skills** directory-based knowledge modules (mostly) following the [agentskills.io](https://agentskills.io/) SKILL.md format
 - **Hooks** that fire shell commands on lifecycle events (post-tool, pre-message, pre/post-compact)
-- **Sandbox** (linux only) via bubblewrap with filesystem and network isolation
+- **Sandbox** (Linux and macOS) via [Hozo](https://github.com/justyns/hozo) with filesystem and network isolation
 
 ## Agents in more detail
 
@@ -133,7 +143,7 @@ For a complete example, check the built-in [default agent](tsugite/builtin_agent
 
 ## Sandbox
 
-On Linux only (for now), agent code runs inside a [bubblewrap](https://github.com/containers/bubblewrap) sandbox when you pass `--sandbox`:
+Agent code runs inside a [Hozo](https://github.com/justyns/hozo) sandbox (bubblewrap on Linux, `sandbox-exec` on macOS) when you pass `--sandbox`:
 
 ```bash
 tsu run +default "task" --sandbox --allow-domain "github.com"

{tsugite_cli-0.25.4 → tsugite_cli-0.27.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tsugite-cli"
-version = "0.25.4"
+version = "0.27.0"
 description = "Micro-agent runner for task automation using markdown definitions"
 authors = [{ name = "Justyn Shull" }]
 requires-python = ">=3.11"
@@ -55,6 +55,7 @@ all = [
   "tsugite-acp",
   "tsugite-claude-code",
   "tsugite-codex-cli",
+  "tsugite-cursor",
 ]
 
 [project.scripts]
@@ -87,6 +88,7 @@ tsugite-tmux = { workspace = true }
 tsugite-acp = { workspace = true }
 tsugite-claude-code = { workspace = true }
 tsugite-codex-cli = { workspace = true }
+tsugite-cursor = { workspace = true }
 tsugite-web = { workspace = true }
 tsugite-youtube = { workspace = true }
 tsugite-sandbox = { workspace = true }
@@ -95,6 +97,8 @@ tsugite-daemon = { workspace = true }
 tsugite-discord = { workspace = true }
 tsugite-cc-driver = { workspace = true }
 tsugite-onlyoffice = { workspace = true }
+tsugite-mcp = { workspace = true }
+tsugite-forge = { workspace = true }
 
 [tool.ruff]
 target-version = "py311"
@@ -170,8 +174,11 @@ paths = [
   "plugins/tsugite-cc-driver/tsugite_cc_driver",
   "plugins/tsugite-claude-code/tsugite_claude_code",
   "plugins/tsugite-codex-cli/tsugite_codex_cli",
+  "plugins/tsugite-cursor/tsugite_cursor",
   "plugins/tsugite-daemon/tsugite_daemon",
   "plugins/tsugite-discord/tsugite_discord",
+  "plugins/tsugite-forge/tsugite_forge",
+  "plugins/tsugite-mcp/tsugite_mcp",
   "plugins/tsugite-onlyoffice/tsugite_onlyoffice",
   "plugins/tsugite-pty/tsugite_pty",
   "plugins/tsugite-sandbox/tsugite_sandbox",
@@ -238,7 +245,7 @@ ignore_names = [
   "get_completions",   # prompt_toolkit Completer API, dispatched by the session
   "complete_event",    # mandatory prompt_toolkit get_completions() parameter
   "language",          # CodeExecutionEvent field, read by the web UI via serialized events
-  "BubblewrapSandbox", # plugin entry point (tsugite.sandbox: bwrap), loaded via get_sandbox_class
+  "HozoSandbox",       # plugin entry point (tsugite.sandbox: hozo), loaded via get_sandbox_class
   # Public API / test-infra reached only from tests (vulture excludes tests).
   "subscribe_filtered",         # imperative EventBus filtered-subscription API (docs/plugin-events.md)
   "unsubscribe_filtered",
@@ -264,6 +271,7 @@ dev = [
   "tsugite-acp",
   "tsugite-claude-code",
   "tsugite-codex-cli",
+  "tsugite-cursor",
   "tsugite-web",
   "tsugite-youtube",
   "tsugite-sandbox",
@@ -272,4 +280,6 @@ dev = [
   "tsugite-discord",
   "tsugite-cc-driver",
   "tsugite-onlyoffice",
+  "tsugite-mcp",
+  "tsugite-forge",
 ]

{tsugite_cli-0.25.4 → tsugite_cli-0.27.0}/tsugite/agent_preparation.py

@@ -330,6 +330,17 @@ class AgentPreparer:
                 if "notify_user" not in expanded and "notify_user" in _tools:
                     expanded.append("notify_user")
 
+            if agent_config.deferred_tools:
+                from tsugite.permissions import get_permissions
+                from tsugite.tools.tool_access import TOOL_ACCESS_TOOLS, start_turn
+
+                perms = get_permissions()
+                granted = perms.listed(f"agents.{agent_config.name}.tools") if perms else []
+                deferred = expand_tool_specs(agent_config.deferred_tools) + granted
+                deferred = [t for t in deferred if t in _tools and (has_interaction or t not in interactive_tool_names)]
+                access = start_turn(agent_config.name, expanded, deferred)
+                expanded += [t for t in TOOL_ACCESS_TOOLS + access.loaded if t in _tools and t not in expanded]
+
             return [create_tool_from_tsugite(name) for name in expanded]
         except Exception as e:
             raise RuntimeError(f"Failed to create tools: {e}") from e

{tsugite_cli-0.25.4 → tsugite_cli-0.27.0}/tsugite/agent_runner/exec_directives.py

@@ -41,8 +41,6 @@ def _success_note(directive: ExecDirective) -> str:
 def execute_exec_directives(
     content: str,
     existing_context: Optional[Dict[str, Any]] = None,
-    sandbox_config: Optional[Any] = None,
-    workspace_dir: Optional[str] = None,
     event_bus: Optional[Any] = None,
 ) -> Tuple[str, Dict[str, Any]]:
     """Execute exec directives in `content` and return (modified_content, exec_context).
@@ -52,8 +50,6 @@ def execute_exec_directives(
         existing_context: Vars from prior pipeline stages (prefetch, tool directives,
             caller). Made available to each exec block as Python locals. Vars assigned
             by an earlier exec block in the same content are also visible to later ones.
-        sandbox_config: Optional SandboxConfig; when set, blocks run inside bubblewrap.
-        workspace_dir: Optional workspace path for sandbox bind mounts.
         event_bus: Optional EventBus for emitting warnings on continue_on_error paths.
 
     Returns:
@@ -89,8 +85,6 @@ def execute_exec_directives(
                 locals_dict=block_locals,
                 timeout=directive.timeout,
                 continue_on_error=directive.continue_on_error,
-                sandbox_config=sandbox_config,
-                workspace_dir=workspace_dir,
             )
         except Exception as e:
             if not directive.continue_on_error:

{tsugite_cli-0.25.4 → tsugite_cli-0.27.0}/tsugite/agent_runner/exec_runner.py

@@ -4,15 +4,10 @@ This is a deliberate parallel path to `tsugite.core.subprocess_executor.Subproce
 Both run user Python in a subprocess, but they differ:
 
   - `SubprocessExecutor` is async, turn-stateful, blocks `open()`, forces tool usage,
-    and manages a network proxy when sandboxed. It's designed for the LLM agent loop
-    where each turn is a long-running session.
+    and runs inside the sandbox backend when sandboxed. It's designed for the LLM agent
+    loop where each turn is a long-running session.
   - `run_python_block` (this module) is synchronous, one-shot, allows plain Python
     (`open`, `os.listdir`, etc.), and is invoked at agent-prep time before the LLM runs.
-
-Sandbox plumbing is deferred: passing `sandbox_config` raises `NotImplementedError`.
-The async path's bubblewrap+proxy lifecycle does not translate cleanly to the
-synchronous one-shot model; a future shared `build_python_subprocess_command` helper
-would converge both paths. Any sandbox-related change must update both call sites.
 """
 
 import json
@@ -126,8 +121,6 @@ def run_python_block(
     locals_dict: Dict[str, Any],
     timeout: int = 30,
     continue_on_error: bool = False,
-    sandbox_config: Optional[Any] = None,
-    workspace_dir: Optional[str] = None,
 ) -> ExecBlockResult:
     """Run a Python block synchronously in a one-shot subprocess.
 
@@ -138,8 +131,6 @@ def run_python_block(
         timeout: Wall-clock timeout in seconds.
         continue_on_error: If True, exceptions are captured to result.error and
             return_value is None instead of re-raising.
-        sandbox_config: Optional SandboxConfig; when set, blocks run in bwrap.
-        workspace_dir: Optional workspace path for sandbox bind mounts.
 
     Raises:
         TimeoutError: On timeout.
@@ -158,7 +149,7 @@ def run_python_block(
         with open(payload_path, "w") as f:
             json.dump({"locals": safe_locals, "code": code}, f)
 
-        cmd = _build_command(harness_path, payload_path, result_path, sandbox_config, workspace_dir)
+        cmd = [sys.executable, "-u", harness_path, payload_path, result_path]
 
         try:
             proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
@@ -205,19 +196,3 @@ def _filter_json_safe(d: Dict[str, Any]) -> Dict[str, Any]:
         except (TypeError, ValueError, OverflowError):
             continue
     return safe
-
-
-def _build_command(
-    harness_path: str,
-    payload_path: str,
-    result_path: str,
-    sandbox_config: Optional[Any],
-    workspace_dir: Optional[str],
-) -> list[str]:
-    if sandbox_config is None:
-        return [sys.executable, "-u", harness_path, payload_path, result_path]
-    raise NotImplementedError(
-        "sandbox_config support for tsu:exec is not implemented yet - the existing async "
-        "SubprocessExecutor path manages a network proxy that doesn't translate cleanly to "
-        "this synchronous one-shot path. Track in a follow-up."
-    )

{tsugite_cli-0.25.4 → tsugite_cli-0.27.0}/tsugite/agent_runner/helpers.py

@@ -1,6 +1,7 @@
 """Shared helper functions for agent execution."""
 
 import contextvars
+import uuid
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, List, Optional
@@ -105,7 +106,7 @@ def build_sandbox_policy(
     `tsu exec` so the two never drift. Agent frontmatter (network/sandbox) can only
     tighten the CLI/daemon ceiling, never loosen it.
 
-    Raises RuntimeError if the sandbox is requested but bwrap is unavailable.
+    Raises RuntimeError if the sandbox is requested but no backend is available.
     """
     from tsugite.agent_runner.runner import resolve_effective_sandbox
     from tsugite.core.sandbox import SandboxConfig, sandbox_available
@@ -121,7 +122,9 @@ def build_sandbox_policy(
         return None, None
 
     if not sandbox_available():
-        raise RuntimeError("No sandbox backend available. Install tsugite-sandbox and bubblewrap, or use --no-sandbox.")
+        raise RuntimeError(
+            "No sandbox backend available. Install tsugite-sandbox (and bubblewrap on Linux), or use --no-sandbox."
+        )
 
     ctx = SandboxContext(
         allow_domains=allow_domains,
@@ -197,6 +200,30 @@ def get_allowed_secrets() -> Optional[List[str]]:
     return _allowed_secrets_var.get()
 
 
+_turn_id_var: contextvars.ContextVar[Optional[str]] = contextvars.ContextVar("turn_id", default=None)
+
+
+def start_turn() -> contextvars.Token:
+    """Mint a fresh turn id for the history events recorded in this context. Returns a reset token."""
+    return _turn_id_var.set(uuid.uuid4().hex)
+
+
+def reset_turn(token: contextvars.Token) -> None:
+    """Restore whatever turn id was current before the matching start_turn."""
+    _turn_id_var.reset(token)
+
+
+def get_turn_id() -> Optional[str]:
+    """Return the current turn's id, or None outside a turn."""
+    return _turn_id_var.get()
+
+
+def turn_fields() -> dict:
+    """The turn_id field for an event recorded now, or nothing outside a turn."""
+    turn_id = _turn_id_var.get()
+    return {"turn_id": turn_id} if turn_id else {}
+
+
 def clear_current_agent() -> None:
     """Clear the currently executing agent (tests and top-level teardown)."""
     _current_agent_var.set(None)

{tsugite_cli-0.25.4 → tsugite_cli-0.27.0}/tsugite/agent_runner/history_integration.py

@@ -13,6 +13,7 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 
+from tsugite.agent_runner.helpers import get_turn_id, turn_fields
 from tsugite.attachments.base import Attachment
 from tsugite.config import load_config
 from tsugite.history import (
@@ -88,6 +89,14 @@ def open_or_create_session(
     return backend.create(agent_name=agent_name, model=model, workspace=workspace)
 
 
+def _turn_has(storage: Session, event_type: str) -> Optional[bool]:
+    """Whether the current turn recorded an event_type; None outside a turn."""
+    turn_id = get_turn_id()
+    if turn_id is None:
+        return None
+    return any(e.data.get("turn_id") == turn_id for e in storage.iter_events(types=(event_type,)))
+
+
 def _current_turn_already_has_user_input(storage: Session) -> bool:
     """True if the in-progress turn already recorded a user_input.
 
@@ -98,7 +107,13 @@ def _current_turn_already_has_user_input(storage: Session) -> bool:
     A genuinely repeated message opens a new turn *after* the prior session_end,
     so this stays False for it. A final_result also ends a turn copied without
     its session_end (branches, older compacted sessions).
+
+    That event-order rule covers callers with no turn id. With one set, only a
+    user_input carrying it counts.
     """
+    has = _turn_has(storage, "user_input")
+    if has is not None:
+        return has
     events = list(storage.iter_events(types=("user_input", "session_end", "final_result")))
     return bool(events) and events[-1].type == "user_input"
 
@@ -122,7 +137,7 @@ def record_user_input(
     """
     if _current_turn_already_has_user_input(storage):
         return
-    data: Dict[str, Any] = {"text": text}
+    data: Dict[str, Any] = {"text": text, **turn_fields()}
     # Only files the user actually uploaded ride here: this field is display-only
     # (the web UI renders them as clickable `uploads/<name>` chips). The agent's
     # auto-included context (workspace memory files like USER.md, config
@@ -158,11 +173,15 @@ def record_final_result(
     the agent reaches its end-of-run recording). Skip in that case so the
     conversation view doesn't render the answer twice.
     """
-    for event in reversed(list(storage.iter_events(types=("user_input", "final_result")))):
-        if event.type == "user_input":
-            break
-        if event.type == "final_result":
-            return
+    has = _turn_has(storage, "final_result")
+    if has:
+        return
+    if has is None:
+        for event in reversed(list(storage.iter_events(types=("user_input", "final_result")))):
+            if event.type == "user_input":
+                break
+            if event.type == "final_result":
+                return
     storage.record(
         "final_result",
         result=result,
@@ -170,6 +189,7 @@ def record_final_result(
         turns=turns,
         tokens=tokens,
         cost=cost,
+        **turn_fields(),
     )
 
 
@@ -189,7 +209,7 @@ def record_session_end(
     liveness. The two stores tracking different things (last-turn outcome vs
     conversation open/closed) is expected, not a desync.
     """
-    storage.record("session_end", status=status, error_message=error_message)
+    storage.record("session_end", status=status, error_message=error_message, **turn_fields())
 
 
 def save_run_to_history(

{tsugite_cli-0.25.4 → tsugite_cli-0.27.0}/tsugite/agent_runner/runner.py

@@ -12,7 +12,6 @@ from typing import TYPE_CHECKING, Any, Dict, List, Optional  # noqa: E402
 
 from tsugite.core.agent import NO_ACTION_MESSAGE, AgentResult, TsugiteAgent  # noqa: E402
 from tsugite.core.executor_registry import get_executor_class  # noqa: E402
-from tsugite.core.proxy import _parse_pattern  # noqa: E402
 from tsugite.core.state import session_state_path  # noqa: E402
 from tsugite.exceptions import (  # noqa: E402
     AgentExecutionError,
@@ -29,13 +28,16 @@ from .helpers import (  # noqa: E402
     _stderr_console,
     build_sandbox_policy,
     get_display_console,
+    get_turn_id,
     get_ui_handler,
     reset_allowed_secrets,
     reset_current_agent,
     reset_sandbox_context,
+    reset_turn,
     set_allowed_secrets,
     set_current_agent,
     set_sandbox_context,
+    start_turn,
 )
 from .models import AgentExecutionResult, AgentSkippedError  # noqa: E402
 
@@ -497,7 +499,7 @@ async def _execute_agent_with_prompt(
     )
 
     if sandbox_config is not None:
-        # bwrap sandboxing is a subprocess feature, so a sandboxed run always uses
+        # Sandboxing is a subprocess feature, so a sandboxed run always uses
         # the subprocess executor regardless of the configured default backend.
         from tsugite.core.subprocess_executor import SubprocessExecutor
 
@@ -582,6 +584,10 @@ async def _execute_agent_with_prompt(
             pre_llm_call=pre_llm_call_cb,
             expects_action=requires_action or (channel_metadata or {}).get("source") == "scheduler",
         )
+        if agent_config.deferred_tools:
+            from tsugite.tools.tool_access import get_access
+
+            get_access().agent = agent
         # Set event_bus in context so tools can access it during execution
         _setup_event_context(event_bus)
 
@@ -609,13 +615,14 @@ async def _execute_agent_with_prompt(
             )
 
         try:
+            from tsugite.models import resolve_usage_model
             from tsugite.usage import get_usage_store
 
             meta = channel_metadata or {}
             get_usage_store().record(
                 session_id=continue_conversation_id,
                 agent=prepared.agent_config.name,
-                model=model_string,
+                model=resolve_usage_model(model_string),
                 source=meta.get("source") or "cli",
                 schedule_name=meta.get("schedule_id"),
                 input_tokens=agent.prompt_tokens,
@@ -750,8 +757,8 @@ def resolve_effective_sandbox(
     desired = set(fm_network.get("domains") or []) | set(fm_sandbox.get("allow_domains") or [])
     base = list(daemon_domains or [])
     if desired:
-        # Keep each desired pattern only if the daemon ceiling permits it, using the
-        # proxy's glob semantics (so agent "api.github.com" is kept under daemon
+        # Keep each desired pattern only if the daemon ceiling permits it, using
+        # glob semantics (so agent "api.github.com" is kept under daemon
         # "*.github.com"). An empty ceiling permits everything.
         effective = sorted(d for d in desired if _domain_within_ceiling(d, base))
         if not effective:
@@ -764,10 +771,25 @@ def resolve_effective_sandbox(
     return enabled, allow_domains, no_network
 
 
+def _parse_pattern(pattern: str) -> tuple[str, set[int]]:
+    """No port means {80, 443} and `:*` means any port (empty set). IPv6 takes a port
+    only in brackets (`[fd00::/8]:443`), as Hozo's proxy does."""
+    if pattern.startswith("["):
+        domain, _, port_str = pattern[1:].partition("]")
+        port_str = port_str.removeprefix(":")
+    elif pattern.count(":") == 1:
+        domain, port_str = pattern.split(":")
+    else:
+        domain, port_str = pattern, ""
+    if not port_str:
+        return (domain, {80, 443})
+    return (domain, set() if port_str == "*" else {int(port_str)})
+
+
 def _domain_within_ceiling(desired_pattern: str, ceiling: list) -> bool:
     """True if a desired domain:port pattern is permitted by the daemon ceiling.
 
-    Uses the proxy's glob + port semantics so e.g. 'api.github.com' is within
+    Uses glob + port semantics so e.g. 'api.github.com' is within
     '*.github.com', but 'github.com:22' is NOT within 'github.com' (which only allows
     the default 80/443). The ceiling is a union: the desired ports must be covered by
     the union of port sets from ALL ceiling patterns whose domain glob matches (so
@@ -777,9 +799,6 @@ def _domain_within_ceiling(desired_pattern: str, ceiling: list) -> bool:
     if not ceiling:
         return True
     d_domain, d_ports = _parse_pattern(desired_pattern.lower())
-    # The proxy treats the allowlist as a union, so collect the ports from EVERY
-    # ceiling pattern whose domain glob matches and check the desired ports against
-    # their union (e.g. ["github.com:80","github.com:443"] together cover 80/443).
     matched = False
     allowed_ports: set = set()
     for c in ceiling:
@@ -1082,7 +1101,21 @@ async def run_agent_async(
     if context is None:
         context = {}
 
-    from tsugite.hooks import fire_pre_message_hooks
+    from tsugite.hooks import fire_pre_message_hooks, reset_skip_hooks, resolve_skip_hooks, set_skip_hooks
+
+    # Parse agent configuration (with inheritance resolution)
+    try:
+        agent = parse_agent_file(agent_path)
+        agent_config = agent.config
+    except Exception as e:
+        raise ValueError(f"Failed to parse agent file: {e}")
+
+    skip_hooks_token = set_skip_hooks(
+        {
+            *resolve_skip_hooks(agent_config.hooks, agent_config.skip_hooks),
+            *(channel_metadata or {}).get("skip_hooks", []),
+        }
+    )
 
     hooks_dir = workspace.path if workspace else (path_context.effective_cwd if path_context else Path.cwd())
     hook_message = context.pop("raw_message", prompt)
@@ -1160,17 +1193,14 @@ async def run_agent_async(
             # New conversation (e.g., fresh workspace session) - start with empty history
             pass
 
-    # Parse agent configuration (with inheritance resolution)
-    try:
-        agent = parse_agent_file(agent_path)
-        agent_config = agent.config
-    except Exception as e:
-        raise ValueError(f"Failed to parse agent file: {e}")
+    from tsugite.tools.tool_access import current_access
 
     # Scope this run's ambient state with tokens: an agent hook nests a full run
     # inside this one and must restore what it found rather than clobber it.
     agent_token = set_current_agent(agent_config.name)
     secrets_token = set_allowed_secrets(agent_config.allowed_secrets)
+    turn_token = start_turn() if get_turn_id() is None else None
+    access_token = current_access.set(None)
 
     setup = _RunSetup(
         exec_options=exec_options,
@@ -1205,6 +1235,10 @@ async def run_agent_async(
     finally:
         reset_current_agent(agent_token)
         reset_allowed_secrets(secrets_token)
+        reset_skip_hooks(skip_hooks_token)
+        current_access.reset(access_token)
+        if turn_token is not None:
+            reset_turn(turn_token)
 
 
 def preview_multistep_agent(