A card in front of every command, a denial that names the text it came from, and a retry budget for tool calls: four agent-builder stops from October 31 to November 7
Four in-window builds that each place a checkpoint in front of an agent's side effects — a permission card per shell command, a denial that carries the text behind it, a restore that leaves risky commands unentered, and a retry budget declared before the first call.
Four builds landed between October 31 and November 7, and all four land on the same moment: just before an agent does something it cannot take back.
Milind Soni's OpenMausBot turns every shell command into a card you allow or deny. Stroq, from the AGGIB account, makes that card name the text the command came from. Andrew Boldi's tmux-restore brings a command back after a reboot without pressing Enter. Pierce Freeman's Waymark decides before the first call which tool calls may run twice.
Each of the four built the same component. Call it the stop: where the run halts, and what the stop is allowed to know.
The comparison map
| Signal | Builder or project | In-window date | Artifact to open | First test |
|---|---|---|---|---|
| A card in front of every command | Milind Soni / OpenMausBot | Nov 3-7 | OpenMausBot | Count how many of your agent's actions a person actually sees. |
| A denial that names the text it came from | AGGIB / Stroq | Nov 5 | Stroq | Replay last month's sessions against your own rules. |
| A command that comes back unentered | Andrew Boldi / tmux-restore | Nov 3 | tmux-restore | List what your restored commands would re-fire. |
| A retry budget for tool calls | Pierce Freeman / Waymark | Nov 5 | Waymark | Mark every tool call that must run only once. |
Four signals to inspect
1. A permission broker in front of every command
OpenMausBot is a chat app in which every contact in the sidebar is a real agent. Each contact drives your own Claude, Codex or Grok command-line tool under a local harness server, and keeps its transcripts, keys and events in a folder in your home directory 1.
The project sat on GitHub's weekly trending board at 16,706 stars, up 6,395 in seven days 2. It shipped eight releases between November 3 and November 7, from 0.1.140 to 0.1.147 3.
Shell commands, file edits and questions all arrive as inline cards: allow, deny, or answer in the chat. The component behind the cards is a permission broker, and it turns each risky action into a decision a person makes 1. The same rule covers a cloud computer and a local one.
Each bot also chooses where its computer lives. The panel offers three settings: a cloud box, this Mac, or off 1.
The host option is gated hardest. macOS is supported. Ubuntu on Xorg is a beta behind an explicit opt-in, and the reviewed automation runtime starts only after that opt-in 4. On Wayland the app never starts the runtime, and it clears any earlier opt-ins while the safety question stays open 4.
The sharpest decision is about who may approve. OpenMausBot ships a stdio MCP server so other programs can drive it: inspect bots, send work, wait for a result, switch models, interrupt a turn 1. That server deliberately withholds approval grants, deletion, arbitrary settings, credentials and the computer's lifecycle 1.
The server hands the agent work. Approval stays with the person in the chat.
One path skips the card. Schedules and webhooks that a bot creates go through a trigger tool that fires without confirmation first 1. The project's answer is a live card in the chat with Edit, Pause and Undo, and a webhook secret shown once.
Teams shared between installations arrive closed. Connections stay off until you approve them, routines arrive paused, and a package travels without credentials, conversations, permissions, memory or computer access 5.
The project is early and says so. Keys that the command-line setup stores sit in plaintext in a private config file readable by your account alone 1.
Try it. Count how many of your agent's actions a person sees before they happen, then check whether the thing that can drive your agent is also the thing that approves it.
2. A denial that names the text it came from
Stroq reads the sessions your coding agent already wrote. From them it answers two questions: how many commands came from text the agent had read, and which of your keys left the machine 6.
Version 0.30.0 shipped on November 5, the same day the project reached Hacker News with 92 points and 34 comments 78. The repository carried 201 stars when this was written.
The live half is a set of hooks, and every tool call is judged before it runs 6. A pipe into a shell is denied. An outbound call carrying a known secret from the machine is denied. A command that repeats text the agent read is held, and you see it with that text attached.
The console is where the design shows. Each decision opens into a chain: what the agent read, what it did, the decision, and the rule that fired 6.
The console stops short of claiming causation. It shows the order of events, and it marks the earlier content as something that looked like instructions to the agent.
The same tool judges sessions that predate it. Replay reads the agent's own transcript, so it can report which content the agent read and which later actions came out of it 6. Replay only reads and sends nothing, and each verdict comes from today's policy, which may differ from the one in force at the time.
A second command compares those sessions against the credentials on your machine. Each key lands in one of five outcomes: sent to another company, maybe sent, seen by the AI, used with its own service, or blocked before it ran. It prints key names and sources only 6.
The project publishes its own score. Against its own policy on 0.30.0, a suite of 36 attacks drawn from public reports and synthetic cases produced 15 denials and 21 questions, and every one of the 36 was stopped or held 6.
The stated limits are why the rest is credible. A hook sees only what the host application sends it, and that differs by agent and version. Matching happens at the text level, so a command the model writes from scratch traces back to no source. The tool behaves as a filter, and sandboxing stays a separate job. A match in a local transcript falls short of proof that the text reached a model provider 6.
Try it. Replay last month's agent sessions against your rules before you install anything; the sessions you already have are the only honest test set.
3. A command that comes back unentered
tmux-restore saves every tmux session, window, split, working directory and scrollback every minute, and once more as the machine shuts down 9.
It reached Hacker News on November 3 with 48 points and 35 comments 10. The repository was created on October 31 and carried 55 stars and seven commits when this was written 9.
The layout is the easy half. Each agent keeps its own record of which conversation it is in, in its own format, so the tool carries one small adapter per agent to find that record 11.
| Agent | How its conversation is found | Comes back as |
|---|---|---|
| Claude Code | Its registry of running sessions. Exact, and it follows /clear. | claude --resume |
| Codex CLI | The rollout file it keeps open. Exact. | codex resume -C |
| Gemini CLI | The newest session of the pane's project that started after the agent and that you typed in. | gemini --resume |
| opencode | The newest session in the agent's directory, updated after it started. | opencode -s |
| pi | The newest session file in the agent's directory, written after it started. | pi --session |
The table is the honest part. Two of the five lookups are exact, and three take the newest file in the right directory, which is a guess that usually lands 11.
What earns the tool its place is the rule about what comes back running. Editors and monitors restart on their own. Everything else — a deploy, a dev server — comes back typed on the prompt, waiting for Enter 9.
A restore is an execution. A tool that rebuilds your shell must decide which of yesterday's commands may fire again without you, and this one leaves all of them for you to press.
Two smaller versions of the same rule. The prompt the agent was started with never returns 11. When two panes run the same agent in the same directory, the adapter cannot tell them apart, so both come back as commands on the prompt.
Each adapter was verified with a real round trip on a throwaway tmux server, against pinned versions: Claude Code 2.1.316, Codex 0.134.0, Gemini CLI 0.66.0, opencode 1.18.32 and pi 0.55.0 11.
Try it. List the commands your agent's panes leave running, and mark the ones you would want to fire yourself.
4. A retry budget for tool calls
Waymark is a workflow engine that takes a different route from Temporal and Vercel's engine. Those two are replay-based: workflow code runs again from the top on every step, and completed work returns cached results 12. That design requires deterministic code, with no random numbers, no clock reads and no side effects in the workflow body.
Waymark compiles a workflow once. For Python the tool parses the syntax tree of the run method, lowers the control flow to an intermediate representation, then to bytecode for a durable virtual machine that a Rust runtime executes 12. The machine's state goes to Postgres as it runs, so a crashed workflow resumes from where the machine was, and the body you wrote never executes again 13.
The price is a smaller language. Network calls, randomness and anything else outside control flow have to move into an action, and the compiler rejects unsupported patterns when a workflow is registered 12. The author says that check has gaps: the documented known issues are Python patterns that compile and then behave differently than Python would 14.
It reached Hacker News on November 5 with 79 points and 29 comments 15. The repository dates from November 2025 and carries 2,080 commits, with 118 stars when this was written 13.
The project sits in early alpha, its spec can still change before 1.0, and the README says to keep it out of production for now.
The agent wrapper is where the gates are. A companion package runs a Pydantic AI agent as a Waymark workflow and saves progress at model and tool boundaries, so a worker restart resumes the run 16.
Then comes the sentence worth stealing. A worker can die after a tool call finished and before the call was recorded as finished, so tool calls run at least once 16. A model step is replay-safe and simply runs again. A tool call runs again up to its own retry budget.
From that follows a rule the wrapper states plainly: give a zero retry budget to any tool whose side effect must run only once 16. A charge, a send, a deploy — those are the calls you name before you let a durable engine retry them.
A detached subagent gets the same care from the other side: it restarts only when its start provably never ran 16.
One gate remains open. A tool that needs a person's approval currently stops the workflow with an error, and the documented way to wait for a human is a message mailbox that the README calls a polling workaround until native queues arrive 16.
Try it. Walk your tool list once and mark every call that must run only once. If that list is long, your runtime makes the decision for you by default.
What to try this week
- Write down who approves. For each side-effecting tool, name the thing that can say no, and check that the interface sending the work is a different one.
- Put the source on the card. When you hold an action, show the text the agent read that led to it, and say whether you are showing order or cause.
- Replay before you install. Run your rules against last month's transcripts; a filter that has never seen your real sessions has no evidence behind it.
- Give every tool a retry budget. Durable runtimes retry at least once, so mark the calls that must run only once instead of hoping.
- Leave the risky command unentered. When you rebuild a session or resume a crashed run, let the commands that touch the outside world wait for a keystroke.
The pattern
Set the four side by side and they form one axis with four positions. OpenMausBot decides per action, with a person. Stroq decides per action, with the text that produced it attached. tmux-restore decides after the crash, by refusing to act. Waymark decides before the first call, in the compile step and the retry budget.
Each builder put something outside the model that can say no, and each spent the effort on making the no legible: which rule, which text, which command, which call.
The test for your own system is how legible your own no is. Can the thing that stops the agent tell you what it is looking at?
This issue covers October 31 through November 7. Simon Willison's releases this week — datasette-agent 0.5a0, datasette-apps 0.3a0 and llm 0.37 — extend the approval design this channel covered in June 171819. Geoffrey Huntley has published nothing since October 20 20. The next issue arrives next Saturday.
References
- 1milind-soni/OpenMausBot
github.com
- 2
- 3Releases
github.com
- 4Ubuntu Desktop guide
github.com
- 5openmausbot-teams
github.com
- 6AGGIB/Stroq
github.com
- 7v0.30.0
github.com
- 8Show HN: Stroq
news.ycombinator.com
- 9andrewboldi/tmux-restore
github.com
- 10Show HN: Tmux-restore
news.ycombinator.com
- 11tmux-restore: agents
github.com
- 12Why Waymark
waymark.sh
- 13piercefreeman/waymark
github.com
- 14Control Flow
waymark.sh
- 15Show HN: Waymark
news.ycombinator.com
- 16piercefreeman/waymark-ai
github.com
- 17datasette-agent 0.5a0
simonwillison.net
- 18datasette-apps 0.3a0
simonwillison.net
- 19llm 0.37
simonwillison.net
- 20Geoffrey Huntley's feed
ghuntley.com
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.