Session restore relaunches agents without their original flags, environment, and pane cwd

[kunchenguid]

Is this a reproducible bug?

• I confirm this is a reproducible bug, not a feature request, idea, question, contribution proposal, or direction check.

Current behavior

After herdr server stop and relaunching the same named session, the layout restores great - workspaces, tabs, panes, ids, labels all intact, and each pane's agent relaunches with its session id. But the relaunch drops everything else about how the agent was originally started:

• command-line flags are gone: panes I launched as claude --dangerously-skip-permissions came back as plain resumed claude, silently downgraded to per-command approval prompts (the missing "bypass permissions on" footer line is the tell)
• environment is gone: CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false set at launch was not present after restore
• the pane restarts at the TAB's creation cwd, not the directory the pane was actually working in

I hit this across multiple server restarts in one afternoon running a fleet of agent panes. Every pane needed manual repair: interrupt, exit, relaunch with the right cwd + flags + --resume <id>.

Expected behavior

A restored pane relaunches its agent with the same argv, environment, and per-pane working directory it had before the stop. The session-id resume part already works - it's the launch context around it that gets lost.

Reproduction

1. herdr, create a tab in directory A
2. in the pane: cd /some/other/dir-B, then FOO=bar claude --dangerously-skip-permissions
3. herdr server stop, relaunch herdr, let the session restore
4. the pane is back and claude resumes with context, but: no --dangerously-skip-permissions (default permission mode in the footer), FOO unset, cwd is A instead of dir-B

Impact

Unattended agent fleets silently lose autonomy on every server restart - each agent freezes at its first tool-approval prompt until a human fixes the pane by hand. Bit me twice in one afternoon before I worked out the repair routine.

Environment

• Herdr version: 0.7.1
• Update channel (stable or preview): stable
• Operating system: macOS 26.5.1 (Apple Silicon, M4 Pro Mac mini)
• Terminal: WezTerm
• Shell, if relevant: zsh
• Relevant config, if any: config.toml managed via nix/home-manager; update_check = false, manifest_check = false

[ogulcancelik]

thanks for the report. i’m going to close this as a feature request rather than a bug.

agent restore currently means: restore the pane, then run the supported agent’s resume command with the saved session id, e.g. claude --resume <id>. it does not mean replaying the original process launch.

that boundary is intentional. the current path is safe and robust because herdr does not parse shell history, last commands, or process invocations. preserving flags, inline env, and exact launch context would require process/pane launch tracking or a shim, which is a separate feature with different tradeoffs and a much larger scope.

for now, put persistent agent behavior in the agent’s own settings where possible, e.g. claude permission settings instead of one-off cli flags.

feel free to open a discussion for this as a feature idea.

[rjyo]

Following up on #965 — closed as needing "process/pane launch tracking or a shim." I think there's a much smaller version of this that avoids launch tracking entirely, scoped to the one piece that actually breaks unattended fleets: the permission/approval mode.

The key point: the dangerous-mode signal is already persisted in the agent's own session file — the same file herdr reads to resume. So herdr doesn't need to know how the process was originally launched; it can derive the correct resume flag from the session it's already resuming from.

Codex (rollout JSONL) records the effective policy per turn:

{ "type": "turn_context",
  "payload": {
    "approval_policy": "never",
    "sandbox_policy": { "type": "danger-full-access" } } }

approval_policy == "never" + sandbox_policy.type == "danger-full-access" is the --yolo signal. A normal restricted session instead looks like "approval_policy": "on-request" / "sandbox_policy": { "type": "workspace-write", "network_access": false }.

Claude Code (session JSONL) records the mode directly:

{ "type": "permission-mode", "permissionMode": "bypassPermissions", "sessionId": "..." }

(user rows also carry "permissionMode": "bypassPermissions".) So permissionMode == "bypassPermissions" is the skip-permissions signal.

Proposed scope — on restore, after resolving the session id, read the last known mode from that session file and map it to the resume argv:

• Codex: never + danger-full-access → add --yolo (else resume plain)
• Claude: bypassPermissions → add --dangerously-skip-permissions (else resume plain)

This is deliberately not the broad request from #965. No argv replay, no env reconstruction, no per-pane cwd tracking — just reading a field that's already in the file herdr opens to resume. It targets the specific failure that makes restore unsafe for autonomous fleets: every agent silently downgrades to per-command approval prompts on server restart/update and freezes at its first tool call until a human repairs the pane.

The "put it in agent settings" workaround doesn't fully cover this — these flags are intentionally one-off/per-invocation (there's no persistent config equivalent for Codex --yolo), and that's exactly the case herdr's session restore drops.

[ogulcancelik]

moved to discussion since it's a shape of feature req now but i'll test @rjyo's idea soon.

[kodama24ek]

Another concrete case of this: Claude profiles via CLAUDE_CONFIG_DIR. A pane launched with CLAUDE_CONFIG_DIR=~/.claude-work claude restores as plain claude --resume <id>, which searches the default ~/.claude and fails with "No conversation found" (#1269 reported this and was closed as expected behavior).

The workaround suggested there (set the var from shell rc or a directory-aware env tool) doesn't cover setups where the profile isn't derivable from the cwd.

This case fits the "derive it from what herdr already reads" approach discussed above: the claude integration hook already reports the transcript's full path as agent_session_path in pane.report_agent_session, and that path starts with the owning config dir (<config-dir>/projects/<project>/<session-id>.jsonl). If that path were persisted alongside the session id, restore could run CLAUDE_CONFIG_DIR=<derived-dir> claude --resume <id> for non-default profiles — no launch tracking or shim needed, and default-profile behavior stays unchanged.

[jkraemer]

Adding an adjacent case that I think matters for how this gets designed: agents launched through a sandbox wrapper.

I run Claude Code with --dangerously-skip-permissions via a bubblewrap wrapper that confines it to one workspace, and use HERDR_AGENT=claude (from #679) so Herdr can still detect it behind bwrap. That part works well. But on restore, Herdr relaunches the pane as:

claude --resume <session-id>

So I am currently losing bwrap as well as the --dangerously-skip-permissions flag. Were this flag restored from the session file as suggested above, the outcome would be worse: I would have Claude in YOLO mode, but without the wrapper that confines it to the intended workspace.

The pane record Herdr persists is just cwd plus agent_session (source/agent/kind/value), so there is nothing to replay and no wrapper-side fix available (that is with Herdr 0.7.5 on Linux).

Of course one could entirely deactivate session restore (which I am doing currently), but that's inconvenient since it hits all agents and sessions, not those launched via a wrapper. A minimal suggestion would therefore be for automatic restore to be skipped if HERDR_AGENT was set on the foreground process.

Ideally, there would be a way to specify not only the manifest via HERDR_AGENT, but also an explicit restore command line via another env variable: HERDR_RESUME_COMMAND="claude-sandboxed --resume {session_id}", used verbatim in place of the synthesised canonical command.

[davifernan]

I’m hitting the same restore gap, specifically for per-invocation agent flags. I don’t need Herdr to reconstruct the original argv, environment, cwd, or wrapper.

Would you be open to a smaller opt-in config surface that appends literal argv items to Herdr’s canonical resume command, for example:

[session.agent_resume_args]
claude = ["--dangerously-skip-permissions"]
codex = ["--yolo"]

It would be empty by default and scoped per agent. Alternatively, would you prefer the explicit resume-command override suggested above? I’m willing to implement the shape you prefer after approval.