OpenRig 0.7.11

OpenRig 0.7.11 is a patch for people running their own agent teams. An ordinary send or work notice now goes into a person's typed draft by default instead of being refused (see Behaviour that changed). A person can work with their team from their own Claude Code or Codex through the new openrig plugin, or from an ACP app such as Zed or T3 Code, and, as an experiment that's off by default, answer the team's questions from an assistant connected through a grant service. A prepared managed compaction waits for an idle moment instead of asking again, and a restore stopped at a prompt clears itself. On Linux, a daemon run as a systemd user service no longer takes its seats down when its unit stops or restarts, and writable terminal tiles reflow text when the screen resizes, as in 0.7.10. There are fixes across the queue, workflows, launch and speed under load, many contributed or reported by people using OpenRig. The OpenShell worker's maintained cleanup now works on OpenShell 0.1.6, but a restored guest takes in its startup content again, so the worker still isn't end to end.

The runtime results below were earned on earlier builds of 0.7.11 and carried to this final package, whose changes since them are in terminal tiles and host pairing. This final package itself got archive and content checks of those changes, a code review, the release Tests, and checks of host pairing: real Slack with a real operator agent (4 of 4 answer paths, one run), the real TUI without a model, and 29 of 29 contained cases with synthetic credentials. The tile changes were checked on an earlier 0.7.11 build with the same tile code: typing and pasting into a tile on tmux 3.4, 3.3a and 3.6, a check of text reflowing in a terminal, and one run in real Herdr 0.9.5 on tmux 3.4 (one run each), which passed. What we tested on the CLI and the new @openrig/acp launcher: the private and stock content checks and the release Tests; an upgrade from 0.7.10 with Claude (continuity, relaunch, and event retention with no loss of data you'd act on); the speed and memory baseline (8 of 8 measures unchanged); the OpenShell worker on OpenShell 0.1.6 (its maintained cleanup, an exact restore, and its reports and exports passed; strict recall after a restore wasn't met, and finishing its task was assisted and time-boxed); ACP on Claude through a headless ACP client; managed compaction under Claude Code's update banner (3 of 3); Slack on a real workspace, including a button answer and a message in flight across hosts; messaging between 0.6.11 and 0.7.11 in both directions; a Claude first user from the website to a finished result with no help; and the selected regression cells (13 of 15 and 19 of 19 passed, none failed). Testing found four regressions against 0.7.10, all fixed in this package (archive file modes; Pi seats with their own account home not starting; typing into a writable tile not reaching the agent on tmux older than 3.5; and a tile someone was only viewing not fitting or reflowing to the screen), a probable fifth that it also fixes (a multi-line paste into a terminal tile could arrive split), and two accepted changes, disclosed below (a draft-aware send under the update banner, under Known issues, and a Pi upgrade stop, under Before you upgrade). Otherwise no regression or data loss was demonstrated. Not run: a Codex first user reaching a finished result (for the third release), the Codex upgrade and journey checks, a Codex account home, the ACP desktop app, an agent reading pairing answers given in the TUI, Slack directory paging, whether a switched Pi account's selection persists, and the 0.7.10 comparison for the tile fix (#2757).

Before you upgrade

npm install -g @openrig/cli@0.7.11
rig daemon stop && rig daemon start

• Back up your database first. Five migrations run at the daemon's first start (150 to 154). With the daemon stopped, copy the file $OPENRIG_DB names. Going back to 0.7.10 after these migrations isn't established.
• The openrig-core plugin moves from 0.1.26 to 0.1.27. Its activity relay and refocus hooks and three skills changed. The CHANGELOG says replaced files are kept under $OPENRIG_HOME/backups/managed-refresh/<id>/ for reapplying local edits; this release's checks didn't test that route. (#2756)
• Sends now join a person's draft (transport.draft_delivery = deliver). To keep the old refusal, run rig config set transport.draft_delivery refuse. (#2645)
• A Pi seat that declares an absolute PI_CODING_AGENT_DIR in its env: now uses it as its account home and needs a readable auth.json there, or the launch stops. A Pi seat that already has its own Pi login also stops at launch when its spec declares an absolute PI_CODING_AGENT_DIR, even if that folder has an auth.json; the seat's login is kept, and the error names a missing account file rather than the existing login. This is shown by source and function-level tests, not a native run. (#2630)
• Linux, with the daemon run as a systemd user service: the seats move into their own scope only when their tmux server next starts fresh. Until then, stopping or restarting the daemon's unit still takes the seats down. (#2749)

What's new and fixed

Sends and drafts.

• Under the default deliver, an ordinary send or work notice to a seat whose prompt holds a person's typed draft pastes the message at the cursor and submits the combined input, and the result says whether submission was confirmed. Menus, permission prompts, the typing guard, managed compaction and --wait-for-idle still refuse or wait. (#2645)
• A draft only the input box shows is caught by one read before pasting. (#2653)
• Claude seats showing a statusLine or the background task panel read as a normal composer under the draft-aware guard. (#2703)
• A full held-message quota no longer drops a sender's later messages, and seats stopped while they owe work don't get a burst of undeliverable notices at each daemon start. (#2701, #2620)

Compaction, restore and handover.

• A prepared managed compaction is held as prepared and sends /compact at the next idle moment instead of asking the seat to prepare again. rig compact --state shows it and --cancel disarms it. (#2698, #2716)
• The final /compact allows for the preparation's own fresh activity (23 seconds, against 9), so a seat that's already idle gets /compact instead of a refusal. (#2764)
• A restore stopped at a prompt, such as Claude's resume selection, clears itself once the seat runs the conversation it was restoring. (#2711, #2674)
• A work notice refused at a prompt no longer goes in right after "Compacted" while the compaction still owes its restore request. (#2666)
• A Codex helper inside a Claude seat no longer becomes the seat's resume token; a Claude rebuild handover checks its priming packet; restoring activity hooks finds the agent's own source. (#2740, #2650, #2617)
• on_restore: follow_source on a skill refreshes it from its source when a seat is restored; keep_saved stays the default. (#2626)

Your own coding agent and ACP apps.

• The openrig plugin, shipped beside openrig-core, lets a person hand work to their local team from their own Claude Code or Codex, follow it, answer the team's questions and read the result. The plugin's README has the steps. VS Code, Copilot CLI and Cursor install it with no seat. Answers are recorded exactly as typed. (#2647, #2683, #2709, #2718, #2657, #2733, #2719)
• rig acp serve --to <member@rig> runs OpenRig as an agent in ACP apps such as Zed and T3 Code: a prompt becomes a queue task, each task the work reaches shows as a step, the closing resolution is the reply, and the team's questions reach the app while a turn is open. (#2648, #2714, #2651, #2708, #2686, #2712)
• The @openrig/acp launcher runs the matching @openrig/cli's rig acp serve for the ACP registry's npx launch, released at the same version. (#2655, #2715)

People and connected assistants (experimental, unsupported, off by default).

• Assistants connected through a grant service can list and answer the team's questions as a registered person, and --task-destination names the receiver for new tasks. (#2735, #2638, #2750)
• The relay gateway connector sends questions, updates and notices to an operator-owned bridge over loopback HTTP and takes replies back. The bridge is yours. (#2624)
• The web UI's For You feed answers a local ask's questions on its card. (#2612)

Queue, workflows and status.

• One backlog notice replaces a finding per task for a seat that reads without claiming; claims read working while a Claude owner has a live background shell or a managed restore is owed. (#2752, #2675)
• rig queue show, list, transitions, update and block take --host <id>; cross-host handoffs that override a claim notify the claimer. (#2678, #2734, #2621)
• An openrig.code-result/v1 manifest gives rig queue artifact the commit pair to diff. (#2659)
• Workflows keep their own spec and root objective, rig workflow unregister removes versions, and trace --full returns the whole trail. (#2696, #2738, #2676, #2667)
• A helper harness inside a seat no longer reports its turns as the seat's; refocus traces projects outside workspace.root. (#2743, #2664, #2717, #2619, #2207)

Launch, install and setup.

• On Linux, a daemon run as a systemd user service starts the seats' tmux server in its own user scope, so stopping or restarting the daemon's unit no longer ends the seats. A daemon started from a login session starts the server as before. (#2749)
• A Claude seat launched with --settings JSON written with spaces can be verified again, and a Claude launcher script that execs the native installer's symlink becomes ready, with --no-chrome recognised; in our test, 0.7.10 also became ready under the same chain, so this isn't a demonstrated fix. (#2665, #2751)
• launch_wrapper works for local Claude Code, Pi and Codex seats, and a wrapped seat never starts unwrapped. (#2746, #2609)
• rig provider switch --seat <pi seat> --to-account <name> --account-home <dir> --reason "<why>" moves a Pi seat to another account through a confirmed successor (--dry-run shows the plan); in our native run the successor started but the switch wasn't completed, so a completed switch is untested. A Pi seat whose spec declares its account home starts and resumes again. (#2630, #2782)
• Claude seats that load openrig-core themselves stop loading its skills twice. (#2660)
• Also: rig attach --self outside tmux, rig host pair --timeout, rig config set naming a masking variable, daemon start and stop treating a blocked probe as unknown. (#2640, #2641, #2692, #2547, #2502, #2643)

Host pairing.

• Denying or dropping a host pairing request in Steering now gives the requesting machine no access. The problem, that action returning the daemon access token, was found in the 0.7.9 and 0.7.10 source and reproduced with synthetic credentials on an earlier 0.7.11 build. (#2884)
• Answers to a pairing request now reach the target's kernel operator. When the target has an operator that can receive them, typed words and Approve or Deny choices in the TUI, Steering or Slack go to that agent as replies, and receiving one neither grants nor denies access. The operator acts on clear intent with rig host approve <code> or rig host deny <code> and asks back when the answer is unclear. Both commands also work from a plain terminal on the target, using its operator bearer (OPENRIG_AUTH_BEARER_TOKEN, or --bearer <token>). An Approve click on a request the operator owns waits for the operator to act; a stopped operator keeps the request, and the answer waits in its queue. (#2900)
• With no operator, one that can't receive answers, or one OpenRig can't determine, the request says so: Approve and Deny decide directly, and a typed reply gets another ask instead of a denial (the no-operator case was checked; the other two come from the source). (#2900)
• TUI answers use the daemon's operator bearer when one is configured; a missing or wrong one leaves the answer unrecorded and says what to set. Ordinary terminal calls keep their own credential. (#2900)
• Checked on this package: real Slack with a real operator agent in one run (a button or a typed yes approved, a no denied, and a qualified reply got a clarifying question before the refusal denied it); the real TUI without a model (answer credentials, typed answers asked again with no operator, plain-terminal approve and deny, and expiry); and 29 of 29 contained cases with synthetic credentials. Not run: an agent reading answers given in the TUI, Slack thread replies beyond the tested path, and Steering in a browser.

Terminals and views.

• Writable tiles reflow with the screen: they attach as in 0.7.10, so the screen in use sizes the seat and text reflows on resize, and once attached tmux handles typing and paste directly. Read-only tiles keep showing the seat without attaching, typing into it or resizing it. Fixed web geometry is opt-in (terminal.fixed_geometry, off by default); that browser option wasn't exercised in our checks. Checked in one run in real Herdr 0.9.5 on tmux 3.4 (reflow while viewing, typing and paste once attached, and a tmux window fixed by hand at 80x24), with typing and paste also checked on tmux 3.4, 3.3a and 3.6; phone-size screens and tmux 3.3a weren't run in Herdr. (#2868, #2757)
• Herdr follow views work on macOS too (protocol 22). (#2663, #2706)
• Closing the herdr-core terminal that started OpenRig no longer ends the daemon or its seats. After merging, @w4rc0n ran a real close with herdr-app 0.1.13 in an isolated Linux sandbox: without the change the daemon, tmux server and seat ended, and with it they kept running. That sandbox had no systemd --user, so herdr-core's service-unit path wasn't run, and a tmux server started inside the terminal before the daemon still ends with it. (#2737)
• Terminal snapshots keep colours, a reattach during a broker teardown works, and rig doctor says why tmux control mode is off. (#2654, #2671, #2633, #2707)

Speed under load.

• The stuck sweep batches its reads: on a copy of a busy 340 MB database, a pass went from about 11 s to about 5 s and the longest stall from about 10 s to 0.57 s. (#2649)
• view.changed events are no longer stored, and opt-in retention.events_days prunes eight history-only event types. (#2695, #2699)
• The web UI loads the newest 100 events; daemon.seat_poll_interval_ms trades activity freshness for daemon CPU. (#2704, #2688, #2636, #2690, #2713)

Docs and tests. Daemon HTTP clients and bearer tokens (#2652), the 0.7.10 capability map (#2736), a neutral TUI demo snapshot (#2724), a web UI editor timer (#2689), and test and CI fixes (#2753, #2681, #2685, #2673, #2628).

Behaviour that changed

• Sends and work notices that were refused with prompt_draft now go through by default, joined to the person's draft. rig config set transport.draft_delivery refuse restores the refusal from the next send, and under refuse a draft only the input box shows now refuses too. (#2645, #2653)
• A Pi seat with an absolute PI_CODING_AGENT_DIR uses it as its account home; no auth.json, no launch. (#2630)
• /api/events no longer emits view.changed. (#2695)
• The stuck sweep files one backlog notice where it filed one per task. (#2752)
• A prepared managed compaction stays waiting, and a manual rig compact over it reads already_in_progress. (#2698, #2716)
• The daemon and seats no longer inherit HC_SCOPE, HC_TERMINAL_ID or HC_TERMINAL_SOCKET. (#2737)
• Read-only terminal tiles show the seat without attaching; writable tiles attach as in 0.7.10, and detaching ends that viewer while the agent keeps running. (#2757, #2868)
• On a target with a kernel operator that can receive answers, an answer to a host pairing request no longer decides it: the operator decides with rig host approve <code> or rig host deny <code>. (#2900)
• MCP, ACP and CLI details changed; see CHANGELOG.md.

Known issues

• Draft-aware send under Claude Code's update banner: with the draft-aware typing guard, a send to a seat showing the bare ✔ Update installed banner can paste the message and not press Enter, leaving it typed but unsent. Look at the input box before sending again. A fix is on main (#2786) and isn't in 0.7.11. Managed compaction under the same banner sent /compact 3 of 3 times in our test.
• Unsent compaction preparation: Managed compaction can repeatedly leave its preparation unsent when it cannot read a seat's input box. Inspect the seat; rig compact <seat> --skip-map is the supported manual recovery route, subject to its normal idle and delivery checks; this route was not exercised by the 0.7.11 release checks.
• A post-compaction step can still hold when the box reads as typed, under draft-aware delivery or the typing guard, or after a lost /compact. Run rig compact <seat> --cancel, then send a restore request naming the newest restore map, marker and packet. A work notice refused at a prompt now waits for that step, but notices at daemon start and on a new handoff don't check for it yet. (#2575, #2666)
• OpenShell: on OpenShell 0.1.6 the maintained cleanup (delete-owned) now works for a custom image, and recreate and an exact resume passed in our native run. A restored guest takes in its startup content again, so strict recall after a restore isn't met. In our run, finishing the guest's task was assisted and time-boxed, so whether it finishes unassisted is unknown. Never give the guest the daemon's main API port (normally 7433), and after a same-generation reconciled launch, run rig environment connect yourself. (#2755)
• First users: in one of our three Claude first-user runs, the agent set up the starter team with a Codex reviewer without offering a choice, and a person with only Claude then reached a Codex sign-in. It depends on the agent's choice.
• rig down can start a duplicate claude --resume for a moment. It's pre-existing and the same on 0.7.10, and we saw no conversation write from it.
• Herdr follow views: closing a tile when an agent leaves still isn't confirmed, as in 0.7.10.
• Drafts: detection isn't complete. Under refuse, an unreadable input box lets the send go ahead, so an undetected draft goes with the message; under deliver, a result may not mention a draft it joined. (#2645, #2653)
• Draft-aware delivery to Claude: a message held as draft_input_unknown still isn't retried. (#2605)
• Claude provider switch: the last report on #2341, on 0.7.9, fails before any probe pane with "The seat's agent spec (queue.worker) wasn't found where its last launch read it." Its cause isn't established, and 0.7.11 isn't shown to fix it.
• Pi seats with their own Pi login can stop at launch after upgrading; see Before you upgrade.
• Host pairing with no operator agent: on a target with no kernel operator that can receive answers, no agent reads a typed answer; it gets another ask, and Approve or Deny decides. An attachment-only reply, or the literal [file reply], keeps no words there and doesn't deny (from the source; not run). (#2900)
• Host pairing requests live in the daemon's memory, so a daemon restart drops an open request. Receipts, repeat asks and outcomes from clicks reach the requesting machine only while it keeps polling; an explicit rig host approve or rig host deny sends its outcome directly. A request that expires unanswered gets no further update. This comes from the source; no restart case was run. (#2900)
• Host pairing on older targets: the change is on the machine being paired with, so targets running 0.7.9 or 0.7.10 still treat a typed reply as approval. (#2900)
• Pi account homes: launch and resume passed in our native run. An account switch didn't complete in that run (the successor started and answered, the test model never confirmed, and the original seat stayed intact), so a completed switch and whether its selection persists are untested. The fix's env -u ordering is tested in macOS CI; for GNU and BusyBox it rests on their documented behaviour, because the Linux CI job doesn't exercise that branch. (#2782)
• Early writable-tile input: as in 0.7.10, Enter or Ctrl-C typed while a new tile is still attaching can close that viewer. The agent keeps running; reopen the view. This case wasn't exercised in our checks. (#2868)
• Tiles kept from 0.7.8, 0.7.9 or an earlier 0.7.11 build keep their old client. To refresh one, close only its viewer and reopen the view with rig terminal open; for a --follow view, use --no-follow first, then open a fresh view. The agent and its conversation aren't touched. In our run, kept 0.7.8 and 0.7.9 views kept their process, session and history through the upgrade and the refresh, but they already reflowed before it, so this isn't shown to repair a frozen viewer, and the follow-view upgrade didn't confirm, so it isn't qualified. (#2868)
• Pi and OMP input order: On Node 22.21.0–22.22.0, 24.9.0–24.11.1 or 25.0.0–25.1.0, cursor-edited text in a Pi or OMP seat can be submitted in the wrong order when keys arrive together, potentially changing its meaning. This also affects 0.7.10. Node fixes are available in 22.22.1, 24.12.0 and 25.2.0, respectively: our input-reader reproduction passed on 22.22.1; the Node 24 and 25 affected ranges and fixes were checked at source, not runtime-tested by us. Real-terminal frequency has not been measured. See #2834.
• Claude account homes: our checks couldn't verify whether a Claude seat's own account home takes effect, so these notes make no claim about it.
• keep_saved skills: a skill whose source changes between rig down and the restore comes back missing, named in the restore's warnings; an edited seat copy is kept. (#2626)
• Read-only terminal tiles each run one tmux command a second while showing: 8 tiles used about 6–8% of one core on an Apple Silicon Mac mini, against about 0.2% for 0.7.10's attached tiles. Writable tiles don't poll. (#2757)
• rig exec: checked with Claude Code and Codex through their ACP adapters. A cancel is acknowledged, not settled, and says nothing about further spend. Cancel with rig exec cancel, not rig acp cancel.
• ACP apps: checked in T3 Code (Beta) 0.1.7 on a pre-release build and with a scripted client. The 0.7.11 release checks ran ACP on Claude through acpx 0.15.1, a headless client, not in a desktop app, and the unanswered-question notice hasn't run in a live app. A cancel stops waiting; the work carries on. (#2648, #2686, #2712)
• The openrig plugin hasn't run in Claude Desktop, the Codex app or Copilot CLI. A seatless app can't claim, update, hand off or answer questions, and everyone using the app on a machine acts as its seat. (#2647, #2657, #2683)
• Grant-service assistants still aren't notified: a task stays queued until its receiver claims it. Relay: "Accepted by bridge" means the bridge has it, not the person, and a failed send replays only at a restart. (#2735, #2624)
• Event retention can't be undone, and the database file doesn't shrink. (#2699)
• Claude launch_wrapper hasn't run with zsh, on macOS arm64 or with a real installed Claude, and an alias or shell function named claude stops the launch. (#2746)
• Going back to 0.7.10: besides the migrations, an older permission hook gives named-policy Claude sessions no decision until relaunched. (#2640)
• Codex hooks: a session kept running across an upgrade can show "Hook failed — plugin contents changed; hook approval required" until relaunched, and 0.7.11 changes openrig-core again. rig seat restart --keep-conversation refuses a Codex seat launched with developer instructions (settings_drift), and one started by a 0.6.x tmux-send script (#2200).
• Codex hook setup: with smol-toml 1.9.x and an existing hooks.json, OpenRig can leave its activity hooks and trust records unchanged. The range (^1.8.0) still permits 1.9.x; the repository lockfile uses 1.8.0. Not fixed in 0.7.11; a fix is on main (#2804) and isn't in this release. (#2720)
• A Codex snapshot restore writes OpenRig's guidance blocks into a tracked AGENTS.md. Check git status before committing.
• A scheduled reminder whose delivery fails before input isn't retried; the next occurrence still arrives. (#2478 covers a reminder that never reached its seat; this case remains.)
• Claude Code 2.1.319 starts in auto mode by default, so a new Claude seat may act without asking; manual mode restores asking.
• Also: permission requests in seat status show only the latest, in memory for five minutes, and suggested rules can contain sensitive values; Slack private channels need the documented, untested route, direct messages aren't supported and directory reads haven't run live; SSH host status reads unknown behind ProxyJump or ProxyCommand; advisories don't show on a native resume; seats handed over before 0.7.9 refuse stop, restart and clean; after a project-local install, plain rig isn't found in the TUI's own shell; with Claude Code 2.1.319, rig up can wrongly say "Startup prompt still staged … press Enter"; two npm installs into one folder at once once left a partial install, cause unknown.

Docs that are out of date in this package (fixed on main):

• docs/reference/seat-delivery.md says drafts are protected without naming the setting. Under the default, transport.draft_delivery: deliver, an ordinary send that meets a person's draft is joined to it and submitted, unless the seat's typing guard holds input (draft-aware, openrig-urgent, urgent-only or hold).
• --binding on rig gateway human add is optional, though the CLI reference marks it required.
• The hosted-members register example needs --delivery-class (for example --delivery-class B).

The full list of limits, including those carried from earlier releases, is in CHANGELOG.md. Its 0.7.11 section was written before testing finished, so where it and these notes differ, these notes have the tested result. In particular: it says a real close of a herdr-core terminal wasn't exercised, but @w4rc0n ran one (#2737, above); it quotes an earlier error for the Claude provider switch (#2341); it lists the bare update banner (#2662) as fixed, which holds for managed compaction but not for a draft-aware send (above); it says managed compaction under that banner wasn't retested, but it was, 3 of 3.

Credits

Thanks to @billbenetti, @seanmcn, @smota, @Aummadour, @dajiaohuang, @w4rc0n, @Mohsintl, @twotnguyen, @ziadeh and @Nikhi00718 for merged contributions, and to @w4rc0n for running the real terminal close behind #2737. Thanks to @billbenetti for the reports behind #2752, #2660, #2738, #2749, #2666 and #2665; to @pr0xc3nt4ur1 for the report behind #2740 and #2743; to @oneandonlydean for the process chain behind #2751; to @niklasbaldi for the reports and causes behind #2654 and #2671; to @vadym-abstract-factory for the report behind #2717; to @w4rc0n for the fix and root cause in #2821; to @ziadeh for the reports behind #2622 and #2486; and to @mlc-factory-bot for the reports behind #2605 and #2607.