OpenRig 0.7.8

OpenRig 0.7.8

OpenRig 0.7.8 lets a person answer a runner seat's permission requests, with a
conformance check and an example runner to build against. It includes 0.7.7's
fixes plus repairs across seats, tmux, Slack and the TUI. It also includes a
reference for running a Claude worker in an NVIDIA OpenShell sandbox, but that
worker isn't usable in this release: see the OpenShell reference.

Before you upgrade

• Restart the daemon after installing:

  npm install -g @openrig/cli@0.7.8
  rig daemon stop && rig daemon start

  Four migrations (142 to 145) store a Claude seat's MCP opt-out, seat activity
  grants, OpenShell environment bindings and the person chosen to answer a
  seat's permission requests.
  (#2177, #2295, #2296, #2301)
• The bundled openrig-core plugin advances from 0.1.23 to 0.1.24. One line
  of its seat-continuity skill changed. Managed refresh preserves replaced files
  under $OPENRIG_HOME/backups/managed-refresh/<id>/; reapply local edits you
  still need from that copy. (#2287)
• The install is larger: in the 5 November clean-install check, 0.7.8
  resolves to 118 npm packages (including OpenRig itself), against 0.7.6's 32.
  The MCP SDK is now a runtime dependency.
  (#2374)

Permissions for runner seats

• A runner seat's permission requests now reach a person, and the default is
  permit. The runner contract's first version refused every request. Section 7
  of docs/reference/harness-runner-contract.md now covers who is asked:

  • With a default person, "They get an ordinary ask in the Feed and on
    Slack. No setup is needed."
  • To choose someone else, run
    rig seat set-permissions-to <seat> --to <person> --reason "…". --clear
    returns to the default.
  • When no one can be asked, the request is "Permitted at once, with the
    agent's own allow option."
  • Refusal is opt-in, with --deny.

  "A person's no is never a grant." An unanswered request "stays pending and
  visible" until the agent's turn ends: "It's never timed out into a grant."
  (#2301)

• A runner conformance check:
  node docs/reference/runner-conformance/check-runner.mjs --runner '<runner command with {agent}>' --name <harness>.
  It covers the answered path, and needs Node and tmux but no daemon, model,
  credentials or network.
  (#2303, #2306)

• An example runner for DeepSeek Harness (dsh), with its preset, is under
  docs/reference/community-harness-examples/dsh/. OpenRig doesn't install it.
  (#2305)

• A seat activity grant lets a runner outside the host's hook setup report
  activity for one seat and launch, without the install-wide hook token. (#2295)

The OpenShell reference isn't usable in 0.7.8

0.7.8 includes rig environment (setup, create, attach) and a reference
for binding a seat to an NVIDIA OpenShell sandbox (daemon/assets/openshell/README.md).
In our release testing the worker never became usable: after the sandbox was
created and the native process started, rig environment connect failed when its
check timed out after 5 seconds, so no team work ran. Don't rely on this path in
0.7.8. The packaged CHANGELOG and What's new describe it as working; this
release body replaces them on that point.
(#2296, #2300, #2378)

Seats, delivery and the TUI

• Seats:
  • an isolated tmux server per OpenRig home
    (rig config set terminal.tmux_server isolated);
  • claude_mcp: none for a Claude member;
  • resuming with a new token file;
  • first starts on rig launch --seats;
  • an accurate account record and kept effort after rig provider switch;
  • skill copies, activity hooks and startup declarations kept across
    rig down, resumes and exports;
  • clearer stops for handover's fork:<seat>, a missing conversation,
    claude not found, Codex restart refusals and failed unpins.
    (#1260, #2177, #2269, #2342, #2344, #2337, #2338, #2190, #2297, #2287, #2255, #2282, #2330, #2332)
• tmux:
  • with OPENRIG_TMUX_CONTROL=1, no crash on tmux 3.3a to 3.7c when the
    control client ends while another leaves;
  • a submit key that a read-only client blocks is pasted instead.
    (#2317, #2325, #2345)
• Wakes:
  • OPENRIG_WAKE_SUSPEND matches destinations with a colon;
  • prompt escalations stay deliverable without a reachable person;
  • reminders stop at a full quota;
  • human@kernel raises no false finding;
  • OpenRig's own Codex hooks are trusted when no choice is recorded;
  • refusals name their fix.
    (#2353, #2343, #2281, #2286, #2294, #2290, #2284, #2280, #2273, #2202)
• Slack and usage:
  • typed replies to parked decisions are recorded as answers;
  • row bodies render Markdown;
  • resolved decisions stop showing as live asks;
  • OpenRouter charge retries aren't delayed.
    (#2293, #2299, #2316, #2349, #2314)
• Hosts and setup:
  • rig host edit and rig host remove;
  • a warning when another OS user's daemon holds the port;
  • rig daemon status shows a pending start.
    (#2310, #2346, #2302, #2348)
• The TUI and views:
  • agent pages show health and recent work;
  • pod, spec and instance-table views read correctly;
  • rig terminal open mission:<id> --follow --provider herdr follows a
    mission.
    (#2263, #2264, #2265, #2266, #2327, #2260, #2289)
• Also:
  • MCP text is cut between whole characters;
  • an ACP cancel survives a failed note;
  • long transcript lines read faster;
  • there are Pi and kernel dashboard recovery guides.
    (#2268, #2262, #2274, #2186, #2275)

Behaviour that changed

• A runner following section 7 gets answers or permits, not refusals.
  --deny keeps a seat refusing.
• On tmux older than 3.7c, OPENRIG_TMUX_CONTROL=1 uses spawned clients
  instead of a control client.

Known limits

Runner seats

• What we ran end to end: Our Linux release tests exercised dsh-seat 0.3.0 with dsh 0.2.1-rc.2: useful work, a person's allow and deny through the answered path, and cancel. The same dsh-seat session resumed after a managed down/up. The shipped #2305 preset declares no resume; a fresh launch is a new conversation. We did not test another harness end to end under this contract for this release.
• The dsh example's OPENRIG_DSH and OPENRIG_DSH_HOME aren't accepted in a
  rig spec's env:. A preset command wrapper that exports them was the route we
  observed. (Fixed on main, #2414; not in 0.7.8.)
• Cancel a dsh turn by typing a bare /abort in the pane. A /abort sent
  with rig send is an ordinary prompt.
• An in-place keep-conversation restart is Codex-only.
• The answer owner is a registered person. "A colleague's answer is
  followed on this host. If the ask is handed to another host, the request
  waits, shown as needs input, until the agent's turn ends."
• allow_always from a permit: with no one to ask, "If the agent offers
  only allow_always, the harness then remembers a permission nobody chose."
• "Permits and answers aren't recorded beyond the runner's pane and the ask
  itself."
• Coming as follow-ups: recording a permit made when no one can be asked,
  and passing a person's typed words that aren't a plain yes or no to the agent.
• The dsh example keeps one hold per seat: "if dsh asks twice in one turn,
  settling one ask releases the hold while the other may still wait on a
  person."
• The conformance check can falsely fail a correct runner on a busy machine
  (case 4b's pending count). Fixed on main; not in 0.7.8.

OpenShell

• The worker isn't usable (above). The reference also requires NVIDIA
  OpenShell 0.1.6, a Linux image, and an API-backed provider using
  ANTHROPIC_API_KEY; subscription or OAuth credentials aren't supported.
  "Provider registration and image construction can incur costs."
• The OpenShell README example uses operator@kernel; the actual kernel
  operator is operator-agent@kernel.
• "Never grant the guest access to the daemon's main API port (normally
  7433)." The guest-only listener is what confines a guest's reach. Its grant
  only authorizes requests for its own seat and launch.
• When the viewer's command exits, OpenRig can type the seat's startup text
  into the host shell, and a line of it can run there as a command. In our
  test, rig whoami --json ran on the host. The missing check is the same in
  0.7.6; environments are a new way to trigger it.
• Cleanup: delete-owned didn't confirm its delete in our test, and the
  vendor's own delete cleaned up. A delete still finds the sandbox by name after
  reading its ID, so a deliberate name replacement in that gap is an open race.

Typing and delivery

• With the typing guard off (the default for agent seats), an ordinary send
  submits whatever is in the input box, including a person's unsent draft.
  rig seat set-typing-guard <seat> --mode draft-aware protects an unsent draft.

Codex seats

• The alert for a kernel Codex seat stopped at hook review doesn't fire.
  #2290 added it, but a managed
  Codex pane runs under a shell, so the check never matches and nobody is told.
  The review itself still shows in the pane.
• After an upgrade, Codex seats that kept running show "Hook failed — plugin
  contents changed; hook approval required" and lose refocus until relaunched.
• With Node installed outside the login PATH (seen with an /opt tarball), a
  kernel Codex seat can report rig: command not found. In our first-user test,
  asking the agent to fix PATH recovered it.

Claude seats

• For a Claude installed at a custom path not named claude, a provider
  switch can't read the running effort (it uses the authored effort, and says
  so), and rig down may briefly run a resume probe.
• On macOS, after a daemon restart, rig seat continue can refuse a healthy
  auto-mode Claude seat with attention_required. Ordinary sends still work.
• A rebuild still waits when the running Claude's command is a symlink to the
  launched binary (the case reported in #2341). The repair is on main; not in
  0.7.8.

Handover and Slack

• The rebuild-handover receipt reports provenanceRecordWritten and
  departingSessionKilled as false even when both happened, so don't re-run a
  handover on those two fields alone. (Fixed on main, #2420.)
• A button click on an ask its owner re-parked is answered "Already
  answered", and resumes the owner with the earlier answer without a wake; a
  typed reply records a new answer. (Fixed on main, #2421.)

The packaged notes

• The packaged CHANGELOG and What's new still say 0.7.7 isn't published. It
  was published on November 2. They also describe the OpenShell reference as
  working (above), and the capability map says a typed reply to a question parked
  on its own person isn't recorded as the answer, which 0.7.8 now does (#2293).

• The 0.7.7 and 0.7.6 known limits still apply.

Credits

Thanks to @Aschenbath, @dajiaohuang, @Vaishnavi220506, @Nikhila-Dhevi-R,
@Nikhi00718, @oodadoudou, @DeryFerd, @ch-davidriott, @vanducng, @Ethereal49,
@AdityaxDeore and @Mydudeclaps for merged contributions. Thanks to @salbang,
@ziadeh, @davey64, @bpamiri, @oneandonlydean, @xwcq, @seanmcn and @AlexGhanem
for reports carried into this release, and to @bpamiri for dsh-seat, whose fake agent the conformance check's
stand-in follows.