v0.12.0

Release v0.12.0

This release is about work that happens without you starting it. Your squad is a group of agents that watches for the conditions you describe and runs a workflow when one fires — no separate program, driven from the same CLI and TUI as everything else. Around it: Claude credentials that stay fresh through an overnight run, workflows that survive a failed step instead of ending on it, published skill libraries you can pull from GitHub, and a structured ACP launch mode.

Features

• squad. Your squad is a group of agents that work on your behalf while you're doing something else. You give it tasks — "when a new issue is opened, triage it and post a plan", "if any open PR has failing tests, push a fix" — and on each task's interval one of your squad's agents decides whether the condition is actually met. If it is, the squad designs a workflow for it and runs it unattended, the same way awman exec workflow --dynamic would. See squad.

  • Task management from the CLI. awman squad add creates a task; list, show, edit, pause, resume, remove manage it. awman squad trigger <name> has your squad tackle a task right now, ignoring its schedule; awman squad cancel <name> stops a run in progress; awman squad attach <name> drops you into a live container. Deleting a task cascades to its runs, workspace, and history.
  • Durable task workspaces. Each task gets a persistent directory at ~/.awman/squad/tasks/<name>/workspace/, mounted at the stable context(workflow) location, so state carries between runs. A task can instead point at a directory or repository of your own; the mount scope is captured at creation and never widened later.
  • The squad tab. awman squad opens a TUI tab showing every task as a card with its last and next run. Enter opens a detail modal, h the run history, t triggers, c cancels, a attaches, e edits, p/r pause and resume, d removes. Card outlines carry task state (grey paused, blue running, magenta triggered, red failed, yellow never run, green healthy), and every colour is spelled out in the card body so nothing depends on colour alone. A squad ● indicator sits on the bottom row of every tab, re-probed every ten seconds.
  • Run history with the leader's reasoning. Every run records why the evaluation agent decided the task did or didn't fire, alongside its outcome (running, not triggered, executed, failed, interrupted, canceled), timings, and any error. The reason is kept even when a run later fails or is canceled, and awman squad show prints the same column.
  • Per-task agents and models. A config.json beside a task's workspace narrows the agent pool, models, leader, and guidance for that task alone, inheriting anything it doesn't set from the global squad block.
  • Environment coverage you can see. env() overlays are resolved by the daemon, which doesn't inherit the shell you created the task from. awman squad env reports every variable your tasks need, whether the daemon currently holds a value, and where that value came from — values themselves are never printed. --push re-sends everything this shell has (reach for it after rotating a token) and --clear drops the persisted item. By default the daemon persists what it holds in the OS keychain so values survive an OS-initiated restart; set squad.envPersistence to "none" to opt out.
  • Guardrails for unattended execution. Every run is autonomous and PTY-backed under the same auto-advance rules as --yolo, credentials are injected only at container startup and never written into a task's persistent directory, and the docker-sbx-experimental runtime is refused outright rather than degrading silently. See Guardrails.

• Live agent credential refresh. Containerized Claude sessions used to get a frozen snapshot of the host OAuth access token, which expires after 8–12 hours — so any long run died on 401s partway through. awman now writes a sanitized, awman-authored .credentials.json (access token, expiry, and scopes only — never the refresh token) into the staged ~/.claude mount and keeps it fresh for as long as the session lives, rotating the host's own keychain entry through the same sanctioned ping awman ready uses. A running container picks up the new token on its next request with no restart. awman ready reports token health. Tune or disable it with the authRefresh config block. See Live credential refresh.

• Workflow step-failure recovery and resume. A failed agent step no longer ends the run. The control board opens with the failure attached so you can retry the step, step back to the one before it, step over it, or pause — and a paused run resumes from a named step (the one that failed, its predecessor, or its successor) the next time you start it. --dynamic runs resume identically, and accepting a resume skips the leader-design pass entirely, so it costs no leader tokens. Unattended runs (the squad daemon, the API server) retry a failed step once before giving up. An aborted run's state is now reset correctly, fixing resumes that previously reported success having executed nothing. See Workflows.

• Curated skill libraries. Your skills store is no longer limited to what you write by hand. awman new skill --pull github.com/obra/superpowers adds a published library to your collection under ~/.awman/skills/.library/, alongside your own skills in ~/.awman/skills/<name>/, and the usual overlay syntax mounts anything on either shelf: skill(superpowers) for a whole library, skill(superpowers/brainstorming) for one skill inside it. Curate the set over time — --pull <name> refreshes a library by short name, --pull-all refreshes every one so the whole collection stays current, and --subdir points at a layout other than skills/ and remembers the choice. Pulls run entirely on the host as plain git commands, and awman only ever touches directories it created. See Pulled skill libraries.

• ACP launch mode. --launch-mode acp (or launchMode: "acp" in .awman/config.json) drives an agent over the Agent Client Protocol instead of raw container stdio, so awman renders structured messages, tool calls, plans, diffs, and permission prompts itself rather than passing through the agent's terminal output. Cline supports it today; the global launchModeFallback setting decides whether an agent that doesn't support ACP is a hard error (the default) or downgrades to stdio with a visible warning. Containerization is unchanged — ACP only changes how awman talks to the agent's stdio. See ACP launch mode.

Improvements

• The squad leader knows what it has. The evaluation leader's prompt now states the task's fully-merged overlay inventory — directories with their container paths and permissions, environment variables split into set and declared but not set, skills, context directories, and the structural mounts always present. It no longer has to guess whether GITHUB_TOKEN is in its environment or ~/.ssh is mounted, so it stops writing steps that fail on a missing key and stops writing weaker workflows than the task could support.
• Squad daemon environment forwarding. The daemon's environment previously differed by platform: systemd-run --user forwarded nothing, launchctl bootstrap forwarded eight names, and the fallback forwarded everything — so on Linux a daemon could resolve a different storage root than the process waiting for it, and AWMAN_OVERLAYS, AWMAN_MAX_CONCURRENT_AGENTS, and AWMAN_LAUNCH_MODE were silently lost. Bootstrap forwarding is now consistent across all three paths, values can be pushed to a running daemon in memory, and keychain persistence is on by default.
• Attach parity on Apple Containers. Attaching to a running container now works on the Apple Containers runtime through an attach rendezvous socket, matching Docker.
• Dynamic workflow leader prompt rewrite. The leader prompt, example workflow, and workflow-usage reference were substantially tightened and shortened, and the workflow file format reference the leader reads was brought in line with the current format.
• Architecture audit remediation. The Critical and High findings from the September architecture audit were remediated — binary and library entry points, TUI state ownership, and test organization — with no user-facing behavior change. An architecture-lint script now guards the layer boundaries in CI.
• CI on newer Node. The GitHub Actions workflows moved off Node 20, and macOS and Linux CI failures were fixed.
• Dependencies were updated across the tree.

Fixes

• Fixed squad attach, a conflicting keybinding, yolo auto-advance in squad runs, build-log surfacing, and image naming.
• Fixed a task's env() overlays being silently dropped when the daemon had no value for them — an unmet name is now reported at task creation, on the card, in the indicator, and in awman squad env, rather than producing a run that quietly fails.
• Fixed a fork bomb and a flaky test in the test suite.

Upgrade path

curl -s https://prettysmart.dev/install/awman.sh | sh
awman ready

No config migration is required. Existing .awman/config.json files work unchanged — the new squad, authRefresh, launchMode, and launchModeFallback settings are all optional, and live credential refresh is on by default under the existing keychain auth mode.

To put a squad on duty:

awman squad start --background
awman squad add --name issue-triage \
  --description "When a new issue is opened, analyze it and post a plan as a comment." \
  --interval 30m --overlay "env(GITHUB_TOKEN)"

The squad daemon and awman api share the awman database and cannot run at the same time; stop one before starting the other. squad requires the docker or apple-containers runtime — docker-sbx-experimental is refused.