v0.13.0

Release v0.13.0

This release brings a builtin microVM runtime for Apple Silicon that ships inside the awman binary, custom agents defined in one TOML file, and awman agents for inspecting and managing every running agent. Workflows now check their commit, push, PR and CI prerequisites before the first container starts, and the HTTP API gains cancellation, labels, idempotency keys, one-shot runs, resumable event streams and structured results. Several commands changed behaviour — read Breaking and behaviour changes before upgrading.

Highlights

• Builtin microVM runtime (experimental, Apple Silicon). Run every agent
  in a hardware-virtualized microVM that ships inside the awman binary — no
  Docker, container or sbx needed at run time.
• Custom agents. Teach awman a new agent with one TOML file and
  awman new agent.
• awman agents. Inspect, attach to and stop running agents on any
  runtime, with Docker-style list/ps, detail/inspect and kill/rm.
• Workflow prerequisite checks. Before a workflow starts, awman checks that
  its commit, push, PR and CI steps have the identity and credentials they need,
  and asks before handing any credential to a step.
• A sturdier API for automation. Cancel a running command, label it,
  retry safely with an idempotency key, run a one-shot job in one call, resume
  an event stream, and read structured results.

Breaking and behaviour changes

awman status is now awman agents status

The top-level awman status command is gone, with no alias. Use
awman agents status (add --watch to keep refreshing; it no longer watches
by default). See awman agents.

Who is affected: scripts and habits that run awman status.

The amux → awman migration is gone

awman no longer moves a leftover ~/.amux/ or <repo>/.amux/ directory to
.awman/ on startup, and no longer warns about AMUX_* environment variables.

Who is affected: anyone who has not run awman since the rename. Move the
directories yourself (mv ~/.amux ~/.awman, and mv .amux .awman in each
repo) and rename any AMUX_* variables to AWMAN_*.

crush and maki are custom agents now

crush and maki are no longer built in. They ship as custom-agent examples:
create the definition once and everything that names them keeps working.

awman new agent crush --from crush          # this repo
awman new agent maki --from maki --global   # every repo
awman ready --agent crush                   # review, approve, build

Without a definition, a run that names them fails with
unknown agent 'crush'; … define one with: awman new agent crush. See
Custom Agents.

An API run no longer silently resumes an existing worktree

When the worktree for an exec workflow --worktree run already existed, the
API reused it without telling you. It now fails the command (exit code 1,
HTTP 409) with a message naming the worktree path and branch. Pass
--on-existing-worktree resume to get the old behaviour, or recreate to
start over. The TUI, interactive CLI, piped CLI and squad daemon behave as
before when the flag is absent.

Who is affected: API clients that re-run a workflow whose worktree was left
behind by an earlier run.

recreate now discards the branch and its commits

Choosing to recreate an existing worktree used to remove the directory and
reuse the old branch, so the earlier commits came back. It now deletes the
worktree, the branch (git branch -D) and every commit on it, then starts from
HEAD. If Git cannot delete the branch, the run stops with Git's error.

Who is affected: anyone who answered R to the existing-worktree prompt
expecting to keep committed work. Merge or copy what you need first. The same
choice is available up front as --on-existing-worktree recreate.

Worktree directories are now <repo-name>-<hash>

Worktrees live under ~/.awman/worktrees/<repo-name>-<hash>/, where <hash>
is 8 hex characters derived from the repository's full path, so two checkouts
with the same folder name no longer collide. A worktree created under the old
~/.awman/worktrees/<repo-name>/ folder is still found and reused while Git
lists it for the same repository; new worktrees always use the new folder.

Who is affected: scripts that build a worktree path by hand.

awman chat now exits with the agent's exit code

A chat session whose agent exited non-zero reported that code in the TUI but
exited 0 from the CLI and reported success over the API. All three now use
the same rule.

Who is affected: scripts and CI that run awman chat and branch on $?,
and API clients that read a command's status. A chat session that looked
successful because its agent crashed or was killed is now reported as failed.
Nothing changes for a chat session whose agent exits 0.

The TUI reports a failed workflow as failed

A failed exec workflow wrote "Command 'exec workflow' completed
successfully." into the tab's status log and coloured the tab as a clean
finish. The log line and the tab colour now reflect the real result. TUI only;
no scripting surface changes.

--non-interactive on a terminal is honoured by every CLI prompt

awman <command> --non-interactive (and --json, which implies it) on a real
terminal used to prompt anyway for the mount-scope, agent-setup, agent-auth,
worktree-lifecycle, init, ready and clean questions: each one checked
whether stdin was a terminal rather than whether you had asked for a
non-interactive run. They now take the headless answer, which is what the
command already believed was happening.

A malformed config.json fails a daemon start

awman api start and awman squad start with a malformed
~/.awman/config.json now fail with config parse error in <path>: <reason>
— naming the file, the line and the offending key — instead of starting on
default settings you did not write. Nine other config reads that silently
defaulted a bad file away are gone.

The squad daemon reads authRefresh from the global config only

The squad daemon builds its credential-refresh monitor when it boots, from the
global config and the environment. A repo-level authRefresh block is no
longer honoured by the daemon, and credential leases begin at daemon boot
rather than at the first request. See
Configuration.

persistence is omitted rather than empty when no daemon answered

DaemonStatus.env_persistence (GET /v1/status) and awman squad env's
persistence field are now absent rather than "" when no live daemon
answered. "" and an explicit none opt-out were previously
indistinguishable.

Exit codes and messages for container failures

• Exit code 3 now means only that the Docker or Apple Containers backend is
  missing or failing. Builtin runtime and image-builder failures exit 1.
• A Docker backend error no longer carries a blanket "install Docker Desktop"
  line, and a missing container CLI names the runtime it belongs to
  (install Apple Containers and retry for container).
• The CLI, the TUI and the API print the same text for these errors.

awman ready reports its phases

awman ready now prints ready: <phase> lines on stderr, as the TUI and API
already did. They are suppressed with --json.

Non-interactive agents receive their subcommand once

exec prompt, workflow steps and every other non-interactive launch passed
the agent's non-interactive form twice (codex exec exec …,
claude --print --print …, crush run run …), so codex and crush read
the second copy as the prompt. It is now passed once.

Codex interactive launches pass --no-daemon

Interactive Codex sessions now start with --no-daemon: the image ships no
app-server daemon, and newer Codex releases refuse to start without one.
codex exec rejects the flag, so awman adds it to interactive launches only.
An agentFlags entry for --no-daemon is now redundant: awman drops it from
interactive launches and warns that non-interactive runs may reject it.

Interactive prompts no longer answer themselves on a pipe

Several prompts used to pick an answer for you when there was nobody to ask:

• awman squad add --interview through a pipe took a workspace, a mount
  scope, an agent pool and an overlay set that nothing displayed. Each of
  those steps now fails with "interactive input unavailable" rather than
  choosing. A run that reaches them needs a terminal, or the equivalent flags.
• The work-item kind question (awman new spec, awman specs) accepted
  feature, bug and enhancement in the CLI but not in the TUI. Both now
  accept only the digits both display, and dismissing the question abandons
  the interview instead of silently filing a Task.

commit_changes stages every change by default

A commit_changes teardown step without add_all used to commit only what was
already staged, so an agent's unstaged edits were left out of the pushed
branch and the pull request. add_all now defaults to true: every change is
staged except awman's run state under .awman/workflows/. A step with nothing
to commit, for example because the agent committed its own work, now succeeds
instead of failing the teardown.

Who is affected: workflows that relied on committing only staged changes.
Set add_all = false to keep that behaviour.

yoloDisallowedTools is enforced

The list was validated and stored but never reached the agent. Every --yolo
launch (chat, exec prompt, each workflow step, and API commands, which
default to --yolo) now passes it to Claude as --disallowedTools. An agent
with no way to enforce a disallowed-tools list — every first-party agent but
Claude — is refused under --yolo while the list is non-empty, with an error
that names the setting. To keep running such an agent with --yolo in a repo,
clear the list there: awman config set yoloDisallowedTools "". See
Disallowed tools.

awman remote exec --follow exits with the remote command's result

It used to exit 0 whatever happened on the server. It now exits 0 only when
the remote command finished done, with the command's own exit code when that
is non-zero, and 1 when it failed, was cancelled, or following stopped before
it finished. Without --follow, a successful submit still exits 0.

Features

Builtin microVM runtime (experimental)

runtime: "builtin-experimental" runs each agent session in a
hardware-virtualized Linux microVM. The VM code, kernel and guest agent are
compiled into awman (powered by Microsandbox), so installing awman is the only
install step: no Docker, container or sbx is needed to run agents.

• Where: macOS on Apple Silicon only, in the awman-macos-arm64 release
  asset, which is ad-hoc signed with the hypervisor entitlement and not
  notarized. Every other platform refuses the runtime with a clear message.
• Enabling it: global config only, never a default:
  awman config set --global runtime builtin-experimental.
• Images: awman ready imports agent images from an explicit source
  (registry, docker-local, apple-local or archive). With
  builtin.builder.enabled: true and a local source, ready builds the
  Dockerfiles in that Docker or Apple Containers store and imports the result
  in one command; chat, exec prompt and API session setup build a missing
  image the same way. Workflow preflight and squad never build.
• Per-session controls: builtin.network (public, allowlist or
  none; a repo may only narrow the global policy), hostPorts, vcpus
  (default 2), memoryMib (4096), rootDiskMib (30 GiB) and mountQuotaMib
  (30 GiB per host mount). Repo settings apply to every launch for that repo —
  CLI, TUI tabs, API sessions, squad tasks and workflow worktrees — and a repo
  with an invalid builtin block fails only its own launches.
• Upgrades: a state directory written by an earlier worker protocol is
  upgraded in place, with a db.pre-* backup kept for rollback.
• Not supported yet: --allow-docker, and reattaching after the awman
  process that launched the agent exits.

Behaviour and config may change while the runtime is experimental. See
Runtimes.

Custom agents

Define your own agent in TOML under .awman/agents/ or ~/.awman/agents/ and
awman builds, launches and operates it like a first-party one. awman new agent <name> [--global] [--from crush|maki] [--force] writes a starting definition.
Repo definitions, and global ones that declare a host [ping], are reviewed
and approved once per content hash (awman ready --agent <name>); approvals
live in ~/.awman/trusted-agents.json. Custom agents run on Docker, Apple
Containers and the builtin runtime, not yet on Docker Sandboxes.

awman also ships builtin skills: awman new skill --pull builtin adds
create-custom-agent, which teaches a code agent to write a definition for
you. See Custom Agents.

awman agents: inspect and manage running agents

awman agents status [--watch], list (ls, ps; --all includes stopped
agents), detail (inspect), kill (rm) and attach work on every
runtime. Each agent shows its source: session, or squad:<task> for one your
squad started. status, list, detail and kill are also available over
the API.

Workflow prerequisite checks

Before the first container starts, exec workflow checks what its setup and
teardown steps need: a Git identity for commit_changes, an SSH key for an SSH
push_branch, a GitHub token for create_pull_request, HTTPS pushes and
poll_ci, and gh in the image. Interactive runs show a report and ask before
using any host credential; credentials go only to the steps that need them and
tokens are redacted from output. Headless runs use only what policy or flags
grant — --yes never grants credentials.

• --prerequisite-identity, --prerequisite-ssh, --prerequisite-token and
  --prerequisite-unresolved warn|fail answer up front;
  --check-prerequisites prints the report and exits.
• The workflows.prerequisites config block sets policy (allowed token
  variables, an acquire command, refresh: "beforeTeardown", and the
  global-only allowApiClientGrants).
• Remembered SSH and token choices (decisions only, never secrets) are listed
  and revoked with awman config prerequisite-grants list|revoke.
• Before teardown, prerequisites are re-checked without prompting.

See Workflow prerequisite checks.

Worktree merge-back handles a dirty target and a failed merge

--on-dirty-merge-target ask|commit|stash|fail decides what happens when the
branch you merge back into has uncommitted changes, and
--on-merge-failure ask|agent|keep decides whether a failed merge launches a
merge-fix agent or keeps the worktree. See
Worktree merge-back.

The Workflow Overview scrolls sideways

A workflow with more stages than fit across the terminal scrolls with
Shift+←/→ (or a horizontal wheel) instead of squeezing every stage into an
unreadable column. ‹/› markers show hidden stages, coloured red or blue
when a hidden stage failed or is running, and the view follows the running
stage until you scroll by hand.

Dynamic workflow settings use workflows.dynamic

Dynamic workflow settings now live in the workflows.dynamic block in both
repo and global config. Run awman config migrate to move a repo's existing
dynamicWorkflows block; saving repo config also migrates it automatically.
The old global dynamicWorkflows block was never read, so copy any settings
you want to keep into the global workflows.dynamic block. Global settings now
provide defaults for all repos, with repo settings taking precedence. Older
awman versions do not read workflows.dynamic, so teammates on older versions
will stop seeing these settings after the updated config is committed.

Related changes to how awman writes config files:

• Every config save (config set, the TUI config dialog, awman init,
  config migrate) now writes a temporary file and renames it into place.
  A save refuses a read-only config.json. A repo save also refuses a
  .awman/ directory or config.json that is a symlink; previously
  config set wrote through it. A symlinked ~/.awman/config.json (for
  example one managed in a dotfiles repo) is still followed: its target is
  replaced and the link is kept. A new config file gets the same permissions
  as before (your umask default); an existing file keeps its mode.
• config set work_items.dir and work_items.template now save the value,
  and config get/config show display it. Previously the edit reported
  success but was dropped.
• A save refuses a value that would make the file fail to load (for example a
  51st guidance entry), so config set can no longer leave a file that every
  later command rejects.
• A repeated guidance entry is now dropped even within one file, so a repo
  that listed the same instruction twice gets one bullet in the leader prompt.

A sturdier HTTP API for automation

Clients can drive a job end to end without scraping text. GET /v1/status
lists each capability in features, so a client can detect it.

• Cancel a command: POST /v1/commands/{id}/cancel stops a queued or
  running command. A cancelled workflow still runs its cleanup teardown but
  skips publishing steps and remediation, and ends cancelled (exit 130).
• Labels and idempotency: tag sessions and commands with labels and filter
  by them; send an Idempotency-Key so a retried POST returns the original
  response instead of creating a duplicate.
• One-shot runs: POST /v1/runs creates a session, runs one command and,
  with close_on_finish, closes the session — one call instead of four.
• Resumable event streams: SSE frames carry an id:, so a client resumes
  with Last-Event-ID (or ?after=) after a disconnect.
• Structured results: a command's result reports outcome, failure,
  failed_steps, git, pull_request, final_message, outputs and, for
  agents commands, data. Files an agent writes to /awman/output are
  listed and downloaded from /v1/commands/{id}/outputs. Events carry a
  source, ?step= filters the log to one step, and step_activity events
  report live per-step output.
• Consistent resources and errors: GET /v1/commands/{id} is the command
  record and /v1/commands/{id}/workflow its workflow state (the old
  /status and /v1/workflows/{id} paths still answer). Every error carries
  a stable machine-readable code beside its message. Sessions report
  setup_status and setup_error, filterable with ?setup_status=, and
  POST /v1/commands accepts session_id in the body.
• Remote sessions: exec workflow --dynamic runs in a server-cloned
  session. Create the session with base_ref to branch from any branch, tag or
  commit, merge_refs to merge branches in first, and push: true to commit
  and push the result when the command succeeds.
• Workflows finish cleanly: API yolo workflows (every API --dynamic run)
  no longer abort after their last step: their teardown now runs.

See API & Remote Mode.

API workdir roots: --workdir-root and api.workDirRoots

awman api start --workdir-root <dir> (repeatable) and the global
api.workDirRoots setting allow any Git repository cloned directly beneath a
root to be used as a local session workdir, without listing each one in
--workdirs. The child must be its own Git root with a real .git directory.
GET /v1/workdirs now also returns roots, and a refused workdir names the
rule it failed. See Working directory allowlist.

--on-existing-worktree for exec workflow

ask, resume, recreate or fail answers the existing-worktree question up
front on the CLI, TUI and API. See Worktrees.

Extra agent flags: agentFlags and --agent-flag

Add arguments awman doesn't know about to an agent's command, per agent, in
repo or global config ("agentFlags": {"codex": ["--search"]}) or for one run
(--agent-flag=--search on chat, exec prompt and exec workflow). The
flags go after awman's own and before a seeded prompt. A repo entry replaces
the global one for that agent, and [] turns it off. remote exec forwards
the flag to the remote host. See Configuration.

Fixes

Claude's host config is always sanitized before it is mounted

If ~/.claude.json contained a byte that is not valid UTF-8, awman mounted
the host file itself into the container, read-write and with your
oauthAccount intact. The file is now always sanitized; if that is
impossible, the container gets a minimal generated config instead.

A failed parallel step stops queued steps from starting

When a step in a parallel group failed without abort_on_failure, a sibling
that finished afterwards (or was advanced by a yolo countdown) could still
start the next queued step. Queued steps now wait until the failure is
retried from the recovery board, as
Workflows describes.

awman remote exec sends every flag to the server

remote exec workflow|prompt used to send only --work-item and --agent
and drop the rest silently (and exec prompt's --agent arrived as part of
the prompt text). Every exec flag you pass — --yolo, --model, --issue,
--plan, --overlay, --agent-flag, the prerequisite grants and the rest —
now reaches the server. remote exec workflow --dynamic works without a
workflow path. --json, which shapes local output, is now refused as an
unknown flag instead of being ignored. See
awman remote exec workflow.

A static workflow asks about a missing agent image again

Before a static exec workflow starts its first container on Docker or Apple
Containers, awman checks the image of every agent its steps run. For a missing one it asks — set it up (writing its Dockerfile from the
agent definition and building it), run those steps with the default agent
instead, or stop — in the CLI and the TUI alike. The run used to start and
fail at the first step that needed the image. See
Agent images.

awman remote explains a refused connection to another machine

The API server listens on 127.0.0.1 only. A refused connection to a
non-loopback address now says so and suggests an SSH tunnel or a reverse
proxy; a refused loopback connection asks whether awman api start is running.

Cancelling an API run stops its repository clone

A cancel sent to a run or command while its session was still cloning the
repository was ignored until the clone finished — never, against an
unresponsive origin. The clone now stops as soon as the cancel arrives.

create_pull_request no longer fails right after a push

GitHub indexes a push a moment after it arrives, so a pull request created
straight after push_branch could fail with No commits between main and <branch>. awman now waits and retries for about 30 seconds before failing the
step.

poll_ci judges only the pushed commit, and on_failure can fix CI

• poll_ci no longer falls back to the branch's previous runs when the new
  commit has none yet. It used to report an old commit's failure as the new
  commit's result.
• A re-run replaces the earlier run of the same workflow, and a run cancelled
  by a concurrency group is ignored when another run of that workflow for the
  same commit was not cancelled.
• When CI fails, the on_failure agent's failure file now lists the failed
  jobs and steps with the tail of each job's log.
• After each on_failure attempt, awman re-runs the teardown's earlier
  commit_changes and push_branch steps before polling again, so the
  agent's fix actually reaches CI. Before, the retry polled the same failed
  commit. The fix commit's message ends with the failed jobs, for
  example Implement 0014: fix CI jobs lint, test.

Running the test suite no longer touches your keychain or your squad daemon

On macOS, make test read your real Claude credential from the keychain, and
the awman clean and squad daemon tests could overwrite or delete the squad
daemon's stored environment (squad.envPersistence). Tests that started a
squad daemon did so through launchd (systemd --user on Linux) under the same
fixed label as your real daemon, stopping it and leaving a test daemon
registered in its place. The TUI copy tests also overwrote your clipboard.

make test now runs with a throwaway home directory and no global git config,
and awman uses an in-memory keychain and clipboard and starts daemons as plain
child processes. Tests that drive Docker, Apple's container or sbx no
longer build, run or remove images and containers in your own daemon: they are
skipped unless you opt in with AWMAN_TEST_DOCKER=1 (or
AWMAN_TEST_APPLE_CONTAINER=1, AWMAN_TEST_SBX=1). make test-full opts into
Docker.

If make test ran on your machine before this fix, check your daemon with
launchctl print gui/$(id -u)/io.awman.squad (or systemctl --user status awman-squad). If it is not running, or its AWMAN_SQUAD_ROOT points into a
temporary directory, restart it with awman squad start from a shell that has
your task variables exported, so it stores them again.

A running daemon is no longer mistaken for a stale one on macOS

awman checks that a daemon's PID still belongs to awman with ps, which
truncated the executable path to 79 columns. With awman installed at a longer
path, a running API or squad daemon looked stale: awman cleared its PID file
and started a second daemon beside it. The full path is now read.

GitHub issue references resolve from more remote URL shapes

--issue derives owner/repo from your origin remote. It now also
recognises ssh://git@github.com/owner/repo.git and a host written in any
case (https://GitHub.com/...), alongside the git@/https:// spellings it
already handled. This widens what is accepted and narrows nothing.

A repo-local git identity counts

The warning exec workflow prints before a commit_changes teardown step
("git user.name / user.email not set") probed git with no working directory,
so it only ever saw the global identity. A repository that sets its own
user.name/user.email no longer gets the warning.

"did you mean" works for nested commands

awman exec wrkflow — and the same typo in the TUI command box — got no
suggestion, because both frontends searched only the top-level command list.
Suggestions now come from the command catalogue and cover subcommands.

A remote session's tab is magenta again

The documented magenta tab colour for a remote (auto-cloned) session never
appeared. It does now.

The container window opens after a yolo countdown advances a workflow

When a yolo countdown ended a step and the next step started right away, the
new container's window and status bars sometimes stayed hidden until you
pressed Ctrl-M. They now open as soon as the new container prints output.

A setup step that fails gets the same failure file a teardown step gets

A setup step that fails and has an on_failure: agent now writes the
failed command's captured output to a file the remediation agent can read, and
its prompt points at that file — behaviour only teardown steps had. The file
lands in the same per-invocation run directory, and its name now says which
phase it came from: setup-failure-<step>.txt / teardown-failure-<step>.txt
(it was teardown-failure-<step>.txt either way, which could not tell a setup
and a teardown step of the same name apart).

StatusMessage.phase on the API event stream is unchanged: still exactly
setup / teardown.

Interface changes

The TUI command box rejects what the API rejects

The command box used to accept input the API refused:

• chat --launch-mode banana was carried through as the string banana; it
  is now rejected at the box, with the reason and the allowed set, and your
  text is kept so you can correct it.
• squad start --port abc likewise.
• A --prefixed token is no longer accepted as a flag's value.
• --flag=false on a boolean flag is now honoured, as it already was
  elsewhere.
• ready -ab now reads unknown flag: -ab — what the CLI and the API already
  said — instead of short-flag bundle '-ab' is not supported by the command box.

Typed enums on the wire

Six event and session fields that were free-form strings are now enums. No
wire value is renamed — every variant serialises to exactly the string its
predecessor carried. The enumerated values are listed in
API and Remote Mode.

Field	Values
WorkflowStepTransition.from_status / .to_status	pending, running, succeeded, failed, cancelled, skipped
CommandStatus.status	done, paused, aborted, error, cancelled
WorkflowPhaseTransition.status	running, succeeded, failed, paused, teardown_failed, cancelled
session type (create body, session_type column)	local, remote
awman squad env row state	set, unmet

One ready summary everywhere

The ready summary box showed different rows in different places: the CLI
omitted the "Image rebuild", "aspec folder" and "Work items config" rows the
TUI showed, and a remote session showed them under different labels plus one
row neither had. All three now show the same list, and
awman remote session start draws the same box ready draws.

The API-key and squad-key banners are drawn per frontend

awman api start --refresh-key and the first-run key mint drew a
box-drawing banner that every frontend received verbatim, so the TUI got a box
inside its own frame and the API serialised the box characters into JSON. The
CLI still draws the box; the TUI and the API state the key as text. The key
itself is unchanged, and is still shown exactly once.

The mount-scope and workspace questions read the same in the CLI and the TUI

awman squad add --interview asked for the mount scope as [gitroot]/cwd? in
the CLI and as "Mount the entire git root? (No = current directory only)" in
the TUI. Both now ask the same question with the same options. The same
applies to the Dockerfile-setup question awman init asks, which also now
shows the path it looked at on its own line.

One worktree-creation failure message

exec workflow printed one of three messages when it could not create a
worktree — failed to create worktree for issue:, ... for work item: or
... for workflow: — depending on how you named the run. There is now one:

exec workflow: failed to create worktree: <reason>

The reason text is unchanged. Only a log grep for the longer forms is
affected.

The "INTERACTIVE mode" banner is gone

Launching chat or exec printed a box-drawn INTERACTIVE mode banner
before the agent started, in both the CLI and the TUI. No frontend shows it.
The agent launches identically, and the container overlay still shows the
agent name and elapsed time in its title.

Known issues

awman ready --agent antigravity reports the local agent as not installed

The host-side ready ping for antigravity runs a binary named antigravity,
but antigravity ships agy — which is what awman uses to launch it. The ping
therefore always fails, and credential refresh for antigravity cannot succeed.
This is long-standing, not new; fixing it changes behaviour on the one
sanctioned host-side agent execution path and is tracked separately.

Documentation corrections

• An unqualified dir() overlay mounts read-write; the docs said
  read-only. Add :ro to mounts that should be read-only.
• The API server listens on 127.0.0.1 only. Reach it from another machine
  through an SSH tunnel or a reverse proxy; see
  Reaching the server from another machine.
• The TUI has no remote-bound tabs, and remote.savedDirs and
  api.alwaysNonInteractive are not read; the docs that described them are
  gone.

New environment variables

• AWMAN_TEST_ISOLATION — set to 1 to keep awman off your per-user OS
  resources: an in-memory keychain and clipboard, daemons started as plain
  child processes rather than through launchd or systemd --user, and no
  downloads from the internet, and docker, container and sbx treated as
  not installed. For test runs; make test sets it.
• AWMAN_TEST_DOCKER, AWMAN_TEST_APPLE_CONTAINER, AWMAN_TEST_SBX — with
  AWMAN_TEST_ISOLATION, set one to 1 to let awman use that real CLI.
  make test-full sets AWMAN_TEST_DOCKER.

New environment variables documented

No behaviour changed; these were previously read but undocumented. See
Configuration.

• AWMAN_SQUAD_ROOT — overrides where squad stores its tasks and state
  (<data home>/squad by default).
• AWMAN_ATTACH_DIR — overrides the attach-socket directory
  (~/.awman/attach/ by default).
• AWMAN_API_VERBOSE_SETUP — set to 0, false, no or off to demote the
  API server's per-session setup logging from info to debug. Verbose is
  the default; the parse is case- and whitespace-insensitive.
• PATH, HOME, RUST_LOG — forwarded to a systemd/launchd daemon job.

---

Back to contents