v0.1.3
This release replaces the old sandbox write modes with complete execution profiles. It also adds
DeepSeek Harness and Grok Build support and clearly separates estimated costs from costs reported by
a provider.
Execution profiles
- Replaces
--sandbox workspace-write,scratch-write, anddanger-full-accesswith four profiles:
editgives the agent a writable task worktree,reviewmakes that worktree read-only,sealed
hides the repository and local instructions, andhostuses native host access. Each profile now
defines what repository data, host paths, instructions, environment values, and reusable state the
agent can see. Isolated profiles start with an empty filesystem view and add only the paths they
need (9b2ebd6). - Replaces live
--readmounts with--inputsnapshots. AOP copies and hashes the declared bytes
before launch, mounts the copies read-only at stable/inputspaths, and retains them with the run.
A sealed run can work outside a Git repository without revealing the original input paths or task
name (9b2ebd6). - Adds
aop profile explainandaop run --dry-runso a profile can be inspected before launch. Every
dispatched run saves the profile it actually used inrequest.jsonfor later review (9b2ebd6). - Keeps Hermes runtime files, tool settings, caches, mounts, and launcher environment private in
sealed runs while allowing the same authenticated session to continue later (03197d5,e8835d4,7ba894b,c43586e).
Providers and costs
- Adds DeepSeek Harness support for its DeepSeek route and other configured providers (
9b2ebd6). - Adds Grok Build support without interactive prompts, saves its structured output, continues the
same conversation on resume, keepsGROK_HOMEprivate to the task, and records model, token, and
cost details.GROK_STORAGE_MODEis passed through only when users define it (d6ba6ca). - Adds an estimated API cost for Agy and records estimated costs separately from costs reported by
providers in both individual and batch results (aef59b0,ac34173).