OpenRig 0.6.10

0.6.10 is a fix release, and most of it came from the community: 38 of its 56 changes are from ten outside contributors. Setup can now be told which agent harnesses you use. A resumed Claude seat whose session ID changed proves and restores. Sends reach Codex seats that run behind a launcher, and Claude seats that show a suggested prompt. Restore puts back the guidance rig down removed, and attach commands name the tmux server the daemon actually uses. Several commands now tell the truth where they used to say "already running" or "fully restored".

npm install -g @openrig/cli

It is built from main at 3001cc43 (after #1170, which changes only code comments). Work merged to main after that point isn't in this release. If something breaks for you, please open an issue.

Before you upgrade

Restart the daemon after upgrading the CLI. The running daemon keeps its old build until it restarts: run rig daemon stop, then rig daemon start. Two database migrations run on the first start, and neither changes existing data:

• 099 adds one partial index to the queue table, so the queue's recovery and stuck-sweep lookups stop scanning every row (#1073);
• 101 adds four empty columns to sessions, so OpenRig can remember a resumed Claude conversation's new ID (#1080).

There is no migration 100. The bundled openrig-core plugin goes from 0.1.8 to 0.1.9 (#1080).

Behaviour that changed:

• rig capture --lines N shows the last N lines. When earlier lines are cut, stderr says how many. In --json, lines is then the count returned, and requestedLines and omittedLines are new. For the old output, N history lines plus the whole pane, add --history-plus-pane, which also keeps the old JSON without those two fields. Without --lines, nothing changed (#1136).
• Compact rig queue list rows carry summary, and so do overdue and undelivered. The fields they leave out are now absent instead of null or "", and fieldsElided names them (#1096).
• rig launch no longer calls an exited agent running. On a seat whose agent exited to a shell in its kept pane, rig launch <rigId> <seat> returns attention_required and exits 1, with the ways back. It used to report the seat already running (#1070).
• rig up <rig> --existing reports a seat still missing part of its guidance. The rig then reads partially_restored instead of fully_restored, and the command exits 1 (#1068).
• lastNudgeResult reads claimed on a claimed row whose wake wasn't confirmed. The recorded value is kept in the new lastNudgeWireResult (#1094, reported in #165).
• rig chatroom history returns the newest messages when you give neither --after nor --since, still listed oldest first. Before, a long room returned its oldest (#1057).

Highlights

Setup asks only about what you use. rig setup --providers claude (or codex, both, or a comma list) installs and checks only the harnesses you chose. One you didn't choose reads skipped, never failed. Before, a person who used only Claude Code saw Codex checks fail. The first hour also stops showing tmux's "error connecting to …" when the daemon starts, and the next steps say the remaining steps are part of the install, not extras (#1065). On WSL2, a first rig daemon start after a timed-out probe goes ahead when the port is free. It's refused only when the port is really held, and the refusal names --port (#1061).

Restore.

• A resumed Claude seat whose session ID changed now proves. Claude can continue --resume under a new conversation ID. When the first SessionStart hook from the process OpenRig launched reports that resume, OpenRig records the new ID. The seat restores as resumed, and sends stop warning that its identity can't be confirmed. Before, such a seat stayed attention_required (#1080).
• rig up --existing puts back the OpenRig guidance that rig down removed from CLAUDE.md, CLAUDE.local.md or AGENTS.md. This happens before a resumed seat starts, and the person's own text isn't touched. Before, the seat came back without its role and culture guidance while the restore read fully restored (#1068).
• A restore no longer trusts a launcher's word. A launcher that isn't Claude can name one conversation while the Claude it started runs another. That restore now reads attention_required instead of a false resume (#1091).

Sends that used to be refused now arrive.

• Codex seats behind a launcher. A seat whose codex is a launcher that starts Codex as a child now receives rig send and queue wakes. Before, every send was refused with "reports sh as the foreground command". This had been broken since 0.5.17 (#1088, reported in #1079).
• Claude seats showing a suggested prompt. Claude's faint suggested prompt in an empty input box no longer reads as a person's draft, so a send to that idle seat goes through. Real typed text is still protected (#1139).

Seats tell the truth about their state.

• A seat whose tmux session is confirmed gone reads detached, and rig ps --nodes says to restore or relaunch it. Before, it read as needing attention and could still look active (#1074).
• A Codex seat showing its usage-limit banner reads unknown with reason usage_limit instead of idle, and rig provider signals can show a provider-event signal for that seat's account that allows a switch decision (#973, towards #763).

Attach commands name the right tmux server. If the daemon was started inside tmux on a non-default socket, every attach command it prints now carries -L <name> or -S <path>. From inside tmux, run it as env -u TMUX <command>. This was 0.6.9's known issue about attach commands reporting "no sessions" (#1083).

Queue and escalation.

• rig queue create --verify reports an agent seat's wake result and any claim as soon as one is recorded. Before, it waited 30 seconds and said still-pending (#1029, towards #766).
• New escalation setting: queue.wake_human_rung defaults to always. Set it to explicit-only to keep agent-to-agent escalations off the person's Slack unless the row is addressed to a person (#1090, towards #811).

Slack. A decision click that isn't recorded now gets one reply in the thread saying why. It covers clicks from someone who isn't registered, clicks on a decision sent to someone else or no longer waiting, and buttons that no longer match. A recorded click still gets its usual reply. It's best effort and needs the Slack bot token (#1067).

Teams are guided to ask less and say more. Starter and factory guidance now directs teams toward first steps and checks that need fewer approvals (#1082). The operator is instructed to explain what a launch changes in your project folder and to offer a separate copy before launch (#1086). Operators and leads are instructed to surface a waiting seat's prompt and attach command (#1087). The first-user check still needed four team approvals and didn't surface the reviewer's prompt until the person asked; see Known issues.

Dependency and install-script changes

• npm dependencies: none added, removed or changed, and the Node requirement is unchanged (node >=22). OpenRig's own version fields advance to 0.6.10 (#1164).
• Install scripts: unchanged. The package's only lifecycle script is still postinstall: node scripts/check-abi.mjs.
• Database: migrations 099 and 101, as above.

Everything else since 0.6.9

Seats and terminals.

• rig add takes a rig's name as well as its ID (#1027).
• rig start says why it skipped an existing kernel and how to bring it back (#1060).
• A Codex seat keeps its last context reading across quota-only usage records (#1124).
• A fresh Codex launch keeps git metadata paths that end in whitespace (#1134).
• When a caller of the daemon's terminal API names no provider, the daemon uses cmux if Herdr isn't available, and says so (#1071, towards #1069). rig terminal open without --provider, and the TUI's "Open terminal...

OpenRig 0.6.9

0.6.9 is a quick fix release for Slack, kernel readiness and cross-host communication. A typed answer to a Slack decision is kept, Slack status shows the inbound records waiting to be retried, a kernel that recovered from a failed start reads ready, and a cross-host send or a long chatroom wait no longer reports failure when the work went through. A Slack connection that stops delivering is now caught and replaced, and an alert for a closed row is no longer posted late. Three of its twelve changes came from three outside contributors.

npm install -g @openrig/cli

It is built from main at 4b48ca21 (after #1063). Work merged to main after that point isn't in this release. If something breaks for you, please open an issue.

Before you upgrade

Restart the daemon after upgrading the CLI. The running daemon keeps its old build until it restarts: run rig daemon stop, then rig daemon start. There is one database migration: migration 098 adds an index on (qitem_id, transition_id) to the queue's transition history, and a 0.6.8 daemon still opens the upgraded database (#1043). And the bundled openrig-core plugin stays at version 0.1.8.

Behaviour that changed:

• Scope approval with --workspace. rig scope <tier> approve --workspace <path> now stamps the work tree you named. Before, it reported success while the stamp landed in the daemon's own work tree. If the named workspace has no missions/ folder, approve now refuses instead of stamping the configured one (#997).
• Cross-host sends over http. rig send <session> --host <id> to an http-registered host has a 30-second request budget, plus any --wait-for-idle time, instead of 5 seconds. If the answer doesn't come back, or the connection drops after the request went out, the send reads "Delivery UNCONFIRMED" (failedStep: "remote-outcome-unknown", exit 1) and tells you to check the target with rig capture <session> --host <id> before any resend. Only a host that was never reached reads as unreachable (#1048).
• rig chatroom wait. A long wait keeps waiting through a slow or restarting daemon instead of ending at the first failed poll: poll timeouts, connection refusals, and reset or closed connections are retried until --timeout. The first failure in a run prints one line on stderr. Other errors, including an error answer from the daemon such as a removed rig, still end the wait (#1047).

Highlights

Slack.

• A typed reply to a decision with structured questions is now kept on the row, in humanAnswers. Before, the decision closed with no recorded answer. A typed reply is placed under the first unanswered question and marked as typed, so text that matches an option's ID is never read as clicking that option. The decision still closes, and closing doesn't mean approval (#1045). The messaging-the-human skill says how to read it.
• rig slack status shows how many retained records for inbound messages, reactions and click answers are waiting to be retried; it counts records, not distinct messages. That backlog is kept across restarts, and if it can't be read, status says the count is unknown and why (#1036).
• A Slack alert whose first post failed is kept and retried when the gateway next starts. If its row has closed by then, the alert is no longer posted, and the row says why. Alerts for rows still open, decision-resolved notices and digests still post, and rig slack enable says how many earlier posts wait to be retried (#1051). Before, four alerts for long-closed rows posted after an enable 28 hours later.
• A Slack connection that stops delivering is caught and replaced. On one install, a connection stayed "connected" for an hour while Slack delivered nothing to it, and two button presses were lost. OpenRig now watches Slack's server pings and the echo of its own posts. When either stops, it opens a new connection and then closes the old one, at most once every 5 minutes; Slack's own refresh requests are handled the same way, without the limit. rig slack status adds a Delivery: line beside the socket state (delivering, not yet confirmed, events missing, no server pings, or Socket Mode disabled), with the last automatic reconnect and any held-back one. The connections view shows connected; delivering or connected; delivery not yet confirmed (#1052).

A kernel that recovered reads ready. When a kernel's first start fails and its seats then recover, for example after rig seat continue, rig status now reports it ready, with a separate line naming the earlier failure. Before, it kept reporting bootstrap_failed, and its agent list could show a seat twice (#1044, fixing #1042).

NixOS. Claude Code seats installed from nixpkgs, whose claude is a wrapper around .claude-unwrapped, are recognised as Claude and read running. Before, every one read attention_required, and each rig send warned that the runtime couldn't be established. A seat that already carries an attention marker from an earlier failed launch keeps it until rig seat clear-attention (#1053).

Dependency and install-script changes

• npm dependencies: none added, removed or changed, and the Node requirement is unchanged (node >=22). OpenRig's own version fields in the package files and the lockfile advance to 0.6.9 (#1062).
• Install scripts: unchanged. The package's only lifecycle script is still postinstall: node scripts/check-abi.mjs.
• Database: one migration, 098, adds an index on the queue's transition history (qitem_id, transition_id), so a row's latest transitions are read without sorting its whole history (#1043).

Everything else since 0.6.8

Off by default. The refocus work packet is in this release, off by default; no change unless enabled (#1043).

Docs. The what-changed note, capability map and changelog were written for 0.6.9, and they now say rig launch takes a rig ID, not a rig name (#1063).

How it was tested

• The final package: openrig-cli-0.6.9-4b48ca21.tgz, 4,139 files, SHA-256 d1adf1c08f9fd9c8a8da2113c783f6420c60ec4df76e357e9bbc14aea817af07, built once from 4b48ca21 in a clean environment. Compared file by file with the published 0.6.8 package, 174 files changed, 4 were added (migration 098's compiled files) and none were removed, all traced to the twelve changes. Installed from that exact package, the installed checks passed, including migration 098 and provider-free checks of the changes in #997, #1036, #1047 and #1048.
• The first-user check ran on Linux only. A fresh non-sudo user on Ubuntu, with no display, gave a Claude Code session the website's skill line (npx skills add mvschwarz/openrig --skill rigs) and asked it to set up OpenRig. The agent installed the exact package and started OpenRig, and OpenRig's operator set up a two-agent team, which built and reviewed a small command-line tool: 20 minutes 17 seconds from the ask to finished, reviewed work. The skill also loaded in a new session. It had help: the package came from a local registry instead of npm, Claude Code was installed and signed in beforehand, its first-run screens and folder trust were done as setup, the person answered the one question the agent asked (installing npm packages under their own folder instead of with sudo), and the person approved 10 permission prompts. What it found is under Known issues. It didn't exercise a real Slack button press or typed reply.
• A real Slack decision was checked separately, on macOS, apart from the Linux first-user check above: the same package in an isolated install with no kernel and a test Slack app. The Slack input was real, sent by an agent driving a Slack web client signed in as a person. A button press on a decision was recorded and handed back to the seat that asked, and a typed reply in the decision's thread then reached that seat as a linked message. On a second open decision, a typed answer given instead of pressing a button was recorded as the decision's answer and handed back the same way. It didn't cover the kernel's operator as the asking seat.
• Each change ran the repository's automated tests, merged into the main of its day, before it merged. The tests ran again on the release commit itself and passed, the package tests on macOS and the other checks on Linux.
• Not tested: a first install on macOS or native Windows with this package; Codex, as the person's agent or on a team; the Herdr and Ghostty views and desktop apps; the TUI in a live session; and a first install by a person whose terminal isn't already inside tmux.

Known issues

• The latest first-install check used 0.6.9 on Linux only (Ubuntu, a fresh user, no display, Claude Code only), with the help listed under How it was tested. Install, setup, a two-agent team and reviewed work all ran. macOS was last checked with 0.6.8, and native Windows hasn't been checked. It found the next four items.
• **Attach commands can name t...

OpenRig 0.6.8

0.6.8 is mostly fixes, and most of them came from the community. One skill being edited in the managed catalog no longer stops every seat's skills, a launch plan can never start a seat by accident, Slack replies stay in their thread, a seat that stays quiet after compacting is still restored, and a workflow that could never finish is caught when you validate it. Twelve of this release's 21 changes came from nine outside contributors.

npm install -g @openrig/cli

It is built from main at aa126c74 (after #1041). Work merged to main after that point isn't in this release. If something breaks for you, please open an issue.

Before you upgrade

Restart the daemon after upgrading the CLI. The running daemon keeps its old build until it restarts: run rig daemon stop, then rig daemon start. There are no database migrations in this release, and the bundled openrig-core plugin stays at version 0.1.8.

Behaviour that changed:

• TUI keys. On an empty command line, j and k move the selection down and up (#1019). The footer toggle moved from f to F, and in a selected Scopes view the mini-requirements and narrative keys moved from m and n to M and N, so typed commands such as find, feed, mission, narrative and needs reach the command line whole (#1020).
• Workflows. rig workflow validate reports step_cannot_finish, and refuses to instantiate, when no allowed exit can finish a step or route onward. An allowed mapped exit is valid; in a dependency graph, handoff can finish a sink without a next step. A spec that validated on 0.6.7 can be refused now; the message names the step and the fix (#1012).
• Skill projection exit codes. rig context work-install --runtime <runtime> and rig skill loadout --runtime <runtime> report a selected skill skipped for uncommitted catalog content with exit 1. Inspection is the default; applying with --apply-skills or --apply, respectively, still reconciles the remaining clean skills. Exit 1 alone doesn't say whether files were changed (#1031).
• Launch plans. rig launch --plan refuses to send to a daemon older than 0.5.9, which would ignore the plan and launch (#1024).

Highlights

One skill being edited no longer blocks every seat's skills. Before, any uncommitted or untracked file in the managed skill catalog made the whole catalog unavailable, so rig context work-install, rig up, launch and restore preflight all failed for every seat. Now a skill with uncommitted content is skipped by itself and named in a warning, and the remaining clean skills stay available for projection (#1031).

• A seat that already has a copy of the skipped skill keeps that copy as it was. After the catalog change is committed or restored, the next applied projection can refresh it.
• No seat receives the skill's uncommitted files, whichever runtime it uses.
• A seat's launch only warns about a skipped skill; it doesn't fail.
• An uncommitted change to catalog.yaml itself still makes the whole catalog unavailable, because it changes what every selection means.

See a launch before it happens, safely.

• rig launch <rig> <seat> --plan now previews a single seat's launch, as --seats already could: the snapshot it would use, the target, and what happens to the other seats, without launching anything. It works over --host too (#1023).
• A daemon older than 0.5.9 ignores the plan flag and launches. rig launch --plan now reads the daemon's version first and refuses to send to such a daemon. If an answer comes back that isn't a plan but shows the daemon acted, the command exits non-zero and tells you to check rig ps --nodes -A before retrying (#1024).

Slack.

• When a person replies inside a thread OpenRig opened, an agent's answer with rig queue create --human-intent update --reply-to <that reply's row> now posts in the same thread, instead of as a new message (#1021). The messaging-the-human skill says how.
• When Slack rate-limits a post and asks for a pause of 10 seconds or less, OpenRig waits that long and retries the post once. A longer pause is still left to the usual retry of retained messages (#1026).
• The check that keeps the Slack bot token on Slack's own hosts now sits inside the private-file download itself, not only at its one caller (#1006).

A workflow that could never finish is caught at validate. Before, rig workflow validate passed a step with no exit that could finish it, and the workflow then stalled on that step. Now validate reports it, naming the step and how to fix it (#1012).

A quiet seat is restored after compaction. After a managed /compact, the turn boundary, the restore request and the read-depth audit now reach a Claude seat that takes no turn. Before, they waited for the seat's next turn, so a seat with nothing to do could sit unrestored until something woke it. Each stage still waits until the seat's screen shows it idle, and only a fresh usage reading can start a compaction (#1035).

The TUI keeps typed commands whole. Agents drive the TUI by typing, so every command now reaches the command line intact, and j/k navigate when the line is empty (#1019, #1020).

Dependency and install-script changes

• npm dependencies: none added, removed or changed. External dependency lock entries and direct ranges are unchanged, and the Node requirement is unchanged (node >=22). OpenRig's own version fields in the package files and the lockfile advance to 0.6.8 (#1038).
• Install scripts: unchanged. The package's only lifecycle script is still postinstall: node scripts/check-abi.mjs.
• Building from source: the CLI and TUI build scripts now finish their output with one Node script, scripts/prepare-workspace-build.mjs, instead of chmod, mkdir and cp, so they no longer need POSIX shell tools (#1033, originally contributed by @dajiaohuang in #956). This hasn't been run on Windows yet; WSL2 is still the way to run OpenRig there.
• Database: no migrations.

Everything else since 0.6.7

Launch, restore and seats. A Claude seat launched with --remote-control confirms its identity instead of staying "identity not confirmed" (#1025). rig down still saves its recovery snapshot when finding one seat's resume details fails, instead of skipping the snapshot for every seat (#1030).

Queue. A wake for a handed-off task now shows the task's summary on one line, up to 120 characters, so the woken seat sees what it's for (#1028).

Scope and proof. rig scope audit accepts slice folders numbered 100 and above, which rig scope slice create makes after 99 (#1016). rig proof add --file keeps a leading UTF-8 byte-order mark in the artifact instead of removing it (#270).

Docs. A topology naming reference explains how to name a team's pods and seats, from purpose to domain to role, and the rig spec, bundle and authoring guides point to it (#1000). The architecture and CLI reference docs were brought to the 0.6.7 release (#1015). The README, reference guides and architecture docs were brought to 0.6.8 (#1041), and the what-changed note, capability map and changelog written for it (#1039).

How it was tested

• The final package: openrig-cli-0.6.8-aa126c74.tgz, 4,135 files, SHA-256 b573304ffad3f4b3ed412d819de9c6fc587e5e2fbbe6c56ed1c099cc2d732b50, built from aa126c74. Compared file by file with the earlier candidate build from 4f7626e6, 82 files changed, all traced: the compaction fix's compiled files (#1035), the version fields and the packaged context-pack manifests that carry the version (#1038), the packaged what-changed note, capability map and reference guides (#1039, #1041), and the two build stamps. Installed into a fresh Linux server: the CLI and daemon reported 0.6.8 at aa126c74, clean; rig ps, help and specs ran; the starter and factory launch plans listed 2 and 7 seats; the workshop's create, inspect and install plan from the current registry passed; and the installed package served the 0.6.8 what-changed note and the capability map for 0.6.8. The same check confirmed four of this release's changes: a single seat's launch plan selected only that seat and changed nothing; a daemon older than 0.5.9 received no plan request and the CLI exited 1 with the upgrade message; a catalog skill with uncommitted changes was skipped while its clean sibling projected its exact fil...

OpenRig 0.6.7

0.6.7 is about the first hour. When your agent installs or starts OpenRig, it now opens the OpenRig TUI and the kernel's operator in front of you as the next step, laid out for your terminal's width. rig setup installs herdr for that view, the kernel's operator stops asking permission for routine checks, and a message or wake no longer answers a question that is waiting for you. Forty-two of this release's 120 changes came from ten outside contributors.

npm install -g @openrig/cli

It is built from main at b3c3c857 (after #1014). Work merged to main after that point isn't in this release. If something breaks for you, please open an issue.

Before you upgrade

Restart the daemon after upgrading the CLI. The running daemon keeps its old build until it restarts: run rig daemon stop, then rig daemon start. On its first start the daemon:

• runs two database migrations: it records each team's install folder (#901) and adds a table that maps a Slack ask's thread replies back to the ask (#947);
• installs the bundled openrig-core plugin at version 0.1.8 (#928, #965, #972, #975). Running seats pick it up when they next launch;
• copies two skills for your own Claude Code and Codex sessions into ~/.claude/skills and ~/.agents/skills: rigs, which takes an agent from installing OpenRig to a team doing the work (#967), and refocusing (#928). They're refreshed on every upgrade. A rigs copy you added earlier with npx skills add has no OpenRig marker, so it's left alone and not refreshed; remove it if you want OpenRig to keep it current.

rig setup installs herdr by default on macOS and Linux, by running herdr's own installer (curl -fsSL https://herdr.dev/install.sh | sh, into $HERDR_INSTALL_DIR or ~/.local/bin). Pass --no-herdr to decline it. If the install fails, setup warns and the view uses plain tmux. On a Mac, setup offers Ghostty once and installs it with Homebrew only when you pass --ghostty; --no-ghostty declines. Setup no longer installs or configures cmux, and an existing cmux keeps working. In rig setup --json, the cmux_install step is gone and herdr_install and ghostty_install appear (#936).

rig terminal open <view> opens a desktop window by default. To add tiles to a herdr or cmux workspace that is already open, pass --provider herdr or --provider cmux (#954). The default saved:kernel view's layout now depends on your terminal's width; a kernel view you saved yourself still wins (#978, #998). If you have your own herdr config, OpenRig uses it unchanged (#969, #998).

rig doctor checks Claude Code and Codex installs, and a login or configured provider credential for each, the way rig setup does, and exits 1 when either is missing or has neither, including a harness you don't use. Its output, and --json, gain claude_install, claude_auth, codex_install and codex_auth rows. A pass means a login or configured provider credential is available locally, not that a provider accepts the credential or that an agent can work (#924).

Defaults that changed:

• agents.advisor_session now defaults to the kernel's advisor seat, which every install has. rig restore-packet write without flags targets the seat's own rig (#937).
• rig bundle create, and rig up <GitHub link>, name a bundle after the name in its rig.yaml instead of my-bundle or github-bundle; --name still wins (#985).
• A periodic reminder first fires one interval after you register it, not immediately (#860).
• rig package validate, plan and install resolve relative paths, and the default --target ., from the folder you run them in, not the daemon's (#754).
• Managed Codex launches pass -c check_for_update_on_startup=false, so a Codex seat doesn't stop at Codex's update offer. Updating Codex is left to you or the operator (#986).

Claude seat settings that OpenRig rewrites: at a Claude seat's next launch, its status-line command in .claude/settings.local.json is written with quoted paths (#852), and its activity hook points at $OPENRIG_HOME/state/claude-activity-hooks/ instead of a script inside the project (#870). Claude team seats get a command hook in their launch settings that lets lifecycle help run without a prompt (#927), and the kernel's Claude seats get it too, with a wider allowance (#983). No settings file is written for either.

Highlights

Your agents open in front of you. After your agent installs or starts OpenRig, it now opens the OpenRig TUI and the kernel's operator for you as the next step, with rig terminal open saved:kernel --window, instead of waiting for you to ask (#998). The same command brings your agents back later.

• The layout follows your terminal's width. Under 120 columns the operator fills the first tab; from 120 columns the dashboard and the operator share it; the advisor always has its own tab (#978, #998).
• It opens where your agent runs. Inside herdr it opens as a focused openrig kernel space; in Terminal as a new window that copies the size of your front window when it can; in Ghostty as a new tab. From Claude Desktop, iTerm or VS Code on a Mac it opens a new Ghostty (1.3 or newer) or Terminal window at that app's default size, and macOS may ask you to allow that (#970, #998). On a Linux desktop it uses GNOME Terminal, Konsole or xterm and asks for a readable size (#952, #970). Opening the same herdr view again reuses the open workspace (#957), and your existing windows are never resized (#958).
• When no window can open, over SSH, in CI or with no display, the command says why and prints the exact command to run instead (#954, #970).
• In the TUI, the Open terminals action uses the same launcher, works without herdr, and shows per-seat attach commands when no window can open (#959).
• Your own agent knows how. The rigs skill, now installed for your Claude Code and Codex sessions (#967), carries the whole route from install to the operator: when the install is finished, how to hand the operator your goal, folder and branch, how to relay the operator's questions to you, and what to give you when no window can open (#909, #964, #971, #982, #988). CLI help, setup's next steps and onboarding point "show me my agents" and "the welcome screen" to the same command (#950).

Install with one command, preview first. The README, the getting-started guide and the help guide show a one-command install with a stable link, and a --dry-run preview that prints its four steps and changes nothing. If only provider sign-ins are left, the install itself finished (#917). If the agent installing OpenRig has a tool call refused by its own permission rules, the guides tell it to show you the refusal rather than report a failure (#950).

Fewer permission prompts.

• In Claude team seats, help on lifecycle commands, such as rig down --help and rig bundle install -h, runs without a prompt, and common spellings of allowed commands match too (quoted or absolute paths, env, command and exec, a project's vitest and jest). Real lifecycle actions still ask (#927).
• The kernel's operator runs routine inspection (cd, pwd, echo, wc, sort, python, command -v and WebFetch) without asking (#983), reads /rigs pages with WebFetch (#994), and runs its first-boot checks as separate commands (#932).
• Setup's permission question now matches the team default: it recommends keeping it and offers extra remembered allowances only if you want...

OpenRig 0.6.6

0.6.6 is about getting to your agents fast. After you install OpenRig, the kernel's operator greets you, asks what you want to build, offers three teams and launches the one you pick in your own project. Teams can now be shared and installed from a GitHub folder link, and the workshop, OpenRig's four-seat team for building in any repository, installs from openrig.dev/rigs with one command.

npm install -g @openrig/cli

It is built from main at 2620dea8 (after #900). Work merged to main after that point isn't in this release. If something breaks for you, please open an issue.

Before you upgrade

Restart the daemon after upgrading the CLI. The running daemon keeps its old build until it restarts: run rig daemon stop, then rig daemon start. On its first start the daemon adds a database column for the non-interruptive choice (existing rigs start with it off) (#737), and installs the bundled openrig-core plugin at version 0.1.4 (#685, #829). Running seats pick up the new plugin when they next launch.

The built-in teams have new names. The shelf is now starter (a Claude Code builder and a Codex reviewer), factory (a lead, an advisor, a builder, QA, design and two reviewers), the specialist teams code-review, research and pm, plus secrets-manager and the kernel (#864, #866, #868).

• rig up first-project still works and starts starter, with a note that the team's providers changed. first-project used two Codex seats; starter has a Claude Code builder and a Codex reviewer, so on a Codex-only machine ask the kernel's operator to adapt it.
• adversarial-review is now code-review, research-team is now research, and pm-team is now pm. There is no alias for these three.
• conveyor, demo, implementation-pair, product-team, first-project-claude, first-project-mixed and factory-rsi are no longer built in. Rigs you already created from them keep restoring.
• The implementer and QA agents no longer load the test-driven-development skill by default. The skill is still available.
• workshop isn't built in, so rig up workshop doesn't resolve. Install it from openrig.dev/rigs (see the highlights).

Team seats get permission defaults that need fewer prompts. A Claude Code or Codex seat in any rig other than the kernel, with no member or rig permission_policy, no permission choice saved for the seat, and (for Codex) no named Codex profile, gets a team default at its next launch, resume, fork or handover (#893).

• Claude Code: OpenRig passes an allow list and an ask list with the launch. rig commands, reads inside the project and common test commands (npm test, pytest, go test, cargo test and similar) run without a prompt. Lifecycle commands such as rig up, rig down, rig bundle install, rig seat stop and rig daemon stop still ask. Your own ask and deny rules still apply, and no settings file is written.
• Codex: the seat keeps the workspace-write sandbox and can also write OpenRig's workspace folder and its pod's state folder. Lifecycle commands don't ask yet (see Known issues).
• These are command allowances, not containment: a project's test command runs project code.
• To keep the previous behaviour, give the rig or member an explicit policy, for example permission_policy: none.

Kernel seats get operational authority. Seats of the rig named kernel with no explicit permission choice, member or rig policy, or (for Codex) named profile launch with a wider default, so the operator can install and run teams for you (#820, #858). Claude Code runs in acceptEdits with an allow list for file tools, reads under your home folder, and operational commands such as rig, tmux, npm, git, ssh and curl, plus claude auth status and codex login status. Codex runs unsandboxed with approvals off (-s danger-full-access -a never). Your ask and deny rules still apply to Claude. rig seat status reports the source as the kernel operational default. To keep the previous behaviour, set an explicit permission choice or policy on those seats.

New rigs with services get their own Docker Compose project. A new rig's default Compose project now comes from its rig ID instead of its name, so two rigs whose names sanitize to the same string no longer share containers (#481). Existing rigs keep their project. A rig created fresh, not as a same-name replacement, won't attach to containers or volumes under the old name-based project unless you set services.project_name. If service boot or every seat launch fails, the new project is brought down (never with volumes). When the generations being replaced use different projects and no project_name is set, rig up refuses with compose_project_conflict and starts no services. rig down exits 2 when it keeps a project that a live rig of the same name still uses.

Files a launch creates now show in git status. When a launch creates a new guidance file such as AGENTS.md or CLAUDE.md in a Git repository, OpenRig leaves it visible to Git and prints the exact line you can add to .git/info/exclude. New files under .codex/plugins/openrig-core/ are excluded automatically, in a marked OpenRig block in info/exclude; delete a line in that block to make a path visible again (#721, #727).

Slack catches up after a gap. On the first daemon start with Slack inbound configured, each channel gets a recovery checkpoint. From then on, top-level messages posted while the daemon was disconnected are delivered late as tasks marked "Recovered after a gap". History before the checkpoint stays unknown (#742).

Compaction restore maps move into the seat's workspace. Managed Claude compaction now writes the restore map at .openrig/compaction/preparation/<session>/<attempt>/RESTORE-MAP.md in the seat's launch folder, with a .gitignore that keeps it out of Git. Tools that don't read .gitignore (rsync, zip deploys, Docker build contexts without .dockerignore) still see the folder. The OpenRig home is used when the workspace is unknown or unwritable (#685).

Highlights

Meet the kernel's operator after install. On a fresh kernel the operator greets you first and asks, once, what you want to build or change (#858, #862). It offers three teams, starter, workshop and factory, with one recommendation and a drawing of each, and fits the chosen team to the providers you have by writing an adapted copy. It shows you the plan, launches only on your yes, shows you the team, and hands your goal to the team's lead as a queue task (#862, #880). The lead starts from that goal instead of asking again. For continuing work it records one mission and slice in OpenRig's workspace, not in your repository, and a question just gets an answer (#865). An agent that installs OpenRig for you now keeps the kernel running and passes your goal and project folder to the operator, instead of building the project itself (#873). rig setup prints how to reach the operator after ready, incomplete and dry-run results (#859, #886), and when the operator offers the workshop it reads the current pin from the registry's raw file, because a cached copy can be older (#900). The kernel advisor no longer assumes you're on macOS (#770). These are guidance changes for the agents: how closely an agent follows them is what OpenRig's journey runs check (see How it was tested).

See your agents. After installing, the agent opens a new terminal space with the kernel's TUI, advisor and operator (herdr, then cmux, then a plain terminal window) without taking over its own terminal (#821). rig terminal open saved:kernel now works without any saved-view file: it opens the TUI, the advisor and the operator side by side, for Claude-only, Codex-only and mixed kernels. A view you saved yourself under the name kernel still wins (#830, #854). Without herdr or cmux, setup, the TUI preview and a failed rig terminal open give an exact tmux or ssh -t attach command for each seat, and rig tui --shared is named as the dashboard, not the conversation (#831, #833, #878). Team views say the dashboard is the overview and the lead's pane is where you talk about the work (#884, #890). The TUI now goes straight to the work views once it has read the daemon, even when no rig is running; the Start page is still ...

OpenRig 0.6.5

0.6.5 collects what was merged to main since 0.6.4: new features, many repairs, and a large share of community contributions.

npm install -g @openrig/cli

It is built from main at b345706b (after #651), plus eight changes merged to main afterwards: #652, #653, #654, #656, #657, #658, #679 and #681 (ported as #687). Work merged to main after that point isn't in this release. If something breaks for you, please open an issue.

Before you upgrade

Check CODEX_HOME first. If your shell rc sets a CODEX_HOME different from the daemon's, align them (or unset the daemon's explicit selection) before upgrading. Managed resume now uses the daemon-selected home and does not search the other home for an earlier thread, so a Codex seat whose earlier conversation lives in the other home won't find it. Choosing a home is opt-in: with CODEX_HOME unset, a second install still shares ~/.codex. To give an install its own Codex home, set an absolute CODEX_HOME when you start its daemon. Running sessions aren't moved, and no login, history or settings are copied (#638).

Restart the daemon after upgrading the CLI. The running daemon keeps its old build until it restarts: run rig daemon stop, then rig daemon start. On its first start the daemon updates its database, including two new indexes on usage samples; how long that takes on a very large usage history hasn't been measured (#569). It also replaces the bundled openrig-core hooks and skills, now at plugin version 0.1.3. Running seats pick them up when they next launch (#568, #591).

Codex seats get network inside their sandbox. See the highlight below. To keep it off, set network_access = false under [sandbox_workspace_write] in your Codex config (#608).

Shell startup files no longer change a seat's OpenRig settings. Each launch now re-applies the daemon's OPENRIG_URL, OPENRIG_HOME and related settings, and puts the rig that matches the running daemon first on PATH, even if your shell rc sets something else (#618). A classic Claude launch now runs from a staged script; see Known issues for the shells where a claude alias or function still doesn't resolve.

Highlights

Reasoning effort per seat. Rig and agent specs accept effort on a pod member, in a profile's preferences, or in an agent's defaults. OpenRig passes it to Claude as --effort and to Codex as model_reasoning_effort on fresh launch, resume and fork. A spec without it launches exactly as before. OpenRig doesn't check the value, and Pi seats ignore it (#320). A Claude seat launched with effort passes OpenRig's exact identity check, so messages to it carry no unverified-identity warning and rig seat clear-attention can verify it behind a shell wrapper (#681).

Codex seats can reach the daemon under the default sandbox. On OpenRig's default workspace-write sandbox, Codex seats now get network access inside the sandbox, so they can reach the local daemon and do their queue work. Before each such launch, OpenRig reads your Codex configuration and adds the network setting only when you haven't made your own choice and no managed requirement restricts it. That read takes about 0.1 to 1.5 seconds; if it takes longer than 4 seconds, that launch keeps network off. Seats launched with a named Codex profile, full bypass or an explicit approval policy are unchanged. This hasn't been checked with real logins, managed policy bundles or on Linux (#608, toward #275). When something does block a rig command from reaching the daemon, the error now says the connection was blocked and the daemon may still be running, instead of telling the agent to start another one (#504).

Claude seats come back with the right conversation.

• After /clear, rig down and rig up bring back the current conversation, not the one from before the clear. At shutdown, OpenRig reads the live Claude process's session file and saves its current ID. When you shut down an archived rig whose seat name a live rig now uses, the refresh skips that live namesake, and the archived rig keeps its own saved conversation in its snapshot. Shutdown can take a little longer: it adds two process checks and a small file read, and a stalled process listing or file system can delay it. A /clear followed immediately by rig down, with no new message, was checked with a real Claude session on Linux: after rig up the seat came back to the empty post-clear conversation, not the earlier one. A conversation change in the moment between that read and shutdown hasn't been verified (#658).
• A fresh Claude launch records the session ID OpenRig assigned, so seats that share a Claude config folder no longer pick up each other's conversation. Forks still look the session up by name (#656).
• Managed Claude seats behind a shell wrapper or a native install are now confirmed from the native Claude process and the exact saved conversation ID, during restore, readiness checks, identity checks and rig seat clear-attention (#264, #335, #520, #554). Acknowledging a seat's attention no longer reports its conversation as resumed: continuity shows "unverified" unless there is strict restore proof (#652, #651).
• rig send and queue wakes reach a Claude seat whose launcher shim starts the real Claude binary (#567), and a seat whose conversation changed with /clear (#607; see Behaviour changes).

Compaction waits for a restore map. Managed Claude compaction now asks the seat to write a restore map for that attempt and waits for it before sending /compact. Automatic compaction waits up to 25 minutes. If no map arrives, that attempt stops and automatic compaction stays off for the seat until you run rig compact again, so an unprepared seat can reach its context limit instead. rig compact gains --state, --cancel and --skip-map (#610, #633). If OpenRig can't tell which occupant a seat holds, compaction stops with occupant_generation_unavailable and points to rig reconcile-session <session> --no-launch (#645). The bundled restore skill now writes a ranked map before compacting and reads down it afterwards, and the daemon's post-compaction prompts ask for the map's top entries instead of every packet file (#591). A post-compaction profile without a seat recap now loads with a warning instead of failing (#597). Automatic compaction acts only on fresh context readings (#464). These changes weren't tested against a real Claude compaction.

See what transcript capture costs your host. rig ps --resources (with --json and --host <id>) shows load per CPU, running seats and what transcript capture costs. Idle panes are captured less often, backing off to once every 6 seconds, so an idle seat's transcript can trail its pane by up to about 6 seconds. Changes to transcripts.lines and transcripts.poll_interval_seconds now reach running seats without a daemon restart (#556, #624, #536). Load average isn't CPU use, and capture time is time spent waiting for tmux.

Large fleets stay responsive. Activity, identity and structural sweeps read tmux in a few batched calls instead of one or more per seat (#293, #309). Slack sweeps skip building expensive queue views for items with nothing to post. On a synthetic 200-row queue, that was much faster when few items needed a post, and about 11% slower when none had been posted; it is still a scan of active rows. Based on korallis/agent-stack#139 by korallis and Lee (#642). Each seat's latest usage sample is found through an index instead of by sorting its history, based on korallis/agent-stack#137 (#569). Execution views no longer freeze the daemon while their Git checks run ([#557](https://github.com/mvschw...

OpenRig 0.6.4

0.6.4 is the code tested and published as the 0.6.4-rc.1 release candidate, now the normal release. Only its version and these notes changed.

npm install -g @openrig/cli

It was cut from main at afde814f, and since then it has changed only by the bounded changes described here: the repairs below, the web UI default, and browser access with its docs page. If something breaks for you, please open an issue.

Two changes you might notice

The web UI is off by default. The daemon no longer serves the web UI's pages or its terminal connection unless you turn it on with rig config set ui.enabled true and then stop and start the daemon. While it's off, opening the page shows those steps, and rig ui open prints them. The web UI is in maintenance mode; the CLI and the TUI are the supported ways to use OpenRig.

The daemon checks which address and which web page a request comes from. Nothing changes for the CLI, the TUI, agents, the queue, Slack, or other OpenRig hosts that reach this machine by its IP address, its own hostname or its own Tailscale name. Two cases now need one setting:

• If you reach the daemon by a custom DNS name, an /etc/hosts alias or a reverse-proxy domain, add that name to OPENRIG_ALLOWED_HOSTS.
• If a local app or development server on another port calls the daemon from a browser, add its origin to OPENRIG_ALLOWED_ORIGINS.

Each refusal says which setting to add, and both need a daemon restart. The details are in Browser access and allowed addresses (#358, #372).

Repairs made after the candidate was cut

These repairs went into the candidate after it was cut.

• Bundles keep binary files intact. rig bundle create re-encoded binary files in agent packages (#245, #257).
• Local commands reach the daemon you started. A daemon started with rig daemon start --port is now the one other commands talk to (#246, #266).
• A rig's only seat can be relaunched fresh. rig seat launch --fresh --stop on a single-seat rig no longer refuses after stopping the seat ended the tmux server (#265, #267).
• More time for Claude's capability check. A managed Claude launch with an explicit permission mode first reads claude --help. That check now gets five seconds instead of one. Answers arriving within the longer budget can succeed; a timeout can still refuse the launch. Slow answers were reported when several seats started at once (#260, #271).
• Seats launch after an upgrade removes the old version. Fresh launches and restores use the running version's built-in startup files instead of failing on paths into the removed install (#261, #269).
• Claude seats take messages after a full down and up. When a managed Claude seat resumes in auto mode, it accepts ordinary messages again once OpenRig confirms the same Claude process is running in its pane. A resume it can't confirm asks for your attention instead of starting a fresh conversation (#287, toward #273).
• Natively installed Claude is recognized. OpenRig recognizes a native Claude install behind its managed shell wrapper, including versioned install paths. When it can't observe the runtime, ordinary delivery goes ahead with a warning; a pane that is plainly an idle shell, or the wrong recipient, is still refused (#310, a follow-up to #197).
• Restoring an older Claude seat keeps an uncertain launch. If the resume check can't tell whether the conversation came back, the restore keeps the new session and asks for attention instead of closing it (#345, #346).
• Replacing proof files doesn't write through links. rig proof add --replace now swaps in a new file, so a symlinked or hard-linked artifact no longer overwrites the other path's contents (#307).
• Slack keeps long messages, and retry errors stay contained. A message from a registered person is stored with its complete text; before, anything past 1,800 characters was lost. A storage error while the gateway retries undelivered events is now logged instead of escaping (#361, #375, #404).

Everything else since 0.6.3

Messaging and delivery. An unverified runtime is reported separately from a stopped agent (#240). tmux reads use printable separators and a shell-free command path (#179, #167). Native process checks no longer depend on your locale (#239). Event subscriptions cancelled during replay are released (#233). CLI request deadlines cover the whole response, and a body that fails after its headers is reported as an unknown outcome (#201).

Queue, seats and rigs. A blocked row keeps its park timer through a seat handover, and a rerouted row's periodic timer is retired (#242). Closed queue items show the right pickup state (#176). Discovery claims survive background rescans (#237). A seat launch that times out reports an unknown outcome (#191). Attaching accepts runtime guards for existing nodes (#228). Kernel Claude seats get the shared activity hooks (#178). An unset native Claude config selection stays unset (#225). Importing YAML over a stopped rig with the same name archives the old one and shows its ID and unarchive command (#196).

Files, transfer and context. SSH, rsync and Herdr output keeps UTF-8 intact across chunks (#230, #241). Local rsync directory operands are preserved (#231). Atomic file edits keep the executable bit (#235). File-shaped entries are projected instead of failing (#185). Oversized suffix ranges are clamped (#234). Headings inside fenced examples aren't treated as context addresses (#236). rig env status says when a service receipt is stale (#232).

Platform and setup. Codex readiness works with providers other than OpenAI (#222). Removing Codex activity hooks leaves the rest of your config untouched (#186). Daemon liveness on Windows no longer uses ps (#173). Module URLs and transcript paths are portable (#168). ps rows whose command name contains spaces are kept (#82).

Onboarding and repository. The onboarding text that new seats read now covers both ways a build goes wrong, and the skills router says a project, rig or machine may add its own skills (#303). Release checks skip tag diffs when old tags are absent (#152), and security and integration PRs are asked for practical scenarios (#224).

Fixes merged to main after this candidate was cut, including many community contributions, aren't in this release. They'll ship in the next release, with their credits.

How it was tested

Most installed and real-agent results below come from earlier builds of this candidate. The final package received the package-content/stock check and the affected Slack component checks; unchanged-path evidence was carried forward through checked package deltas.

• Required checks: the integrated release changes passed their recorded CI runs. The release checks cover build and packaging, types, repository checks, package test suites and an installed-package scenario.
• Scripted checks without real agents: installed copies of candidate builds ran the repository's scripted checks. Three known failures remain: two cases in plugin usage reporting (#251, fixed on main for the next release), and rig proof add --file dropping a leading byte order mark from the stored file ([#250](https://github.com/mvschwarz/openrig/i...

OpenRig 0.6.4-rc.1 release candidate

This is a prerelease of 0.6.4 for people who want to try it before it's stable. The current stable release stays 0.6.3, so a normal install or upgrade doesn't pick this up.

npm install -g @openrig/cli@rc

It was cut from main at afde814f, and since then it has changed only by the bounded changes described here: the repairs below, the web UI default, and browser access with its docs page. If something breaks for you, please open an issue and say you're on the release candidate.

Two changes you might notice

The web UI is off by default. The daemon no longer serves the web UI's pages or its terminal connection unless you turn it on with rig config set ui.enabled true and then stop and start the daemon. While it's off, opening the page shows those steps, and rig ui open prints them. The web UI is in maintenance mode; the CLI and the TUI are the supported ways to use OpenRig.

The daemon checks which address and which web page a request comes from. Nothing changes for the CLI, the TUI, agents, the queue, Slack, or other OpenRig hosts that reach this machine by its IP address, its own hostname or its own Tailscale name. Two cases now need one setting:

• If you reach the daemon by a custom DNS name, an /etc/hosts alias or a reverse-proxy domain, add that name to OPENRIG_ALLOWED_HOSTS.
• If a local app or development server on another port calls the daemon from a browser, add its origin to OPENRIG_ALLOWED_ORIGINS.

Each refusal says which setting to add, and both need a daemon restart. The details are in Browser access and allowed addresses (#358, #372).

Repairs made after the candidate was cut

These repairs went into the candidate after it was cut.

• Bundles keep binary files intact. rig bundle create re-encoded binary files in agent packages (#245, #257).
• Local commands reach the daemon you started. A daemon started with rig daemon start --port is now the one other commands talk to (#246, #266).
• A rig's only seat can be relaunched fresh. rig seat launch --fresh --stop on a single-seat rig no longer refuses after stopping the seat ended the tmux server (#265, #267).
• More time for Claude's capability check. A managed Claude launch with an explicit permission mode first reads claude --help. That check now gets five seconds instead of one. Answers arriving within the longer budget can succeed; a timeout can still refuse the launch. Slow answers were reported when several seats started at once (#260, #271).
• Seats launch after an upgrade removes the old version. Fresh launches and restores use the running version's built-in startup files instead of failing on paths into the removed install (#261, #269).
• Claude seats take messages after a full down and up. When a managed Claude seat resumes in auto mode, it accepts ordinary messages again once OpenRig confirms the same Claude process is running in its pane. A resume it can't confirm asks for your attention instead of starting a fresh conversation (#287, toward #273).
• Natively installed Claude is recognized. OpenRig recognizes a native Claude install behind its managed shell wrapper, including versioned install paths. When it can't observe the runtime, ordinary delivery goes ahead with a warning; a pane that is plainly an idle shell, or the wrong recipient, is still refused (#310, a follow-up to #197).
• Restoring an older Claude seat keeps an uncertain launch. If the resume check can't tell whether the conversation came back, the restore keeps the new session and asks for attention instead of closing it (#345, #346).
• Replacing proof files doesn't write through links. rig proof add --replace now swaps in a new file, so a symlinked or hard-linked artifact no longer overwrites the other path's contents (#307).
• Slack keeps long messages, and retry errors stay contained. A message from a registered person is stored with its complete text; before, anything past 1,800 characters was lost. A storage error while the gateway retries undelivered events is now logged instead of escaping (#361, #375, #404).

Everything else since 0.6.3

Messaging and delivery. An unverified runtime is reported separately from a stopped agent (#240). tmux reads use printable separators and a shell-free command path (#179, #167). Native process checks no longer depend on your locale (#239). Event subscriptions cancelled during replay are released (#233). CLI request deadlines cover the whole response, and a body that fails after its headers is reported as an unknown outcome (#201).

Queue, seats and rigs. A blocked row keeps its park timer through a seat handover, and a rerouted row's periodic timer is retired (#242). Closed queue items show the right pickup state (#176). Discovery claims survive background rescans (#237). A seat launch that times out reports an unknown outcome (#191). Attaching accepts runtime guards for existing nodes (#228). Kernel Claude seats get the shared activity hooks (#178). An unset native Claude config selection stays unset (#225). Importing YAML over a stopped rig with the same name archives the old one and shows its ID and unarchive command (#196).

Files, transfer and context. SSH, rsync and Herdr output keeps UTF-8 intact across chunks (#230, #241). Local rsync directory operands are preserved (#231). Atomic file edits keep the executable bit (#235). File-shaped entries are projected instead of failing (#185). Oversized suffix ranges are clamped (#234). Headings inside fenced examples aren't treated as context addresses (#236). rig env status says when a service receipt is stale (#232).

Platform and setup. Codex readiness works with providers other than OpenAI (#222). Removing Codex activity hooks leaves the rest of your config untouched (#186). Daemon liveness on Windows no longer uses ps (#173). Module URLs and transcript paths are portable (#168). ps rows whose command name contains spaces are kept (#82).

Onboarding and repository. The onboarding text that new seats read now covers both ways a build goes wrong, and the skills router says a project, rig or machine may add its own skills (#303). Release checks skip tag diffs when old tags are absent (#152), and security and integration PRs are asked for practical scenarios (#224).

Fixes merged to main after this candidate was cut, including many community contributions, aren't in this prerelease. They'll ship in the next release, with their credits.

How it was tested

Most installed and real-agent results below come from earlier builds of this candidate. The final package received the package-content/stock check and the affected Slack component checks; unchanged-path evidence was carried forward through checked package deltas.

• Required checks: the integrated release changes passed their recorded CI runs. The release checks cover build and packaging, types, repository checks, package test suites and an installed-package scenario.
• Scripted checks without real agents: installed copies of candidate builds ran the repository's scripted checks. Three known failures remain: two cases in plugin usage reporting (#251, fixed on main for the next release), and `rig proof add --f...

Published: @openrig/[email protected] is available on npm as latest.

npm install -g @openrig/[email protected]

OpenRig v0.6.3 — Managed Claude messaging repair

This patch repairs a 0.6.2 regression that refused messages to running Claude
Code seats launched with an explicit permission mode. It also fixes snapshot
helper cleanup and interference from archived rigs with duplicate names.

Managed Claude seats can receive messages

OpenRig's managed launch can leave a shell wrapper in front of Claude Code.
The delivery check previously treated that wrapper as a bare shell and refused
rig send, even though Claude was running beneath it.

The check now recognizes a stable, foreground Claude process descended from the
bound pane, with the expected native session identity. A bare shell alone still
does not qualify. Fork arguments that identify the parent rather than the
current occupant remain insufficient evidence.

Thanks to @dmelo for the detailed
#197 report, addressed by
#220.

Snapshot helpers and archived rigs

• Clean up a newly created snapshot helper when its input target cannot be
  established and its ownership can still be proven. This prevents unusable
  rigged-refresh-* helpers accumulating on repeated attempts. If ownership
  cannot be established, preserve the session and report the limitation.
  Thanks to @z4cc for
  #188, addressed by
  #189.
• Exclude archived rigs from seat-reference resolution, prefer unarchived
  delivery targets, and preserve another live seat's session and queue work
  when removing a stale duplicate node. Removal reports whose session it kept.
  Thanks to @Farkinell for
  #174, addressed by
  #181.

Proof media and repository checks

rig proof add rejects binary files supplied as artifact text, requires a
Markdown artifact name, and requires --replace before overwriting an existing
artifact. Attach screenshots and other binary evidence with --media. This
prevents a proof write from replacing media with a Markdown body
(#177). Thanks to
@agammann for the fix and
@korallis for reporting
#170.

Repository script tests now run serially because packaging tests rebuild daemon
output that other tests import. This removes the reproduced shared-output race
without weakening those tests
(#221).

Upgrade and verification scope

Node.js 22 and 24 remain supported. This patch changes no dependencies, engine
requirements or database migrations. Use the
existing upgrade procedure.

The fixes have source reviews and focused regression coverage. The Claude
process checks use synthetic process metadata; an installed Claude/Fedora send
has not been demonstrated by that evidence. These checks do not establish
native receipt, automatic recovery, or protection against a process exiting
between verification and input.

Release commit: 8b5e948807e258aa659862064258e41da9e3eaa9.

Published: @openrig/[email protected] is available on npm as latest.

npm install -g @openrig/[email protected]

OpenRig v0.6.2 — first-project and recovery fixes

Choose your providers, give an owner one useful change in your repository, and
have a second agent check the result. OpenRig 0.6.2 adds first-project choices,
clearer permission guidance and repairs for bundle installation and agent delivery.

A small team and one useful result

The first-use guide offers the same owner and
checker workflow with three recipes:

Use the accounts you already have; an unused provider's installation or login is
not a prerequisite. Codex seats retain gpt-6-astra; Claude seats use the native
configured default. Check model access before launching. Automatic kernel startup
continues to select independently from available authenticated providers.

Agent-guided setup asks once whether to allow OpenRig commands without repeated
permission prompts, with Yes recommended. An explicit Yes authorizes native
rig command rules at personal project scope unless you choose user-wide scope.
No or no answer leaves settings unchanged. The allowance includes lifecycle and
configuration commands, but does not grant general shell access or change sandbox
and network settings. The guide covers applying, checking and undoing the rules;
bootstrap does not silently apply them
(#147).

Bundle files stay where you install them

Schema-version-2 bundles now copy their verified contents into --target and
launch from there, keeping relative working directories and agent references
available after temporary extraction is removed. Different files at a bundle
path cause target_conflict before copying; identical files can be reused.

Without --target, rig up <file>.rigbundle installs into your current directory, so run it from the project folder you want.

rig bundle create|inspect|install and local rig up --target resolve relative
paths against your current directory. Files still live on the daemon's host;
this is not an upload. Install launches the rig. Legacy version-1 behavior and
the separate --cwd override are unchanged. See the
bundle guide
(#146).

Delivery and restore diagnostics

Managed launches after a tmux/host restart preserve the named launch target
instead of confusing it with an old bare pane binding. The existing identity
checks still apply to each write. Thanks to
@diaztunjano for reporting
#141, addressed by
#151. Actual reboot and power-loss
recovery remain subject to the verification limits below.

Message delivery now refuses a known bare-shell foreground when an agent runtime
should be running, so the message is not entered as shell commands. Terminal-only
seats still receive text; unreadable or unknown foregrounds retain the existing
advisory behavior (#150, fixes
#142).

Community fixes

• Local sender identity: recognize a sender qualified with this daemon's own
  host ID as its local seat, avoiding false ownership refusals. Foreign host
  qualifiers and destination handling stay unchanged. Thanks to
  @korallis for
  #135, and
  @Yi-111-a for the additional cases from
  #137, included through
  #144.
• Terminal and status details: parse tmux window fields with printable
  separators (#101); distinguish
  health that was not requested from a failed read
  (#102); use native realpath for
  Codex hook trust (#103); pass
  known Claude/Codex runtime hints to Herdr
  (#106); report missing fresh
  startup context or adapters as needing attention
  (#107); accept numeric Claude
  rate-limit reset timestamps (#108).
  Thanks to @dajiaohuang.
• Pi input and portable checks: retain line editing with TERM=dumb, and
  correct macOS path and timezone assumptions in tests. Thanks to
  @shravansumanthanan for
  #123.
• Configured restore paths: restore-check uses the configured shared-docs
  root. This does not repair every issue in
  #130. Thanks to
  @jbaehova for
  #139.
• Anthropic gateways: permit ANTHROPIC_BASE_URL in configured provider-auth
  environment forwarding. Thanks to @FenjuFu for
  #143.
• Terminal authentication maintenance: reuse the shared token-comparison
  helper. Thanks to @Sunil56224972 for
  #145.

Also in this release

• Mixed Claude/Codex projects: shared skills are now also placed where Codex
  looks for them, even when a matching Claude copy exists. Edited Codex skills are
  kept unless you force an overwrite. Thanks to @a4w-h4y
  for diagnosing #159, fixed by
  #162.
• Slow polling no longer piles up: identity and transcript polling no longer start
  overlapping work on every tick when a sweep runs slowly. This prevents accumulated
  overlap; it is not a measured overall CPU reduction, and polling cadence is
  unchanged. Thanks to @korallis for reporting
  #161, addressed in part by
  #169.
• Codex behind managed shell wrappers: messages and queue nudges reach a ready
  Codex seat launched through a managed shell wrapper, instead of being refused as a
  bare shell. The existing process-identity and input-readiness checks are retained
  (#171).

Upgrade and verification limits

Node.js 22 and 24 remain supported; Node 20 is unsupported. This maintenance
change adds no dependency, engine or database-migration change. Follow the
existing upgrade procedure.

Verified on an installed 0.6.2 test machine: a two-agent Codex team (owner and
checker) completed a native handoff, an independent review and the owner's closure.
After a graceful reboot, and again after a hard power-off, the same Codex pair resumed
useful, reviewed work. Recovery used a manual daemon start and resuming the existing
rig; it was not automatic. Checked task files, queue records and saved history prefixes
were preserved, but a checkpoint written just before the hard power-off was lost, so
this is not a general crash-durability guarantee.

Not yet verified: Claude-only and mixed-runtime starters; the scope, loading and
revocation of the OpenRig command-permission rules; and any overall CPU improvement.

Slack app manifest/setup assistance and Rig Stream classification remain
experimental, with no new real-app or provider-run validation here. The existing
Slack connector is not experimental. See the
retained limitations.

Release commit: f8f3aff68bf425735173df9e2c5ac5ef19716f5b.