agentproto 0.8.0 — the daemon makes decisions so you don't have to

0.8.0 released 2026-07-17 · npm i -g @agentproto/cli · source · Apache-2.0

If you've been running an agent daemon you've hit the wall. The agent finishes
its work, runs the tests, everything passes — and then it stops. Not because it's
done. Because it's waiting for you to click "Approve."

0.8 is about tearing that wall down.

No breaking changes in this one. Upgrade and the daemon gets smarter; your
existing config stays intact.

permissions watch: your agent stopped asking permission

When an agent pauses mid-turn to ask "should I run this command?", the daemon
parks it in a durable inbox. Until 0.8, someone — you, or a supervising agent —
had to answer explicitly. That's the right default. But after the hundredth
npm install you've approved in a row, it stops being safety and starts being
noise.

agentproto permissions watch --rule 'command:npm:*:allow' \
                             --rule 'command:git:status,diff,log:allow'

A watch is a persistent rule that auto-resolves matching permission requests
before they ever surface in the inbox. The agent pauses for exactly as long as it
takes the daemon to check the rule — sub-millisecond. You never see the prompt.

The rule grammar is kind:adapter:action:decision:

# Allow all git reads, deny force-pushes
command:git:status,diff,log,show,branch:allow
command:git:push.*force:deny

# Allow file writes in the project tree (but nowhere else)
write:**/src/**:allow
write:/etc/**:deny

A watch is a live daemon session you start once and forget. It survives agent
restarts, adapter swaps, model changes — it lives at the daemon layer, not the
agent layer. agentproto permissions watch --list shows what's active;
--remove <id> kills one.

This is the feature that makes the permission-hold inbox from 0.6 actually
usable at scale. Before, answering every prompt yourself was exhausting.
Auto-approving everything was reckless. permissions watch gives you the middle
ground: you decide the policy once, the daemon enforces it forever.

Worktree isolation as policy, not convention

agent_start has accepted worktree: true since 0.6. It was opt-in — if you
remembered to set it, your parallel agents couldn't collide on the working tree.
If you forgot, they could.

0.8 makes it a daemon-level policy:

{
  "defaults": {
    "worktrees": { "isolation": "always" }
  }
}

always means every root spawn gets its own worktree, no matter what the caller
passes. A spawn that would have landed directly in your main working tree now
lands in a fresh worktree instead. The caller can't opt out — that's the point of
a policy.

never means the opposite: worktree isolation is disabled daemon-wide, and a
spawn that requests it is rejected rather than silently ignored. (A CI box with
ephemeral runners has no worktree to isolate.)

The default is permissive — today's behaviour — so nobody's setup changes
unless they choose to tighten it.

This is the pattern: take a thing that required discipline and turn it into a
thing that's enforced. The daemon's job isn't to suggest best practices. It's to
make the unsafe path harder than the safe one.

Your CI can speak agentproto now

- uses: agentproto/agentproto-run@v0
  with:
    prompt: "run pnpm test, fix every failure, commit, open a PR"
    adapter: claude-code
    model: claude-sonnet-5
    worktree: true
    gate: "pnpm test"

agentproto/agentproto-run is a composite GitHub Action that boots the daemon,
spawns the agent session, waits for it to finish, runs the gate, and reports the
result. It's the same path agentproto run takes locally, wrapped in a CI step.

Underneath it's the generic agentproto-run lane — the same one the review-fix
loop uses. Any adapter, any model, any gate, in CI or on your machine. The
composite action is just the GitHub-shaped packaging of it.

Why this matters: until now, putting an agent in CI meant wiring up your own
Dockerfile with the daemon, the adapter, the credentials, the gate script, and
the exit-code plumbing. agentproto-run collapses that into one step. It's what
lets the review-fix-demo from 0.7 reuse a session across turns on the same CI
lane — the session stays alive, the lane re-prompts it.

The LLM endpoint learned to say "try again"

A stripped model — one whose safety layer removes the entire response — returns
an empty completion. To the caller it looks exactly like a network timeout:
nothing came back, retry.

0.8's LLM endpoint now replays the turn once when a provider returns zero
content. If the second attempt also comes back empty, it surfaces the emptiness
explicitly rather than silently dropping it. The caller gets a real error instead
of a mystifying hang.

Also in this release: the Requesty gateway is a first-class preset. Route your
calls through it the same way you route through OpenRouter or Moonshot —
agentproto providers set requesty $REQUESTY_API_KEY and it's live. The
transparent pack is committed in the repo, so the route is auditable.

Skills are now built, not hand-copied

The skill directory in ~/.agentproto/skills/ used to be a hand-maintained copy
of what lived in the monorepo's packages/. That meant the two drifted. 0.8
adds a build step — pnpm build in the skill-pack packages — that produces the
directory from source. Hand-copied .skills/ is retired.

This is infrastructure, not a feature you'll notice directly. But it's the
reason the permissions watch skill ships on day one instead of waiting for
someone to remember to copy it over. Every package under packages/ that
declares a skill manifest is now part of the build graph.

The getting-started path works end to end

0.8 rewrites the quickstart as one verified path: install, serve, spawn, prompt,
read output. Every step was walked by a fresh machine with no prior agentproto
state. If friction was found, it was removed or documented.

The old quickstart assumed you already knew what an MCP server was and why you'd
want one. The new one starts from "you have a coding agent, here's what happens
when you give it a supervisor." That's the right frame for someone who hasn't
been living in this repo.

Also in the box

• Codex model selection fixed. Codex spawns now receive the model as a CLI argument instead of ACP session config — the old path was silently ignored, and every Codex session ran on the default model regardless of what you asked for.
• Zero-credential users get a helpful message. If you don't have credentials configured for an adapter, the daemon tells you how to configure them instead of telling you to go buy a subscription. Two very different things.
• Provider-key env aliases. GOOGLE_API_KEY is now injected alongside GEMINI_API_KEY, so providers that expect one but not the other don't fail silently. The mapping lives in the catalog, not in every adapter.
• Worktree NUL-byte bug fixed. A literal NUL in a worktree status file made grep, git, and file all treat it as binary. The fix isn't glamorous, but a worktree that can't be ls-ed is worse than no worktree.
• Release notes don't overwrite themselves. A same-day second batch of releases no longer wipes the first one's notes. Small thing. Cost me a changelog entry once.

The arc from 0.5 to 0.8

Four releases in two weeks. Look at the shape:

Release	Theme
0.5	Credentials, sandboxes, cost accounting
0.6	Pairing, E2E encryption, permission inbox
0.7	Extension polish, session story, the things 0.6 got slightly wrong
0.8	Autonomy — the daemon resolves permission, isolates worktrees, and runs in CI without a human in the loop

0.5 was "the daemon knows who you are." 0.6 was "the daemon reaches other
machines securely." 0.8 is "the daemon makes decisions so you don't have to."

The direction is intentional. A supervisor that needs supervision isn't one.
Every release moves one more decision from the human to the daemon — not by
guessing, but by enforcing a policy you declared once.

Upgrading

npm i -g @agentproto/cli

No breaking changes from 0.7. permissions watch and worktree isolation policies
are additive — they don't touch existing behaviour unless you activate them.

---

Previously: 0.6 + 0.7 — pair two machines through a broker that can't read your traffic · 0.5.0 — credentials, sandboxes, and cost accounting that refuses to lie · 0.4.0 — the daemon grows up into a supervision surface

agentproto is an open-source (Apache-2.0) orchestration layer that runs on top
of your existing stack — it doesn't replace your coding agent, it supervises it.
File an issue.

Building agentproto in the open — follow @theagentproto and @agentik_ai on X.