#10 feat(agents): Mistral Vibe as a fourth agent runner, in beta

[Anonymous]

Originally created by: imshaikot

What and why

Closes [#9].

The side panel ran on Claude Code, Codex or Antigravity. This adds Mistral Vibe (vibe) as a fourth, marked beta, so a Le Chat subscription or a Mistral API key is a way in too.

It is the first file-configured runner with real containment: --enabled-tools is a per-run allowlist, so Vibe's shell and file tools are never loaded — the allowlist class, alongside Claude Code.

vibe --prompt <instruction> --output streaming --trust --agent ask
     --enabled-tools 'browsentic_*' [--resume <sessionId>]

The MCP server, the picked model and the tool permissions go into a .vibe/config.toml written into the run's own folder under ~/.browsentic/agents/vibe/run/<runId>, with the system prompt as AGENTS.md beside it. The user's ~/.vibe/config.toml is read for their key and models and never written, so there is no check() / grant().

What had to change outside runners/vibe.ts

Change	Why
Runner.endsOnExit	Vibe's stream has no closing event. runStream rejected any run that closed before the reader called done; a runner can now say exit code 0 is the end of the turn. A non-zero exit still fails through hint()
StreamContext.mcpTools	Vibe looks permissions up by exact tool name, MCP tools default to ask, and headless turns an ask into a refusal. So every tool is granted by name, from the daemon's live list (AgentSessionDeps.actionNames) — a drifted extension manifest is still covered. agentRunToolNames() in tool-names.ts shares the status/site-map/focus-shot names with the MCP server rather than restating them
Requirements.allows in spawn.ts	vetPlan now asserts that nothing outside the expected names ever follows --enabled-tools, and that the flag is present at all — an empty list means every tool
FORBIDDEN gains --auto-approve	The alias of --yolo, which was already there. Checked for every runner
MISTRAL_ sealed, MISTRAL_ / VIBE_ kept for Vibe	MISTRAL_API_KEY reads as a credential and was being sealed out of the run; it is now Vibe's own, and lost by the other three

--agent ask pins the approval profile, so a user whose default_agent is auto-approve does not carry that into a browser run.

The reader

• takes the session id from any entry — they all carry sessionId
• drops replayed history. --resume re-emits the whole conversation before the new turn; entries whose createdAt predates the reader are skipped
• emits each completed assistant message as text, separated by a blank line
• reports only Vibe's own tools (web_search, web_fetch) — Browsentic's MCP calls already report themselves

One-shot tasks get no MCP server, and either read_file alone or re:^$, a pattern no tool matches.

Known differences, documented rather than fixed

• A reply arrives a message at a time. Vibe's headless stream carries completed entries, never token deltas.
• No token counts, so the context card says so, as it does for Antigravity.
• No effort names. Reasoning is a thinking key in Vibe's own config.

Verification

• yarn check — both type-checks, 40 toolkit checks, 596 security checks (15 new: both plans contained in both modes and with research/reads, the config grants by name and never a local tool, a task carries no MCP server, and tampering — bash, *, a dropped allowlist, a task reaching the browser, --auto-approve, --yolo, another approval profile, a lost config — is each caught)
• Synthetic stream through reader(): session, replay skipped, MCP call not double-drawn, web_search reported, two messages separated, junk lines ignored
• A stub vibe through the real runStream: clean exit resolves with stopReason: end_turn and the session id; exit 1 with Vibe's missing-key message becomes the vibe --setup hint; MISTRAL_API_KEY reaches the child and AWS_* does not
• The probe: ready with the stub on PATH, AGENT_MISSING with uv tool install mistral-vibe as the fix without it

Not verified: the real CLI. Vibe was not installed and there was no Mistral key. The entry field names (sessionId, createdAt, detail.toolName) come from reading Vibe v2.25.5's source, not from captured output. Before the beta label comes off: uv tool install mistral-vibe && vibe --setup, yarn daemon:restart, browsentic agent vibe, then one instruction and a follow-up in the same conversation — that exercises the config trust, the by-name grants and the replay skip in one go.

Checklist

• [x] yarn check is green locally
• [ ] Registry touched → yarn daemon:manifest run, and docs/reference/tools.md in step — not touched
• [x] Docs travel with the change
• [x] Commits follow the log's convention (feat(actions): …, fix(daemon): …)

[Anonymous]

Ticket changed by: imshaikot

• status: open --> closed