OpenRig 0.7.9

OpenRig 0.7.9 follows through on 0.7.8. A person's typed words on a runner seat's permission ask now reach the agent, each permit OpenRig grants a runner by default is recorded, and a runner can keep a long, quiet turn reading working. New stream observations go to the queue worker by default. Fresh Pi seats, and fresh Codex seats on Codex 0.164.0 or later, can keep OpenRig's guidance out of your repository's AGENTS.md. There are fixes across delivery, asks, handover, install and recovery, many reported or contributed by people using OpenRig. The OpenShell worker that wasn't usable in 0.7.8 still isn't usable in 0.7.9; read The OpenShell worker before relying on it.

Before you upgrade

• Restart the daemon after installing: bash npm install -g @openrig/cli@0.7.9 rig daemon stop && rig daemon start Four migrations (146 to 149) run on the first start.
• Stream intake is on by default. Each rig stream emit now opens an intake row for the kernel queue worker (queue.worker), or adds a note to the one still unclaimed. The row wakes the queue worker like any queue row, and earlier stream history isn't replayed. To keep 0.7.8's behaviour, with no intake rows, run this after installing: rig config set stream.intake off. (#2321, by @Totopo27)
• The bundled openrig-core plugin advances from 0.1.24 to 0.1.25: its seat-continuity-and-handover skill changed. Managed refresh preserves replaced files under $OPENRIG_HOME/backups/managed-refresh/<id>/; reapply local edits you still need from that copy. (#2420, #2554)
• If you run an OpenShell environment, rebuild its guest image with this release's helper (daemon/assets/openshell/README.md). An older helper rejects the new startup step, and the error names the rebuild. (#2418)

Runner seats

• A person's typed words reach the agent, and the ask says what they do. A reply of just yes or no counts as the agent's allow or reject. "Any other words choose nothing": OpenRig's default permits the request when the agent offered an allow option, and the words come back whole in the read result as said. Section 7 of docs/reference/harness-runner-contract.md lets a runner queue them for the agent "as an ordinary prompt" after the current turn: "They're never the answer." (#2363, #2561)
• Each permit OpenRig grants by default is recorded, once, as a stream item from the seat: when no one can be asked, and when an ask is closed without a choice (a row passed to an agent seat included). The record names the tool call, why no person answered, the option the agent got with its kind, and the request or ask. Read them with rig stream list --tag runner-permission-permit. A record has no destination, and one that can't be written doesn't change the permit. Stream intake reads past it, so it opens no intake row and wakes no one. (#2361, #2563)
• A working beat keeps a long, quiet turn reading working (section 4); a runner that sends none behaves as before. The Pi runner and the dsh example post it, and the conformance check covers it and no longer falsely fails a correct runner on a busy machine. (#2370, #2336, #2368, #2375, #2530)

The OpenShell worker

The OpenShell worker still doesn't work in 0.7.9. Don't rely on this path.

0.7.9 repairs the layer that stopped it in 0.7.8: in our release testing the guest's agent now starts and reaches its first input. Startup reaches the guest through a hash-checked first-input file, and nothing is typed through the host viewer; the case where the viewer exits wasn't run in our release testing. Readiness checks the guest's own execution, and a failed owned delete reports the stage that failed. (#2418, #2404)

Our release testing on 0.7.9 then found two more problems:

• The worker can't reach its model. The guest's Claude starts, but every API call fails with SELF_SIGNED_CERT_IN_CHAIN. The guest launcher builds a clean environment and leaves out the CA settings the OpenShell exec supplies (NODE_EXTRA_CA_CERTS, SSL_CERT_FILE, REQUESTS_CA_BUNDLE and CURL_CA_BUNDLE).
• Deleting an owned environment doesn't run. Its inventory step misreads a "Not Found" reply, so the delete is never sent and the owned resources stay. In our test they were removed with the vendor's own cleanup.

Attached resources were kept, as intended, and the worker stopped cleanly. With the four CA settings passed through by hand, a worker did useful work; a verified export, an exact restore and a finished task weren't shown. Fixes for both problems are on main (#2602, #2603). They aren't in 0.7.9 and haven't been run end to end.

Assistants connected through a grant service (experimental)

Experimental and unsupported. Off by default. Use at your own risk. This path needs a grant service that you supply and run; ordinary use of OpenRig doesn't need one. With rig mcp serve --http --grant-service <url>, a connected assistant can now claim, update and park the rows addressed to its own seat, and see its team with rig_team, within the scope its existing tools have. Serving MCP over HTTP behind your own tunnel "is like opening a port in your firewall." See docs/reference/hosted-members.md. (#2384)

For client authors

New daemon reads, two of them by @dajiaohuang: people and the default person, a person's open updates without Slack, a rig's messages in one request, and Slack channels and people without the client holding the bot token. An opt-in decisionRevision lets a client settle exactly the decision its person reviewed. docs/reference/daemon-http-clients.md covers them. The people, updates and messages reads pass their route tests, but no real client used them in our release testing. (#2495, #2497, #2496, #2501, #2448, #2490)

Seats, delivery and the TUI

• Delivery: fewer deliveries held or misdirected on Claude seats (prompt suggestions, wrapped lines, a wake's own paste, the Theme picker, quoted permission questions); held messages are announced when a seat starts or changes occupant; undelivered reminders retry; a stalled tmux client is ended after 30 seconds.
• Status and receipts: idle Claude and busy Codex seats read correctly in more layouts; stale window samples expire, so a seat whose pane can't be read reads unknown rather than its last verdict; uncertain sends read unconfirmed or indeterminate instead of delivered, lost or failed.
• Guidance and handover: an edited culture or startup file reaches the next start, while your own edit to a managed block is kept; shared CLAUDE.md and AGENTS.md files stop growing; handover successors get their guidance and a list of their startup files; several Claude rebuild and resume failures are repaired.
• Asks: in a shared workspace, any registered person can settle another's ask and the first answer wins; a person may have no connector binding; Slack records a click on a re-parked ask and marks asks handled.
• Install and hosts: the upgrade skill backs up without the sqlite3 CLI when Node has node:sqlite; preflight warns when a Codex seat's login shell can't find rig; rig host ls reads your ssh config with ssh -G, which runs any Match exec command in it; rig doctor no longer hangs on a port held by a listener that never replies; a scoped launch on tmux 3.4 keeps its default command.
• Options and views: specs.builtins_visible: false hides built-in specs; plugin_channels passes a Claude member's plugin channels to --channels (by @Aschenbath, carrying on @todie's fork work), warns beside claude_mcp: none, and hasn't been run with a real channel plugin; rig context add <url> installs into a new nested name; TUI and web UI display fixes.

Every user-facing change, with its pull request, is in the CHANGELOG.

Behaviour that changed

• Stream intake is on by default (see Before you upgrade).
• Fresh Pi seats, and fresh Codex seats on 0.164.0 or later, get OpenRig's guidance outside the repository AGENTS.md: Pi in its own agent folder (unless that file or folder is a link), Codex as launch developer instructions. Codex still uses the repository file for a resume, fork, restore or handover successor, an older or unknown version, or a config layer that sets developer_instructions or can't be read. If only your shell startup sets CODEX_HOME, OpenRig reads ~/.codex, so a developer_instructions in your home is replaced for that session; declare the same absolute path as CODEX_HOME in the member's or rig's env: to have it checked. (#2432, #2441, #2443)
• rig down removes OpenRig's own additions from a working folder once no live seat uses them. (#2387)
• After upgrading, the Slack connector edits asks that ended earlier to show they were handled, at Slack's edit rate: about an hour for 450 asks. rig slack status shows pending edits. (#2472)
• A later answer to a settled ask gets 409 qitem_already_terminal and records nothing. (#2386)
• rig send --verify reports unconfirmed and exits 1, not delivered, when it can't see what its Enter did. (#2509)
• rig export with no -o writes rig-export.yaml beside an existing rig.yaml instead of replacing it. (#2356)
• rig workspace validate exits 1 for malformed optional frontmatter. (#2396)
• An active rig name that matches more than one rig makes rig env down, status and logs list the matching rig IDs and stop, and rig doctor --spec report conformance as unknown, instead of using the first match. (#2548, #2550)
• New default kernels start in <workspace.root>/kernel. Existing kernels stay where they are; docs/reference/agent-startup-guide.md describes the optional move. (#2402)

Known limits

• OpenShell: the worker doesn't work in 0.7.9 (see The OpenShell worker). 0.7.8's requirements, cost note and cleanup limits still apply, including "Never grant the guest access to the daemon's main API port (normally 7433)." A same-generation reconciled launch opens no viewer, so run rig environment connect yourself; non-text startup actions aren't supported on environment seats.
• Grant-service assistants aren't woken: "an item stays queued until its receiver claims it."
• Open updates for a person read a 1,001-row window, so a page can come back short, marked truncated.
• Slack: a private channel needs the documented route, which we don't test, and direct messages aren't supported. The channel and people reads, and a click on a re-parked ask, haven't been run against a live Slack workspace in our release testing. Redaction of the bot token from a transport error can still leave a malformed token fragment shorter than six characters, so review an error before sharing it. (#2503)
• SSH host status reads unknown behind a ProxyJump or ProxyCommand; that isn't proof the connection is broken. (#2488)
• Shared asks: "a click's option written before its answer row … can stand beside or inside the closer's answer without the first clicker's authorship."
• Existing seats pick up Codex launch instructions and the single skill load at their next fresh launch. A CLAUDE.md or AGENTS.md that already grew isn't trimmed.
• Permit records last as long as stream retention keeps them. A permit a runner makes on its own, when it can't reach OpenRig, is in its pane only. For an ask opened before 0.7.9, a record may omit the option's kind. (#2361)
• Draft-aware delivery to Claude: on 0.7.8 with Claude Code 2.1.319, deliveries to idle Claude agents, queue wakes included, were reported held at an empty prompt when a narrow pane showed ✔ Update installed · Restart to update on its own line. 0.7.9 still doesn't recognize that bare banner, though it recognizes /rc and the full versioned banner. A message the draft-aware delivery path holds isn't replayed automatically by that path. (#2605)
• After a managed compaction, the restore request can stay held. OpenRig delivers each post-compaction step only when it can read the seat's input box as empty. When it can't, it holds the restore request and keeps retrying on its polls, so the seat can sit idle at an empty prompt with its restore not yet requested. rig compact <seat> --state and rig seat status show the restore as owed, and from the second failed attempt the seat's owner gets a queue item naming it. To restore by hand, send the seat a restore request naming its newest restore map, its restore marker and its packet, then settle the owed attempt with rig compact <seat> --cancel; a poll can still race that step. Reported on 0.7.8, and 0.7.9 behaves the same way. (#2575)
• Seats handed over before 0.7.9 keep their adopted origin until a later launched handover or managed launch records a new session, so until then rig seat stop, restart and clean refuse them as before. (#2440)
• rig broadcast: an uncertain recipient's outbox receipt now reads indeterminate, but the broadcast's own output for that recipient still says FAILED. Check that seat with rig capture before resending. (#2507)
• Codex hooks after an upgrade: Codex sessions kept running across the upgrade show "Hook failed — plugin contents changed; hook approval required" until relaunched. In our upgrade test from 0.7.8, one seat restarted with OpenRig's managed restart showed no review afterwards.
• Codex seats can still report rig: command not found when rig isn't on the login shell's PATH: with Node outside it, or when npm can't install globally and OpenRig is installed inside the project instead. Preflight now warns at launch. In our testing the agents recovered by calling rig by its full path; the getting-started guide describes a ~/.profile fix, which we didn't run.
• What we ran end to end under the runner contract: this release's dsh example runner, natively, with dsh 0.2.1-rc.2 on DeepSeek's deepseek/deepseek-v4-flash through dsh's pi-ai OpenRouter chat-completions profile, against 0.7.8 Core: two useful queue tasks, queued and multiline input, a quiet tool interval of about 26 seconds that still read working, allow-once and reject-once with their file effects, cancel, a return to the same conversation with recall, and shutdown. The permission answers came from an automated test operator, and the run's preset added resume: true, which the shipped preset doesn't declare. dsh's own DeepSeek Messages route through OpenRouter failed with HTTP 400, and the cause isn't established. Not run: a missing-conversation refusal, cross-host restore, OpenShell, and other adapters, models or providers. 0.7.8's release tests had already run its dsh example end to end, so the 0.7.8 CHANGELOG's "No harness has run end to end under the contract yet" was out of date.
• Fixed or changed from 0.7.8's limits: the dsh example's env: names, the conformance check's false failures, a person's typed words, the README's operator address, a rebuild behind a symlink, the rebuild receipt, a click on a re-parked ask, and recording a permit made when no one can be asked: a person's answer is recorded on the ask, and a default permit as the stream item above. The other 0.7.8, 0.7.7 and 0.7.6 known limits still apply.

Credits

Thanks to @porterchild, @Mohsintl, @Nikhi00718, @oodadoudou, @AdityaxDeore, @w4rc0n, @genius8267, @Aschenbath, @DeryFerd, @mohitdixit02, @Vaishnavi220506, @Nikhila-Dhevi-R, @natefaerber, @dajiaohuang, @Aummadour, @KM199 and @Totopo27 for merged contributions, and to @todie and @seanmcn, whose fork work is carried in #2439 and #2400. Thanks to @ziadeh, @billbenetti, @eisenbergjerry, @ch-davidriott, @puniserv, @oneandonlydean, @sabnanikl-dev, @gifflen, @pvl-agent, @EZotoff, @adam-nectar, @bpamiri, @tgrundtvig, @aanestesia, @AdamWhitehurst and @eisenrigbot for reports carried into this release. Thanks also to @z4cc, @hitianqi, @jimallen, @m3ac-AllbrittenJ and @lkraider for reports and field feedback.