Watchable Is Not Watched

In the fortnight to May 7, Agent Zero fired the agent that used its browser. One commit replaced the browser-use sub-agent with a native browser tool the main agent drives directly, added a live viewer to the web UI, and moved the old module out of core. Around it came a persistent Chromium runtime, tabs, screenshot previews in the tool log, Linux desktop controls, a document canvas and a LibreOffice runtime.

The agent has a computer, and you can watch it work. Everything you can now watch is also something the agent can now touch: a logged-in browser, a desktop, OAuth grants. Agent Zero shipped OAuth disconnect and remaining-quota visibility in the same fortnight. The machine it had just handed the agent holds real credentials, and the operator needs a way to take them back.

Every receipt below is a commit on a project’s main branch, not a release. Read it as the direction of travel, not as what you have installed.

The fortnight’s work was making the agent visible

Agent Zero’s move is also a bet on the model. It deleted a specialist sub-agent whose job was to browse, and gave the general agent the browser instead. That is Bitter Lesson Maxing: building where better general agents compound your advantage rather than erase it. The browse-for-me wrapper is the part the next model makes redundant. The viewer the operator watches is not.

The other projects built windows of their own. OpenClaw put agent progress into the chat as timeline spans and showed Codex tool progress in channel drafts, so the person on the other end of a chat sees the work move. OpenHands exposed its sandbox grouping in the UI. Paperclip added per-issue cost summaries and pause and resume for agents in its sidebar.

State got the same treatment. Codex’s /goal drew validation, paste handling and queued-command behavior, which is the plumbing a feature earns once people lean on it. Gemini CLI’s Auto Memory inbox shows proposed memory as a patch to accept. Hermes added a scoping header to long-term memory. Who decides what those memories hold is the argument of the overlapping rollup; here the point is only that each can now be seen.

A log is a window and a copy

The same visibility that lets an operator supervise also writes things down. OpenHands found a debug log that had been recording hook-config secrets and deleted it, and strengthened API-key redaction across its loggers. It also began injecting user secrets into the ACP subprocess environment, which is one more place a credential lives and one more place to audit.

Around it, the boundaries got drawn in public. OpenClaw bounded live exec output, made Telegram honor access-group allowlists, and documented where sub-agent security stops. Gemini CLI made sub-agents respect the active approval mode and showed workspace trust in its MCP list. Codex added plugin share access controls and a bundled Linux sandbox. Paperclip made security a first-class agent role.

What this agent could read, change, run, install, send or leak is now answerable in some of these tools. The OpenHands log is the reminder that the answer includes the tool’s own record of the work.

Legibility is mostly setup recovery

The least glamorous commits in the window do the most for a new user. OpenClaw’s diff-reviewed onboarding fix stops a stale channel plugin from dead-ending setup: it reinstalls from a trusted catalog where it can, and leaves channels the operator disabled disabled. Beside it sit labels on Claude CLI OAuth status and a fix that stops the Discord voice bot hearing itself.

Hermes did the adjacent work: a setup wizard that no longer dead-ends on a system-scope unit, restart readiness for the gateway, push-to-talk parity. Pi made auth-provider login searchable.

None of this is polish. An operator who cannot get the agent running again after a config goes stale cannot supervise it either. Recovery is where visibility starts.

The newest agents work where nobody is looking

Then the vendors shipped the other half. On May 6, Anthropic previewed dreaming, which reviews an agent’s past sessions, extracts patterns, and curates memories so your agents learn over time@claudeai. No transcript records that curation and no operator approves it. On May 7, Codex reached Chrome on macOS and Windows, and OpenAI said it now works in parallel across tabs in the background without taking over your browser@OpenAI.

That last clause changes the job. Agent Zero’s viewer assumes someone watching. An agent that drives your browser while you keep using it is computer use as a background process, and nobody supervises a background process by staring at it. Hermes, tagging v0.13.0 the same day, went the same way without a browser. Its lead’s announcement put multi-agent orchestration through a Kanban board first, with Enforced goal completion with /goal@Teknium beside it. Workers hand tasks to each other and a goal holds across turns, and neither needs a person at the screen.

This is where Amdahl Maxing earns its place: design the system so scarce human attention goes to the decisions where it is worth most. A live viewer spends attention for as long as someone watches it. A prompt spends it per action, and one operator paying for it said so. swyx, after switching to the Codex plugin, wrote that whatever this default is is not working for me, particularly on clearly nondestructive actions.@swyx A prompt on a harmless action spends attention where the risk is lowest.

Paperclip spent the fortnight on the cheaper kind. A cost summary or a stale session asks for a human only when something is off. Its runtime specs go further and delete a human task: each adapter now declares how to install itself on a remote sandbox, so nobody hand-writes a provisioning script per agent CLI. That is the shape that survives agents which do not wait for you.

Provider notes

Pi. The window’s reminder that integrations change under you. It added a Cloudflare AI Gateway provider, moved Codex to a cached websocket transport with an SSE fallback, and removed built-in Gemini CLI and Antigravity support. Record the version, provider and transport of any run you care about.

Hermes. 2,061 commits. The ones that matter here are above; it also moved model providers into plugins and gave Curator archive and prune commands.

OpenHands. Consolidating on its app server and removed the V0 runtime. Its log fix, above, is the item to act on.

Codex, Gemini CLI. Covered above and in the overlapping rollup. Agent Zero, OpenClaw, Paperclip. Covered above.

Closing

The open projects spent a fortnight building windows into the agent’s computer, and the work was worth doing. The agents that shipped at the end of it were built so you would not need to look.

Watchable is a feature. Watched is a schedule nobody keeps.