The Handoff Has an API

On 13 October, Oh My Pi (OMP) 18.10.4 let an extension revise a plan and answer its execution review while the terminal picker stayed open; the first answer wins. The person can still be reading when OMP answers. As harnesses take over coding handoffs, operators must choose which ones still wait for a person.

This is a 23-day catch-up issue, covering 21 September through 13 October 2026, inclusive, UTC. Versions and channels below are as of 13 October 2026, 23:59:59 UTC.

The planning pause belongs to somebody

On 23 September, Thariq proposed removing Claude Code’s plan mode: I don’t think the models need plan mode anymore, but if you’re a plan mode diehard would love to get your feedback on why@trq212 A reply from rishi turned the question around:

plan mode isn't for the agent it's for me lol

The next day, Thariq acknowledged others prefer the UX of entering a mode where Claude is just thinking & brainstorming with you@trq212 and proposed preserving the mode as a built-in mod.

Claude’s released changelog still carries plan-mode repairs. Planning can compensate for a model that loses the plot, or give a person somewhere to change the plot. A better model could remove the first need and leave the second intact.

Where a person must choose the plan, restrict OMP extension discovery to reviewed code. OMP loads project inputs without a trust decision.

A plan-only Gemini job needs an enforced write boundary. Gemini 0.63.0 tells headless planning to continue into implementation, using an exit-to-YOLO path already present in 0.62.0. That path leaves planning for execution without approval prompts.

Claude’s 2.1.287 mod launch on 1 October puts more of the harness within reach of plugin code. Claude’s launch thread describes installation: Mods ship inside plugins, so you install them with /plugin in the CLI or desktop app.@ClaudeDevs It also warns about machine access: Mods run with the same access to your machine as Claude Code itself, so make sure to only install mods from sources you trust.@ClaudeDevs

Choosing a Claude mod means choosing who may answer permission questions. An admitted mod can approve over a rule requiring a prompt or a blocking hook outside managed settings, skipping the model that normally reviews actions in auto mode. Deny rules take precedence over user-installed mods when the built-in guard loads through managed settings or Team/Enterprise sign-in, with allowModsToOverrideDenyRules false; the mod’s own file and process operations remain outside tool rules. Additional controls protecting requests for human approval and policy-related environment variables remain unreleased.

In a root-cause note, Lydia Hallie attributes a reported failure to the order of permission checks: Root cause was PreToolUse hooks returning "allow" by default, which tells Claude that the command is already approved, so it skips the step where the auto mode classifier would normally run.@lydiahallie

Native tools give private adapters less to do

Pi 0.99.0 brought MCP and JavaScript tool composition into the CLI on 29 September. MCP is the protocol connecting the agent to external service tools. Pi’s product account announced the reversal: A pretty big change is that Pi now has MCP at the core.@pidotdev On current 1.2.0, the model can compose registered tools in a script. A private bridge whose only job is making those services callable is now a candidate for replacement.

Putting Pi’s shell in a VM does not contain every service it starts. Pi waits for trust before reading project MCP configuration; its tool-server subprocesses inherit the harness environment. Putting only shell tools in a VM leaves those servers beside the harness. Inspect server configuration and credential scope before running them.

A shorter bridge does not remove the need to control permissions and model spend. Pi’s nested tool calls traverse hooks, but scripts can call classification and image-generation models using session credentials outside those individual hooks. The visible tool list also does not fully describe script-callable MCP tools.

Eve lets an existing agent reuse its integrations. Its optional MCP service lets another harness call eligible tools you define without invoking Eve’s model. Calls run as the authenticated caller, or as a user named by an accepted trusted forwarder. Calls needing human approval return approval_required without running. Pi brings services into its loop; Eve lets an existing loop reach its services.

Kush describes the work the team stopped owning after moving to Eve: the scaffolding let us focus on agent behavior instead of the intricacies of a slack integration.@kushbhuwalka Andrew Barba makes the customization case: eve is one of the few frameworks that gives you full control over building the exact agent loop that you want.@andrew_barba Eve 0.79.0’s defaultTools: false removes framework-default tool definitions while preserving tools explicitly supplied as replacements. Keep customizations your workload still needs.

Shantanu Goel describes batching costs in other implementations: Models keep fighting their own batching issues (scripting problems, or batching incorrectly and then having to re batch again because one command was wrong etc).@shantanugoel Mario Zechner poses the minimalist challenge: what does it tell you that a shitty little coding agent with 4 tools and no subagents is at the pareto frontier?@badlogicgames Neither supplies a Pi 1.2.0 comparison; a hundred deleted lines lose their appeal if every batch needs untangling.

Unreal’s comparisons do not settle a current-release choice. Its 22 September vendor comparisons report lower input-token use against historical Codex and Pi. The build IDs recorded in Terminal-Bench, SWE-Atlas and DeepSWE are absent from 0.3.1’s public commit history. Run a matched current-release trial before switching or dismissing its specialized loop (comparison details).

The repair handoff reaches beyond the editor

OpenHands lets a person inspect a proposed recurring job instead of transcribing one from chat. It adds an agent beside the automation form to fill its fields, with saved drafts and a test run before creation. The resulting automation runs as its creator.

Graham Neubig describes the team’s response to generated contributions: make sure that all the issues are maximally clear through automated issue triage, and (2) automate code review so that we only accept high-quality contributions.@gneubig OpenHands supplies the automation service and Canvas 1.24.0’s read-only viewer for shared automation conversations on Cloud backends, with hosted availability unverified; the contribution-quality threshold comes from Neubig’s account.

Cursor’s 23 September Rollouts announcement offers Teams and Enterprise deployment watching, telemetry inspection and a cloud-agent repair handoff. Its account summarized the handoff: One click starts a cloud agent to fix it.@cursor_ai Merge and rollback remain human decisions. For Cursor teams, the proposed trade is fewer dashboard visits for more review of the monitoring plan and reported regressions.

Akash Hadagali proposes an acceptance standard for that handoff: Keep the failing input, offending commit, and post-fix regression test attached to the agent task, or you will automate guesswork.@akashc777

Lucas describes repeated Claude review with no stopping point: It never runs out of bugs to find... so how do you decide your code is actually done?@lucas_builds John Rood replies with a stopping rule: Done has to come from something binary, a failing test or an unmet spec, not from a reviewer running out of ideas.@johnroodepic

On 13 October, Origin opened public app submissions with installation tokens, webhooks and write-back operations. Cursor described the scope: Connect your repos to tools for CI, deployments, code review, security, monitoring, and project management.@cursor_ai Origin challenges the assumption that providers will stop at the coding loop. An independent operating layer has to earn its place through portable state, carefully scoped authority or better outcomes.

Consent needs an action, an identity and a moment

Eve 0.78.0 stopped lending the approver’s credentials to an approved call and rechecks policy under the requester. A release manager can consent without silently making their account perform the work.

That credential fix does not fix consent timing. Stable 0.79.0 can still consume requester text queued before its later approval prompt existed. The repair excludes those older queued messages and was only on main at cutoff. An old message cannot answer a question that did not yet exist.

OpenClaw’s stable and beta releases protect different parts of approval. On stable 2026.10.3, an ordinary hook can replace arguments after inline approval. 2026.10.5-beta.3 requires approval for the final replacement parameters or blocks the call. Extended-stable 2026.8.35 includes an earlier command-execution approval repair; the hook repair still needs a separate release decision.

Before delegating Eve or OpenClaw approvals, check that the answer follows the request, credentials belong to the requester, and execution uses the approved arguments.

The running process needs its own owner

Codex package pins no longer necessarily identify the running code. 0.157.0 made eligible interactive terminals clients of a shared background server. At 0.162.1, eligible npm/Homebrew-seeded servers can update independently and retain their startup environment. Scrubbing credentials from a new shell does not scrub that server. One account put the inventory problem plainly: Your inventory says one version; the process answering turns may be another.@hackerlogs

Agent Flywheel’s fresh launcher configuration starts interactive Codex; holding its client version does not govern the native server updater. Explicit standalone pins and codex exec have different background-server behavior. Apply this advice to interactive Codex; CI needs its own checks.

Temporal Agent Harness moves waiting into the workflow system. Preview 0.6.0 moves Monty script stepping into workflow workers. Scripts use durable timers and wait for tools or people without holding an interpreter subprocess while they wait. Jason Steving’s design priority is And durability shouldn't be the secondary afterthought bolted on later.@JasonSteving

Flue’s released approval recipe takes another route: save exact arguments, end the response, then accept a decision through an authenticated application route. Temporal operators check worker and history compatibility; Flue operators supply authentication, expiry and protection against executing the same action twice.

Shiro names a recovery test: Checkpointing is the part we'd test hardest: a resumed run that replays a send is worse than a crash.@japanaibuilders Kylian, describing hosted OpenClaw failures, put the dependency plainly:

works until the bug takes down the agent itself. we host openclaw agents and what breaks is rarely the model, its the box: ram blows up mid build, disk fills, logins expire. if nothing outside brings it back, theres no one left to read the error

Name the process or person that can recover the box and reconcile its last external action when the agent itself is down.

Breaking changes and security notes

Claude Code graders and CI. Pin latest 2.1.296 for restricted runs, beyond September’s stable recommendation. It includes 2.1.295’s repairs for tool restrictions bypassed by late registration of built-ins or deprecated tool names.

Managed Claude Code fleets. Verify the running account can read its managed policy source. 2.1.285 permits startup after an OS-denied managed-source read.

Claude Code plugin users. Verify your release includes the older 2.1.179 fix named by the 9 October Plugin4Shell advisory. It blocks a requested-commit-pin bypass when installing a malicious plugin from a Git host allowing branch names that look like commit hashes. The advisory is new; 2.1.179 is not.

Claude Code behind gateways. Record which action checks ran and what they decided on each deployed platform, and alert on the warning notice. Correction to Before the First Turn: we said a gateway stripping the safeguards request field makes the first checked action wait on a notice. An unattended run can print the notice to stderr and continue on billed local checks.

Codex users relying on model review. Identify the active reviewer and export available review records. Tibo presents Auto-review as an answer to approval fatigue: Auto-review improves upon the default sandbox setting that requires you to approve everything, which is prone to decision fatigue unless you spend a lot of time configuring specific rules.@thsottiaux At 0.162.1, the older Guardian reviewer defaults on while Guardian V2 defaults off. Full Access skips model review. 0.158.0’s opt-in export of completed synchronous assessments excludes cached V2 approvals, partly answering The Body, Not the Pencil’s auditability question.

OpenHands local users on Canvas 1.27.1/agent-server 1.54.0. Keep production secrets out of the shared store and test that terminal sessions cannot read excluded secrets. The launcher passes its shared API key into terminal commands under an automation variable name that terminal cleanup does not remove. The key reaches secret values without checking the conversation’s secret profile. Per-conversation Docker construction does not copy the outer environment wholesale; test your actual stack.

Gemini CLI 0.64.0 unattended-job operators. Test dependency-editing jobs before rollout. Restrictions on build-file changes through editing tools arrived in 0.61.0; final conversion of approval requests into denials for unattended runs arrived in 0.63.0. Shell redirection stays outside those edit-tool restrictions.

Temporal Agent Harness service operators. Require authentication and origin checks even on loopback. 0.6.0 still binds all interfaces by default, with wildcard CORS, allowing requests across origins, and no login layer on the approval routes. September’s access-control question remains open.

Flue 2.3.0 operators requiring package attestation. Choose explicitly between execution repairs and published provenance. Execution repairs arrive without npm provenance, unlike 2.2.2; that older release retains its runtime faults.

The other providers need different checks

Omnigent 0.18.0 shared-server users. Replace uploaded Python/TypeScript source tools with MCP services and start new sessions. A separate repair stops uploaded Python source tools executing with runner privileges during discovery on multi-user servers. Re-uploading does not rewrite existing sessions.

Hermes 0.21.7 Gateway operators. Test unattended commands against your intended allow and deny rules. The Gateway consults configured unattended policy before model review on the repaired paths. This version also includes 0.21.6’s repair for repository-configured Git filters running before the first prompt, beyond September’s startup advice. That matters when opening a delivered directory with its own .git/config. Tonbi describes the update choice: Stable: The default, your Hermes will only update to stable releases@tonbistudio That stable default concerns official managed source checkouts, preserves an ahead-of-stable checkout and differs from forks and packaged applications.

Copilot CLI 1.0.97 users. Enable and test local sandboxing rather than assuming it is active. Generally available since 1.0.93, it is off by default. Destination-scoped credential injection supplies credentials to selected destinations, reducing ambient exposure. Andres Villa offers a reminder in Spanish: Ojo: el acceso saliente a internet está permitido por defecto. Activarlo no equivale a desconectar al agente.@iamandresvilla

Copilot fleet administrators. Enforce mandatory containment through device policy and migrate user settings to settings.json. Set sandbox.enabled true to enable isolation, sandbox.failIfUnavailable true to stop without it, and sandbox.allowBypass false to prevent bypass. Windows host rules depend on programs honoring the proxy; macOS masking can disrupt commands connecting to their own listener. Restrict credential files separately.

Antigravity 1.3.4 users. Test saved Remote Control denials and previously revoked browser grants after upgrading; both have named repairs.

Grok Build 1.0.52 HTTP MCP users. Take the repair for repeated tool execution, then test an error after a tool has acted. 1.0.54’s fix for forked worktree sessions editing the original checkout remains outside stable 1.0.52.

Paperclip 2026.1012.0 operators. Finish pending writes and stop old writer processes before migrating the locking protocol, then check earlier permission grants against actual tool calls. The release fixes grants authorizing calls outside their restrictions. Limit the fourteen grants given to newly activated standard agents before dispatch.

Agent Zero users needing separate browser identities. Use separate instances. A0 CLI v2.14 separates chats’ shell state, but retains the same host filesystem and account; internal browser sign-ins remain shared.

DeepSeek Harness testers. Keep prerelease 0.2.0-rc.2 in a disposable VM and disable session-log upload separately from telemetry. Web login alone does not isolate credentials from same-user agent commands with credential-file read access and local API access.

heypi 0.3.0-beta.2 just-bash users. Check the installed dependency and verify file and directory creation under /agent/skills is refused before relying on read-only skills. The optional wrapper omits the createExclusive file-creation operation from its blocked filesystem operations; the ordinary scaffold selects Docker.

Agent Flywheel v0.10.0 installers. Pin and review the checksum ledger separately from installer scripts when qualifying installation. The maintainer reports eight passed component checks followed by a failed factory installation.

Keep the decision, retire the relay

Bitter Lesson Maxing means building where improving general agents compound your advantage. Retire relay code or manual handoffs only when a trial preserves authorization and reduces review time. Keep specialized engineering where recovery and execution requirements still justify its cost.

Amdahl Maxing means spending scarce human attention where judgment changes the outcome. Use time saved on routine handoffs to decide who may act, which exceptions deserve escalation and whether work is good enough to accept. The handoff can have an API; deciding what it may authorize still needs an owner.