Ship openagents coder: a terminal coding agent in the CLI #132

Outcome

npm i -g @openagentsinc/cli then openagents coder gives you a terminal coding agent. It signs in with the account you already have, spends a budgeted inference grant the server mints, edits the checkout you launched it from, and asks before it changes anything. No second binary, no provider key, no second backend.

Current behavior

Every piece exists except one route and one command.

The probe repository ships the agent: a turn state machine, permission as typed data, six confined tools with output caps and path refusal, an ACP v1 server, OpenAI-compatible and Gemini wire lowerings, and a WebAssembly build whose artifact is checked in and whose ABI is synchronous, so a Node host owns every asynchronous concern. Its native host already reads PROBE_INFERENCE_GRANT and PROBE_INFERENCE_URL from its environment. It is already pointed here.

This server ships the authority: POST /api/inference/proxy (lib/openagents_web/router.ex:342) is an OpenAI-compatible chat-completions surface a coding agent calls with an OpenAgents.Inference.Grant as its bearer, metered against the owner, with the provider credential never leaving the server. Three call sites mint grants (lib/openagents/work/scv.ex:133, lib/openagents/work/coding.ex:64, lib/openagents/work/delegation_server.ex:168) and every one is server-initiated.

What is missing is that no route mints a grant for a client holding a user token. probe's own specification names this: the paired-computer controller has "no channel by which a per-delegation inference grant can reach probe." The CLI has that channel — the token openagents auth login stored — and needs a route to exchange it.

The CLI ships neither. It registers api, auth, and repo (packages/openagents-cli/src/cli.ts:909 in the openagents monorepo), has no streaming (ApiTransport reads the whole body then parses, src/api-transport.ts:103), and has no interactive code at all: terminal-session.ts is 17 lines that report whether stdin and stdout are TTYs.

Work

Full design in docs/2026-08-23-openagents-coder-cli-spec.md. The load-bearing decision is that the CLI is an ACP client, not a second coding agent: it mints the grant, spawns the runtime with the grant in the child environment, speaks ACP v1 over stdio, and renders. Being a separate process is also what fixes the approval problem probe spent three commits failing to solve in process (efcb799, 29459f1, cfdd422), because session/request_permission is a request over the wire rather than a prompt competing for stdin.

This repository.

• POST, GET, and DELETE /api/v3/coder/sessions on :chat_account_api, scope chat:account (router.ex:57). Mint through OpenAgents.Inference.mint/1 with conversation_id from Conversations.ensure_conversation/1 and machine_id: nil, which lib/openagents/work/coding.ex:64 already proves the schema accepts.
• Ceilings independent of the delegation ceilings, a cap on concurrent active grants per account, and revocation on DELETE.
• Later: chunk the inference proxy's SSE response instead of building the whole body and sending it once (inference_proxy_controller.ex:155-:170); checkpoint receipts and the commit trailer that links a commit to one, both currently proposed in docs/taxonomy.md.

The openagents monorepo (packages/openagents-cli/).

• openagents coder [prompt] registered at src/cli.ts:909, reading the token through the existing resolveApiSession (src/session.ts:47) so profiles, the credential store, and OPENAGENTS_TOKEN all work unchanged.
• A CoderSession service that mints and revokes; an AcpClient that spawns the runtime and speaks newline-delimited JSON-RPC over its standard streams.
• An OpenTUI interface in split-footer mode: streaming Markdown, CodeRenderable with line numbers for tool output, DiffRenderable for edits, a status line carrying the grant's call and token budget, double-escape interruption, and a decision pane for approvals. @opentui/core is an optional dependency and the command degrades to line-oriented output when it is unavailable, when stdout is not a TTY, or under --plain or --json.
• A client-side policy table that moves edit to approval-required. The runtime's default allows it, which is right for a delegated agent under a controller's tier policy and wrong for your own checkout.

What is deliberately not built. No new tool-execution endpoint: local tools run locally and delegated work goes through the delegation routes that exist (router.ex:420-:423). No POST /api/v3/coder/turns: a coder turn is not a row in turns or account_chat_runs, because DATA-002 gives an account one conversation and TURN-001 gives a conversation one active turn. The durable evidence is the grant ledger and the forge push receipt.

Acceptance criteria

• openagents coder "what does this repository do" in a fresh checkout answers from files it read, with no sign-in beyond openagents auth login.
• openagents api "coder/sessions/<id>" reports the metered calls and tokens for that session, and the grant is revoked when the process exits.
• The token never reaches the runtime process; only the grant does, in the child environment, and it appears in no transcript, log line, or tool environment.
• Every edit, shell, git push, tracker write, and delegation prompts before it runs, and a refusal reaches the model as a tool result rather than failing the turn.
• No permission option is offered whose id, name, or kind matches /bypass/i, and there is no flag that means "stop asking".
• Double-escape within five seconds cancels a running turn, keeps the partial assistant text, and lets an already-running tool record its outcome.
• With no TTY, with --plain, or with the renderer unavailable, the command runs line-oriented and its exit code is unchanged.
• A mid-session token expiry suspends the session with a typed reason instead of terminating it; SIGINT still exits 130.
• No coder turn creates a row in turns or account_chat_runs.

Verification

Controller and context tests for the session routes covering mint, ceilings, per-account concurrency, revocation, and a scope refusal. Client tests in packages/openagents-cli/test/ covering the ACP handshake, the permission round trip in both directions, cancellation, the degradation matrix, and grant redaction. Renderer fixture tests over a session snapshot. A live smoke that runs a read-only session against this repository and shows the metered grant afterward.

Dependencies

• docs/2026-08-23-openagents-coder-cli-spec.md carries the full design, the route-by-route API split, and the open questions.
• Sibling of #129 (named issue and project commands in the CLI): both add commands to @openagentsinc/cli, and the tracker tools in Stage 4 should reuse whatever #129 settles about repository inference and --json envelopes.
• #127 covers scoped push identity for a delegation working an issue on a connected Computer. The coder does not work around it: where an assignment credential is absent, the session reads, edits, and reports, and says it cannot land the work.
• #73 standardizes ACP as the executor contract across Work and SCV. This issue is the interactive client for the same protocol.
• Blocked on confirming that the runtime package is installable and that its JavaScript host reaches tool parity with its native host. Section 11 of the doc names the commands that settle it.