Stop three questions the session had to ask

Stop three questions the session had to ask

Three round-trips seen in one transcript, each avoidable.

It ran `pwd && ls && git status` to find out where it was. The status line shows
the repository and branch, but that is the interface talking to the reader, not
to the model. The shell tool's description now names the working directory it
runs in, which reaches both lanes because a tool description is the one thing
the client writes on the thread lane as well as the local one.

It ran `openagents issue list --help`, which the command tree in the `openagents`
tool description exists to prevent -- but it had reached the CLI through `shell`,
where that tree is not. The shell description now sends `openagents` work to the
tool that carries the list.

It ran `devin --help` to find a read-only mode, because the delegation skill
documented only the unattended one. The skill now carries the four permission
modes and says the default is already read-only, so no flag is needed for it.

Also tightened the workspace-trust note in that skill. Telling the model about a
failure mode invited it to diagnose every failure as that one: a run that had
not failed on trust at all was followed by an invented
`--respect-workspace-trust` flag. The note now says which exact message means
trust, that nothing else does, and that `respect_workspace_trust` is a config
key rather than a flag.

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified packages/openagents-cli/skills/delegating-work/SKILL.md
modified packages/openagents-cli/src/coder-tools.ts

Diff

2 files changed, +38 -19

Run it non-interactively through `shell`:

```sh
devin -p "<a complete, self-contained task>" --permission-mode dangerous
devin -p "<a complete, self-contained task>"                        # read-only
devin -p "<a complete, self-contained task>" --permission-mode dangerous  # unattended
```

Three things about that command are worth knowing before you run it.
`-p` means one prompt, print the answer, exit. What it may do is the permission
mode, and the default is already the read-only one:

| `--permission-mode` | Auto-approves |
| --- | --- |
| `auto` (default, no flag needed) | read-only tools only |
| `accept-edits` | and edits inside the workspace |
| `smart` | and anything a fast model judges safe |
| `dangerous` | everything, including writes and shell |

For a read-only run, pass no flag. In `-p` mode there is nobody to answer a
prompt, so anything not auto-approved simply does not happen — the mode is the
whole of the boundary. Run `devin --help` if this disagrees with the build in
front of you; the values it lists are the values it takes.

Three things are worth knowing before an unattended run.

**`dangerous` is the mode name on this build.** The published documentation
calls the equivalent mode "bypass". Passing `--permission-mode bypass` is not
rejected — it is accepted and ignored, so the session silently falls back to
prompting, and in `-p` mode a prompt nobody can answer is a task that does
nothing. Read `devin --help` if unsure; the values it lists are the values it
takes.

**It refuses a workspace it does not trust.** In an untrusted directory it
exits at once with `Refusing to run in an untrusted workspace`. Trust is
granted by starting `devin` interactively there once, which is something only
the person at the keyboard can do. If you hit that, say so and name the
directory rather than retrying.

**`dangerous` auto-approves every tool it has, including writes and shell.**
That is the point of using it unattended, and it is also the reason to say what
you are handing over before you hand it over. Give it a bounded task in this
repository, not an open-ended one.
prompting, and a prompt nobody can answer is a task that does nothing.

**It refuses a workspace it does not trust**, but only in a directory nobody has
opened it in. You will know because it exits at once, before doing anything,
with the words `Refusing to run in an untrusted workspace`. Only that message
means this; do not read any other failure as a trust problem. Trust is granted
by starting `devin` interactively there once, which only the person at the
keyboard can do, so say so and name the directory rather than working around it.
`respect_workspace_trust` is a config-file key, not a command-line flag, and
passing it as one will not do anything.

**`dangerous` auto-approves every tool it has.** That is the point of using it
unattended, and it is the reason to say what you are handing over before you
hand it over. Give it a bounded task in this repository, not an open-ended one.

There is also `devin acp`, an Agent Client Protocol server over stdio, for a
caller that speaks ACP. `-p` is the simpler route from here and needs no

  return {
    name: "shell",
    description:
      "Run a shell command on this machine, in the session's working directory, and return what " +
      "it printed. Use it for anything you would type at a terminal: reading files, listing " +
      "directories, searching, git, running builds and tests. Prefer it over `delegate` for " +
      `Run a shell command on this machine. The working directory is ${cwd}, so paths are ` +
      "relative to it and you do not need to ask where you are. Returns what the command " +
      "printed. Use it for anything you would type at a terminal: reading files, listing " +
      "directories, searching, git, running builds and tests. For the `openagents` CLI use the " +
      "`openagents` tool instead — it carries the list of commands, so running it through here " +
      "costs a turn finding out what exists. Prefer it over `delegate` for " +
      "single commands -- a child agent is for work worth a whole agent, not for one line of " +
      "output. Both output streams come back together with the exit code. There is no terminal, " +
      "so a command that would prompt gets end-of-file instead of waiting; pass a flag that " +

38	38		Run it non-interactively through `shell`:
39	39
40	40		```sh
41		-	`devin -p "<a complete, self-contained task>" --permission-mode dangerous`
	41	+	`devin -p "<a complete, self-contained task>" # read-only`
	42	+	`devin -p "<a complete, self-contained task>" --permission-mode dangerous # unattended`
42	43		```
43	44
44		-	`Three things about that command are worth knowing before you run it.`
	45	+	`-p` means one prompt, print the answer, exit. What it may do is the permission
	46	+	`mode, and the default is already the read-only one:`
	47	+
	48	+	\| `--permission-mode` \| Auto-approves \|
	49	+	`\| --- \| --- \|`
	50	+	\| `auto` (default, no flag needed) \| read-only tools only \|
	51	+	\| `accept-edits` \| and edits inside the workspace \|
	52	+	\| `smart` \| and anything a fast model judges safe \|
	53	+	\| `dangerous` \| everything, including writes and shell \|
	54	+
	55	+	For a read-only run, pass no flag. In `-p` mode there is nobody to answer a
	56	+	`prompt, so anything not auto-approved simply does not happen — the mode is the`
	57	+	whole of the boundary. Run `devin --help` if this disagrees with the build in
	58	+	`front of you; the values it lists are the values it takes.`
	59	+
	60	+	`Three things are worth knowing before an unattended run.`
45	61
46	62		`dangerous` is the mode name on this build. The published documentation
47	63		calls the equivalent mode "bypass". Passing `--permission-mode bypass` is not
48	64		`rejected — it is accepted and ignored, so the session silently falls back to`
49		-	prompting, and in `-p` mode a prompt nobody can answer is a task that does
50		-	nothing. Read `devin --help` if unsure; the values it lists are the values it
51		-	`takes.`
52		-
53		-	`It refuses a workspace it does not trust. In an untrusted directory it`
54		-	exits at once with `Refusing to run in an untrusted workspace`. Trust is
55		-	granted by starting `devin` interactively there once, which is something only
56		-	`the person at the keyboard can do. If you hit that, say so and name the`
57		-	`directory rather than retrying.`
58		-
59		-	`dangerous` auto-approves every tool it has, including writes and shell.
60		-	`That is the point of using it unattended, and it is also the reason to say what`
61		-	`you are handing over before you hand it over. Give it a bounded task in this`
62		-	`repository, not an open-ended one.`
	65	+	`prompting, and a prompt nobody can answer is a task that does nothing.`
	66	+
	67	+	`It refuses a workspace it does not trust, but only in a directory nobody has`
	68	+	`opened it in. You will know because it exits at once, before doing anything,`
	69	+	with the words `Refusing to run in an untrusted workspace`. Only that message
	70	+	`means this; do not read any other failure as a trust problem. Trust is granted`
	71	+	by starting `devin` interactively there once, which only the person at the
	72	+	`keyboard can do, so say so and name the directory rather than working around it.`
	73	+	`respect_workspace_trust` is a config-file key, not a command-line flag, and
	74	+	`passing it as one will not do anything.`
	75	+
	76	+	`dangerous` auto-approves every tool it has. That is the point of using it
	77	+	`unattended, and it is the reason to say what you are handing over before you`
	78	+	`hand it over. Give it a bounded task in this repository, not an open-ended one.`
63	79
64	80		There is also `devin acp`, an Agent Client Protocol server over stdio, for a
65	81		caller that speaks ACP. `-p` is the simpler route from here and needs no

460	460		`return {`
461	461		`name: "shell",`
462	462		`description:`
463		-	`"Run a shell command on this machine, in the session's working directory, and return what " +`
464		-	`"it printed. Use it for anything you would type at a terminal: reading files, listing " +`
465		-	"directories, searching, git, running builds and tests. Prefer it over `delegate` for " +
	463	+	`Run a shell command on this machine. The working directory is ${cwd}, so paths are ` +
	464	+	`"relative to it and you do not need to ask where you are. Returns what the command " +`
	465	+	`"printed. Use it for anything you would type at a terminal: reading files, listing " +`
	466	+	"directories, searching, git, running builds and tests. For the `openagents` CLI use the " +
	467	+	"`openagents` tool instead — it carries the list of commands, so running it through here " +
	468	+	"costs a turn finding out what exists. Prefer it over `delegate` for " +
466	469		`"single commands -- a child agent is for work worth a whole agent, not for one line of " +`
467	470		`"output. Both output streams come back together with the exit code. There is no terminal, " +`
468	471		`"so a command that would prompt gets end-of-file instead of waiting; pass a flag that " +`