For sealed evaluation runs and air-gapped work. A network block only refuses the call: the model still sees both tools, can spend turns on them, and the record cannot say they were absent. The flag withholds them at registration (build_engine(web_tools=False)), and summary.json and the trajectory record web_tools: false. Without the flag nothing changes.
Tests: with the flag both calls get the engine's unknown-tool answer and the record says false; without it web_fetch is present, shown with a non-URL the tool rejects before any network I/O.
A failed model call prints what was underneath it, such as a proxy's 403.
SIGTERM during the wait before a retry now stops the run and leaves its record (exit 130).
--mode, --persona, --attendance and the unlisted mode names are no longer accepted.
Flags cannot be shortened, so --mode is refused instead of being read as --model.
Default mode is ask; approvals and questions are separate (--auto-answer); --isolated keeps the sealed benchmark run.
Without --out the record goes to sessions/<workspace path>/<session id> in the state folder; --allow-site adds sites for the run.
Exit code 0 only when the task finished; 3 when it stopped early with its record written.
"root" already means the superuser and the top of the filesystem; `--add-dir` says what
the flag does and is the name the best-known agent CLIs use for the same idea. Recorded
in summary.json as args.extra_dirs.
A harness can put its output contract outside the workspace: CyberGym-E2E runs the agent
in /src and grades /output/fix.patch and /output/poc.bin. OpenWorker's file tools only
write under a declared root, in every permission mode (the dangerous mode clears the
permission floor, but the tools still resolve paths against the session's roots by
construction), while the shell is not scoped. So without a way to declare /output, a
delivery depended on which tool the model happened to pick.
`--root DIR` (repeatable) adds writable roots after the workspace, which stays the folder
relative paths resolve against; the folders are announced to the model in the session's
directories block and recorded under args.roots in summary.json. The reference harness
does the same for Gemini CLI with --include-directories /src,/scripts,/output.
A headless one-shot command beside `up`: give it a task, a folder and a model; it builds the same engine the desktop app uses, runs to the end with attendance `auto` (coworker/unattended.py), and leaves a record: every event, the final conversation, a summary with tokens and cost, every answer the engine gave on the absent user's behalf, the audit log, a per-call model log, and a trajectory in the ATIF interchange format. The trajectory and the exit code are the stable contract; the other files are internal.
State and scratch folders are pointed under --out before the engine starts, so a run never touches the machine's own conversations, keys or settings. A transient provider failure or an empty reply is waited out with backoff and a nudge instead of ending the run; permanent errors are not retried. Tool results are bounded with the full text spilled beside the record. A small price table gives an estimated cost per call as a cross-check; an unpriced model gets counts but no cost.
The mode axis decides approvals (`dangerously-bypass-approvals` prints its warning line here); the runner adds no policy of its own.
Devika Verma