Agents That Read Each Other

Linked agents can read each other's work — a linked agent can pull its peer's bounded transcript, full transcript, terminal screen or notes and use the answer in the same turn, instead of asking and waiting. Reads are off until you grant them, per link, and the three scopes are separate grants rather than one switch. The consent dialog names every agent the content could reach and says the part nobody else says: whatever is read becomes part of that vendor's conversation, and revoking stops the next read — it cannot recall what was already copied.

A read has to prove who is asking — on macOS the request is verified against the operating system, so only the live process running inside the terminal that owns the link can read through it; a neighbouring agent that merely knows the right ids gets nothing. Linux and Windows refuse these reads for now rather than accept a weaker proof, and sending, asking and everything else works as before.

Link controls in Settings — AI settings now lists every link your agents have: active, broken, and requested-but-not-yet-granted. Approve or deny a link an agent asked for, edit what an existing link may do, review exactly whose content a read grant would expose, reconnect a link whose terminal was restarted, or remove it outright. Auto-grid also became a real setting instead of a hidden preference.

The Tasks board, rebuilt — a segmented control switches between **Board**, a plain kanban where every card says who owns it, and **By agent**, a roster with each agent's state in words (Working, Waiting for approval, Idle, Offline) and its own counts. Filter by agent, priority, tag and project with a count beside every option, and a **Blocked** column appears only when there is blocked work, so a "Needs me" count can no longer point at tasks the board never drew.

Dragging a task is a request, not a silent write — dropping into a column an agent is waiting on opens the approval instead of stepping over it; a move that would skip a pending plan or spec review is refused and names what is holding it; accepting a status an agent already wrote, or starting work with an open blocker, asks first. Pulling a task back or cancelling it always works, and dragging never assigns work — **Assign** is still the only way an agent is given a task.

Decompose a goal — you pick who plans. A target picker lists your installed agents and every live AI terminal, so you can run the planning quietly in the background or hand the goal to the agent already in front of you. A live log streams the run with an elapsed-seconds counter, names the binary it started and where, and says out loud when an agent prints nothing until it finishes. A proposal that fails to parse shows what the agent actually replied instead of a dead end, and a borrowed terminal is always given back.

Remote terminals sized for the phone — the phone actively viewing a terminal owns its width, so lines wrap for your screen instead of forcing you to pan across a desktop-width grid. The newest output and the agent's input box sit where you can see them, two phones viewing at once settle on the size that works for both, and the desktop pane gets its own size back the moment you close the terminal on your phone. While a phone is attached the desktop pane says so with a **Sized for phone** badge and a shortcut into Reader Mode.

Approve a delivery before it lands — a queued delivery now shows up on the receiving agent's card in Mission Control and on the Team Map with **Submit** and **Reject**, so a confirm-mode link no longer means hunting for the message in a list.

Teams on your phone — a Teams tab in the phone UI shows which agents are linked, what has been delivered, what is queued, what is waiting on a reply, and which links are broken. Read-only by design: the phone shows you the picture, the desktop makes the changes.

Codex and OpenCode now collaborate over their own protocols — orchestrated runs with those two stream output, ask for tool approval, interrupt and resume through their native interfaces instead of a scraped terminal. Every other agent keeps the terminal path exactly as before, and each is verified against the installed version before being used

Windows file watching is native again — files created or changed by another editor appear immediately, and the app stops burning several CPU cores watching large projects. Network and SSH folders keep the previous polling behavior

Cursor can take Swarm work — Cursor now has explicit read and write sandbox profiles, so a swarm can target it without handing it blanket permission

Deliveries reach Cursor terminals — a message linked to a Cursor terminal is recognized as ready and delivered instead of sitting queued

Task history is kept, not dropped — when a task's activity, runs or approvals grow past what the file holds, the overflow is archived alongside it rather than discarded

Agents wait on your approval properly — the polling loop an agent uses while waiting for a verdict was measured against Claude, Codex, OpenCode, Grok and Hermes, so an agent asking for sign-off no longer times out its own request

Every agent state on the board says its name — the coloured dot is now shorthand for a word, not the only signal, so "mid-turn" and "waiting on you" can be told apart