Corey James- PID 1the supervisor's place in each seat's container
- 1vendor TUI per tmux session
- 2Enter keys for the vendor whose composer swallows the first
- 9tests in the transport experiment for checking seats
Driving vendor CLIs as governed sessions
AgentOS governs coding agents that live inside the vendors' own command-line tools, and those tools are terminal programs built for a person at a keyboard. I chose to drive them the way a person does, through a terminal, and to make every delivery's outcome explicit.
The supervisor for each agent seat owns a tmux session in its container. Operators attach to the same session to watch or take over, so humans and the automation see the same screen. The wider program is in Directing AI coding agents at program scale.
pastes, submits, Ctrl-C
watches or takes over
A delivery protocol for a terminal
I treat a terminal UI as an unreliable transport. A message is loaded into a tmux buffer, pasted as one bracketed paste, and submitted with separately delivered Enter keys.
Delivery is confirmed from the agent's transcript, because a successful tmux command only proves bytes left. When I cannot confirm a message was taken, the supervisor reports it as unknown and never retries it, because a duplicated instruction to a coding agent does more harm than a missing one.
Choosing the transport by experiment
Agent Swarm uses the same supervisor for its managed seats. For the seats that check other agents' work I compared tmux with a vendor plugin in an experiment, judged on one property: whether the seat stays inside its write scope. tmux held it. That property carries the governance design in Separation of duties for AI work.
Every test stayed inside its write scope.
Durable sessions behind a least-authority manager
Helix hosts durable vendor CLI sessions for its multi-model workspace. A small privileged manager creates the tmux-hosted sessions and answers only one caller, checked by user ID over a Unix socket. CLIs with a protocol get structured adapters; the one that offers only a terminal runs through tmux and lists its reduced capabilities with the session.
A browser terminal attaches under a lease, and idle sessions raise a notification and stay open. One finding changed the delivery code: a very large prompt pasted into a terminal could vanish without an error, so Helix now confirms delivery from the session transcript. tmux is used as published; the delivery protocol, the confirmation logic and the supervision are mine.
I can turn tools built for people into dependable machine interfaces and still keep duplicates out.