Mitchell Hashimoto wants programs to say out loud when they are blocked.

OSC 7501, the Program Status Protocol, is a short specification Hashimoto published on Tuesday. A program writes ESC ] 7501 ; state=blocked:kind=permission:app=terraform:msg=<base64> ESC \ to its own terminal, and the terminal, or any tool reading the pty, decides how to show it: a notification, a status icon, an inbox row. The states are idle, working (with an optional progress percentage), done, blocked (with kind set to permission, question or auth) and error. Hierarchical ids let a deploy report us-east at 40% while eu-west waits for approval. The post's example integration is a five-line POSIX shell function wrapped around rsync, with no SDK, socket or JSON.

The argument is against the two approaches inboxes use now. Screen-scraping heuristics break with every release, and per-inbox sockets mean every program integrates with every inbox and nothing works over SSH or from a container without bridging. The pty already crosses all of those. Hashimoto has implemented it in libghostty and in Superlogical's Rex, and as proofs of concept in Terraform, Claude Code, Codex and Homebrew, each in "no more than a dozen lines." Pi's terminal docs already list it: blocked when a dialog or login waits, done when a run finishes. In the thread, one commenter argued that kind := permission | question | auth gives away that the spec is shaped around TUI agents; another warned that more in-band signaling is a security problem, and that a lockable way to query process state would be safer. A third pointed out that BSD's ^T/SIGINFO has answered "what are you doing" for decades, just as a pull rather than a push.

Reach for it if you write a long-running CLI, or build anything that hosts terminals and has to guess when they want a human. Delete the regex that watches a window title for a Braille spinner. Tradeoffs: it is a spec from Tuesday, implemented so far in libghostty and Rex, and the Claude Code and Codex support is Hashimoto's own plugins and forks, not upstream; unsupported terminals should ignore it but older and serial terminals may not; and commenters doubt that the kind values generalize beyond agents.

Pocketty (iPhone and iPad, 14-day trial then $99 once, rising to $129; Show HN Thursday, 28 points) is an SSH terminal built around herdr. The app connects straight to your computer over SSH, through Tailscale or any route you have, and runs Ghostty's terminal engine drawn with Metal, so TUIs look the way they do on a desk. With the optional daemon (brew install lukeed/tap/pocketty, macOS and Linux), it lists every herdr pane with its state, opens the one that needs you with Face ID, and sends real keys: Return, Esc, Ctrl, arrows. The daemon also snapshots the worktree each time an agent starts work, so you can swipe in for a diff of just that turn, and it offers a preview when a pane opens a localhost port.

The design choice is where the alert travels. When a pane goes blocked or done, the daemon seals the notification to your phone's key with HPKE (X25519, ChaCha20-Poly1305); a stateless relay on Cloudflare Workers passes the bytes to Apple, which sees only "Agent update." The SSH key is generated in the Secure Enclave. The site's comparison table sets this against Moshi, whose hook sends prompt text to its own server. In the thread, one user got "herdr is not installed on this host" on a machine where it was; the author said that was a fish-shell bug, with the fix waiting on App Store review. Asked how many trials had converted at $99, the author answered "Zero, as far as I can tell," and predicted more build-it-yourself variants than purchases. Another commenter pointed to the free one below.

Reach for it if your agents run in herdr and you want the blocked alert on your phone without anyone else's server reading it. Delete the habit of walking back to the desk to see whether the agent finished. Tradeoffs: iOS only, closed source, $99; the agent-state view and alerts need herdr, so without it this is a plain SSH client; it depends on herdr's own state detection, the heuristics OSC 7501 is meant to replace; and one early user's first connection failed.

herdr web ui (MIT, 692 stars, 35 contributors, repo created September 17, v0.4.3 on Friday) is a herdr plugin that serves a browser and phone client from your own machine. curl -fsSL https://herdrweb.dev/install.sh | sh on Linux or macOS, or a PowerShell one-liner on Windows x64, installs herdr 0.9.0+, Bun and the plugin, then prints a QR code for your Tailscale address. The server listens on 127.0.0.1 by default. For Claude Code, Codex and pi it reads the agent's own session files, so a pane becomes a chat with approvals and questions as tap-to-answer cards, and the live terminal is a click away. Any other program in a pane gets the terminal and its status.

Installed to the home screen, it sends web push alerts when an agent needs input or finishes, even with the app closed. You can attach a screenshot from the phone, which it uploads into the pane's folder and passes to the agent by path, or start a second agent on a new worktree. There is no hosted relay or account, but the README is specific about what does leave the machine. Voice input goes to your configured provider, push alerts and updates can use external services, and the app sends an anonymous count on install and update, which Settings can turn off. Its FAQ also says which competitor fits better: if you want tmux or zellij support, diffs, Telegram or a tunnel out of the box, use one of the others.

Reach for it if you want Pocketty's job for free and are fine with a browser instead of a native terminal. Delete the tmux attach you run over SSH from a phone keyboard. Tradeoffs: it drives only herdr; Windows gets a screen mirror with a fixed grid, not a real terminal attach; push and install need HTTPS or localhost; two releases shipped on Friday alone, so expect churn; and unlike Pocketty's sealed alerts, the push path goes through the browser vendor's service.

CodeAF (Apache-2.0, Go, 360 stars, 11 contributors, "early preview," dev builds shipping daily) is a single binary (curl -fsSL https://agentfield.ai/get/codeaf | bash) built for cheaper models: OpenRouter, DeepSeek, GLM, Kimi, MiniMax, Qwen, Ollama, or Codex through a ChatGPT plan. Its home screen lists every project and conversation on the machine and answers "what needs you, what is unread, what is running and what it cost"; a digit answers a waiting question from its row. Name three bugs in one message and each can become a task in its own copy of the repo on its own branch. Work that passes its check lands on your branch, never on main; work nothing could check waits under unread for a 1 or 2.

The README states the rule directly: a question waits under needs you, and "everything else it decides, writes down, and carries on." The headless mode, codeaf do "..." --json, goes further: where the conversation would ask, "it takes its best answer and records the assumption." Each task runs on a crew of worker, planner and checker models picked automatically, with a $5 per-task limit unless you set one. On the project's own DeepSWE run (113 issues, one seed per harness, all on DeepSeek V4 Flash) its /senior-dev subharness solved 62, ahead of mini-swe-agent's 56 and Codex's 51, at 22 cents per task. The benchmark page's own limits section says 62 against 56 "is not a statistically resolved difference," and that /senior-dev alone skipped the temperature and top-p settings the other nine sent.

Reach for it if you run several agents on open models and want one queue of questions instead of three terminals. Delete the tmux layout you keep to remember which repo's agent is which. Tradeoffs: early preview; the benchmark is the vendor's, one seed, with a sampling difference it discloses; Model Pool, which sends numeric per-model results to a shared index, is on by default (CODEAF_MODEL_POOL=off turns it off); and an agent that records its assumptions is still one you have to audit afterwards.

MXC (Microsoft eXecution Container; MIT, Rust, 2,050 stars, 1.0.0 of the Rust crate published Tuesday, 63 points on HN today) is an SDK that launches untrusted workloads, such as model output, plugins and tools, inside an OS sandbox from a JSON policy. Install @microsoft/mxc-sdk from npm, Microsoft.Mxc.Sdk from NuGet or mxc-sdk from crates.io. A request names a command, a filesystem policy (read-only, read-write and denied paths), a network policy (egress: { default: 'deny' }, proxies, host filtering where the backend supports it), UI limits on clipboard and display, and a timeout. Defaults are ProcessContainer on Windows 11, Bubblewrap on Linux and Seatbelt on macOS; LXC, MicroVM, Hyperlight, WSLC and Windows Sandbox are alternatives, several marked experimental.

The feature that bears on how often an agent stops to ask is audit mode. wxc-exec.exe --audit policy.json runs a trusted tool with the sandbox off, records what it touches, and produces a ProcessContainer policy granting exactly that. The README warns in bold never to use it on untrusted code. In the thread, one commenter praised the learning mode, the license and the plain telemetry disclosure; another noted that macOS gets only Seatbelt, which "is not nearly the same as microvm." One commenter claimed to have written a bubblewrap/MXC sandbox escape but posted no details, so treat that as unverified. The most useful comment was a request: a sandbox that collects blocked accesses into a dashboard you approve later, instead of a harness that halts until you click OK.

Reach for it if you ship an app that runs model-written code on users' machines and need one policy format across three OSes. Delete the per-platform bwrap and sandbox-exec wrappers you maintain by hand. Tradeoffs: audit mode only works on Windows ProcessContainer; macOS has one backend and it is the weakest; telemetry is opt-in, gated on the run, user consent and admin policy, and off on non-Windows; and an unverified escape claim is sitting in the launch thread.

Also on the desk: Cactus's Whistle (800 points on HN) is a 16.9 MB speech-to-text model in seven languages that loads beside their Needle tool-calling model, so one binary goes from a voice clip to JSON function calls; pip install cactus-needle. On their own table it beats Whisper base on LibriSpeech and loses on TED-LIUM and AMI, and commenters found Spanish uneven. And Why isn't the industry freaking out about DeepSeek 4.1 Flash? (828 points, 737 comments) is one developer's month of all-day sessions under a dollar each; it is the model behind CodeAF's live demo.

Verification notes: star, license, creation, contributor and release data are from the GitHub API on 2026-10-09; MXC's crate version and date are from crates.io. HN points and comments are from the Algolia API. OSC 7501's states, keys, example sequence, shell integration, herdr rule history and implementations are from Hashimoto's 2026-10-06 post and the linked spec; pi's support is from its terminal-setup docs; the agent-shaped kind, in-band security and SIGINFO comments are from HN item 49984159. Pocketty's price, transport, sealing, Secure Enclave key, diffs and Moshi comparison are from pocketty.app; the fish-shell bug, zero-conversions answer and free-alternative pointer are from HN item 50009634. herdr web ui's install, defaults, chat sources, push, data flow and "use the others" FAQ are from its README. CodeAF's install, home screen, branch rules, asking rule, headless assumption-recording, crew limit and Model Pool default are from its README; the DeepSWE figures and their limits are from its docs/benchmarks/deepswe page. MXC's backends, policies, SDKs, audit mode and telemetry are from its README; the praise, macOS, escape-claim and blocked-access-dashboard comments are from HN item 50016489. Whistle's size, languages, benchmarks and install are from Cactus's 2026-10-02 post; the Spanish reports are from HN item 50008427. Pipeline health: today's pool held 86 rows, against the ~280 the compose prompt assumes. github:trending returned 8 rows, and Reddit returned zero again, 153 days since its last nonzero day on May 9.