Publish guides to letting a second agent watch a terminal over MCP, keeping a local agent run reachable when a laptop sleeps, running Codex in a container you can open from a browser, starting a coding agent from your phone, approving Muse Code's commands from a phone, running Codex in parallel git worktrees, and keeping one browser link for a multi-night Antigravity CLI run

[artemiia]

What changes for the user?

Adds seven blog posts to shell.online/blog/:

• How to Let a Second Agent Watch a Coding Agent's Terminal Over MCP (2026-10-10), a tutorial by Artemii Amelin (Security).

  • News hook: Anthropic's report "Investigating unintended model actions" (2026-10-09), on Claude models acting on real outside systems during evaluations, and the detection tooling Anthropic built in response.
  • The post walks through shell mcp grant <id> <label> observe <ttl> into an environment variable, a Codex config.toml entry with bearer_token_env_var and an enabled_tools allow-list, the watcher's instructions, the E2EE · MCP badge and Agent: <label> chip a browser viewer sees, revocation (shell mcp revoke, revoke-all, shell password rotate), and what the setup does not do.
  • Files: blog/posts.json (entry), blog/posts/how-to-let-a-second-agent-watch-a-coding-agents-terminal-over-mcp.html, public/blog/banners/how-to-let-a-second-agent-watch-a-coding-agents-terminal-over-mcp.webp.

• How to Keep a Local Agent Run Reachable When Your Laptop Sleeps (2026-10-11), a tutorial by Artemii Amelin (Operations).

  • News hook: Google Cloud's Gemini agent, introduced by Thomas Kurian at Gemini at Work 2026 (2026-10-08), whose work "keeps running after you close your laptop".
  • The post covers the local counterpart: wrapping shell --foreground in caffeinate -i or systemd-inhibit so the wake lock ends with the agent (and why the default background start would release it at once), the Linux lid-switch caveat from logind.conf, reading shell list relay status and shell ls / --all (the ten-minute "machine gone" rule), the host's 30-second ping and 0.5 s to 10 s reconnect backoff, the relay's 12-hour window, restarting with claude --continue after a reboot, a pointer to --persistent, and what the setup does not do.
  • Files: blog/posts.json (entry), blog/posts/how-to-keep-a-local-agent-run-reachable-when-your-laptop-sleeps.html, public/blog/banners/how-to-keep-a-local-agent-run-reachable-when-your-laptop-sleeps.webp.

• How to Run Codex in a Container You Can Open From a Browser (2026-10-12), a tutorial by Artemii Amelin (Security).

  • News hook: Kaspersky's guidelines "AI agent security through the lens of Cyber Immunity" (2026-10-07, AI Everything Global, Abu Dhabi), which call for treating the model as untrusted, isolating agents in sandboxes or VMs, and default-deny network and tool rules.
  • The post runs the repository's Docker Compose setup (docker compose up --build -d, reading the link and password from docker compose logs shell-online, docker compose exec shell-online shell list), puts the Codex musl binary into /workspace with docker compose cp without root, signs in with codex login --device-auth from the shared terminal, explains what docker compose restart keeps (link and password, not the process), and states the limits: a container rather than a VM, no network default-deny, and an agent in the same user account can read /var/lib/shell-online/password and session.json.
  • Files: blog/posts.json (entry), blog/posts/how-to-run-codex-in-a-container-you-can-open-from-a-browser.html, public/blog/banners/how-to-run-codex-in-a-container-you-can-open-from-a-browser.webp.

• How to Start a Coding Agent on Your Own Computer From Your Phone (2026-10-13), a tutorial by Artemii Amelin (Guide).

  • News hook: Cursor's remote control for local agents (changelog, 2026-10-06), which lets the Cursor iOS app see and reply to agents running on your computer, with Anthropic's Remote Control for Claude Code as a second example.
  • The post covers allowing browser starts (shell auth, the one-time prompt, --allow-remote-start / --no-remote-start), checking the listener with shell daemon status and shell service status (2-second poll, 15-second reachability window, PATH detection of agent tools), the app's New session sheet and its Codex and Claude Code forms with the command preview, putting the project directory into the command (codex --cd <path>, cd <path> && claude, why codex resume --last depends on it), "Who can open it" and how the browser seals the password to the machine and to ticked colleagues, phone controls, owner-only Stop, and what the setup does not do (no attach to running processes, no wake, no shell.online flags from the browser, not a sandbox, own machines only).
  • Files: blog/posts.json (new first entry), blog/posts/how-to-start-a-coding-agent-on-your-own-computer-from-your-phone.html, public/blog/banners/how-to-start-a-coding-agent-on-your-own-computer-from-your-phone.webp.

• How to Try Muse Wonder in Muse Code and Approve Its Commands From Your Phone (2026-10-14), a tutorial by Artemii Amelin (Guide).

  • News hook: Meta's release of Muse Wonder and Muse Wonder Full (2026-10-12), available through the Meta Model API and Meta's terminal coding agent, Muse Code.
  • The post starts Muse Code through shell (shell --name wonder-trial muse --model muse-wonder-1.0 --approval-judge off), explains why options after the command name go to muse untouched (Go flag parsing, optional --), how Muse Code's Auto-review judge and approval modes decide whether a prompt reaches a person, answering the prompt from a phone (shared 80x40 grid, Esc and Ctrl-C behaviour), capping the run with --auto-close 90m (SIGTERM to the process group, SIGKILL two seconds later on macOS and Linux) and resuming with Muse Code's /resume --last, then shell list, shell attach, Ctrl-X D, shell kill and shell password rotate, and what the setup does not do.
  • Files: blog/posts.json (new first entry), blog/posts/how-to-try-muse-wonder-in-muse-code-and-approve-its-commands-from-your-phone.html, public/blog/banners/how-to-try-muse-wonder-in-muse-code-and-approve-its-commands-from-your-phone.webp.

• How to Run Codex in Parallel Git Worktrees and Tell the Sessions Apart (2026-10-15), a tutorial by Artemii Amelin (Guide).

  • News hook: Codex CLI 0.162.0 (2026-10-08), which adds tools for creating and listing managed Git worktrees from trusted local projects, with OpenAI's worktrees page and Claude Code's --worktree flag as context.
  • The post creates one worktree per task with plain git worktree add -b, starts Codex in each with shell --name "<name>" codex (the background process keeps the launching directory), reads shell list (table vs compact output, 24-character NAME column), filters shell list --json with jq and warns that it includes e2ee_password, uses shell ls / shell ls --all --json (statuses, exit_code), opens and renames sessions in the web app (who may rename), then shell attach, Ctrl-X D, shell kill and git worktree remove, and states what the setup does not do (no worktree tracking, names not unique, a worktree is not a sandbox, no reach into the Codex app's managed worktrees).
  • Files: blog/posts.json (new first entry), blog/posts/how-to-run-codex-in-parallel-git-worktrees-and-tell-the-sessions-apart.html, public/blog/banners/how-to-run-codex-in-parallel-git-worktrees-and-tell-the-sessions-apart.webp.

• How to Keep One Browser Link for a Multi-Night Antigravity CLI Run (2026-10-16), a tutorial by Artemii Amelin (Guide).

  • News hook: Google's release of Gemini 4 Argon (2026-10-13), built for long-horizon work such as code migrations and rolling out in the Antigravity CLI (agy) for Google AI Pro and Ultra subscribers, with the open Gemini CLI issue asking for the same model as context.
  • The post runs agy under shell --persistent <state-file> --name "<name>" agy so the same link, password and session ID come back every night, puts the state file under ~/.local/state outside the repository (0700 directory, 0600 file, refusal of group/other-readable files and symlinks), explains the 30-day versus 12-hour relay windows and why the session ID comes back after the record expires, the fixed read-only mode and password, shell password rotate (same path, new fragment) and retiring the link by deleting the state file, and states what the setup does not do (not a process checkpoint, no automatic restart after a crash, MCP grants cleared on resume, no --no-e2ee, no wake).
  • Files: blog/posts.json (new first entry), blog/posts/how-to-keep-one-browser-link-for-a-multi-night-antigravity-cli-run.html, public/blog/banners/how-to-keep-one-browser-link-for-a-multi-night-antigravity-cli-run.webp.

Verification

Run on the branch as it now stands (all seven posts, merged with current upstream/main, which had no new commits).

• python3 tools/lint_post.py how-to-keep-one-browser-link-for-a-multi-night-antigravity-cli-run: OK, 1,617 words, 26 links (14 outside across 8 sites, 3 to pilotprotocol.network).
• python3 tools/check_links.py blog/posts/how-to-keep-one-browser-link-for-a-multi-night-antigravity-cli-run.html: 26 links, 26 ok, 0 blocked, 0 dead. (A first run reported ai.google.dev's model page as dead because it redirects scripted requests to a Google sign-in; that link was replaced.)
• Earlier posts, when they were added: 2026-10-15 lint OK, 1,986 words, 22 links, link check 22 ok; 2026-10-14 lint OK, 1,802 words, 22 links, link check 22 ok; 2026-10-13 lint OK, 1,973 words, 25 links, link check 25 ok; 2026-10-12 lint OK, 1,992 words, 28 links, link check 27 ok; 2026-10-11 lint OK, 1,964 words, 25 links, link check 25 ok; 2026-10-10 lint OK, 1,978 words, 24 links, link check 24 ok. 0 blocked, 0 dead in all six.
• npx vitest run tests/blog.test.ts: 1 file, 15 tests passed.
• node scripts/test-landing-seo.mjs: passed.
• npm run build:web: exit 0 (only the existing chunk-size warning).
• Claims in the 2026-10-16 post were checked at this commit against cmd/shell/help.go, cmd/shell/main.go, cmd/shell/persistent.go, cmd/shell/private_file_unix.go, cmd/shell/account_sessions.go, shared/session-lifetime.ts, shared/persistent-session.ts, the resume, disconnect and expiry paths in worker/index.ts (grants cleared on resume), and the CLI, encryption and reliability pages in docs/content.json. Antigravity CLI details come from Google's getting started and models pages. agy was not run end to end on the publishing machine.
• Claims in the 2026-10-15 post were checked at this commit against cmd/shell/help.go, cmd/shell/main.go, cmd/shell/sessions.go (list table, compact output, --name validation, JSON fields), cmd/shell/account_sessions.go (shell ls, statuses, ten-minute machine-gone rule), cmd/shell/session_output.go, cmd/shell/background_unix.go (working directory of the background child), app/src/lib/session-view.ts, app/src/lib/session-title.ts and app/src/routes/Session.tsx (rename), and the CLI page in docs/content.json. Git behaviour comes from the git-worktree and gitignore manuals. Codex was not run end to end on the publishing machine.
• Claims in the 2026-10-14 post were checked at this commit against cmd/shell/main.go (flag parsing), cmd/shell/autoclose.go, cmd/shell/handoff.go, cmd/shell/session_unix.go and cmd/shell/process_unix.go (deadline termination), cmd/shell/help.go, app/src/terminal/chat/keys.ts and the docs and mobile pages in docs/content.json. Muse Code details come from Meta's developer docs (overview, configuration, permissions, interactive). Muse Code was not installed on the publishing machine, so the run was not performed end to end.
• Claims in the 2026-10-13 post were checked at this commit against cmd/shell/help.go, cmd/shell/agent_loop.go, cmd/shell/remote_start.go, cmd/shell/browser_command*.go, cmd/shell/harness.go, cmd/shell/service*.go, internal/account/sealed.go, app/src/lib/session-kinds.ts, app/src/components/NewSessionModal.tsx, app/server/app.ts (POST /api/commands, AGENT_ONLINE_MS), CHANGELOG 0.24.1 and the app, mobile and security pages in docs/content.json. Browser starts were not run end to end on the publishing machine.
• Noted while checking, and left out of the post: when remote start is off, shell service install says "Run 'shell daemon start' to allow it", but shell daemon start itself refuses in that state and points to shell auth --allow-remote-start. Worth a look by a maintainer.
• Claims in the 2026-10-12 post were checked against Dockerfile, docker-compose.yml, scripts/docker-entrypoint.sh, cmd/shell/help.go, cmd/shell/session_output.go, cmd/shell/persistent.go, cmd/shell/session_unix.go and the Docker, encryption and security pages in docs/content.json. Docker itself was not available on the publishing machine, so the steps were not run end to end; the post says so.
• Noted while checking, and deliberately left out of the post: shell password rotate inside the container updates session.json but not the entrypoint's /var/lib/shell-online/password, so on the next start the entrypoint appears to export the old password, which persistent.go rejects as not matching the state. The Docker help and docs page recommend rotating inside the container. Also, the entrypoint generates an 8-character password while shell help docker says ten. Worth a look by a maintainer.

Access and privacy

No product change. All seven posts and their covers contain only invented session names, links, passwords and placeholders; no real share links or tokens.

• No real share links, credentials, private terminal content or deployment secrets are included.
• User-facing docs and the changelog are updated, or I explain why no update is needed. (An article needs no changelog entry.)

Rollout

Website only. The posts are live after the next deploy.

🤖 Generated with Claude Code