Agent CLI

mur agent cli opens an interactive, streaming terminal chat with a running MUR agent — tokens stream live, tool calls show as step cards, and risky actions pause for your approval.

mur agent cli coach            # chat with the "coach" agent
murmur coach                   # quick form — the murmur symlink is identical
mur agent cli coach --resume   # continue the last conversation
mur agent cli dev qa ops       # three agents, one tiled pane each
murmur                         # bare murmur opens the concierge

The agent must be running (mur agent status <name>; start one with mur agent start <name>). Multiple names open one pane per agent — tmux is preferred, with zellij / WezTerm / kitty auto-detected. See Agent Lifecycle for start/stop/remove and what changes once it runs as a service.

Keys

Completion menu

Type / to open a filtered menu of everything you can invoke — built-in slash commands and the agent's own skills. Keep typing to filter, ↑↓ to move, Tab or Enter to accept, Esc to dismiss. Commands expand to a second layer (for example /mcp → list · add · remove · …), and the agent's skills appear by name so you can drop one straight into your message.

The second layer is not always a fixed list. Four commands complete from the agent itself, so what you see is what this agent can actually do right now:

/effort is the one where the difference bites. Effort levels are an arbitrary subset per model, never a prefix of one scale: Claude Opus 4.6 has max but no xhigh, DeepSeek V4 publishes low/high/max with no middle step, Qwen and GLM are a two-position switch, and Magistral rejects the parameter outright. The menu asks the same table the command does, so a model with no reasoning control opens no menu at all rather than offering a level it would have to silently drop. Switch models with /model and the levels on offer change with it.

The menu marks where you are

Five commands are settings rather than actions, and their menu shows the value in force — a green ✔ on the row you are already on: /model, /effort, /skin, /auto, /verbose. Effort is marked from the session first and the profile second, so a /effort high you set for this conversation shows as the current level even though the profile still says something else. A level nobody has set marks nothing, because the API default belongs to the model and a ✔ on a guess would be a lie. Action menus — /mcp, /skill, /login, /secret, /forget — mark nothing; there is no value in force to mark.

Completing a shell line

A line that starts with ! completes too, from your machine rather than the agent. The first word offers executables on your $PATH, scanned once when you first ask. Every word after that offers paths under the chat's working directory: directories come first with a trailing /, and accepting one keeps the menu open on its contents so you can walk down a tree with Tab. ~ expands to your home. Hidden entries stay hidden until you type the leading dot.

Slash commands

Running a command yourself

Start a line with ! and the rest runs on your machine, in your shell, in the chat's working directory:

!cargo test --lib

The command and its output appear as their own card, and the same block goes to the agent as your message the moment the command finishes — so the next thing you type can be "why did that fail?" with nothing pasted. If the agent is mid-reply when the command lands, the output steers the turn already running instead of starting a second one.

Output is captured whole (stdout and stderr, with the exit code when it is non-zero) up to a byte cap, and a command that runs too long is cut with a note rather than hanging the chat. Nothing is run without you typing it: ! is a line prefix, not something the agent can invoke.

Handing over a credential

Sooner or later an agent needs a token — a Gitea deploy key, an API key for a service it has to call. Pasting it into the chat puts the plaintext in three places at once: the model's context, the agent's signed append-only channel on disk, and your model provider. Pattern-based redaction does not save you; it recognises sk-, ghp_, AKIA and a handful of other shapes, and a bare hex token matches none of them.

/secret is the way in:

/secret GITEA_TOKEN
Enter value for GITEA_TOKEN (input hidden, Enter alone cancels): ****
✓ GITEA_TOKEN available as $GITEA_TOKEN

The value is read with echo off, outside the chat box — it never reaches your input history, the transcript, or the channel. Only the KEY goes on the command line; a value typed there is ignored rather than accepted.

What the agent gets is an environment variable. Its shell commands can use $GITEA_TOKEN, but the model is only ever told the name, and every tool result is scrubbed of the value on the way back:

> print the length of $GITEA_TOKEN and then its value
LEN=40 VAL=[SECRET:GITEA_TOKEN]

Tell the agent to use it by name — curl -H "Authorization: token $GITEA_TOKEN" — and keep it out of URLs and git remotes, where it would land in .git/config.

Secrets are per-agent and survive restarts: the value goes to your OS keychain (the same slot mur agent secret set uses) and the name to the agent's profile, while the running agent is told immediately so nothing needs restarting. /secret with no key lists the names you have set; /secret <KEY> --delete revokes one.

If the agent is not running, the command says so in as many words — saved to keychain ✓ · running agent: not reached — rather than showing a tick that would have you believe the agent already has it.

What this does and does not protect. The guarantee is that the plaintext never enters the model's context. Masking tool output on top of that is a second line of defence, not the first: it is a literal string match, so a value the agent re-encodes (base64, xxd) before printing is not caught. Anything you hand an agent, it can use — treat the token's scope, not the masking, as the real boundary.

Suggested replies

When the agent wants you to pick from a short set of options, it offers them as Tab-to-fill suggestions right in your input box — no copy-paste. A single suggestion shows as greyed ghost text you accept with Tab; several show as a small picker you move through with ↑↓ and accept with Tab/Enter. Start typing to ignore them.

Proposal chips

When the agent wants you to run something rather than pick a reply, it offers one command as a chip above the input instead of telling you to retype it.

Nothing runs on its own: Enter on a shell or slash chip does nothing, and a restart chip can only restart the agent that offered it. A chip disappears 120 seconds after the turn finishes; Ctrl+K on an empty input pins it, and pressing it again unpins it. A new chip replaces the old one. Proposals are vetted before they reach you — placeholders such as <name>, control characters and secret-shaped strings are rejected back to the agent.

Permanent instructions

Ordinary memories compete for a share of the prompt and may lose to a better match. A permanent instruction does not compete: it is injected every turn, before ranking, and is never truncated. That is a guarantee that the text is in front of the model, not that the model obeys it.

Only you can create one — with /instruct, or by promoting a memory with /pin. The agent's own remember tool always saves ordinary memories. Permanent instructions share a fixed budget of 3,500 tokens. A write that would overflow it is refused with the size it needs and the commands that free room (/memories shows each one's size). The same check runs before every turn, from the chat, --plain, and mur agent send alike.

Live fleet progress

When the agent you are chatting with kicks off a fleet (the concierge's fleet_run tool — which returns a run_id at once and lets the agent carry on), the TUI arms two things automatically — no flag, no command:

• a member rail at the bottom: one row per fleet member with its live state (working / blocked on approval / done / failed), the sub-goal it was handed, and elapsed time;
• a milestone feed in the transcript: delegations with their sub-goal, each member's own completion summary with how long the turn took, run outcomes, loop-guard notes, and approval gates (with the exact mur channel approve … command inline).

Milestones come from the fleet's signed channel, so what you see is what was recorded — not a narration. The raw event stream is still there when you want it: /channels N --follow live-tails any channel line by line, and mur agent cli <name> --fleet <fleet> arms the rail at launch for a fleet you are about to run by hand.

The rail's collapsed job line (job N/M · K ✖ failed) counts failures from the moment it armed, not the whole queue's history — a fleet dispatched a second time no longer inherits a stale failure count from an earlier run. When there is an older, unrelated failure still sitting in the queue, the line splits it out explicitly: K ✖ failed (this run) vs. K ✖ failed (queue, before this run). mur fleet jobs <name> --since <run-id> gives you the same split from the CLI, scoped to one dispatch's run_id (see Fleet Loops).

Tool approvals

A session starts with auto-approve on: read and write tool calls run without asking, and the AUTO badge in the status bar says so the whole time. Auto-approve has a ceiling it cannot lift — spend, destructive, privileged and network-egress calls (rm -rf, curl, sudo, git push --force) still stop and ask, even in the default session.

Browser MCP tools are tiered by what they do to your logged-in web session, whatever name you gave the MCP server:

The read list is an allow-list on purpose: a new upstream browser tool asks until it is known to be harmless.

To have the agent pause before any write or otherwise risky tool call and show you exactly what it's about to run — approve or deny in place — start the session ask-first:

mur agent cli coach --ask                    # ask before every risky tool call this session
mur agent cli coach --ask --no-auto-reads    # …and ask for reads too — the strictest setting
mur agent cli coach --auto                   # the default, spelled out (kept for older scripts)

You can also toggle full auto-approval mid-chat with /auto on / /auto off. Nothing is persisted — a fresh session starts from the default again, not from where the last one left off.

read_file and shell commands a conservative classifier can prove read-only (cat, ls, grep, git status, …) are auto-approved by default, even under --ask — anything it cannot prove still asks. --no-auto-reads puts the prompt back on reads; the older --auto-reads is still accepted and does nothing. It behaves the same in --plain mode, so a piped or headless run doesn't stop on every read.

/auto off also revokes the per-tool grants made with [a], and the AUTO: badge in the status bar names the tools currently muted rather than only counting them — so you can see what you granted, and take it back.

Answering a gate

An open gate always renders somewhere: inline on the step card that triggered it, or as a centred modal when that card has scrolled out of the live view. The status line names the tool and counts down to the auto-deny.

Decision keys only count while the composer is empty. Once you have started typing, y / a / n are ordinary characters — a message that happens to contain one cannot decide the gate behind your back. The session-wide grants take two presses for the same reason: a single keystroke should never hand out blanket approval.

If nobody answers, the gate expires, the call is denied, and the status line stops asking.