Dicklesworthstone/ntm v1.23.0 on GitHub

v1.23.0

A large reliability release driven by GitHub issue triage (#243–#249) and a seven-machine sweep of real agent-session history for field failures.

Idempotent sends (#245): --robot-send --op-id=<id> durably claims the operation before any keystroke, binds it to your exact command, replays the recorded outcome on identical retries, rejects conflicting reuse (IDEMPOTENCY_CONFLICT), and returns typed per-target admission states. Query receipts later with --robot-send-receipt=<id> — they survive caller timeouts and crashes.
No more silently swallowed prompts: the dispatcher now refuses typed delivery to Claude/codex panes still showing an init splash, trust dialog, or menu instead of their composer (typed failure instead of a lost prompt), and restart-prompt delivery gates on the agent actually being foreground and ready — a prompt is never typed into a bare shell again.
Composer visibility: --robot-is-working and --robot-status report unsubmitted_input and queued_messages, so a pane that is idle, blocking the swarm, and holding orders unread is finally legible.

Ground-truth context tracking: --robot-context now reads the agent CLI's own session transcripts (Claude usage records, codex token counts with real context windows) instead of scrollback guessing — field-tested at 660k real tokens where the old estimator said 3.1k. Transcript-sourced values carry source/transcript_* fields; ambiguous multi-pane attributions honestly fall back to estimation.
Durable output-change sequence (#246): output_sequence {epoch, sequence} on status/activity gives monitors a privacy-preserving, restart-surviving progress signal.
Narrow panes stop lying: live-detection windows scale with the real tmux pane width, fixing working panes classified idle at ~26 columns.
Interactive gate detection: trust dialogs and login gates now read as blocked with MANUAL_INTERVENTION guidance instead of "healthy" — and auto-restart explicitly refuses to kill a pane a keystroke would fix.
Rate limits: codex/gemini usage-limit banners ("You've hit your usage limit", plan/quota variants) are detected on every surface, including rotate --all-limited.

Security (#243): a repository's .ntm/config.toml can no longer enable Agent Mail/CASS/CM over your global disable (one-way ratchet), session registration honors enabled+auto_register, and missing config fails closed.
CM integration speaks the daemon's real MCP JSON-RPC contract; silent empty-context drops are gone (#249).
handoff create --auto works: br envelope parsing fixed, explicit --goal/--now respected, and auto mode actually captures pane output (#244).
Installer no longer prints a scary curl 404 during successful installs (#247).
Smart-restart failures report what actually failed (SHELL_NOT_RETURNED) instead of "Agent is idle"; unknown-state skips include probe detail and escalation hints.
Robot spawn accepts the CLI's count[:model[:effort]] grammar; ntm add/adopt/restart register Agent Mail identities like spawn does.
Ergonomics: ntm --version works, --message aliases --msg, unknown flags get did-you-mean suggestions, and usage errors are INVALID_FLAG instead of INTERNAL_ERROR.

25 commits since v1.22.1. Full suite green; every change adversarially reviewed twice with all confirmed findings fixed.