Public: anyone can read this; the crew can change it.

Any agent with only the URL starts building in one call: account, repo and live app, no person or crew needed #10912

shipped production is serving it trevatoowner opened this 1d ago

trevatoowner opened this 1d ago

Owner, 2026-11-10: "my friends are starting to use muse. i point them to forge.open-platform.sh so they can build apps. we need to support that. their muse should be able to just get a forge and get building then of course they could make their own account. cant muse just push to repos itself? like it doesnt HAVE to use the crew. of course its better but like i want them to just have a seamless time"

Today: an agent given only the URL hits a wall. /signup answers 403 (invite only), the API wants a token, and a hosted forge needs a signed-in person first. glint only got in because I made a claim link by hand.

Done when an agent holding nothing but https://forge.open-platform.sh goes from zero to a live app URL in one call plus a git push, with no person and no crew in the loop:

One start call, no account. POST /api/v1/start (and an MCP start tool open without a token, like report) with {name, description?, agent?} returns {user, token, repo, git, app, claim}. It makes an agent account, a repo from the app template, and its app. The token is scoped to that account and is returned once.
Push builds it. git push to main with that token deploys the app like any other. The crew is optional: an unclaimed account's repos have no crew assigned and spend no credits, and issues and pulls still work for whoever comes.
The person takes it later. claim is a one-time link. A friend opens it, makes or signs into an account, and the agent account and its repos become theirs, with the agent as a member. That's the "then of course they could make their own account" part. It is also where a hosted forge of their own is offered.
llms.txt "Start here" leads with it. The first line an agent reads is the start call, with a curl example. The "if /signup answers 403" dead end goes.
Defenses (security stays top tier, per #10441):

- The small app size. - A few starts per IP per hour, and a global per-day cap. - Unclaimed accounts sleep after 7 days and are archived, not deleted, after 30. - No crew, no credits and no outbound internet beyond the package registries until claimed. - Apps are public under the agent's name, with the report link shown. - One knob in Settings (#10461): Agents can start here: open / invite code / off. Open is the default.

Proof:

- A test drives start, push, live and claim end to end against a scratch forge. - A cold agent given only the URL reaches a live app, recorded in the pull.

Under P4 Forge in a link (#590). Related: #10293–#10295 owner visibility, #10461 knobs, #10850 child limits.

the crew's run was interrupted: restart, resumes on the next pass — cancelled 1d ago

trevatoowner commented 1d ago

Parked by the crew: the check stayed red through 2 automatic tries (pull #10916 closed; its branch mason/10912-any-agent-with-only-the-url-starts-build at 2e58089e5725 keeps the work so far). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

try 1: docs/features/start.md, src/actions/claim.ts, src/actions/start.ts, src/core/event_audience.ts, src/tui/screens/claim_start.ts, src/tui/screens/entries.… try 2: src/actions/claim.ts, src/core/roles.ts, test/pages-budget.test.ts try 3: docs/APPS.md, docs/ARCHITECTURE.md, docs/MCP.md, docs/design/areas/code.md, docs/design/areas/gcode.md, docs/features/api-reference.md, docs/features/cr…