lea deck
Without the deck
The deck is optional. lea config deck off (or sh install.sh --no-deck [--tool CMD], or
answering no to the deck question of the first run or of lea init) makes lea run your own tool inside the lea container instead:
Claude Code by default, or any command (lea config tool codex, lea config tool aider --model x; a command and its arguments, never run through a shell). Arguments after lea go to it
(lea --resume). lea config deck on brings the deck back. Either switch applies at the next
lea, with the same container: nothing is rebuilt and running agents are not touched. An install
made before the deck was optional (no LEA_DECK in its user config) is asked once, at its next
lea on a terminal, and the answer is recorded.
What stays the same: the container and its confinement (proxy and egress allowlist, seccomp,
AppArmor, no host secrets), grants, lea's daemon and MCP server, and the Locks' sockets. The
docker run arguments are the deck's, to the byte. tmux is not needed (lea new still needs it,
for its agents' terminals).
Your tool from an IDE or another terminal #
lea attach runs the tool in the container
like lea does; lea attach --print prints the docker exec command that does it in the
running container, as is, for a second terminal or an IDE's terminal (VS Code Dev Containers
and JetBrains can also attach to the running lea-<id> container).
lea's agents #
lea new and a lead's spawns still run under the daemon. lea board
(--watch: again every 2 s) follows them, and lea attach AGENT joins one agent's terminal
(detach with abduco's ctrl+\).
What waits for you #
A permission request of one of lea's agents, a spawn request routed to
you, a request or a blocked agent comes as a desktop notification (notify-send, or
osascript on macOS) instead of the deck's sound. lea requests lists the permissions (pN)
and spawn requests (sN); lea approve pN [always], lea deny pN, lea approve sN and
lea deny sN [reason] answer them. Unanswered after LEA_APPROVAL_TIMEOUT seconds, the
agent asks in its own terminal. Lock requests (locksql, lockmq, lockfile, locklog, lockhttp) are not
lea's: lox run decides them, deck or not.
No notifications with LEA_CTL=1 #
lea-ctl runs lea's daemon in a container, which has
neither notify-send nor osascript: without the deck nothing shows when something waits for
you. Check lea requests (or lea board --watch), or lea config ctl off to get the
notifications back. lea doctor warns in that configuration, and when the host has no notifier.
Off without the deck: #
the agent column, lea's sounds and the deck's keys.
lea doctor shows the mode, does not flag a missing tmux with LEA_DECK=0, and says whether
lea's notifications can show.