omarchy-send: agentic generator mode + document the PIN-gated agentic toggle

The reply generator now branches on OMARCHY_AGENTIC (set by omarchy-send):
reply-only (no tools) by default, or agentic (claude with its tools, to act on
the box then report) when the Settings agentic toggle is on. SKILL.md documents
the agentic toggle (g), that it's off by default and may only be enabled with a
PIN set (which gates who can trigger remote command execution), and to keep it
to a trusted LAN.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

omalocal.sh

@@ -862,7 +862,7 @@ reply; omarchy-send sends it. It is:
 
 - **A runtime toggle** — flip it in Settings (`r`); the state persists in config.
   Plain receiving (toggle off) never auto-replies.
-- **Reply-only** — the generator gives the model no tools (`--tools ""`), so an
+- **Reply-only by default** — the generator gives the model no tools, so an
   unauthenticated LAN sender can't make this box do anything but emit a text reply.
 - **Tied to the TUI** — auto-reply (like all receiving) happens only while the TUI
   is open; quit it (`q`) and the box stops replying. No background daemon.
@@ -871,6 +871,20 @@ Requires the `claude` CLI installed and authenticated for this user (omaterm
 installs it; run `claude` once interactively to log in). The generator resolves
 `claude` from PATH or `mise`.
 
+#### Agentic mode (the AI can run commands — PIN-gated)
+
+A second Settings toggle, **`g`**, switches on **agentic** mode: the AI may use
+its tools to *act* on this box (run commands, deploy, inspect) in response to a
+message, then reply with the result. It is **off by default**.
+
+- Because this is **remote command execution driven by LAN messages**, omarchy-send
+  only lets you enable it **while a PIN is set** (`e` to set one). The PIN gates who
+  can trigger it — only senders who know it can message the box. Enabling agentic
+  also turns AI auto-reply on; clearing the PIN turns agentic back off.
+- Keep it to a **trusted LAN**; never expose port 53317 to the internet.
+- Internally, omarchy-send sets `OMARCHY_AGENTIC=1` so the generator runs `claude`
+  with its tools; otherwise it stays reply-only.
+
 > Don't enable AI auto-reply on two boxes pointed at each other — each would
 > reply to the other's reply forever. Phones / desktops running plain LocalSend
 > don't auto-reply, so messaging with them is fine.
@@ -1102,8 +1116,13 @@ cat > "/mnt/home/$USERNAME/.local/bin/omarchy-send-reply" <<'OMS_REPLY'
 #!/usr/bin/env bash
 # omarchy-send-reply — reply generator for omarchy-send's AI auto-reply toggle.
 # omarchy-send runs this for each received message (message in OMARCHY_MSG_* env)
-# and sends whatever we print on stdout back to the sender. So this ONLY composes
-# text: it does no sending and takes no actions. Toggle it from Settings (`r`).
+# and sends whatever we print on stdout back to the sender. It does no sending
+# itself. Two modes, chosen by omarchy-send via OMARCHY_AGENTIC:
+#   unset/0 — reply-only: no tools, the model can only emit text (safe default).
+#   1       — agentic: the model may use its tools to ACT on this box, then
+#             report. omarchy-send only sets this when agentic mode is enabled in
+#             Settings, which it gates on a PIN — so only senders who know the PIN
+#             can reach this path. Still: this is remote command execution.
 set -uo pipefail
 
 text="${OMARCHY_MSG_TEXT:-}"
@@ -1120,14 +1139,18 @@ else
   exit 0   # no AI available; omarchy-send logs the empty reply and skips the send
 fi
 
+# --permission-mode bypassPermissions never blocks on the first-run folder-trust
+# prompt (there's no TTY to answer it).
+if [ "${OMARCHY_AGENTIC:-0}" = "1" ]; then
+  prompt="You are an assistant running on a LAN server. \"$who\" sent: \"$text\". Do what they ask using your tools, then reply with a brief plain-text summary of what you did or found. Output only that summary."
+  "${ai[@]}" -p "$prompt" --permission-mode bypassPermissions 2>/dev/null \
+    | tr -d '\000' | head -c 2000
+else
+  # --tools "" → no tools, so the model can ONLY emit text.
   prompt="You are an automatic responder for a LAN file-transfer tool. \"$who\" sent: \"$text\". Reply in one or two short, friendly plain-text sentences. Output only the reply."
-
-# --tools ""                   no tools, so the model can ONLY emit text — it
-#                              cannot run a command a message asks for.
-# --permission-mode bypass...  never blocks on the first-run folder-trust prompt
-#                              (no TTY to answer it).
   "${ai[@]}" -p "$prompt" --tools "" --permission-mode bypassPermissions 2>/dev/null \
     | tr -d '\000' | head -c 1000
+fi
 OMS_REPLY
 
 arch-chroot /mnt chmod 755 "/home/$USERNAME/.local/bin/omarchy-send-reply"