@bridge4dev/runner 0.13.1 → 0.22.1

package/dist/adapters/claude.js

@@ -1,8 +1,12 @@
 import { query, } from '@anthropic-ai/claude-agent-sdk';
+import fs from 'node:fs';
+import path from 'node:path';
 import { AsyncQueue } from '../async-queue.js';
 import { log } from '../log.js';
+import { mcpConfigPath } from '../paths.js';
 import { evaluateToolUse, maskSecrets, maskString } from '../policy.js';
 import { AGENT_MODES, } from './types.js';
+import { answerSummary, answerValue, discussMessage, invalidationMessage, mirrorOptions, newAskId, MAX_OPTIONS, MAX_QUESTIONS, OPTION_TEXT_LIMIT, QUESTION_TEXT_LIMIT, } from './questions.js';
 // Claude adapter over the Agent SDK. Three live-verified gotchas (plan §2):
 //  1. Bare tool names in `allowedTools` auto-approve BEFORE canUseTool — we
 //     never populate allowedTools with gated tools (we don't set it at all).
@@ -51,7 +55,8 @@ const ENV_ALLOWLIST = [
     // Subscription token — legitimate agent auth when the user configured it.
     'CLAUDE_CODE_OAUTH_TOKEN',
 ];
-function scrubbedEnv() {
+/** Exported for the one-shot commit-message run (session 14), same rules. */
+export function scrubbedEnv() {
     const env = {};
     for (const key of ENV_ALLOWLIST) {
         const value = process.env[key];
@@ -74,62 +79,344 @@ const SYSTEM_APPEND = [
     'You are running inside a DevBridge dev session, controlled from the DevBridge dashboard.',
     'Rules:',
     '- Work ONLY inside the current working directory (a dedicated git worktree on a session branch).',
-    '- Commit your work in the current branch with clear messages. NEVER push to main/master and never force-push.',
+    // Session 13: pushing is now refused outright by layer 1, in every trust
+    // mode. Saying so here is not a duplicate of the rule — it saves the agent a
+    // turn spent discovering the refusal, and tells it what to do instead.
+    '- Commit your work in the current branch with clear messages. You cannot push: `git push` is blocked. A human presses «Push» and «Apply» in DevBridge when the branch is ready.',
     '- If DevBridge MCP tools (mcp__devbridge__*) are available and the task mentions tickets: fetch the ticket first, set its status to IN_PROGRESS when you start and READY_FOR_REVIEW when your implementation is complete, and leave a short summary comment.',
-    '- The user is not in a terminal: if you need a decision or information, ask the question in plain text and end your turn — the answer arrives as the next user message.',
+    '- The user is not in a terminal, but they DO answer: when you need a decision, use the AskUserQuestion tool. It is rendered as a card in the DevBridge dashboard and the call waits — however long it takes — until a human answers it. Only ask in plain text if the tool is unavailable.',
+    '- Never decide for the user when you asked them a question. If the tool comes back saying the question was withdrawn, stop and wait rather than guessing.',
     '- Never print secrets (tokens, API keys, private keys) in your output.',
 ].join('\n');
+/** DevBridge's own rules, then whatever this workspace adds (session 13). */
+function composeSystemAppend(workspaceContext) {
+    return workspaceContext ? `${SYSTEM_APPEND}\n\n${workspaceContext}` : SYSTEM_APPEND;
+}
+/**
+ * The five levels the Agent SDK declares, and the one gate that keeps a
+ * stale or invented one out of a query option (ticket #111).
+ *
+ * The CLI rejects the whole query on a bad `effort`, not just the option — so a
+ * level pinned against a model that no longer offers it would take the session
+ * down at launch rather than degrade.
+ */
+const EFFORT_LEVELS = ['low', 'medium', 'high', 'xhigh', 'max'];
+function isEffortLevel(value) {
+    return typeof value === 'string' && EFFORT_LEVELS.includes(value);
+}
+/**
+ * The sixth rung the CLI's own `/effort` offers — and the one that is NOT a
+ * level (owner, 2026-07-29: «нету уровня еффорта для клода ультракод»).
+ *
+ * `ultracode` is a separate boolean in the settings layer, not a member of
+ * `EffortLevel`: the SDK describes it as «xhigh effort plus standing
+ * dynamic-workflow orchestration», session-scoped and never persisted. Verified
+ * live — `applyFlagSettings({ ultracode: true })` is accepted and the next turn
+ * of the same process reports `CLAUDE_EFFORT=xhigh` with the Workflow tool in
+ * play.
+ *
+ * It rides in the same picker because that is where the user looks for it and
+ * where the CLI itself puts it, but everything below has to keep the two apart:
+ * sending it as an `effortLevel` would be rejected, and leaving the flag set
+ * while a plain level is chosen would pin every later turn to xhigh.
+ */
+const ULTRACODE = 'ultracode';
+function isEffortPin(value) {
+    return value === ULTRACODE || isEffortLevel(value);
+}
+const EFFORT_LABELS = {
+    low: 'Low',
+    medium: 'Medium',
+    high: 'High',
+    xhigh: 'Extra high',
+    max: 'Max',
+    [ULTRACODE]: 'Ultracode',
+};
+const EFFORT_DESCRIPTIONS = {
+    [ULTRACODE]: 'Extra high, plus the agent orchestrates sub-agent workflows on its own',
+};
+/** Longest a task title may be before the tray truncates it. */
+const TASK_TITLE_LIMIT = 120;
+/** How many live tasks travel in one `agent_tasks` event. */
+const TASK_LIST_CAP = 20;
+/**
+ * Floor between two `agent_tasks` publications.
+ *
+ * A twenty-agent fan-out changes membership dozens of times a minute and every
+ * running subagent adds a `task_progress` every ~30s. Each event is a row in
+ * `DevSessionEvent`, so the tray coalesces rather than narrating.
+ */
+const TASK_PUBLISH_INTERVAL_MS = 1_500;
+/** What the agent calls a finished task, mapped onto the tray's three states. */
+function taskStatus(raw) {
+    if (raw === 'completed')
+        return 'done';
+    if (raw === 'failed' || raw === 'killed')
+        return 'failed';
+    return 'running';
+}
+/**
+ * The `usage` block of a `task_progress` / `task_notification`, read one field
+ * at a time. Each is optional on its own: an older CLI that reports only tokens
+ * must still get its tokens through, not have the whole block dropped.
+ */
+function usagePatch(value) {
+    if (!value || typeof value !== 'object')
+        return {};
+    const usage = value;
+    return {
+        ...(typeof usage['total_tokens'] === 'number' ? { tokens: usage['total_tokens'] } : {}),
+        ...(typeof usage['tool_uses'] === 'number' ? { toolUses: usage['tool_uses'] } : {}),
+        ...(typeof usage['duration_ms'] === 'number' ? { durationMs: usage['duration_ms'] } : {}),
+    };
+}
 class ClaudeSession {
     spec;
     input = new AsyncQueue();
     output = new AsyncQueue();
     pending = new Map();
+    /** Parked question calls, keyed by the askId this adapter issued. */
+    pendingQuestions = new Map();
     q;
     stopped = false;
+    /** Path of the 0600 MCP config for this session, or null (ticket #119). */
+    mcpConfigFile = null;
+    /** Set when the write failed and the key went into argv after all. */
+    mcpFallbackNotice = null;
     /** Guards against overlapping capability probes. */
     capabilitiesInFlight = false;
     mode;
     model;
+    /**
+     * Reasoning effort pinned for this session (ticket #111).
+     *
+     * Claude Code has had this dial for a while — the SDK takes `effort` as a
+     * query option and every model row says which levels it accepts — and this
+     * adapter simply never asked for it, so the dashboard drew no control and
+     * every session ran at the model's default. It is a launch-time option with
+     * no live setter, so changing it relaunches the process the same way a model
+     * change used to before `setModel` existed: the pin is kept here and applied
+     * when the supervisor next starts the agent.
+     */
+    effort;
+    /**
+     * The last model catalogue the CLI reported, kept so a wire id can be
+     * resolved back to the row it came from (ticket #111).
+     *
+     * `supportedModels()` answers in ALIASES (`default`, `sonnet`, `opus[1m]`),
+     * `system:init` answers with the RESOLVED id (`claude-opus-5[1m]`). Without
+     * this map the two never meet.
+     */
+    knownModels = [];
+    /**
+     * The wire model the CLI last reported, kept RAW (QA-111 M3).
+     *
+     * `system:init` and the catalogue probe race, and `system:init` can win: the
+     * catalogue arrives as the answer to a control request, nothing orders the
+     * two. Resolving a wire id against an EMPTY catalogue used to overwrite
+     * `this.model` with the wire id — destroying the alias the user picked — and
+     * the later re-ask then had only the wire id to go on, so it asked the
+     * CATALOGUE «who owns this?» and got `default`. A session started on Opus
+     * silently became a session on whatever the account is recommended today,
+     * and `persistAgentState` wrote that into the session row.
+     *
+     * So the raw id waits here until there is a catalogue to read it against.
+     */
+    liveWireModel;
+    /**
+     * Everything running beside the conversation, keyed by the agent's task id
+     * (ticket #113). Membership is owned by `background_tasks_changed`; the
+     * details come from the `task_*` bookends.
+     */
+    tasks = new Map();
+    /** Ids currently in the agent's live set — the tray shows exactly these. */
+    liveTaskIds = [];
+    /** Started / finished within the CURRENT turn: the «14 of 20» numerator. */
+    turnTasksStarted = 0;
+    turnTasksDone = 0;
+    taskPublishTimer = null;
+    taskPublishedAt = 0;
+    /** Last published snapshot, minus the ages — see `flushTasks` (QA-111 M4). */
+    lastTaskFingerprint = '';
+    /**
+     * Ambient tasks the SDK marked `skip_transcript`. Remembered by id because
+     * the flag arrives on `task_started`, which is usually NOT the first message
+     * about the task — the live set typically precedes it (QA-111 m4).
+     */
+    skipTaskIds = new Set();
     events = this.output;
     constructor(spec, queryFn) {
         this.spec = spec;
         this.mode = spec.mode ?? 'ask';
         if (spec.model)
             this.model = spec.model;
+        // Gated, not copied: a pin stored against a model that no longer offers it
+        // would otherwise be reported as the level in force while the CLI ignored
+        // it — and `applyFlagSettings` would be handed a level it rejects.
+        if (isEffortPin(spec.effort))
+            this.effort = spec.effort;
         // Free CHAT sessions start with no prompt: the process boots, reports its
         // capabilities and waits for the first message (live-verified 2026-07-24).
         if (spec.prompt && spec.prompt.trim())
             this.pushUserText(spec.prompt);
+        // Ticket #119: the same object the SDK used to inline into argv, now written
+        // to a 0600 file before the CLI is spawned and removed in `stop()`.
+        const mcpServers = spec.mcp
+            ? {
+                devbridge: {
+                    type: 'http',
+                    url: spec.mcp.url,
+                    headers: { Authorization: `Bearer ${spec.mcp.token}` },
+                },
+            }
+            : null;
+        // If the write fails we fall back to the old inline shape. Losing the
+        // hardening is bad; losing the agent's MCP tools mid-session is worse, and
+        // that is the trade this line makes — loudly, via `log.warn` inside.
+        const mcpConfigFile = mcpServers ? this.writeMcpConfig(mcpServers) : null;
+        this.mcpConfigFile = mcpConfigFile;
         const options = {
             cwd: spec.cwd,
             env: scrubbedEnv(),
-            settingSources: [],
+            /**
+             * Everything the machine's own Claude has (owner's call, 2026-07-30).
+             *
+             * This was `[]` from session 13 onward — SDK isolation mode — and it cost
+             * the sessions most of what the terminal has: the 20 agents in
+             * `~/.claude/agents`, the `sc:*` and superpowers plugins, and every MCP
+             * server the machine is configured with, playwright included. A session
+             * could not open a page and look at its own change; it could only say
+             * «done, please check».
+             *
+             * The owner runs the same agent, on the same machine, with the same
+             * powers, from a terminal. Parity is the point: a session should be able
+             * to do what its owner can do there.
+             *
+             * Two consequences that are NOT bugs and should not be surprises:
+             *  - hooks from `~/.claude/settings.json` fire for sessions too;
+             *  - `.claude/settings.json` lives inside the repository, so an agent can
+             *    edit the file that configures its own next launch.
+             */
+            settingSources: ['user', 'project', 'local'],
             permissionMode: MODE_TO_PERMISSION[this.mode],
-            systemPrompt: { type: 'preset', preset: 'claude_code', append: SYSTEM_APPEND },
+            systemPrompt: {
+                type: 'preset',
+                preset: 'claude_code',
+                append: composeSystemAppend(spec.workspaceContext),
+            },
             canUseTool: (toolName, input, opts) => this.onCanUseTool(toolName, input, opts),
+            // Ticket #113: a running subagent forks its own conversation every ~30s
+            // for a one-line «what am I doing right now», delivered as the `summary`
+            // of a `task_progress`. It reuses the subagent's model and prompt cache,
+            // so it is close to free — and without it a twenty-minute subagent is a
+            // spinner with no words next to it.
+            agentProgressSummaries: true,
             ...(spec.model ? { model: spec.model } : {}),
+            // Only the five levels the SDK declares. A value from an older pin, or
+            // from a model that has since been switched away from, must not reach the
+            // CLI — it rejects the whole query rather than the one option.
+            ...(isEffortLevel(spec.effort) ? { effort: spec.effort } : {}),
+            // `ultracode` is a settings flag, not a level, so it travels in the
+            // inline settings layer instead — the launch-time twin of the
+            // `applyFlagSettings` call `setEffort` makes.
+            ...(spec.effort === ULTRACODE ? { settings: { ultracode: true } } : {}),
             ...(spec.resumeProviderSessionId ? { resume: spec.resumeProviderSessionId } : {}),
             ...(spec.maxBudgetUsd !== undefined ? { maxBudgetUsd: spec.maxBudgetUsd } : {}),
-            ...(spec.mcp
-                ? {
-                    mcpServers: {
-                        devbridge: {
-                            type: 'http',
-                            url: spec.mcp.url,
-                            headers: { Authorization: `Bearer ${spec.mcp.token}` },
-                        },
-                    },
-                }
-                : {}),
+            // Ticket #119. NOT `mcpServers` — the SDK JSON-stringifies that option
+            // straight into argv (`sdk.mjs`: `H.push("--mcp-config", Re({mcpServers:ke}))`),
+            // so the project's live `dbk_…` key landed in `/proc/<pid>/cmdline`,
+            // readable by every process on the box. That is how it was found: an
+            // agent ran `ps` for an unrelated reason and its own key scrolled past.
+            //
+            // The CLI accepts a PATH in the same flag — `--mcp-config <configs...>`,
+            // "Load MCP servers from JSON files or strings" — and `extraArgs` is the
+            // SDK's public escape hatch for passing one. Same JSON, same merge
+            // semantics (no `--strict-mcp-config`, so a project's own `.mcp.json`
+            // still loads exactly as before); only argv changes.
+            //
+            // The file is 0600 AND named into both secret lists in `policy.ts`. The
+            // second half is the load-bearing one: the agent runs as the same uid, so
+            // file mode alone would stop nobody.
+            ...(mcpConfigFile
+                ? { extraArgs: { 'mcp-config': mcpConfigFile } }
+                : mcpServers
+                    ? { mcpServers }
+                    : {}),
         };
         this.q = queryFn({ prompt: this.input, options });
         void this.consume();
+        // Ticket #113. The task level is per-PROCESS: the SDK emits nothing at
+        // startup and tells consumers to reset to the empty set whenever the
+        // session's CLI process (re)starts. The dashboard reads the newest
+        // `agent_tasks` in the stored feed, so without this a session killed
+        // mid-turn — the runner restarted, the machine rebooted — would come back
+        // and show the subagents of its previous life as though they were still
+        // running, right up until the next membership change.
+        // Ticket #119 / QA-114 MAJOR-3: if the protected file could not be written,
+        // say so where a person will see it, not only in journald.
+        if (this.mcpFallbackNotice) {
+            this.emit({ type: 'notice', level: 'warn', text: this.mcpFallbackNotice });
+        }
+        this.lastTaskFingerprint = JSON.stringify({ done: 0, total: 0, tasks: [] });
+        this.emit({ type: 'agent_tasks', tasks: [], done: 0, total: 0 });
         // Report what the agent can do right away. `system:init` only arrives with
         // the first turn (verified live), so a free session waiting for its first
         // message would otherwise show no model list at all — while the control
         // requests themselves work as soon as the CLI is up.
         this.refreshCapabilities();
     }
+    /**
+     * Write this session's MCP config to a 0600 file and return its path, or null
+     * if anything went wrong (the caller then keeps the old inline shape).
+     *
+     * `wx` after an unlink, not a plain write: the mode argument only applies when
+     * the file is CREATED, so writing over an existing one would silently inherit
+     * whatever permissions it already had. A resumed session hits exactly that
+     * path, because the name is derived from the session id.
+     */
+    writeMcpConfig(mcpServers) {
+        const target = mcpConfigPath(this.spec.sessionId);
+        try {
+            fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+            // mkdir's mode is subject to umask, and the directory may predate us.
+            fs.chmodSync(path.dirname(target), 0o700);
+            try {
+                fs.unlinkSync(target);
+            }
+            catch {
+                // Not there — the normal case.
+            }
+            fs.writeFileSync(target, JSON.stringify({ mcpServers }), { mode: 0o600, flag: 'wx' });
+            return target;
+        }
+        catch (error) {
+            log.warn('claude: MCP config file failed — falling back to inline argv', {
+                sessionId: this.spec.sessionId,
+                error: String(error),
+            });
+            // Not only `log.warn`. This path is reachable by the very attacker the
+            // fix defends against — anyone who can make the directory unwritable
+            // downgrades every later session on the machine back to a key in argv,
+            // permanently and silently (QA-114 MAJOR-3). A line in journald is not
+            // where a human would look. The notice goes into the session feed, where
+            // the events are already masked, so the text carries no secret itself.
+            this.mcpFallbackNotice =
+                'MCP settings could not be written to a protected file, so this session passes its key on the command line — readable by other processes on this server. Sessions started before runner 0.22.1 always did this. Check that the runner state directory is writable.';
+            return null;
+        }
+    }
+    /** Best-effort removal of the file written by `writeMcpConfig`. */
+    removeMcpConfig() {
+        if (!this.mcpConfigFile)
+            return;
+        try {
+            fs.unlinkSync(this.mcpConfigFile);
+        }
+        catch {
+            // Already gone, or never made it to disk.
+        }
+        this.mcpConfigFile = null;
+    }
     pushUserText(text) {
         this.input.push({
             type: 'user',
@@ -206,15 +493,73 @@ class ClaudeSession {
             this.q.accountInfo().catch(() => null),
             this.q.mcpServerStatus().catch(() => []),
         ]);
-        const capabilities = {
-            // `default` is the alias row the CLI itself resolves to the account's
-            // recommended model — this SDK version has no isDefault flag.
-            models: models.map((m) => ({
+        // The CLI has answered a control request, so it is up and has already
+        // parsed --mcp-config. The file has no further job: verified live — after
+        // `unlink` the server stays `connected` with all 29 tools, because the
+        // config lives in the CLI's memory from then on.
+        //
+        // This is the difference between the key sitting on disk for the whole
+        // session and sitting there for about a second (QA-114 MINOR-6). The policy
+        // entries still matter, but what they guard is now a one-second window
+        // rather than a parked REVIEW session that lasts days.
+        this.removeMcpConfig();
+        // Remember the catalogue before publishing it: `system:init` resolves a
+        // wire id against this list, and it may land before the next probe.
+        if (models.length) {
+            this.knownModels = models.map((m) => ({
                 id: m.value,
                 label: m.displayName,
                 ...(m.description ? { description: truncate(m.description, 160) } : {}),
+                // `default` is the alias row the CLI itself resolves to the account's
+                // recommended model — this SDK version has no isDefault flag.
                 ...(m.value === 'default' ? { isDefault: true } : {}),
-            })),
+                // Ticket #111: what `system:init` will call this row once a turn starts.
+                ...(m.resolvedModel ? { resolvedModel: m.resolvedModel } : {}),
+                // Ticket #111: the levels THIS model accepts, straight from the CLI —
+                // not a list we keep in sync by hand. A model with no dial reports
+                // none, and the dashboard then draws no control for it.
+                ...(m.supportsEffort && m.supportedEffortLevels?.length
+                    ? {
+                        efforts: [
+                            ...m.supportedEffortLevels.map((id) => ({
+                                id,
+                                label: EFFORT_LABELS[id] ?? id,
+                            })),
+                            // The sixth rung the CLI's `/effort` offers, and the one that
+                            // is not a level. Gated on `xhigh` because that is what the SDK
+                            // requires of it — a model without xhigh cannot run ultracode,
+                            // and offering it there would be a rung that fails on use.
+                            ...(m.supportedEffortLevels.includes('xhigh')
+                                ? [
+                                    {
+                                        id: ULTRACODE,
+                                        label: EFFORT_LABELS[ULTRACODE] ?? ULTRACODE,
+                                        ...(EFFORT_DESCRIPTIONS[ULTRACODE]
+                                            ? { description: EFFORT_DESCRIPTIONS[ULTRACODE] }
+                                            : {}),
+                                    },
+                                ]
+                                : []),
+                        ],
+                        ...(m.supportedEffortLevels.includes('high') ? { defaultEffort: 'high' } : {}),
+                    }
+                    : {}),
+            }));
+        }
+        // The catalogue may have arrived AFTER the id it explains: `system:init`
+        // can land first, or the probe can have failed the first time, and it does
+        // not come round again. Re-ask now that there is something to ask.
+        //
+        // With the RAW id when the CLI has reported one (QA-111 M3) — asking with
+        // `this.model` there would turn the question «does the pick still resolve
+        // to what is running» into «which row owns this wire id», and two rows can
+        // own it. Falling back to `this.model` is safe and covers the other half:
+        // a session whose stored column already holds a wire id, from before any
+        // of this existed. If it IS a catalogue row, `adoptLiveModel` recognises
+        // it and returns without touching anything.
+        this.adoptLiveModel(this.liveWireModel ?? this.model);
+        const capabilities = {
+            models: this.knownModels,
             modes: [...AGENT_MODES],
             // Cap the list: it lands in an event payload with a hard size limit.
             commands: commands.slice(0, 150).map((c) => ({
@@ -224,6 +569,7 @@ class ClaudeSession {
             })),
             currentMode: this.mode,
             ...(this.model ? { currentModel: this.model } : {}),
+            ...(this.effort ? { currentEffort: this.effort } : {}),
             ...(account
                 ? {
                     account: {
@@ -238,6 +584,50 @@ class ClaudeSession {
         };
         this.emit({ type: 'capabilities', capabilities });
     }
+    /**
+     * Take what `system:init` says the live model is, WITHOUT losing the alias
+     * the user picked (ticket #111).
+     *
+     * The catalogue is written in aliases (`default`, `sonnet`, `opus[1m]`) and
+     * `system:init` answers with the resolved wire id (`claude-opus-5[1m]`).
+     * Storing the wire id verbatim — which is what this adapter used to do — left
+     * `currentModel` pointing at a row that does not exist in the list the
+     * dashboard was given. Two things broke at once: the model picker fell back
+     * to printing the raw id, and the effort picker, which reads its levels off
+     * the SELECTED row, found no row and drew nothing at all.
+     *
+     * So: if the reported id resolves to the row we already hold, keep the alias.
+     * If it resolves to a DIFFERENT row (a genuine fallback), adopt that row's
+     * alias. Only an id no row claims is stored as-is — it is still the honest
+     * answer to «what is running», and it is better than naming the wrong model.
+     */
+    adoptLiveModel(reported) {
+        if (!reported)
+            return;
+        this.liveWireModel = reported;
+        // Nothing to resolve against yet (QA-111 M3). Keep the pick — and the raw
+        // id — and come back to this the moment the catalogue lands. Overwriting
+        // `this.model` here is what lost the alias, and it never came back: the
+        // next attempt had only the wire id to ask with, so it asked the catalogue
+        // instead of the pick and was answered `default`.
+        if (this.knownModels.length === 0)
+            return;
+        // The row the user's own pick names, when the pick IS a catalogue row.
+        const picked = this.knownModels.find((m) => m.id === this.model);
+        // Two rows can resolve to the same wire model (`default` and `opus[1m]`
+        // both did on the machine this was traced on), so «does the pick resolve to
+        // what is running» has to be asked of the PICK — asking the catalogue which
+        // row owns the wire id would answer `default` and quietly move the picker
+        // off the alias the user chose.
+        if (picked && (picked.id === reported || picked.resolvedModel === reported))
+            return;
+        const live = this.knownModels.find((m) => m.id === reported || m.resolvedModel === reported);
+        const next = live?.id ?? reported;
+        if (next === this.model)
+            return;
+        this.model = next;
+        this.refreshCapabilities();
+    }
     async setModel(model) {
         await this.q.setModel(model);
         this.model = model;
@@ -253,27 +643,356 @@ class ClaudeSession {
         this.mode = mode;
         this.emit({ type: 'settings', mode });
     }
-    async setEffort(_effort) {
-        // Claude Code has no per-model reasoning dial: its models advertise no
-        // `efforts`, so the dashboard never shows the control for this agent.
+    /**
+     * Session 15: the project's trust level and auto-commit switch, changed
+     * while this session runs. `this.spec` is what `evaluateToolUse` reads on
+     * every tool call, so the next one already sees it.
+     */
+    setWorkspacePolicy(policy) {
+        if (policy.trustMode !== undefined)
+            this.spec.trustMode = policy.trustMode;
+        if (policy.agentAutoCommit !== undefined)
+            this.spec.agentAutoCommit = policy.agentAutoCommit;
+    }
+    /**
+     * Change the reasoning-effort level (tickets #111, #112).
+     *
+     * `effort` is a query OPTION, so this adapter used to record the pin and tell
+     * the user it would apply «from the next start of this session». That was
+     * never true of the CLI, only of us: `applyFlagSettings` merges into the flag
+     * settings layer mid-session and the NEXT turn runs at the new level. Verified
+     * live against `CLAUDE_EFFORT`, which the CLI exports into every Bash call:
+     * launched at `high` → `EFFORT=[high]`, after `applyFlagSettings({effortLevel:
+     * 'low'})` → `EFFORT=[low]`, same process.
+     *
+     * The launch option stays too — it is what a resumed session starts from, and
+     * what the pin means before the first turn.
+     */
+    async setEffort(effort) {
+        if (effort === null) {
+            delete this.effort;
+        }
+        else if (isEffortPin(effort)) {
+            this.effort = effort;
+        }
+        else {
+            // An unknown level would be rejected by the CLI at launch and take the
+            // whole session with it. Refuse it here, where nothing is lost.
+            return;
+        }
+        // An older CLI has no flag-settings channel. Absence is not a failure: the
+        // pin still holds for the next launch, and the notice has to say so rather
+        // than promise a change that will not happen until then.
+        let live = false;
+        if (typeof this.q.applyFlagSettings === 'function') {
+            try {
+                // BOTH keys, every time. `ultracode` is a separate flag that forces
+                // xhigh, so choosing a plain level without clearing it would leave
+                // every later turn at xhigh while the picker showed something else —
+                // and choosing ultracode without clearing `effortLevel` would leave a
+                // level underneath it. `null` on either clears it from the flag layer
+                // and falls back to the model's own default, which is what «Model
+                // default» means here.
+                await this.q.applyFlagSettings({
+                    ultracode: this.effort === ULTRACODE,
+                    effortLevel: isEffortLevel(this.effort) ? this.effort : null,
+                });
+                live = true;
+            }
+            catch (error) {
+                log.warn('claude: applyFlagSettings(effortLevel) failed', { error: String(error) });
+            }
+        }
+        this.emit({ type: 'settings', effort: this.effort ?? null });
+        const level = this.effort ? (EFFORT_LABELS[this.effort] ?? this.effort) : null;
+        this.emit({
+            type: 'notice',
+            level: 'info',
+            text: live
+                ? level
+                    ? `Reasoning effort is «${level}» from the next turn.`
+                    : 'Reasoning effort goes back to the model default from the next turn.'
+                : level
+                    ? `Reasoning effort will be «${level}» from the next start of this session — this runner's Claude Code cannot change it on a running process.`
+                    : 'Reasoning effort goes back to the model default from the next start of this session.',
+        });
+        this.refreshCapabilities();
+    }
+    // ─── Ticket #113: what is running beside the conversation ──────────
+    //
+    // Membership is owned by `background_tasks_changed` — a LEVEL signal the SDK
+    // documents with REPLACE semantics, precisely so a missed start/stop pair
+    // cannot wedge a task in the tray forever. The `task_*` bookends only fill in
+    // detail (what kind of work, how many tokens, how long) and count the turn.
+    onTaskMessage(msg) {
+        switch (msg.subtype) {
+            case 'background_tasks_changed': {
+                const rows = Array.isArray(msg['tasks']) ? msg['tasks'] : [];
+                this.liveTaskIds = [];
+                for (const row of rows) {
+                    const id = typeof row['task_id'] === 'string' ? row['task_id'] : null;
+                    if (!id)
+                        continue;
+                    // Housekeeping the SDK asks consumers to hide. Filtered HERE as well
+                    // as in `task_started`, because the level usually arrives first — so
+                    // filtering only the bookend let an ambient task into the live set
+                    // and it never left again (QA-111 m4).
+                    if (this.skipTaskIds.has(id))
+                        continue;
+                    this.liveTaskIds.push(id);
+                    // A task can reach the live set before its own `task_started` — the
+                    // SDK says the level usually precedes the bookends. Seed it here so
+                    // the tray never has a live id it cannot name.
+                    this.touchTask(id, {
+                        kind: typeof row['task_type'] === 'string' ? row['task_type'] : 'task',
+                        title: typeof row['description'] === 'string' ? row['description'] : 'Working…',
+                    });
+                }
+                this.publishTasks();
+                break;
+            }
+            case 'task_started': {
+                const id = typeof msg['task_id'] === 'string' ? msg['task_id'] : null;
+                if (!id)
+                    break;
+                // Housekeeping tasks the SDK asks consumers to keep out of the
+                // transcript stay out of the tray too — and out of the live set, which
+                // may already have taken it in before this message arrived.
+                if (msg['skip_transcript'] === true) {
+                    this.skipTaskIds.add(id);
+                    this.tasks.delete(id);
+                    const before = this.liveTaskIds.length;
+                    this.liveTaskIds = this.liveTaskIds.filter((live) => live !== id);
+                    if (this.liveTaskIds.length !== before)
+                        this.publishTasks();
+                    break;
+                }
+                this.touchTask(id, {
+                    kind: typeof msg['task_type'] === 'string' ? msg['task_type'] : 'task',
+                    ...(typeof msg['description'] === 'string' ? { title: msg['description'] } : {}),
+                    ...(typeof msg['subagent_type'] === 'string'
+                        ? { subagentType: msg['subagent_type'] }
+                        : {}),
+                    ...(typeof msg['workflow_name'] === 'string'
+                        ? { workflowName: msg['workflow_name'] }
+                        : {}),
+                });
+                this.publishTasks();
+                break;
+            }
+            case 'task_progress': {
+                const id = typeof msg['task_id'] === 'string' ? msg['task_id'] : null;
+                if (!id)
+                    break;
+                this.touchTask(id, {
+                    ...(typeof msg['description'] === 'string' ? { title: msg['description'] } : {}),
+                    ...(typeof msg['subagent_type'] === 'string'
+                        ? { subagentType: msg['subagent_type'] }
+                        : {}),
+                    ...(typeof msg['summary'] === 'string' ? { summary: msg['summary'] } : {}),
+                    ...usagePatch(msg['usage']),
+                });
+                this.publishTasks();
+                break;
+            }
+            case 'task_updated': {
+                const id = typeof msg['task_id'] === 'string' ? msg['task_id'] : null;
+                const patch = (msg['patch'] ?? {});
+                if (!id || !this.tasks.has(id))
+                    break;
+                const status = typeof patch['status'] === 'string' ? patch['status'] : undefined;
+                this.touchTask(id, {
+                    ...(typeof patch['description'] === 'string' ? { title: patch['description'] } : {}),
+                    ...(status ? { status: taskStatus(status) } : {}),
+                });
+                this.publishTasks();
+                break;
+            }
+            case 'task_notification': {
+                const id = typeof msg['task_id'] === 'string' ? msg['task_id'] : null;
+                if (!id)
+                    break;
+                this.touchTask(id, {
+                    status: taskStatus(typeof msg['status'] === 'string' ? msg['status'] : 'completed'),
+                    ...(typeof msg['summary'] === 'string' ? { summary: msg['summary'] } : {}),
+                    ...usagePatch(msg['usage']),
+                });
+                this.publishTasks();
+                break;
+            }
+            default:
+                break;
+        }
+    }
+    /**
+     * Create-or-merge one task row, and count the TRANSITIONS while doing it.
+     *
+     * The counters live here rather than in the individual message handlers
+     * because «started» and «finished» are properties of the transition, not of
+     * whichever message happened to announce it (QA-111 M1). They were counted
+     * per-message, and both orderings the SDK actually produces missed:
+     *
+     *   `background_tasks_changed` → `task_started`   → `total` stayed 0
+     *   `task_updated{completed}`  → `task_notification` → `done` stayed 0
+     *
+     * The first of those is the COMMON ordering — the SDK documents the level as
+     * usually preceding the bookends — so «N of M done», the one number the
+     * ticket asked for by name, was never printed at all.
+     *
+     * `startedAt` is stamped once and never moves.
+     */
+    touchTask(id, patch) {
+        const existing = this.tasks.get(id);
+        if (existing) {
+            const wasRunning = existing.status === 'running';
+            Object.assign(existing, patch);
+            if (patch.title)
+                existing.title = truncate(patch.title, TASK_TITLE_LIMIT);
+            if (patch.summary)
+                existing.summary = truncate(patch.summary, TASK_TITLE_LIMIT);
+            // Counted on the edge out of `running`, so a task that settles twice — a
+            // `task_updated` and then its `task_notification`, or a notification
+            // redelivered after a reconnect — is still counted once.
+            if (wasRunning && existing.status !== 'running')
+                this.turnTasksDone += 1;
+            return;
+        }
+        this.turnTasksStarted += 1;
+        const status = patch.status ?? 'running';
+        // A row that arrives already finished (a notification for a task we never
+        // saw start) counts as both, or `done` could exceed nothing at all.
+        if (status !== 'running')
+            this.turnTasksDone += 1;
+        this.tasks.set(id, {
+            ...patch,
+            id,
+            kind: patch.kind ?? 'task',
+            title: truncate(patch.title ?? 'Working…', TASK_TITLE_LIMIT),
+            status,
+            startedAt: Date.now(),
+            // The only free-text field an agent writes with no length of its own:
+            // a subagent's closing `summary` runs to kilobytes, and twenty of them
+            // push the event past the payload cap, which replaces the WHOLE payload
+            // with `{truncated:true}` and blinks the tray out (QA-111 m1).
+            ...(patch.summary ? { summary: truncate(patch.summary, TASK_TITLE_LIMIT) } : {}),
+        });
+    }
+    /**
+     * Publish the tray, at most once every `TASK_PUBLISH_INTERVAL_MS`.
+     *
+     * Every publication is a stored row in the session feed, and a wide fan-out
+     * changes membership dozens of times a minute. The trailing timer matters as
+     * much as the floor: the LAST change in a burst is the one that says the work
+     * is over, and dropping it would leave the tray running forever.
+     */
+    publishTasks() {
+        if (this.stopped)
+            return;
+        const wait = TASK_PUBLISH_INTERVAL_MS - (Date.now() - this.taskPublishedAt);
+        if (wait > 0) {
+            if (!this.taskPublishTimer) {
+                this.taskPublishTimer = setTimeout(() => {
+                    this.taskPublishTimer = null;
+                    this.flushTasks();
+                }, wait);
+                this.taskPublishTimer.unref();
+            }
+            return;
+        }
+        this.flushTasks();
+    }
+    flushTasks() {
+        if (this.stopped)
+            return;
+        this.taskPublishedAt = Date.now();
+        const now = Date.now();
+        // Only what the agent still calls live. A task that finished keeps its row
+        // in `this.tasks` for the counters, but the tray is about NOW.
+        const tasks = this.liveTaskIds
+            .map((id) => this.tasks.get(id))
+            .filter((t) => Boolean(t))
+            .slice(0, TASK_LIST_CAP)
+            // How long it has been running, measured HERE (QA-111 m2). `startedAt` is
+            // this machine's clock and the browser's is a different one — subtracting
+            // across them put the dev server's clock skew straight into the number,
+            // so a host ten minutes behind showed «10m 03s» on a task one second old.
+            .map((task) => ({ ...task, ageMs: Math.max(0, now - task.startedAt) }));
+        const payload = {
+            type: 'agent_tasks',
+            tasks,
+            done: this.turnTasksDone,
+            total: this.turnTasksStarted,
+        };
+        // A frame that says exactly what the last one said is not worth a row in
+        // the session feed (QA-111 M4). `task_progress` fires every ~30s per
+        // running subagent and usually carries nothing new, and with twenty of
+        // them that alone is the throttle's whole budget. `ageMs` is excluded from
+        // the comparison on purpose — it changes every time by definition, and
+        // including it would make every frame unique and the check pointless.
+        const fingerprint = JSON.stringify({
+            done: payload.done,
+            total: payload.total,
+            tasks: tasks.map(({ ageMs: _ageMs, ...rest }) => rest),
+        });
+        if (fingerprint === this.lastTaskFingerprint)
+            return;
+        this.lastTaskFingerprint = fingerprint;
+        this.emit(payload);
+    }
+    /**
+     * The turn ended. Reset what belongs to the TURN — and only that.
+     *
+     * `done`/`total` are per-turn by definition and go back to zero. The live set
+     * does NOT: background work is precisely the work that outlives the turn that
+     * started it, which is the whole reason the ticket asks for it. Caught on
+     * production during this session's own verification — the agent ended its
+     * turn with `sleep 40` still running in the background and the tray, which
+     * cleared everything here, showed nothing at exactly the moment somebody was
+     * reading the answer and wondering whether the deploy had finished.
+     *
+     * Membership stays owned by `background_tasks_changed`, which reports the set
+     * emptying when it actually empties. Finished tasks are dropped here because
+     * only the live ids are ever rendered anyway, and keeping their rows would
+     * grow the map for the life of the session.
+     */
+    endTaskTurn() {
+        if (this.taskPublishTimer) {
+            clearTimeout(this.taskPublishTimer);
+            this.taskPublishTimer = null;
+        }
+        const live = new Set(this.liveTaskIds);
+        for (const id of [...this.tasks.keys()]) {
+            if (!live.has(id))
+                this.tasks.delete(id);
+        }
+        this.skipTaskIds.clear();
+        this.turnTasksDone = 0;
+        this.turnTasksStarted = 0;
+        // Straight through `flushTasks` rather than an empty frame of its own: the
+        // counters changed, so the fingerprint differs and it will publish — and
+        // what it publishes is the truth about what is still running.
+        this.taskPublishedAt = 0;
+        this.flushTasks();
     }
     async onCanUseTool(toolName, input, opts) {
-        // The agent's interactive question tool assumes a terminal picker. There
-        // is none here, and its raw JSON is unreadable in a permission card — turn
-        // it into a proper question card and let the user answer in the chat.
+        // The agent's interactive question tool assumes a terminal picker. There is
+        // none here — so the call is PARKED and the dashboard becomes the picker.
+        //
+        // Until session 12 this returned `deny`, which the model reads exactly like
+        // a human pressing Escape: the turn was not blocked, so the agent carried on
+        // and decided for the user. Parking is what makes "the question waits"
+        // true; the answer goes back as `{behavior:'allow', updatedInput}` with the
+        // `answers` field the tool's own schema defines (live-verified, §3).
         if (toolName === 'AskUserQuestion') {
-            const question = parseAskUserQuestion(input);
-            if (question) {
-                this.emit({
-                    type: 'question',
-                    text: question.text,
-                    ...(question.options.length ? { options: question.options } : {}),
-                });
-                return {
-                    behavior: 'deny',
-                    message: 'This session has no interactive picker. Ask the question in plain text and end your turn — the user answers with the next message.',
-                };
+            const questions = parseAskUserQuestions(input);
+            if (questions.length) {
+                return this.parkQuestion(input, questions, opts.signal);
             }
+            // Nothing renderable: refuse rather than park a card no one can answer.
+            return {
+                behavior: 'deny',
+                message: 'That question could not be shown to the user (no question text). Ask again in plain text and end your turn.',
+            };
         }
         // Plan approval is a user decision by definition — never auto-resolved by
         // policy, and rendered as a plan card rather than a raw tool prompt.
@@ -291,6 +1010,9 @@ class ClaudeSession {
         }
         const verdict = evaluateToolUse(toolName, input, {
             trustMode: this.spec.trustMode,
+            ...(this.spec.agentAutoCommit === undefined
+                ? {}
+                : { agentAutoCommit: this.spec.agentAutoCommit }),
             worktreePath: this.spec.cwd,
         });
         if (verdict.decision === 'allow') {
@@ -339,6 +1061,158 @@ class ClaudeSession {
             }, { once: true });
         });
     }
+    // ─── Questions (session 12) ────────────────────────────────────────
+    /**
+     * Hold the tool call open until a human answers it.
+     *
+     * The promise is the whole mechanism: while it is unresolved the agent's turn
+     * cannot advance, so "the user went away for 40 minutes" costs the session
+     * nothing but time on the clock — which the supervisor stops.
+     */
+    parkQuestion(input, questions, signal) {
+        const askId = newAskId();
+        const rawTextById = new Map();
+        const rawQuestions = Array.isArray(input['questions']) ? input['questions'] : [];
+        for (const question of questions) {
+            // Indexed by the id, which `parseAskUserQuestions` derives from the RAW
+            // position — walking the parsed list with its own counter shifted every
+            // mapping as soon as one raw entry was skipped, and the answer would then
+            // be keyed by another question's text or by the truncated copy, which is
+            // exactly the byte-mismatch this design exists to avoid (QA-106 M3).
+            const rawIndex = Number.parseInt(question.id.slice(1), 10);
+            const raw = Number.isInteger(rawIndex)
+                ? rawQuestions[rawIndex]
+                : undefined;
+            const rawText = typeof raw?.['question'] === 'string' ? raw['question'] : question.text;
+            rawTextById.set(question.id, rawText);
+        }
+        return new Promise((resolve) => {
+            this.pendingQuestions.set(askId, { input, questions, rawTextById, resolve });
+            // Abort fires when the turn is torn down under us (interrupt, process
+            // shutdown). Say so in the feed — a card that simply stops working is the
+            // thing this whole session set out to remove.
+            signal.addEventListener('abort', () => this.invalidateQuestion(askId, 'turn_aborted'), {
+                once: true,
+            });
+            this.emit({
+                type: 'question',
+                askId,
+                questions,
+                // Mirror fields for a dashboard/API that has not been redeployed yet.
+                text: questions[0]?.text ?? '',
+                ...(mirrorOptions(questions).length ? { options: mirrorOptions(questions) } : {}),
+            });
+        });
+    }
+    answerQuestion(reply) {
+        const pending = this.pendingQuestions.get(reply.askId);
+        if (!pending) {
+            log.warn('claude: answer for a question that is no longer open', { askId: reply.askId });
+            return false;
+        }
+        // Validated BEFORE the ask is consumed: an answer with nothing in it would
+        // otherwise release the tool call with `answers: {}` — the very shape of
+        // the auto-answer this session deleted — and leave the card unanswerable.
+        if (reply.action === 'answer' && !hasAnyValue(reply.answers, pending.rawTextById)) {
+            log.warn('claude: refusing an empty answer', { askId: reply.askId });
+            return false;
+        }
+        this.pendingQuestions.delete(reply.askId);
+        if (reply.action === 'discuss') {
+            const text = reply.text ?? '';
+            this.emit({
+                type: 'question_resolved',
+                askId: reply.askId,
+                outcome: 'discussed',
+                source: 'user',
+                summary: truncate(text.trim(), 200),
+            });
+            // A deny WITH a message keeps the turn alive and hands the words to the
+            // agent (live-verified §3). A deny without one would end it.
+            pending.resolve({ behavior: 'deny', message: discussMessage(pending.questions, text) });
+            return true;
+        }
+        const answers = (reply.answers ?? []).filter((answer) => pending.rawTextById.has(answer.questionId));
+        const answersByText = {};
+        const annotations = {};
+        for (const answer of answers) {
+            const rawText = pending.rawTextById.get(answer.questionId);
+            if (!rawText)
+                continue;
+            const value = answerValue(answer);
+            // An empty value is not an answer — leaving the key out is honest, and
+            // the agent sees which questions are still open.
+            if (value)
+                answersByText[rawText] = value;
+            const notes = answer.notes?.trim();
+            if (notes)
+                annotations[rawText] = { notes: truncate(notes, 1_000) };
+        }
+        this.emit({
+            type: 'question_resolved',
+            askId: reply.askId,
+            outcome: 'answered',
+            source: 'user',
+            answers,
+            summary: answerSummary(answers),
+        });
+        // Not every question answered. The dashboard makes this unreachable, but a
+        // direct API call can do it — and releasing the tool call with the missing
+        // ones simply absent means the agent decides them itself, which is the one
+        // thing this whole session exists to prevent. Hand the answers back as
+        // TEXT instead, naming what is still open, and let it ask again.
+        const unanswered = pending.questions.filter((question) => !(pending.rawTextById.get(question.id) ?? '') ||
+            !answersByText[pending.rawTextById.get(question.id) ?? '']);
+        if (unanswered.length > 0) {
+            pending.resolve({
+                behavior: 'deny',
+                message: [
+                    'The user answered only some of the questions:',
+                    ...Object.entries(answersByText).map(([question, value]) => `- "${question}" → ${value}`),
+                    `Still unanswered: ${unanswered.map((question) => `"${question.text}"`).join('; ')}.`,
+                    'Do not answer those yourself — ask again if you still need them.',
+                ].join('\n'),
+            });
+            return true;
+        }
+        pending.resolve({
+            behavior: 'allow',
+            // The ORIGINAL input, untouched apart from the answers: the tool input is
+            // validated strictly, and a truncated question text would not match its
+            // own `answers` key (§3 risk 1). `answers`/`annotations` are declared
+            // optional on `AskUserQuestionInput` itself and were verified live (§3).
+            updatedInput: {
+                ...pending.input,
+                answers: answersByText,
+                ...(Object.keys(annotations).length ? { annotations } : {}),
+            },
+        });
+        return true;
+    }
+    cancelQuestions(reason) {
+        for (const askId of [...this.pendingQuestions.keys()]) {
+            this.invalidateQuestion(askId, reason);
+        }
+    }
+    /** Withdraw an open question with a reason the user can read. */
+    invalidateQuestion(askId, reason) {
+        const pending = this.pendingQuestions.get(askId);
+        if (!pending)
+            return;
+        this.pendingQuestions.delete(askId);
+        this.emit({
+            type: 'question_resolved',
+            askId,
+            outcome: 'invalidated',
+            source: 'runner',
+            reason,
+        });
+        pending.resolve({ behavior: 'deny', message: invalidationMessage(reason) });
+    }
+    /** The oldest ask still waiting — where a plain typed message lands. */
+    oldestOpenAsk() {
+        return this.pendingQuestions.keys().next().value;
+    }
     answerPermission(requestId, allow, note) {
         const pending = this.pending.get(requestId);
         if (!pending) {
@@ -363,6 +1237,15 @@ class ClaudeSession {
         }
     }
     send(text) {
+        // A parked question blocks the turn, so a plain message — a Telegram reply,
+        // an older dashboard, the composer's own fallback — would sit unread in the
+        // input queue until the card was answered. Route it into the «discuss»
+        // exit: the words reach the agent immediately and the turn continues.
+        const openAsk = this.oldestOpenAsk();
+        if (openAsk) {
+            this.answerQuestion({ askId: openAsk, action: 'discuss', text });
+            return;
+        }
         const accepted = this.input.push({
             type: 'user',
             message: { role: 'user', content: text },
@@ -382,10 +1265,32 @@ class ClaudeSession {
             log.warn('claude: interrupt failed', { error: String(error) });
         }
     }
-    stop() {
+    stop(reason = 'session_stopped') {
         if (this.stopped)
             return;
         this.stopped = true;
+        // A pending tray publication would fire into a closed output queue.
+        if (this.taskPublishTimer) {
+            clearTimeout(this.taskPublishTimer);
+            this.taskPublishTimer = null;
+        }
+        // Before the process goes: withdraw everything a human was still being
+        // asked, WITH a cause. A pending permission used to gutter out as a plain
+        // "denied", which put a decision in the audit trail that nobody made.
+        for (const askId of [...this.pendingQuestions.keys()]) {
+            this.invalidateQuestion(askId, reason);
+        }
+        for (const [requestId, pending] of [...this.pending]) {
+            this.pending.delete(requestId);
+            this.emit({
+                type: 'permission_resolved',
+                requestId,
+                allow: false,
+                source: 'runner',
+                reason: invalidationMessage(reason),
+            });
+            pending.resolve({ behavior: 'deny', message: invalidationMessage(reason) });
+        }
         this.input.end();
         try {
             this.q.close();
@@ -393,6 +1298,9 @@ class ClaudeSession {
         catch {
             // process already gone
         }
+        // After close, not before: the CLI reads --mcp-config at startup, but a
+        // reconnecting MCP transport could touch it again while the process lives.
+        this.removeMcpConfig();
     }
     async consume() {
         try {
@@ -407,10 +1315,7 @@ class ClaudeSession {
                             });
                             // The live model can differ from what we asked for (alias
                             // resolution, fallback) — refresh the pickers when it does.
-                            if (msg.model && msg.model !== this.model) {
-                                this.model = msg.model;
-                                this.refreshCapabilities();
-                            }
+                            this.adoptLiveModel(msg.model);
                         }
                         else if (msg.subtype === 'status') {
                             const status = msg.status;
@@ -428,6 +1333,10 @@ class ClaudeSession {
                                 });
                             }
                         }
+                        else {
+                            // Ticket #113: subagents, background shells and dynamic workflows.
+                            this.onTaskMessage(msg);
+                        }
                         break;
                     }
                     case 'conversation_reset': {
@@ -478,6 +1387,11 @@ class ClaudeSession {
                             numTurns: msg.num_turns,
                             durationMs: msg.duration_ms,
                         });
+                        // The turn is over: whatever the tray still shows as running is
+                        // finished or gone with it. Published immediately rather than on
+                        // the throttle — a stale «12 agents running» outlives the spinner
+                        // otherwise, and it is the last thing anybody sees.
+                        this.endTaskTurn();
                         this.refreshContextUsage();
                         if (msg.subtype === 'success') {
                             this.emit({ type: 'turn_end', ok: true });
@@ -506,6 +1420,13 @@ class ClaudeSession {
             });
         }
         finally {
+            // BEFORE `stopped`, not after: `stop()` returns early when it is already
+            // set, so cleanup placed only there never ran on the commonest ending —
+            // the agent process exiting on its own (QA-114 MAJOR-1). Normally the
+            // file is long gone by now (removed in `publishCapabilities`); this is
+            // the path that catches a session which died before the CLI ever
+            // answered.
+            this.removeMcpConfig();
             this.stopped = true;
             this.input.end();
             this.output.end();
@@ -528,35 +1449,68 @@ function truncateDeep(value, limit) {
     }
     return value;
 }
+/** Does this reply carry at least one real value for a question we asked? */
+function hasAnyValue(answers, known) {
+    return (answers ?? []).some((answer) => known.has(answer.questionId) && answerValue(answer).length > 0);
+}
 /**
- * Flatten the AskUserQuestion payload into plain text + option labels.
- * Shape: `{ questions: [{ question, header, options: [{ label, description }] }] }`.
+ * The whole `AskUserQuestion` payload, not just its first line.
+ *
+ * Shape (SDK 0.3.218 `AskUserQuestionInput`): up to four
+ * `{ question, header, multiSelect, options: [{ label, description, preview }] }`.
+ * Before session 12 we kept `questions[0]` and glued `label — description` into
+ * one string, so questions 2–4, every description, `header`, `multiSelect` and
+ * `preview` were dropped on the floor.
+ *
+ * `allowsCustom` is always true here: the tool's own schema says an "Other"
+ * option is the client's job ("There should be no 'Other' option, that will be
+ * provided automatically"), and we are the client.
  */
-export function parseAskUserQuestion(input) {
-    const questions = input['questions'];
-    const first = Array.isArray(questions) ? questions[0] : undefined;
-    if (!first || typeof first !== 'object')
-        return null;
-    const row = first;
-    const text = typeof row['question'] === 'string' ? row['question'] : null;
-    if (!text)
-        return null;
-    const rawOptions = Array.isArray(row['options']) ? row['options'] : [];
-    const options = rawOptions
-        .map((option) => {
-        if (typeof option === 'string')
-            return option;
-        const entry = option;
-        const label = typeof entry['label'] === 'string' ? entry['label'] : null;
-        if (!label)
-            return null;
-        const description = typeof entry['description'] === 'string' ? entry['description'] : undefined;
-        return description ? `${label} — ${description}` : label;
-    })
-        .filter((option) => Boolean(option))
-        .map((option) => truncate(option, 300))
-        .slice(0, 8);
-    return { text: truncate(text, 2_000), options };
+export function parseAskUserQuestions(input) {
+    const raw = Array.isArray(input['questions']) ? input['questions'] : [];
+    const questions = [];
+    raw.slice(0, MAX_QUESTIONS).forEach((entry, index) => {
+        if (!entry || typeof entry !== 'object')
+            return;
+        const row = entry;
+        const text = typeof row['question'] === 'string' ? row['question'] : '';
+        if (!text.trim())
+            return;
+        const header = typeof row['header'] === 'string' ? row['header'].trim() : '';
+        const rawOptions = Array.isArray(row['options']) ? row['options'] : [];
+        const options = rawOptions
+            .map((option) => {
+            if (typeof option === 'string') {
+                return option.trim() ? { label: truncate(option, OPTION_TEXT_LIMIT) } : null;
+            }
+            if (!option || typeof option !== 'object')
+                return null;
+            const entryRow = option;
+            const label = typeof entryRow['label'] === 'string' ? entryRow['label'] : '';
+            if (!label.trim())
+                return null;
+            const description = typeof entryRow['description'] === 'string' ? entryRow['description'] : '';
+            const preview = typeof entryRow['preview'] === 'string' ? entryRow['preview'] : '';
+            return {
+                label: truncate(label, OPTION_TEXT_LIMIT),
+                ...(description ? { description: truncate(description, OPTION_TEXT_LIMIT) } : {}),
+                ...(preview ? { preview: truncate(preview, 2_000) } : {}),
+            };
+        })
+            .filter((option) => option !== null)
+            .slice(0, MAX_OPTIONS);
+        questions.push({
+            id: `q${index}`,
+            text: truncate(text, QUESTION_TEXT_LIMIT),
+            // 24 rather than the tool's own 12: a header is a chip, and clipping a
+            // slightly long one is better than dropping it.
+            ...(header ? { header: header.slice(0, 24) } : {}),
+            multiSelect: row['multiSelect'] === true,
+            allowsCustom: true,
+            options,
+        });
+    });
+    return questions;
 }
 function truncateInput(input) {
     return truncateDeep(input, 2_000);