@oar-sh/oar 0.9.16 → 0.9.18

package/server/claude-worker/claude-cli-pinned-env.mjs

@@ -0,0 +1,150 @@
+// The CLI's routing and trust variables a chat folder's settings must not
+// set, shared by the backends that run Claude Code on a key of the relay's
+// (DeepSeek, Claude API): each pins them in its live flag settings. And the
+// settings both spawn the CLI with: no hooks (CLAUDE_CLI_KEY_CHAT_SETTINGS).
+//
+// The list comes from the bundled CLI and only from it. On every SDK or CLI
+// bump, re-run both proofs (scripts/deepseek-cli-proof.mjs,
+// scripts/claude-api-cli-proof.mjs) and the env-name grep over that binary
+// (fixed names, grep -a, under timeout and nice; never a regex over the
+// whole binary), and update the list and its source line below.
+
+/**
+ * Every variable through which the env of the chat folder's settings
+ * (.claude/settings.json, settings.local.json) could send the CLI's requests,
+ * and with them the key, somewhere else, or change whom the CLI trusts on the
+ * way: the endpoints, the provider switches, the credentials, the proxies and
+ * the TLS trust. The DeepSeek and the Claude API backends pin each one in
+ * their live flag settings (liveFlagSettings), which the CLI applies over the
+ * folder's, to the value the CLI was spawned with: the worker's own, else the
+ * other case's for a proxy variable, else ''.
+ * '' is unset to the CLI for each of these (truthy or trimmed reads), except
+ * SSL_CERT_FILE and SSL_CERT_DIR: '' empties OpenSSL's and Node's system
+ * store, so those two are pinned only when the worker sets them.
+ *
+ * Source: the names Claude Code 2.1.304 (the bundled CLI) reads, by a grep
+ * of the binary; the CLI's own lists of endpoints (with their selection
+ * switches and companions) and credentials are in it as they are there. A
+ * deny-list, because a settings layer can only pin names known in advance.
+ * Left out, each for its reason: the model variables (same endpoint, same
+ * key), what the CLI already drops from a folder's settings or from all
+ * settings (CLAUDE_CONFIG_DIR, CLAUDE_CODE_CUSTOM_OAUTH_URL, the OTEL
+ * exporter endpoints, ANTHROPIC_UNIX_SOCKET, the host-managed provider
+ * switches, the file-descriptor credentials), a provider's own SDK settings
+ * (AWS_*, GOOGLE_*, AZURE_*, read only for the provider the switches here
+ * turn off), NODE_OPTIONS (at runtime the CLI reads only its system-CA
+ * flags, which add no CA), and what routes only other programs' traffic
+ * (NPM_CONFIG_*, GIT_*, the resolver's variables).
+ */
+export const CLAUDE_CLI_PINNED_ENV = Object.freeze([
+  // Endpoints: the CLI's list, its fallback and the headers sent with them.
+  'ANTHROPIC_BASE_URL',
+  '_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL',
+  'ANTHROPIC_CUSTOM_HEADERS',
+  'ANTHROPIC_BEDROCK_BASE_URL',
+  'ANTHROPIC_VERTEX_BASE_URL',
+  'ANTHROPIC_FOUNDRY_BASE_URL',
+  'ANTHROPIC_AWS_BASE_URL',
+  'ANTHROPIC_GOOGLE_CLOUD_BASE_URL',
+  'ANTHROPIC_BEDROCK_MANTLE_BASE_URL',
+  'CLAUDE_CODE_API_BASE_URL',
+  'CLAUDE_CODE_ARTIFACTS_API_BASE_URL',
+  'CLAUDE_CODE_ARTIFACTS_API_TOKEN',
+  'CLAUDE_CODE_ARTIFACT_ASSET_BASE_URL',
+  'CLAUDE_CODE_ARTIFACT_LIVE_BASE_URL',
+  'CLAUDE_CODE_ARTIFACT_SYNC_BASE_URL',
+  'CLAUDE_CODE_ARTIFACT_VIEWER_BASE_URL',
+  'CLAUDE_CODE_MEMORY_API_BASE_URL',
+  'CLAUDE_CODE_MEMORY_API_TOKEN',
+  // Provider switches.
+  'CLAUDE_CODE_USE_BEDROCK',
+  'CLAUDE_CODE_USE_VERTEX',
+  'CLAUDE_CODE_USE_FOUNDRY',
+  'CLAUDE_CODE_USE_ANTHROPIC_AWS',
+  'CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD',
+  'CLAUDE_CODE_USE_MANTLE',
+  'CLAUDE_CODE_USE_GATEWAY',
+  'CLAUDE_CODE_SKIP_BEDROCK_AUTH',
+  'CLAUDE_CODE_SKIP_VERTEX_AUTH',
+  'CLAUDE_CODE_SKIP_FOUNDRY_AUTH',
+  'CLAUDE_CODE_SKIP_ANTHROPIC_AWS_AUTH',
+  'CLAUDE_CODE_SKIP_ANTHROPIC_GOOGLE_CLOUD_AUTH',
+  'CLAUDE_CODE_SKIP_MANTLE_AUTH',
+  // Credentials: the CLI's list, the OAuth login, the federation profile and
+  // the proxy credential helper.
+  'ANTHROPIC_API_KEY',
+  'ANTHROPIC_AUTH_TOKEN',
+  'CLAUDE_CODE_OAUTH_TOKEN',
+  'AWS_BEARER_TOKEN_BEDROCK',
+  'ANTHROPIC_FOUNDRY_API_KEY',
+  'ANTHROPIC_FOUNDRY_AUTH_TOKEN',
+  'ANTHROPIC_AWS_API_KEY',
+  'CLAUDE_CODE_OAUTH_REFRESH_TOKEN',
+  'CLAUDE_CODE_OAUTH_SCOPES',
+  'CLAUDE_CODE_OAUTH_CLIENT_ID',
+  'ANTHROPIC_PROFILE',
+  'ANTHROPIC_IDENTITY_TOKEN',
+  'ANTHROPIC_IDENTITY_TOKEN_FILE',
+  'ANTHROPIC_FEDERATION_RULE_ID',
+  'ANTHROPIC_ORGANIZATION_ID',
+  'ANTHROPIC_SERVICE_ACCOUNT_ID',
+  'ANTHROPIC_SCOPE',
+  'ANTHROPIC_WORKSPACE_ID',
+  'CLAUDE_CODE_ENABLE_PROXY_AUTH_HELPER',
+  // Proxies: the CLI reads both cases, the lower one first.
+  'HTTPS_PROXY',
+  'https_proxy',
+  'HTTP_PROXY',
+  'http_proxy',
+  'ALL_PROXY',
+  'all_proxy',
+  'NO_PROXY',
+  'no_proxy',
+  'CLAUDE_CODE_HTTPS_PROXY',
+  'CLAUDE_CODE_HTTP_PROXY',
+  // TLS trust and the client certificate.
+  'NODE_TLS_REJECT_UNAUTHORIZED',
+  'NODE_EXTRA_CA_CERTS',
+  'CLAUDE_CODE_CERT_STORE',
+  'CLAUDE_CODE_CLIENT_CERT',
+  'CLAUDE_CODE_CLIENT_KEY',
+  'CLAUDE_CODE_CLIENT_KEY_PASSPHRASE',
+  'SSL_CERT_FILE',
+  'SSL_CERT_DIR',
+]);
+// The two of CLAUDE_CLI_PINNED_ENV for which '' is not unset (see there).
+const PINNED_ONLY_WHEN_SET = new Set(['SSL_CERT_FILE', 'SSL_CERT_DIR']);
+// The proxy variables the CLI and the tools it runs read in either case.
+const OTHER_CASE = new Map(
+  ['HTTPS_PROXY', 'HTTP_PROXY', 'ALL_PROXY', 'NO_PROXY'].flatMap((name) => [
+    [name, name.toLowerCase()],
+    [name.toLowerCase(), name],
+  ]),
+);
+
+/**
+ * The settings both backends spawn every CLI with, on its command line (their
+ * flagSettings): no hooks and no statusLine command, neither the user's nor
+ * the chat folder's nor a plugin's. Those run as the relay's user with the
+ * CLI's environment, the key in it, and a folder's SessionStart hook would run
+ * before the live pins land. The SDK has the spawn settings in force before
+ * any hook (sdk.d.ts, Options.settings; scripts/claude-cli-hooks-proof.mjs
+ * shows it). Hooks in managed settings still run: those are the host admin's.
+ * OAR's Claude worker registers no SDK hooks of its own.
+ */
+export const CLAUDE_CLI_KEY_CHAT_SETTINGS = Object.freeze({ disableAllHooks: true });
+
+/**
+ * The pins of CLAUDE_CLI_PINNED_ENV for a CLI spawned with `cliEnv`: the
+ * value it was spawned with, else the other case's (a proxy the worker sets
+ * as https_proxy holds for HTTPS_PROXY as well), else ''.
+ */
+export function claudeCliPinnedEnv(cliEnv = {}) {
+  const pins = {};
+  for (const name of CLAUDE_CLI_PINNED_ENV) {
+    const own = cliEnv[name] ?? cliEnv[OTHER_CASE.get(name)];
+    if (own !== undefined) pins[name] = String(own);
+    else if (!PINNED_ONLY_WHEN_SET.has(name)) pins[name] = '';
+  }
+  return pins;
+}

package/server/claude-worker/claude-remote-relay-tool.mjs

@@ -1,8 +1,8 @@
 /**
- * The relay's `remote_relay` tool for the Claude worker, shaped as an SDK MCP
+ * The relay's `relay_tool` tool for the Claude worker, shaped as an SDK MCP
  * tool definition (`{ name, description, inputSchema, handler }`) so the
  * adapter can hand it to `createSdkMcpServer` next to the preview tool. On the
- * wire it is `mcp__relay__remote_relay`; the module never imports the SDK.
+ * wire it is `mcp__relay__relay_tool`; the module never imports the SDK.
  */
 
 import * as z from 'zod';
@@ -140,7 +140,7 @@ export function createRemoteRelayToolDefinition({ api, getConversationId = () =>
         // A tool exception would surface as a failed MCP call and can abort
         // the turn; a refusal the model can read cannot.
         const message = error?.message || String(error);
-        dbg('remote_relay tool failed', message);
+        dbg('relay_tool failed', message);
         result = { ok: false, code: REMOTE_RELAY_CALL_FAILED, error: message };
       }
       return { content: [{ type: 'text', text: formatRemoteRelayToolResult(result) }] };

package/server/claude-worker/claude-sdk-adapter.mjs

@@ -6,9 +6,12 @@ import { MEDIA_EMBED_INSTRUCTION_TEXT } from '../../shared/media-embed-instructi
 import { REMOTE_RELAY_TOOL_CALL_TIMEOUT_MS } from '../../shared/remote-relay-tool-core.mjs';
 import { createPreviewToolDefinition } from './claude-preview-tool.mjs';
 import { createRemoteRelayToolDefinition } from './claude-remote-relay-tool.mjs';
+import { CLAUDE_LIVE_FLAG_SETTINGS_CODE, CLAUDE_LIVE_FLAG_SETTINGS_GUIDANCE } from './claude-turn-failure.mjs';
+
+export { CLAUDE_LIVE_FLAG_SETTINGS_CODE };
 
 // The name the in-process MCP server is registered under; it prefixes every
-// tool it carries on the wire (`mcp__relay__preview`, `mcp__relay__remote_relay`).
+// tool it carries on the wire (`mcp__relay__preview`, `mcp__relay__relay_tool`).
 export const RELAY_MCP_SERVER_NAME = 'relay';
 
 // The per-server tool-call timeout the CLI applies to the relay's tools.
@@ -16,7 +19,7 @@ export const RELAY_MCP_SERVER_NAME = 'relay';
 // value, else by the MCP_TOOL_TIMEOUT environment variable, else by 1e8 ms —
 // and SDK servers are exempt from the idle timeout. Pinning it here keeps a
 // host-wide MCP_TOOL_TIMEOUT (set for some other server) from cutting off a
-// remote_relay wait: those run up to wait_seconds (≤ 600 s) plus however long
+// relay_tool wait: those run up to wait_seconds (≤ 600 s) plus however long
 // an approval card sits unanswered.
 export const RELAY_MCP_TOOL_TIMEOUT_MS = REMOTE_RELAY_TOOL_CALL_TIMEOUT_MS;
 
@@ -119,6 +122,23 @@ export function claudeSpawnSettings({ ultracode = false, autoCompactWindow = nul
   return Object.keys(settings).length ? settings : null;
 }
 
+/**
+ * The spawn's `settings` with a backend's flag settings on top: null when
+ * neither has anything, the relay's object untouched when the backend has
+ * nothing to add. `env` is merged by name, so neither side drops the other's
+ * variables.
+ */
+export function mergeSpawnSettings(spawnSettings, backendSettings) {
+  const own = spawnSettings && typeof spawnSettings === 'object' ? spawnSettings : null;
+  const extra = backendSettings && typeof backendSettings === 'object' && Object.keys(backendSettings).length
+    ? backendSettings
+    : null;
+  if (!extra) return own;
+  const merged = { ...(own || {}), ...extra };
+  if (own?.env || extra.env) merged.env = { ...(own?.env || {}), ...(extra.env || {}) };
+  return merged;
+}
+
 /**
  * Live twin of the attribution spawn setting, for a value (OAR or off). A
  * running CLI takes a new text through the flag layer (it arrives as a fresh
@@ -206,7 +226,7 @@ export function systemPromptForRelayMode(relayMode, { backgroundCommandLimitMs =
  * payload. `getConversationId` is called per tool call because a process
  * outlives the turn it was spawned for.
  *
- * `remote_relay` is the exception: it rides along only when the worker found
+ * `relay_tool` is the exception: it rides along only when the worker found
  * at least one paired remote (`remoteRelayTool`), because a tool that can do
  * nothing on a relay without remotes would only cost context on every turn.
  */
@@ -229,14 +249,25 @@ export function createRelayMcpServer({ api, getConversationId, dbg, remoteRelayT
  * emitted, which also closes the control transport (canUseTool, context
  * usage), so the session process keeps this open while background tasks or
  * queued continuations still need the process alive.
+ *
+ * `held`: nothing is sent until `release()` (the messages pushed meanwhile
+ * wait in order). `fail(error)` instead makes the stream throw it, which the
+ * SDK answers by aborting the query; nothing held is ever sent, and neither
+ * is it when the stream ends while still held.
  */
-function createPushableUserMessageStream() {
+function createPushableUserMessageStream({ held = false } = {}) {
   const queued = [];
   let wake = null;
   let ended = false;
+  let holding = held;
+  let failure = null;
   async function* stream() {
     for (;;) {
-      while (queued.length) yield queued.shift();
+      if (failure) throw failure;
+      if (!holding) {
+        while (queued.length && !failure) yield queued.shift();
+        if (failure) continue;
+      }
       if (ended) return;
       await new Promise((resolve) => { wake = resolve; });
       wake = null;
@@ -257,9 +288,80 @@ function createPushableUserMessageStream() {
       ended = true;
       wake?.();
     },
+    release() {
+      holding = false;
+      wake?.();
+    },
+    fail(error) {
+      failure = error;
+      wake?.();
+    },
   };
 }
 
+/** Every string in a settings object, for taking them out of a text. */
+function settingsStrings(value, found = []) {
+  if (typeof value === 'string') {
+    if (value) found.push(value);
+  } else if (value && typeof value === 'object') {
+    for (const item of Object.values(value)) settingsStrings(item, found);
+  }
+  return found;
+}
+
+/**
+ * The blanked keys of a backend's live flag settings (top-level and `env`
+ * values that are ''), for the spawn's `settings` too: an empty value holds
+ * no secret, and the CLI acts on some settings at startup, before the live
+ * ones land (it runs a folder's apiKeyHelper then; CLI 2.1.304,
+ * scripts/deepseek-cli-proof.mjs). Null when there is none.
+ */
+function liveSettingsBlanks(live) {
+  if (!live) return null;
+  const blanks = {};
+  for (const [key, value] of Object.entries(live)) {
+    if (value === '') blanks[key] = '';
+  }
+  const env = Object.entries(live.env && typeof live.env === 'object' ? live.env : {}).filter(([, value]) => value === '');
+  if (env.length) blanks.env = Object.fromEntries(env);
+  return Object.keys(blanks).length ? blanks : null;
+}
+
+/** The spawn's `settings` with the live settings' blanks on top. */
+function withLiveSettingsBlanks(spawnSettings, live) {
+  const blanks = liveSettingsBlanks(live);
+  if (!blanks) return spawnSettings;
+  const settings = { ...(spawnSettings || {}), ...blanks };
+  if (spawnSettings?.env || blanks.env) settings.env = { ...(spawnSettings?.env || {}), ...(blanks.env || {}) };
+  return settings;
+}
+
+/**
+ * How long the CLI may take to answer a backend's live flag settings (ms).
+ * It answers in well under a second (CLI 2.1.304); one that never does fails
+ * the turn like a refusal, and the held message is never sent.
+ */
+export const LIVE_FLAG_SETTINGS_TIMEOUT_MS = 60_000;
+
+/**
+ * The Error a spawn fails with when the CLI refused its live flag settings.
+ * The message names no value; `detail` is the CLI's own words with every
+ * value of the settings taken out.
+ */
+function liveFlagSettingsError(cause, settings, label = '') {
+  const error = new Error(
+    `Claude Code did not take the ${label ? `${label} ` : ''}connection settings before the first message, so nothing was sent.`,
+  );
+  error.code = CLAUDE_LIVE_FLAG_SETTINGS_CODE;
+  error.guidance = CLAUDE_LIVE_FLAG_SETTINGS_GUIDANCE;
+  let detail = String(cause?.message || cause || '');
+  for (const value of settingsStrings(settings).sort((a, b) => b.length - a.length)) {
+    detail = detail.split(value).join('[redacted]');
+  }
+  error.detail = detail.slice(0, 200);
+  return error;
+}
+
 /**
  * The only module that imports `@anthropic-ai/claude-agent-sdk`.
  *
@@ -290,37 +392,75 @@ export function startClaudeSession({
   pathToClaudeCodeExecutable = '',
   api = null,
   getConversationId = () => '',
-  // Whether this process carries `remote_relay` (the worker's registration
+  // Whether this process carries `relay_tool` (the worker's registration
   // decision). Fixed for the process: the tool list is part of the spawn.
   remoteRelayTool = false,
+  // Another endpoint for the CLI (null = Anthropic through the host's Claude
+  // login): it builds the CLI's environment and maps model and effort into
+  // its terms (../deepseek-worker/deepseek-claude-backend.mjs).
+  backend = null,
+  liveFlagSettingsTimeoutMs = LIVE_FLAG_SETTINGS_TIMEOUT_MS,
   queryImpl = query,
   dbg = () => {},
 } = {}) {
   const normalizedModel = String(model || '').trim().toLowerCase();
-  const effort = normalizeClaudeEffort(reasoningEffort);
+  // A backend on Claude's own models (the Claude API backend) takes the
+  // model and the effort exactly as Claude does; only another provider's
+  // backend maps them into its terms.
+  const modelBackend = backend && backend.claudeModels !== true ? backend : null;
+  const effort = modelBackend ? '' : normalizeClaudeEffort(reasoningEffort);
   const ultracode = effort === CLAUDE_ULTRACODE_EFFORT;
-  const effortOption = ultracode ? 'xhigh' : effort;
+  const effortOption = modelBackend ? modelBackend.effortOption(reasoningEffort) : (ultracode ? 'xhigh' : effort);
+  const cliModel = modelBackend ? modelBackend.cliModel(model) : String(model || '').trim();
   // Spawn-time twin of the flag-settings helpers: the settings layer is the
   // only way to hand a fresh CLI the session-scoped ultracode flag, the
   // auto-compact window and the thinking pin, and all three share one
-  // `settings` object.
-  const spawnSettings = claudeSpawnSettings({ ultracode, autoCompactWindow, thinkingEnabled, attribution });
+  // `settings` object. A backend's own pins (no hooks for both, the Claude
+  // API backend's endpoint and blanked credentials) join them; theirs win a
+  // clash.
+  const spawnSettings = mergeSpawnSettings(
+    claudeSpawnSettings({ ultracode, autoCompactWindow, thinkingEnabled, attribution }),
+    typeof backend?.flagSettings === 'function' ? backend.flagSettings() : null,
+  );
   // Relay tools need the worker's authenticated API helper; a caller that
   // passes none (tests, probes) gets a session without them.
   const relayMcpServer = typeof api === 'function'
     ? createRelayMcpServer({ api, getConversationId, dbg, remoteRelayTool: remoteRelayTool === true })
     : null;
-  const env = claudeSpawnEnv({ backgroundCommandLimitMs });
+  // A backend's CLI always gets an environment of its own: the worker's
+  // carries the backend's secret and maybe the host's Anthropic settings.
+  // The model goes in as well: the backend pins Claude Code's model aliases to
+  // it, so a sub-agent asked for as "opus" runs on the session's model. The
+  // Bash limits go on top: the backend drops a host session's Bash cap, not
+  // the relay's own.
+  const backendEnv = backend ? backend.spawnEnv(process.env, { effort: reasoningEffort, model }) : null;
+  const limitEnv = claudeSpawnEnv({ backgroundCommandLimitMs, baseEnv: backendEnv || process.env });
+  const env = limitEnv || backendEnv;
+  // A backend's pins that may not go on the command line (a key): `settings`
+  // below is the CLI's `--settings` argument, which other users of the host
+  // can read. These go into the same flag layer over the control channel
+  // (stdin), and no user message is sent before the CLI has taken them: the
+  // first API request of the process comes after (measured on CLI 2.1.304,
+  // the CLI proofs in scripts/). The layer outranks the user's, the
+  // project's and the local settings and holds through their reloads and
+  // through later applyFlagSettings calls of other keys. A refusal ends the
+  // process before anything is sent (CLAUDE_LIVE_FLAG_SETTINGS_CODE), and so
+  // does no answer within liveFlagSettingsTimeoutMs. Their blanks go on the
+  // command line as well, for what the CLI does at startup. They are built
+  // from the CLI's environment: a pin holds the value the CLI starts with.
+  const liveSettings = typeof backend?.liveFlagSettings === 'function' ? backend.liveFlagSettings(env || process.env) : null;
+  const live = liveSettings && typeof liveSettings === 'object' && Object.keys(liveSettings).length ? liveSettings : null;
+  const settings = withLiveSettingsBlanks(spawnSettings, live);
   const options = {
     cwd,
     permissionMode: permissionModeForRelayMode(relayMode),
-    systemPrompt: systemPromptForRelayMode(relayMode, { backgroundCommandLimitMs: env ? backgroundCommandLimitMs : null }),
+    systemPrompt: systemPromptForRelayMode(relayMode, { backgroundCommandLimitMs: limitEnv ? backgroundCommandLimitMs : null }),
     includePartialMessages: true,
     forwardSubagentText: true,
     ...(effortOption ? { effort: effortOption } : {}),
-    ...(spawnSettings ? { settings: spawnSettings } : {}),
+    ...(settings ? { settings } : {}),
     ...(env ? { env } : {}),
-    ...(normalizedModel && normalizedModel !== 'auto' ? { model: String(model).trim() } : {}),
+    ...(normalizedModel && normalizedModel !== 'auto' && cliModel ? { model: cliModel } : {}),
     ...(String(resume || '').trim() ? { resume: String(resume).trim() } : {}),
     ...(abortController ? { abortController } : {}),
     ...(typeof canUseTool === 'function' ? { canUseTool } : {}),
@@ -329,8 +469,52 @@ export function startClaudeSession({
       ? { pathToClaudeCodeExecutable: String(pathToClaudeCodeExecutable).trim() }
       : {}),
   };
-  const { stream, push, end } = createPushableUserMessageStream();
+  const { stream, push, end, release, fail } = createPushableUserMessageStream({ held: Boolean(live) });
   const turn = queryImpl({ prompt: stream, options });
+  if (live) {
+    // The wait ends with the answer, the timeout or the session's abort,
+    // whichever comes first; each one clears the others.
+    const signal = abortController?.signal || null;
+    let timer = null;
+    let onAbort = null;
+    const settled = () => {
+      clearTimeout(timer);
+      timer = null;
+      if (onAbort) signal?.removeEventListener('abort', onAbort);
+      onAbort = null;
+    };
+    const unanswered = new Promise((resolve, reject) => {
+      const waitMs = Math.max(0, Number(liveFlagSettingsTimeoutMs) || 0);
+      timer = setTimeout(() => {
+        timer = null;
+        reject(new Error(`no answer within ${Math.ceil(waitMs / 1000)} s`));
+      }, waitMs);
+      timer.unref?.();
+      if (signal) {
+        onAbort = settled;
+        if (signal.aborted) settled();
+        else signal.addEventListener('abort', onAbort, { once: true });
+      }
+    });
+    turn.liveFlagSettingsApplied = Promise.race([
+      Promise.resolve().then(() => {
+        if (typeof turn.applyFlagSettings !== 'function') throw new Error('applyFlagSettings is not available');
+        return turn.applyFlagSettings(live);
+      }),
+      unanswered,
+    ])
+      .finally(settled)
+      .then(() => {
+        release();
+        return true;
+      }, (error) => {
+        const refused = liveFlagSettingsError(error, live, backend?.label || '');
+        turn.liveFlagSettingsError = refused;
+        dbg('live flag settings refused', refused.detail);
+        fail(refused);
+        return false;
+      });
+  }
   applyThinkingDisplay(turn, thinkingDisplay, { dbg });
   turn.pushUserMessage = push;
   // The session process MUST call this on every teardown path or the CLI