@skaile/workspaces 5.15.1 → 5.17.0

package/dist/bridge/drivers/claude-sdk.js

@@ -1,29 +1,29 @@
-import { formatDroppedToolsNotice, filterInProcessMcpServerTools, checkToolPropertyKeys } from '../../chunk-X5O56UO4.js';
+import { formatDroppedToolsNotice, filterInProcessMcpServerTools, checkToolPropertyKeys, TOOL_PROPERTY_KEY_PATTERN } from '../../chunk-L2AMXONH.js';
 import { freshBudget, isFirstAttempt, spend, isSpent, decide, isAvailable } from '../../chunk-IZCR27MU.js';
 import { AskSlots } from '../../chunk-EPBKISS5.js';
-import { scrubPoisonedTranscript, transcriptStoreForRuntime, resolveClaudeConfigDir, claudeEndpointMode, buildClaudeEndpointEnv } from '../../chunk-TCWECSEB.js';
-import { dispatchCapability } from '../../chunk-PW3TYWOI.js';
-import { fetchProviderModels } from '../../chunk-GLMKS6V6.js';
+import { scrubPoisonedTranscript, transcriptStoreForRuntime, resolveClaudeConfigDir, claudeEndpointMode, buildClaudeEndpointEnv, APPROVE_ONCE, DENY } from '../../chunk-3OYOBTY4.js';
+import { dispatchCapability } from '../../chunk-AJ7EGIFR.js';
+import { fetchProviderModels } from '../../chunk-ZPCABSSW.js';
 import { ReconfigureLedger, AuthError, stripRunnerPrivateEnv, classifyClaudeSdkError, reclassifyAuthAsAccountUnavailable, AccountUnavailableError, isLongContextEntitlementRejection, LONG_CONTEXT_CREDITS_API_ERROR } from '../../chunk-B4X2N7JQ.js';
 import { agentExecRequested, wrapAgentCommand, resolveAgentExec } from '../../chunk-YROR332M.js';
-import { AgentDriver, getBridgeLogger, registryDriverConfig } from '../../chunk-4AKR4XPQ.js';
-import { BUILTIN_DRIVER_CATALOG, entryCredentialValue } from '../../chunk-GQ5OYFVD.js';
+import { AgentDriver, getBridgeLogger, registryDriverConfig } from '../../chunk-QSLXB44M.js';
+import { BUILTIN_DRIVER_CATALOG, entryCredentialValue } from '../../chunk-LQT2IKYY.js';
 import '../../chunk-6E6PKKAD.js';
-import { withActivityLabelShape } from '../../chunk-D5WTOVLG.js';
-import '../../chunk-MGM5EJQQ.js';
-import { loadDriverSdk } from '../../chunk-4QINFQ27.js';
+import { withActivityLabelShape } from '../../chunk-Y56YIT6J.js';
+import '../../chunk-YK3XLEQJ.js';
+import { loadDriverSdk } from '../../chunk-PIC23DDE.js';
 import '../../chunk-4GY63JU6.js';
-import '../../chunk-X7DIT65W.js';
+import '../../chunk-5RDZ5JHH.js';
 import '../../chunk-D54T2F54.js';
 import '../../chunk-5BEFNLOR.js';
 import '../../chunk-A2ULN3KX.js';
-import '../../chunk-J76LDUDS.js';
+import '../../chunk-ZVZTCDUN.js';
 import '../../chunk-L5VSIPQD.js';
 import '../../chunk-IG5LZ3WU.js';
-import '../../chunk-ANSZULXH.js';
+import '../../chunk-H7R7R5BN.js';
 import '../../chunk-RVRB27AN.js';
-import '../../chunk-SP5NGNBV.js';
-import '../../chunk-VY6NTFE7.js';
+import '../../chunk-YW2BNDSE.js';
+import '../../chunk-FT4ZHLYR.js';
 import '../../chunk-ICSCSM5D.js';
 import '../../chunk-DKXNKFKP.js';
 import { mergeRegistries, parseModelRef, isEntryEnabled, resolveEntryBaseUrl } from '../../chunk-MJHSLODD.js';
@@ -31,6 +31,7 @@ import '../../chunk-C3CAXQMA.js';
 import { createLogger } from '../../chunk-BOFL7GIF.js';
 import '../../chunk-NSBPE2FW.js';
 import { spawnSync, spawn } from 'child_process';
+import { randomUUID } from 'crypto';
 import { readFileSync, existsSync } from 'fs';
 import { createRequire } from 'module';
 import * as zNS from 'zod';
@@ -173,12 +174,18 @@ var SelfTurnTracker = class {
   }
   emit;
   active = false;
-  /** A prompt was pushed while the self-started turn ran; the CLI answers it inside that turn. */
+  /** The self-started turn took a prompt pushed while it ran: its result answers that prompt too. */
   joined = false;
-  /** Tasks the CLI reported settled since the last turn ended, oldest first. */
+  /** A prompt pushed during the self-started turn that the CLI has not taken yet. */
+  queuedPrompt = null;
+  /** This CLI stamps consumed prompts' uuids on assistant messages, so taking one is observable. */
+  stampsPrompts = false;
+  /** Tasks reported settled since the last turn ended, oldest first; only ones reported started. */
   settled = /* @__PURE__ */ new Set();
   /** Tasks registered in the foreground: reported only if they move to the background. */
   foreground = /* @__PURE__ */ new Set();
+  /** Tasks announced with `background_task_started`, the only ids a host can tie to a turn. */
+  reported = /* @__PURE__ */ new Set();
   /** Whether the turn running now is one the driver did not prompt. */
   get selfTurnActive() {
     return this.active;
@@ -196,6 +203,7 @@ var SelfTurnTracker = class {
     }
     if (msg.type !== "assistant" && msg.type !== "stream_event" && msg.type !== "user") return;
     if (msg.parent_tool_use_id) return;
+    this.observeConsumedPrompts(msg);
     if (inTurn) return;
     this.active = true;
     const taskIds = [...this.settled];
@@ -210,17 +218,30 @@ var SelfTurnTracker = class {
     return this.active && !this.joined;
   }
   /**
-   * The driver pushed a prompt into the live CLI. During a self-started turn the
-   * CLI folds it into that turn, whose result then ends the prompted turn too.
+   * Whether the next `result` ends the self-started turn alone: a prompt pushed
+   * during it is still queued, so the CLI answers it in a turn of its own, and
+   * the prompted turn must wait for that turn's result.
    */
-  onPromptPushed() {
-    if (this.active) this.joined = true;
+  get resultEndsWakeOnly() {
+    return this.active && !this.joined && this.queuedPrompt !== null;
+  }
+  /**
+   * The driver pushed a prompt (`uuid`) into the live CLI. During a self-started
+   * turn the CLI may fold it into that turn or answer it in a turn of its own;
+   * the prompt joins the wake only once the CLI stamps its uuid on the wake's
+   * output. A CLI not seen to stamp uuids is assumed to fold it in.
+   */
+  onPromptPushed(uuid) {
+    if (!this.active) return;
+    if (uuid && this.stampsPrompts) this.queuedPrompt = uuid;
+    else this.joined = true;
   }
   /** The running turn's `result` was handled. */
   onResult() {
     if (!this.active) return;
     this.active = false;
     this.joined = false;
+    this.queuedPrompt = null;
     this.settled.clear();
   }
   /**
@@ -234,8 +255,20 @@ var SelfTurnTracker = class {
   reset() {
     this.active = false;
     this.joined = false;
+    this.queuedPrompt = null;
+    this.stampsPrompts = false;
     this.settled.clear();
     this.foreground.clear();
+    this.reported.clear();
+  }
+  observeConsumedPrompts(msg) {
+    const uuids = msg.user_message_uuids ?? (msg.user_message_uuid ? [msg.user_message_uuid] : []);
+    if (uuids.length === 0) return;
+    this.stampsPrompts = true;
+    if (this.queuedPrompt !== null && uuids.includes(this.queuedPrompt)) {
+      this.queuedPrompt = null;
+      if (this.active) this.joined = true;
+    }
   }
   observeTask(msg, inTurn) {
     const taskId = msg.task_id;
@@ -262,11 +295,12 @@ var SelfTurnTracker = class {
     }
     if (msg.subtype === "task_notification") {
       this.foreground.delete(taskId);
-      if (!ambient) remember(this.settled, taskId);
+      if (!ambient && this.reported.has(taskId)) remember(this.settled, taskId);
     }
   }
   reportStarted(taskId, inTurn) {
     if (!inTurn) return;
+    remember(this.reported, taskId);
     this.emit({ type: "background_task_started", taskId });
   }
 };
@@ -382,6 +416,7 @@ function sanitizeAssistantText(text) {
   return changed ? out.replace(/\s+$/, "") : out;
 }
 var TAG_PREFIXES = [
+  "function_calls",
   "function_call",
   "function_cal",
   "function_ca",
@@ -421,18 +456,31 @@ var TAG_PREFIXES = [
   "sy",
   "s"
 ].join("|");
-var PARTIAL_MARKER_TAIL = new RegExp(`\\[\\s*/?\\s*${NS}(?:${TAG_PREFIXES})?[^\\]]*$`, "i");
+var PARTIAL_MARKER_TAIL = new RegExp(
+  `\\[\\s*(?:/\\s*)?(?:${NS}(?:${TAG_PREFIXES})|[a-z][a-z0-9]*:?)?\\s*$`,
+  "i"
+);
+var ROLE_LABEL_TAIL = /(?:^|\n)[^\S\n]*(\[(?:User|Assistant|System)\]\s*)$/i;
 var UNCLOSED_OPENER = new RegExp(`\\[\\s*${NS}function_calls\\s*\\]|\\[\\s*${NS}invoke\\b`, "i");
-function streamingSafeSanitize(text) {
-  let cleaned = sanitizeAssistantText(text);
+function cutAtUnclosedOpener(cleaned) {
   const opener = UNCLOSED_OPENER.exec(cleaned);
-  if (opener && opener.index >= 0) {
-    cleaned = cleaned.slice(0, opener.index);
-  }
+  return opener ? cleaned.slice(0, opener.index) : cleaned;
+}
+function finalizeStreamedText(text) {
+  const sanitized = sanitizeAssistantText(text);
+  const cut = cutAtUnclosedOpener(sanitized);
+  return cut === sanitized ? cut : cut.replace(/\s+$/, "");
+}
+function streamingSafeSanitize(text) {
+  let cleaned = cutAtUnclosedOpener(sanitizeAssistantText(text));
   const tail = PARTIAL_MARKER_TAIL.exec(cleaned);
   if (tail && tail.index >= 0) {
     cleaned = cleaned.slice(0, tail.index);
   }
+  const label = ROLE_LABEL_TAIL.exec(cleaned);
+  if (label?.[1]) {
+    cleaned = cleaned.slice(0, cleaned.length - label[1].length);
+  }
   return cleaned.replace(/\s+$/, "");
 }
 
@@ -443,41 +491,60 @@ function capabilityToolsKey(tools) {
     [...tools].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0).map((t) => [t.name, t.description, t.parameters])
   );
 }
-function jsonSchemaToZodLoose(schema, z2) {
+var LOOSE_SCHEMA_MAX_DEPTH = 6;
+function looseShape(schema, z2, depth, nested) {
   const props = schema?.properties ?? null;
-  if (!props || typeof props !== "object") return null;
+  if (!props || typeof props !== "object" || Array.isArray(props)) return null;
+  const keys = Object.keys(props);
+  if (nested && (keys.length === 0 || !keys.every((k) => TOOL_PROPERTY_KEY_PATTERN.test(k))))
+    return null;
   const required = new Set(Array.isArray(schema?.required) ? schema.required : []);
   const out = {};
-  for (const [key, def] of Object.entries(props)) {
-    let zod;
-    switch (def?.type) {
-      case "string":
-        zod = z2.string();
-        break;
-      case "number":
-      case "integer":
-        zod = z2.number();
-        break;
-      case "boolean":
-        zod = z2.boolean();
-        break;
-      case "array":
-        zod = z2.array(z2.any());
-        break;
-      case "object":
-        zod = z2.record(z2.string(), z2.any());
-        break;
-      default:
-        zod = z2.any();
-    }
-    if (def?.description && typeof def.description === "string") {
-      zod = zod.describe(def.description);
-    }
+  for (const key of keys) {
+    let zod = looseType(props[key], z2, depth + 1);
     if (!required.has(key)) zod = zod.optional();
     out[key] = zod;
   }
   return out;
 }
+function looseType(def, z2, depth) {
+  let zod;
+  const meta = {};
+  const deep = depth >= LOOSE_SCHEMA_MAX_DEPTH;
+  switch (def?.type) {
+    case "string":
+      zod = z2.string();
+      break;
+    case "number":
+    case "integer":
+      zod = z2.number();
+      break;
+    case "boolean":
+      zod = z2.boolean();
+      break;
+    case "array": {
+      const items = def.items;
+      const itemSchema = !deep && items && typeof items === "object" && !Array.isArray(items) ? items : null;
+      zod = z2.array(itemSchema ? looseType(itemSchema, z2, depth + 1) : z2.any());
+      break;
+    }
+    case "object": {
+      const shape = deep ? null : looseShape(def, z2, depth, true);
+      zod = shape ? z2.looseObject(shape) : z2.record(z2.string(), z2.any());
+      if (shape && def.additionalProperties === false) meta.additionalProperties = false;
+      break;
+    }
+    default:
+      zod = z2.any();
+  }
+  if (def?.description && typeof def.description === "string") {
+    meta.description = def.description;
+  }
+  return Object.keys(meta).length > 0 ? zod.meta(meta) : zod;
+}
+function jsonSchemaToZodLoose(schema, z2) {
+  return looseShape(schema, z2, 0, false);
+}
 if (typeof globalThis.require === "undefined") {
   try {
     const metaUrl = (0, eval)("import.meta.url");
@@ -655,6 +722,36 @@ function diffModelUsage(current, previous) {
 var QUESTION_SUPERSEDED_BY_PROMPT = "The user replied in chat instead of answering this dialog, so the question was cancelled. Their reply arrives as the next user turn \u2014 read it before you re-ask or assume an answer.";
 var claudeBinaryCache;
 var claudeBinaryResolved = false;
+function isApproval(answer) {
+  return /^(approve once|approve|allow|yes|y)$/i.test(answer.trim());
+}
+var MAX_APPROVAL_DETAIL = 2e3;
+function describeToolApproval(toolName, input) {
+  const text = (value) => {
+    const raw = typeof value === "string" ? value : JSON.stringify(value) ?? "";
+    return raw.length > MAX_APPROVAL_DETAIL ? `${raw.slice(0, MAX_APPROVAL_DETAIL)}\u2026` : raw;
+  };
+  if (toolName === "Bash") return { kind: "command", details: [text(input.command ?? input)] };
+  if (["Edit", "MultiEdit", "Write", "NotebookEdit"].includes(toolName)) {
+    return { kind: "file", details: [text(input.file_path ?? input.notebook_path ?? input)] };
+  }
+  const detail = text(input) || toolName;
+  return { kind: toolName.startsWith("mcp__") ? "mcp" : "permissions", details: [detail] };
+}
+function withoutExpectedSdkWarnings(fn) {
+  const original = process.emitWarning;
+  process.emitWarning = function(warning, ...args) {
+    const first = args[0];
+    const code = typeof first === "object" && first !== null ? first.code : typeof args[1] === "string" ? args[1] : void 0;
+    if (code === "CLAUDE_SDK_CAN_USE_TOOL_SHADOWED") return;
+    return original.call(process, warning, ...args);
+  };
+  try {
+    return fn();
+  } finally {
+    process.emitWarning = original;
+  }
+}
 var ClaudeSdkDriver = class extends AgentDriver {
   driverInfo = {
     id: "claude-sdk",
@@ -673,11 +770,14 @@ var ClaudeSdkDriver = class extends AgentDriver {
   toolIdToName = /* @__PURE__ */ new Map();
   prevText = "";
   /**
-   * Count of sanitized characters already streamed for the current message.
-   * Lets {@link handleStreamEvent} emit only the newly-stable sanitized suffix
-   * as `_textDelta`, so a leaked marker that spans deltas is never half-sent.
+   * The sanitized text already streamed for the current message, exactly as the
+   * `_textDelta`s carried it. Lets {@link handleStreamEvent} emit only the
+   * newly-stable sanitized suffix, so a leaked marker that spans deltas is never
+   * half-sent, and lets {@link flushHeldBackText} send what was held back.
    */
-  emittedSanitizedLen = 0;
+  emittedSanitizedText = "";
+  /** Set once this message's sanitized text stopped extending what was streamed (logged once). */
+  streamDiverged = false;
   /** Set once the streaming text of the current message classifies as a self-healable auth render. */
   suppressingAuthStream = false;
   /**
@@ -774,6 +874,11 @@ var ClaudeSdkDriver = class extends AgentDriver {
   subagentToolAllowlists = /* @__PURE__ */ new Map();
   /** Guards against duplicate agent_end emissions per turn. */
   turnCompleted = false;
+  /**
+   * The last `result` ended a self-started turn while a prompt pushed during it
+   * was still queued: the prompted turn ends on the result of the turn that answers it.
+   */
+  resultEndedWakeOnly = false;
   /** Announces the turns the CLI starts by itself and the background tasks they continue. */
   selfTurns = new SelfTurnTracker((event) => {
     try {
@@ -883,6 +988,8 @@ var ClaudeSdkDriver = class extends AgentDriver {
    * transcript). Null when no question is pending.
    */
   pendingQuestion = null;
+  /** Tool approvals waiting behind the one on screen; each is shown once the one before is answered. */
+  approvalQueue = [];
   /** Cached slash commands discovered from the SDK. */
   cachedCommands = [];
   /** Token usage from the most recent completed turn. */
@@ -903,15 +1010,17 @@ var ClaudeSdkDriver = class extends AgentDriver {
   /** Per-model usage of the most recent completed turn, derived in `captureResultUsage`. */
   _lastModelUsage = null;
   /**
-   * The raw `modelUsage` map from the most recently seen result message. Like
+   * The raw `modelUsage` map from the most recently seen result message, or the
+   * map a resumed spawn restored (see {@link seedCostBaseline}). Like
    * `total_cost_usd` it is cumulative over the whole SDK run, so a turn's share
    * is the per-model difference against this snapshot.
    */
   _lastCumulativeModelUsage = null;
   /**
-   * The SDK's `total_cost_usd` from the most recently seen result message —
-   * cumulative over the whole SDK run/session, not per-turn. Diffed against
-   * the next result's total to derive the per-turn delta.
+   * The SDK's `total_cost_usd` from the most recently seen result message, or
+   * the total a resumed spawn restored — cumulative over the whole SDK
+   * run/session, not per-turn. Diffed against the next result's total to
+   * derive the per-turn delta.
    */
   _lastCumulativeCostUsd = 0;
   /** Per-turn cost delta derived from `total_cost_usd`, emitted as the `result` event's `costUsd`. */
@@ -919,13 +1028,19 @@ var ClaudeSdkDriver = class extends AgentDriver {
   /** Whether the last result carried `total_cost_usd`; 0 alone cannot tell a free turn from an unreported one. */
   _lastCostReported = false;
   /**
-   * Bumped by every `startQuery()` spawn. Lets `captureResultUsage` detect a
-   * fresh CLI process deterministically, instead of only inferring it from
-   * `total_cost_usd` happening to decrease.
+   * SDK session the cumulative baseline (`_lastCumulativeCostUsd`,
+   * `_lastCumulativeModelUsage`) belongs to. A spawn that resumes this session
+   * keeps the baseline, because the CLI restores the same totals; any other
+   * spawn re-seeds it in {@link seedCostBaseline}.
+   */
+  _costBaselineSessionId = null;
+  /**
+   * The transcript's `cost-state` when a spawn kept the in-memory baseline.
+   * Consulted by the spawn's first result only: the CLI stamps `cost-state` at
+   * exit, so a hard-killed or still-exiting old process can leave it restoring
+   * less than was booked.
    */
-  _querySpawnGeneration = 0;
-  /** Spawn generation `_lastCumulativeCostUsd` was captured under. */
-  _costTrackingGeneration = -1;
+  _staleRestoreFallback = null;
   /**
    * `true` when the active credential is a Claude Code OAuth subscription
    * (no API key in config) rather than a raw `ANTHROPIC_API_KEY`. Set on
@@ -1141,7 +1256,8 @@ var ClaudeSdkDriver = class extends AgentDriver {
     }
     this.running = true;
     this.prevText = "";
-    this.emittedSanitizedLen = 0;
+    this.emittedSanitizedText = "";
+    this.streamDiverged = false;
     this.suppressingAuthStream = false;
     this.suppressedAuthRenderText = null;
     this.lastApiErrorRender = null;
@@ -1157,8 +1273,9 @@ var ClaudeSdkDriver = class extends AgentDriver {
     });
     try {
       if (this.query && this.inputStream) {
-        this.inputStream.push(this.buildUserMessage(message));
-        this.selfTurns.onPromptPushed();
+        const userMessage = this.buildUserMessage(message);
+        this.inputStream.push(userMessage);
+        this.selfTurns.onPromptPushed(userMessage.uuid);
       } else {
         await this.startQuery(message);
       }
@@ -1551,10 +1668,11 @@ var ClaudeSdkDriver = class extends AgentDriver {
    * were cut from, so it matches what the consumer received exactly.
    */
   retractUnfinishedText() {
-    if (this.emittedSanitizedLen === 0) return;
-    const text = streamingSafeSanitize(this.prevText).slice(0, this.emittedSanitizedLen);
+    if (this.emittedSanitizedText === "") return;
+    const text = this.emittedSanitizedText;
     this.prevText = "";
-    this.emittedSanitizedLen = 0;
+    this.emittedSanitizedText = "";
+    this.streamDiverged = false;
     this.log.info("retracting the unfinished text of an attempt about to be replayed", {
       chars: text.length
     });
@@ -1743,7 +1861,7 @@ var ClaudeSdkDriver = class extends AgentDriver {
         elapsedMs: 0,
         outcome: "no_session"
       });
-      return;
+      return null;
     }
     try {
       const scrub = await scrubPoisonedTranscript({
@@ -1766,6 +1884,7 @@ var ClaudeSdkDriver = class extends AgentDriver {
           cacheStripped: scrub.cacheStripped
         });
       }
+      return scrub.costState;
     } catch (err) {
       this.log.warn("preventive transcript scrub failed; continuing", {
         phase: "transcript_scrub",
@@ -1774,8 +1893,45 @@ var ClaudeSdkDriver = class extends AgentDriver {
         sessionId,
         error: err instanceof Error ? err.message : String(err)
       });
+      return null;
     }
   }
+  /**
+   * Set the cumulative baseline a new spawn's results are diffed against.
+   *
+   * `total_cost_usd` and `modelUsage` are run-cumulative, and on `--resume` the
+   * CLI restores both from the transcript's last `cost-state` entry, so the
+   * first result of a resumed spawn restates everything booked before it. The
+   * restored totals are therefore the baseline, not new spend:
+   * - resuming the session the in-memory baseline belongs to (a recycle or a
+   *   replay in this driver lifetime) keeps that baseline. It is what was
+   *   booked, so spend the old process made without a result still counts;
+   * - resuming any other session (a wake: a new driver) takes the transcript's
+   *   `cost-state`, read in the same pass as the scrub;
+   * - a fresh session, or a transcript without a `cost-state`, starts at zero.
+   * A first total below the kept baseline means the CLI restored an older
+   * stamp; {@link captureResultUsage} then diffs against the transcript's
+   * `cost-state` when it fits, else books the total (it never goes negative).
+   * A stale stamp whose first total still reaches the kept baseline cannot be
+   * told apart from a correct restore, so that case under-books by the gap
+   * rather than double-counting; it is logged at info.
+   */
+  seedCostBaseline(resumedSessionId, restored) {
+    this._staleRestoreFallback = null;
+    if (resumedSessionId && resumedSessionId === this._costBaselineSessionId) {
+      this._staleRestoreFallback = restored;
+      return;
+    }
+    if (resumedSessionId && restored) {
+      this._lastCumulativeCostUsd = restored.totalCostUSD;
+      this._lastCumulativeModelUsage = restored.modelUsage;
+      this._costBaselineSessionId = resumedSessionId;
+      return;
+    }
+    this._lastCumulativeCostUsd = 0;
+    this._lastCumulativeModelUsage = null;
+    this._costBaselineSessionId = null;
+  }
   /**
    * Resolve the AI provider registry entry this session addresses, plus
    * everything derived from it: the child env, the credential, the
@@ -1825,12 +1981,13 @@ var ClaudeSdkDriver = class extends AgentDriver {
     };
   }
   async startQuery(message) {
-    this._querySpawnGeneration++;
     this.queryStartedAt = Date.now();
     this.awaitingFirstMessageOfSpawn = true;
     this.spawnResumed = !!(this.config.resumeSessionId || this.sessionId || this.hasSession);
+    const resumedSessionId = this.config.resumeSessionId || this.sessionId || null;
     this.abortController = new AbortController();
-    await this.preventivelyScrubTranscript();
+    const restoredCost = await this.preventivelyScrubTranscript();
+    this.seedCostBaseline(resumedSessionId, restoredCost);
     const endpoint = this.resolveEndpoint();
     const spawnConfig = {
       model: this.config.model,
@@ -1855,8 +2012,8 @@ var ClaudeSdkDriver = class extends AgentDriver {
       strictMcpConfig: true,
       // Use full Claude Code tool preset so skills, agents, etc. work
       tools: { type: "preset", preset: "claude_code" },
-      permissionMode: "bypassPermissions",
-      allowDangerouslySkipPermissions: true,
+      // `interactive` hands every call the SDK does not auto-allow to `canUseTool`, which asks.
+      ...this.config.permissionMode === "interactive" ? { permissionMode: "default" } : { permissionMode: "bypassPermissions", allowDangerouslySkipPermissions: true },
       // AskUserQuestion routes through canUseTool even under bypassPermissions
       // (ask-rule evaluation precedes permission-mode evaluation in the SDK),
       // so this is the only place the turn can pause to collect a real answer.
@@ -1980,7 +2137,7 @@ var ClaudeSdkDriver = class extends AgentDriver {
       options
     };
     if (apiKey) queryArgs.apiKey = apiKey;
-    this.query = query(queryArgs);
+    this.query = withoutExpectedSdkWarnings(() => query(queryArgs));
     this.reconfig.setSnapshot({
       ...spawnConfig,
       providerId: endpoint.providerId,
@@ -2008,6 +2165,9 @@ var ClaudeSdkDriver = class extends AgentDriver {
     const denial = this.toolAllowlistDenialFor(toolName, opts.agentID);
     if (denial) return Promise.resolve({ behavior: "deny", message: denial });
     if (toolName !== "AskUserQuestion") {
+      if (this.config.permissionMode === "interactive") {
+        return this.askToolApproval(toolName, input, opts.signal);
+      }
       return Promise.resolve({ behavior: "allow", updatedInput: input });
     }
     const rawQuestions = Array.isArray(input.questions) ? input.questions : [];
@@ -2034,6 +2194,91 @@ var ClaudeSdkDriver = class extends AgentDriver {
       this.log.debug("paused on AskUserQuestion", { questions: questionTexts.length });
     });
   };
+  /**
+   * `permissionMode: "interactive"`: pause the turn on an approval card for a tool call the SDK
+   * did not auto-allow. The reply goes through {@link answerQuestion} like an `AskUserQuestion`
+   * answer; anything but an approval denies. A session nobody can answer refuses the call.
+   */
+  askToolApproval(toolName, input, signal) {
+    if (this.config.unattended) {
+      return Promise.resolve({
+        behavior: "deny",
+        message: `${toolName} needs approval (permission_mode: interactive) and this session has no one to ask`
+      });
+    }
+    return new Promise((resolve) => {
+      const entry = { toolName, input, resolve };
+      signal.addEventListener(
+        "abort",
+        () => {
+          const queued = this.approvalQueue.indexOf(entry);
+          if (queued >= 0) {
+            this.approvalQueue.splice(queued, 1);
+            resolve({
+              behavior: "deny",
+              message: "session aborted before the approval was answered"
+            });
+          } else if (this.pendingQuestion?.resolve === resolve) {
+            this.denyPendingQuestion("session aborted before the approval was answered");
+            this.presentNextApproval();
+          }
+        },
+        { once: true }
+      );
+      if (this.pendingQuestion) this.approvalQueue.push(entry);
+      else this.presentApproval(entry);
+    });
+  }
+  /** Show the approval card of one tool call and make it the pending question. */
+  presentApproval(entry) {
+    const { toolName, input, resolve } = entry;
+    const { kind, details } = describeToolApproval(toolName, input);
+    const question = `Allow ${toolName}?`;
+    this.pendingQuestion = {
+      resolve,
+      originalInput: input,
+      questionTexts: [question],
+      slots: new AskSlots([question]),
+      answers: {},
+      approval: true
+    };
+    const callId = `approval-${randomUUID()}`;
+    const cardInput = {
+      requestId: callId,
+      questions: [{ question, options: [{ label: APPROVE_ONCE }, { label: DENY }] }],
+      approval: { kind, details }
+    };
+    this.emit("agent-event", {
+      type: "message_start",
+      message: {
+        role: "assistant",
+        content: [{ type: "tool_use", name: "AskUserQuestion", id: callId, input: cardInput }]
+      }
+    });
+    this.emit("agent-event", {
+      type: "tool_call",
+      name: "AskUserQuestion",
+      tool: { name: "AskUserQuestion" },
+      toolCallId: callId,
+      input: cardInput
+    });
+    this.log.debug("paused on a tool approval", {
+      tool: toolName,
+      queued: this.approvalQueue.length
+    });
+  }
+  /** Once nothing is on screen, show the next queued approval. */
+  presentNextApproval() {
+    if (this.pendingQuestion) return;
+    const next = this.approvalQueue.shift();
+    if (next) this.presentApproval(next);
+  }
+  /** Deny the pending question and every queued approval (abort, kill, reset, a new prompt). */
+  denyAllPending(reason) {
+    this.denyPendingQuestion(reason);
+    const queued = this.approvalQueue.splice(0);
+    for (const entry of queued) entry.resolve({ behavior: "deny", message: reason });
+  }
   /**
    * Denial reason when the per-turn allowlist forbids `toolName`, else `null`.
    * A subagent seen under a restricted turn is bound to that turn's allowlist
@@ -2071,7 +2316,7 @@ var ClaudeSdkDriver = class extends AgentDriver {
     return {};
   };
   supersedePendingQuestion() {
-    this.denyPendingQuestion(QUESTION_SUPERSEDED_BY_PROMPT);
+    this.denyAllPending(QUESTION_SUPERSEDED_BY_PROMPT);
   }
   hasPendingQuestion() {
     return this.pendingQuestion !== null;
@@ -2086,11 +2331,21 @@ var ClaudeSdkDriver = class extends AgentDriver {
     if (complete) {
       this.pendingQuestion = null;
       this.lastSdkMessageAt = Date.now();
+      if (pending.approval) {
+        const approved = isApproval(pending.answers[pending.questionTexts[0]] ?? answer);
+        pending.resolve(
+          approved ? { behavior: "allow", updatedInput: pending.originalInput } : { behavior: "deny", message: "the user denied this tool call" }
+        );
+        this.log.debug("answered a tool approval", { approved });
+        this.presentNextApproval();
+        return true;
+      }
       pending.resolve({
         behavior: "allow",
         updatedInput: { ...pending.originalInput, answers: pending.answers }
       });
       this.log.debug("answered AskUserQuestion", { questions: pending.questionTexts.length });
+      this.presentNextApproval();
     }
     return true;
   }
@@ -2158,10 +2413,11 @@ var ClaudeSdkDriver = class extends AgentDriver {
    *
    * A tool whose declared schema has a property key the API rejects
    * ({@link checkToolPropertyKeys}) is left out and reported in `dropped`.
-   * Only the key rule applies here: `jsonSchemaToZodLoose` copies keys
-   * verbatim but flattens every other construct to string/number/boolean/
-   * array/record/any, so the wire schema is always valid draft 2020-12 and
-   * a declared-schema meta check would drop tools that work.
+   * Only the key rule applies here: `jsonSchemaToZodLoose` copies top-level
+   * keys verbatim (nested ones only when they pass the key rule) and flattens
+   * every other construct to string/number/boolean/array/object/record/any,
+   * so the wire schema is always valid draft 2020-12 and a declared-schema
+   * meta check would drop tools that work.
    */
   async buildCapabilityMcpServer() {
     const dropped = [];
@@ -2280,7 +2536,7 @@ var ClaudeSdkDriver = class extends AgentDriver {
         this.firstSdkMessageSeen = true;
         this.captureSessionId(msg);
         this.handleSdkMessage(msg);
-        if (msg.type === "result" && !msg.is_error) {
+        if (msg.type === "result" && !msg.is_error && !this.resultEndedWakeOnly) {
           this.completeTurn();
         }
       }
@@ -2705,10 +2961,12 @@ var ClaudeSdkDriver = class extends AgentDriver {
       this.log.info("suppressing SDK auth-error assistant text; self-heal will retry");
       this.stashSuppressedAuthRender(this.assistantTextOf(agentMsg));
       this.prevText = "";
-      this.emittedSanitizedLen = 0;
+      this.emittedSanitizedText = "";
+      this.streamDiverged = false;
       this.suppressingAuthStream = false;
       return;
     }
+    this.flushHeldBackText();
     this.emit("agent-event", { type: "message_start", message: agentMsg });
     if (agentMsg.toolCalls) {
       for (const tc of agentMsg.toolCalls) {
@@ -2722,7 +2980,8 @@ var ClaudeSdkDriver = class extends AgentDriver {
       }
     }
     this.prevText = "";
-    this.emittedSanitizedLen = 0;
+    this.emittedSanitizedText = "";
+    this.streamDiverged = false;
     this.suppressingAuthStream = false;
     this.suppressedAuthRenderText = null;
     this.emit("agent-event", { type: "message_end", message: agentMsg });
@@ -2808,20 +3067,55 @@ var ClaudeSdkDriver = class extends AgentDriver {
         this.stashSuppressedAuthRender(this.prevText);
         return;
       }
-      const safe = streamingSafeSanitize(this.prevText);
-      const sanitizedDelta = safe.slice(this.emittedSanitizedLen);
-      this.emittedSanitizedLen = safe.length;
-      if (sanitizedDelta.length === 0) return;
-      const agentMsg = {
-        role: "assistant",
-        content: [{ type: "text", text: safe }]
-      };
-      this.emit("agent-event", {
-        type: "message_update",
-        message: agentMsg,
-        _textDelta: sanitizedDelta
+      this.emitSanitizedDelta(streamingSafeSanitize(this.prevText));
+    }
+  }
+  /**
+   * Stream the part of `safe` (the sanitized text so far) not yet sent. Only a
+   * strict extension of what was sent is streamed: deltas cannot be taken back.
+   */
+  emitSanitizedDelta(safe) {
+    if (!safe.startsWith(this.emittedSanitizedText)) {
+      if (!this.streamDiverged) {
+        this.streamDiverged = true;
+        this.log.warn("sanitized text no longer extends the streamed text; streaming paused", {
+          streamed: this.emittedSanitizedText.length,
+          now: safe.length
+        });
+      }
+      return;
+    }
+    const sanitizedDelta = safe.slice(this.emittedSanitizedText.length);
+    if (sanitizedDelta.length === 0) return;
+    this.emittedSanitizedText = safe;
+    const agentMsg = {
+      role: "assistant",
+      content: [{ type: "text", text: safe }]
+    };
+    this.emit("agent-event", {
+      type: "message_update",
+      message: agentMsg,
+      _textDelta: sanitizedDelta
+    });
+  }
+  /**
+   * Send the tail {@link streamingSafeSanitize} held back while the message
+   * streamed. Once the message is complete nothing more can arrive, so only an
+   * unclosed leaked block stays cut ({@link finalizeStreamedText}). Without this
+   * a held-back tail (e.g. after an unclosed `[`) is lost: the consumer keeps
+   * only the deltas.
+   */
+  flushHeldBackText() {
+    if (this.emittedSanitizedText === "") return;
+    const final = finalizeStreamedText(this.prevText);
+    if (!final.startsWith(this.emittedSanitizedText)) {
+      this.log.warn("final sanitized text does not extend the streamed text; tail not sent", {
+        streamed: this.emittedSanitizedText.length,
+        final: final.length
       });
+      return;
     }
+    this.emitSanitizedDelta(final);
   }
   handleUserMessage(msg) {
     const toolResults = this.mapToolResults(msg);
@@ -2837,6 +3131,7 @@ var ClaudeSdkDriver = class extends AgentDriver {
     }
   }
   handleResultMessage(msg) {
+    this.resultEndedWakeOnly = this.selfTurns.resultEndsWakeOnly;
     this.captureResultUsage(msg);
     if (msg.subtype === "success" && !msg.is_error) {
       this.handleSuccessResult(msg);
@@ -2889,10 +3184,22 @@ var ClaudeSdkDriver = class extends AgentDriver {
     const reportedCostUsd = msg.total_cost_usd;
     this._lastCostReported = typeof reportedCostUsd === "number";
     const totalCostUsd = reportedCostUsd ?? 0;
-    const freshCostSession = this._querySpawnGeneration !== this._costTrackingGeneration || totalCostUsd < this._lastCumulativeCostUsd;
+    const staleRestore = this._staleRestoreFallback;
+    this._staleRestoreFallback = null;
+    if (staleRestore && totalCostUsd < this._lastCumulativeCostUsd && staleRestore.totalCostUSD <= totalCostUsd) {
+      this._lastCumulativeCostUsd = staleRestore.totalCostUSD;
+      this._lastCumulativeModelUsage = staleRestore.modelUsage;
+    } else if (staleRestore && staleRestore.totalCostUSD < this._lastCumulativeCostUsd) {
+      this.log.info("resumed spawn's transcript cost-state is below the booked total", {
+        bookedCostUsd: this._lastCumulativeCostUsd,
+        restoredCostUsd: staleRestore.totalCostUSD,
+        firstTotalCostUsd: totalCostUsd
+      });
+    }
+    const freshCostSession = totalCostUsd < this._lastCumulativeCostUsd;
     this._lastTurnCostUsd = freshCostSession ? totalCostUsd : totalCostUsd - this._lastCumulativeCostUsd;
     this._lastCumulativeCostUsd = totalCostUsd;
-    this._costTrackingGeneration = this._querySpawnGeneration;
+    this._costBaselineSessionId = this._lastCostReported ? this.sessionId || null : null;
     if (modelUsage) {
       this._lastModelUsage = diffModelUsage(
         modelUsage,
@@ -2957,7 +3264,7 @@ var ClaudeSdkDriver = class extends AgentDriver {
       this.emit("agent-event", this.withFailoverUsage(resultEvent));
     }
     const awaitingFollowUpThrow = looseMsg.is_error === true && errors.length === 0;
-    if (!this.turnCompleted && !awaitingFollowUpThrow) {
+    if (!this.turnCompleted && !awaitingFollowUpThrow && !this.resultEndedWakeOnly) {
       this.completeTurn();
     }
   }
@@ -3026,9 +3333,11 @@ var ClaudeSdkDriver = class extends AgentDriver {
       this.emit("agent-event", {
         type: "error",
         error: errorText,
-        detail
+        detail,
+        // A wake's error must not read as the end of a prompted turn still waiting for its answer.
+        ...this.selfTurns.stampsTerminal ? { selfStarted: true } : {}
       });
-    } else {
+    } else if (!this.resultEndedWakeOnly) {
       this.armErrorResultGrace(detail, {
         subtype: msg.subtype,
         terminalReason: msg.terminal_reason
@@ -3039,10 +3348,14 @@ var ClaudeSdkDriver = class extends AgentDriver {
   // ---------------------------------------------------------------------------
   // Helpers
   // ---------------------------------------------------------------------------
-  /** Build an SDKUserMessage for the persistent prompt stream. */
+  /**
+   * Build an SDKUserMessage for the persistent prompt stream. The uuid comes back
+   * stamped on the assistant messages of the turn that takes the prompt.
+   */
   buildUserMessage(text) {
     return {
       type: "user",
+      uuid: randomUUID(),
       message: {
         role: "user",
         content: text
@@ -3112,7 +3425,7 @@ var ClaudeSdkDriver = class extends AgentDriver {
    *   down outright — see {@link hardResetQuery}.
    */
   async abort() {
-    this.denyPendingQuestion("turn aborted before the question was answered");
+    this.denyAllPending("turn aborted before the question was answered");
     if (!this.running && this.query) return;
     const abortedQuery = this.query;
     const abortedController = this.abortController;
@@ -3152,7 +3465,7 @@ var ClaudeSdkDriver = class extends AgentDriver {
    * needs to be snapshotted before `query.close()` runs, not after.
    */
   kill() {
-    this.denyPendingQuestion("session terminated before the question was answered");
+    this.denyAllPending("session terminated before the question was answered");
     this.killed = true;
     if (this.turnReject) this.rejectTurnSilently(new Error(KILLED_TURN_MESSAGE));
     const descendants = this.snapshotDescendantPids();
@@ -3213,7 +3526,7 @@ var ClaudeSdkDriver = class extends AgentDriver {
     });
   }
   async resetSession() {
-    this.denyPendingQuestion("session reset before the question was answered");
+    this.denyAllPending("session reset before the question was answered");
     const descendants = this.snapshotDescendantPids();
     this.endInputStream();
     if (this.query) {
@@ -3237,7 +3550,8 @@ var ClaudeSdkDriver = class extends AgentDriver {
     this._lastCumulativeCostUsd = 0;
     this._lastTurnCostUsd = 0;
     this._lastCostReported = false;
-    this._costTrackingGeneration = -1;
+    this._costBaselineSessionId = null;
+    this._staleRestoreFallback = null;
   }
   /**
    * Build allowedTools / disallowedTools options from AgentConfig.tools.
@@ -3319,6 +3633,6 @@ var claudeSdkDriverTarget = {
   }).listModels()
 };
 
-export { ClaudeSdkDriver, claudeSdkDriverTarget, diffModelUsage };
+export { ClaudeSdkDriver, claudeSdkDriverTarget, diffModelUsage, withoutExpectedSdkWarnings };
 //# sourceMappingURL=claude-sdk.js.map
 //# sourceMappingURL=claude-sdk.js.map