@songsid/agend 2.1.4-beta.6 → 2.1.4-beta.61

package/dist/backend/claude-code.d.ts

@@ -1,4 +1,47 @@
 import { type CliBackend, type CliBackendConfig, type ErrorPattern, type RuntimeDialog, type StartupDialog } from "./types.js";
+/**
+ * Take `lockPath` via exclusive create, recording {pid, token} so a stale lock
+ * can be attributed. Returns the token to release with, or null when the lock
+ * could not be acquired within the retry budget.
+ *
+ * A held lock is NEVER auto-reclaimed. Reclaiming under concurrency cannot be
+ * made atomic with the primitives available (rename/link both leave a window
+ * where a reclaimed-and-reacquired live lock gets stolen), and every claude.json
+ * update is best-effort with a fallback — a skipped trust write is picked up by
+ * the startup-dialog dismisser. A lock left by a crashed holder therefore means
+ * skipped updates until it is removed manually (delete the .agend.lock file);
+ * the crash window is one writeFileSync inside a ~1ms critical section. When
+ * the recorded owner PID is verifiably dead we skip immediately instead of
+ * burning the whole retry budget waiting for a release that can never come.
+ */
+export declare function acquireClaudeJsonLock(lockPath: string, maxAttempts?: number): string | null;
+/** Release a lock taken by acquireClaudeJsonLock, only if we still own it. */
+export declare function releaseClaudeJsonLock(lockPath: string, token: string): void;
+/**
+ * Claude's session-resume prompt with the cursor on the destructive default
+ * (captured from the 2.1.261 binary: "❯ 1. Resume from summary (recommended)" /
+ * "  2. Resume full session as-is"). Anchored to the selector + option number so
+ * transcript prose quoting the sentence never matches.
+ */
+export declare const CLAUDE_RESUME_PROMPT_DEFAULT: RegExp;
+/**
+ * The resume prompt's two-option menu in ANY arrangement: two consecutive
+ * numbered "Resume …" rows. Matches the default shape too, so it must be
+ * ordered AFTER the exact entry; on its own it means "a resume menu we do not
+ * know how to navigate" — hold, never press.
+ */
+export declare const CLAUDE_RESUME_PROMPT_MENU: RegExp;
+/**
+ * Is the resume menu the CURRENT interactive region of the pane, and is the
+ * cursor on the destructive default? Bottom-anchored on purpose: the LAST pair
+ * of option rows must be followed only by the dialog's own footer (at most two
+ * rows) — a quoted capture of the menu in a transcript is followed by more
+ * transcript and, above all, by the real `❯` input row, so it is not active.
+ */
+export declare function claudeResumeMenuState(pane: string): {
+    active: boolean;
+    defaultCursor: boolean;
+};
 export declare class ClaudeCodeBackend implements CliBackend {
     private instanceDir;
     readonly binaryName = "claude";
@@ -23,20 +66,28 @@ export declare class ClaudeCodeBackend implements CliBackend {
     getReadyPattern(): RegExp;
     /**
      * The live spinner line, which is on screen only while generating. Captured from
-     * two running panes:
+     * running panes and their pipe-pane recordings:
      *
      *   working →  `✢ Accomplishing… (11m 26s · ↓ 38.0k tokens)`
      *   idle    →  `✻ Worked for 6m 49s`
      *
      * Both panes also showed `❯` and the `ok` statusline, which is why neither of
-     * those can carry the distinction. The discriminator is the ellipsis followed by
-     * a parenthesised live elapsed counter; the completed line is past tense with no
-     * `…` and no counter. The verb and the glyph both rotate, so neither is matched.
+     * those can carry the distinction. The discriminator is the rotating glyph plus
+     * Claude's one-word spinner label ending in an ellipsis. The completed line is
+     * past tense with no ellipsis. The verb and glyph both rotate, so neither
+     * specific value is matched.
      *
-     * The leading class is "any non-ASCII symbol, or an asterisk". It used to be
-     * `[^\x00-\x7F\p{L}\p{N}\s]` alone, requiring a non-ASCII glyph — but the
-     * animation cycles through six frames and one of them is a plain ASCII
-     * asterisk. Sampling a continuously working pane 50 times at 250ms:
+     * Claude Code 2.1.239 paints that line incrementally. For roughly the first
+     * three seconds — and briefly during later repaints — capture-pane can see only
+     * `* Nesting…` before `(3s · ↓ 9 tokens)` is appended. It also emits hyphenated
+     * labels such as `Razzle-dazzling…` and `Sock-hopping…`. Requiring the elapsed
+     * counter and a letters-only verb made both real shapes look idle. Since `❯`
+     * remains visible throughout generation, a settled capture in either shape
+     * retired Cancel and the progress bubble while the turn was still running.
+     *
+     * The animation cycles through six measured frames, including one plain ASCII
+     * asterisk. The older leading class required a non-ASCII glyph, so sampling a
+     * continuously working pane 50 times at 250ms produced:
      *
      *   ✻ 11/11   ✽ 10/10   ✢ 10/10   · 9/9   ✶ 4/4   * 0/6  ← U+002A never matched
      *
@@ -46,19 +97,13 @@ export declare class ClaudeCodeBackend implements CliBackend {
      * retired cancel buttons mid-turn. 12% of frames, so it hit some turns and not
      * others.
      *
-     * `*` is spelled out rather than opening the class to all ASCII punctuation:
-     * `> quoted… (2s)` in agent output would otherwise read as a spinner, and a
-     * false positive on a *stable* pane pins the instance in `working` forever.
-     * If a future release adds another ASCII frame this pattern misses it again —
-     * but a missed frame can no longer flip the state on its own, because the
-     * state machine only decides on patterns once output has settled.
-     *
-     * Deliberately narrow, because the cost is asymmetric. Missing the spinner just
-     * restores today's behaviour; matching prose that happens to sit on a *stable*
-     * pane would hold the instance in `working` forever — no auto-pause, no cancel
-     * button retirement, and eventually a bogus hang alert. So the line must start
-     * with a non-ASCII, non-letter glyph and carry a single word ending in `…`:
-     * `- Something… (5s)` and `I waited… (30s) for the build` are both rejected.
+     * Deliberately narrow, because the cost is asymmetric. Matching prose that
+     * happens to sit on a *stable* pane would hold the instance in `working`
+     * forever — no auto-pause, no cancel-button retirement, and eventually a bogus
+     * hang alert. Therefore this accepts only Claude's six measured spinner glyphs,
+     * exactly one word (optionally hyphenated), and the Unicode ellipsis. Markdown
+     * prose such as `* bullet point…`, `- Something…`, and a completed
+     * `✻ Worked for 6m 49s` remain rejected.
      *
      * Note when this actually decides anything: while the CLI really is generating,
      * the elapsed counter ticks, the pane changes, and motion already reports
@@ -79,14 +124,33 @@ export declare class ClaudeCodeBackend implements CliBackend {
     getEffortLevels(): string[];
     getModelSwitchStrategy(): "runtime" | "restart";
     listModels(): Promise<import("./types.js").ModelOption[]>;
+    /**
+     * Full account catalog from `GET /v1/models` using the same OAuth token the
+     * usage panel resolves. Each model also gets an `<id>[1m]` 1M-context
+     * variant: the API cannot say which plans may use it, so the variants are
+     * offered and a wrong pick surfaces through the model_error pattern above.
+     * Any failure (no token, network, non-200) degrades to [] — the static
+     * aliases from listModels() always remain available.
+     */
+    listApiModels(): Promise<import("./types.js").ModelOption[]>;
     probeCLIEnv(): Promise<{
         version: string | undefined;
         models: import("./types.js").ModelOption[];
+        apiModels: import("./types.js").ModelOption[];
     }>;
     cleanup(_config: CliBackendConfig): void;
-    /** Pre-approve ANTHROPIC_API_KEY in ~/.claude.json to skip the interactive prompt */
+    /**
+     * Pre-accept Claude Code's workspace trust dialog for this working directory.
+     * The interactive TUI blocks a fresh workspace on "Do you trust the files in
+     * this folder?" and nothing in tmux answers it, so the process exits and the
+     * instance crash-loops. No CLI flag skips it interactively (verified on
+     * 2.1.250 — only -p / non-TTY stdout bypass the dialog); the recognised
+     * signal is projects[<cwd>].hasTrustDialogAccepted in claude.json.
+     */
+    preTrust(workingDirectory: string): void;
+    /** Pre-approve ANTHROPIC_API_KEY in claude.json to skip the interactive prompt */
     private preApproveApiKey;
-    /** Check if user has an active OAuth session in ~/.claude.json */
+    /** Check if user has an active OAuth session in claude.json */
     private hasOAuthSession;
     private writeStatusLineScript;
 }

package/dist/backend/claude-code.js

@@ -1,5 +1,5 @@
-import { join, resolve } from "node:path";
-import { existsSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { resolveBinary, shellQuote, validateModel, warnIfModelMismatch } from "./types.js";
 /** Mirror Claude Code's ~/.claude/projects key for a working directory. */
@@ -23,6 +23,169 @@ function claudeProjectKey(cwd) {
     }
     return `${sanitized.slice(0, 200)}-${Math.abs(hash).toString(36)}`;
 }
+/** Claude Code's top-level config file, honoring CLAUDE_CONFIG_DIR. */
+function claudeJsonPath() {
+    const configDir = process.env.CLAUDE_CONFIG_DIR?.trim();
+    return configDir ? join(configDir, ".claude.json") : join(homedir(), ".claude.json");
+}
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * Take `lockPath` via exclusive create, recording {pid, token} so a stale lock
+ * can be attributed. Returns the token to release with, or null when the lock
+ * could not be acquired within the retry budget.
+ *
+ * A held lock is NEVER auto-reclaimed. Reclaiming under concurrency cannot be
+ * made atomic with the primitives available (rename/link both leave a window
+ * where a reclaimed-and-reacquired live lock gets stolen), and every claude.json
+ * update is best-effort with a fallback — a skipped trust write is picked up by
+ * the startup-dialog dismisser. A lock left by a crashed holder therefore means
+ * skipped updates until it is removed manually (delete the .agend.lock file);
+ * the crash window is one writeFileSync inside a ~1ms critical section. When
+ * the recorded owner PID is verifiably dead we skip immediately instead of
+ * burning the whole retry budget waiting for a release that can never come.
+ */
+export function acquireClaudeJsonLock(lockPath, maxAttempts = 40) {
+    const token = `${process.pid}.${Math.random().toString(16).slice(2)}`;
+    const payload = JSON.stringify({ pid: process.pid, token });
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        try {
+            writeFileSync(lockPath, payload, { flag: "wx", mode: 0o600 });
+            return token;
+        }
+        catch { /* already held — fall through to the holder check */ }
+        let ownerPid = null;
+        try {
+            ownerPid = Number(JSON.parse(readFileSync(lockPath, "utf-8")).pid) || null;
+        }
+        catch {
+            continue; /* vanished (retry the create now) or content not written yet (retry) */
+        }
+        if (ownerPid !== null) {
+            try {
+                process.kill(ownerPid, 0);
+            }
+            catch (err) {
+                // ESRCH = the holder is dead and will never release — give up now.
+                // EPERM means alive under another user: keep waiting like any holder.
+                if (err.code === "ESRCH")
+                    return null;
+            }
+        }
+        sleepSync(25);
+    }
+    return null;
+}
+/** Release a lock taken by acquireClaudeJsonLock, only if we still own it. */
+export function releaseClaudeJsonLock(lockPath, token) {
+    try {
+        const holder = JSON.parse(readFileSync(lockPath, "utf-8"));
+        if (holder.token === token)
+            unlinkSync(lockPath);
+    }
+    catch { /* already gone or replaced — nothing of ours to release */ }
+}
+/**
+ * Read-modify-write claude.json under a lock file, so concurrent instance
+ * spawns don't drop each other's updates, then replace it via atomic rename so
+ * a reader never sees a torn file. The file and its lock are created 0600 —
+ * claude.json holds OAuth account data, and the rename would otherwise replace
+ * the CLI's own 0600 file with the temp file's default 0644/umask mode.
+ * `mutate` returns false to skip the write. If the lock cannot be acquired the
+ * update is SKIPPED, never performed unlocked (last-write-wins against a
+ * concurrent holder could drop that holder's entry); an existing-but-
+ * unparseable file is likewise left untouched — never clobber the user's whole
+ * config over a parse error. Both give up to the getStartupDialogs() fallback.
+ */
+function updateClaudeJson(mutate) {
+    const path = claudeJsonPath();
+    // The parent must exist before both the lock create and the rename — on a
+    // fresh machine (no ~/.claude.json yet) an ENOENT here previously made every
+    // lock attempt fail, silently degrading to unlocked last-write-wins.
+    mkdirSync(dirname(path), { recursive: true });
+    const lockPath = `${path}.agend.lock`;
+    const token = acquireClaudeJsonLock(lockPath);
+    if (token === null)
+        return;
+    try {
+        let cfg = {};
+        let raw = null;
+        try {
+            raw = readFileSync(path, "utf-8");
+        }
+        catch { /* missing file — create a minimal one */ }
+        if (raw !== null) {
+            try {
+                const parsed = JSON.parse(raw);
+                if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                    return;
+                cfg = parsed;
+            }
+            catch {
+                return;
+            }
+        }
+        if (!mutate(cfg))
+            return;
+        const tempPath = join(dirname(path), `.claude.json.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`);
+        try {
+            writeFileSync(tempPath, JSON.stringify(cfg, null, 2), { flag: "wx", mode: 0o600 });
+            chmodSync(tempPath, 0o600); // mode above is masked by umask; make 0600 unconditional
+            renameSync(tempPath, path);
+        }
+        finally {
+            try {
+                unlinkSync(tempPath);
+            }
+            catch { /* already renamed */ }
+        }
+    }
+    finally {
+        releaseClaudeJsonLock(lockPath, token);
+    }
+}
+/**
+ * Claude's session-resume prompt with the cursor on the destructive default
+ * (captured from the 2.1.261 binary: "❯ 1. Resume from summary (recommended)" /
+ * "  2. Resume full session as-is"). Anchored to the selector + option number so
+ * transcript prose quoting the sentence never matches.
+ */
+export const CLAUDE_RESUME_PROMPT_DEFAULT = /^[ \t]*[❯›][ \t]*1\.[ \t]*Resume from summary \(recommended\)/m;
+/**
+ * The resume prompt's two-option menu in ANY arrangement: two consecutive
+ * numbered "Resume …" rows. Matches the default shape too, so it must be
+ * ordered AFTER the exact entry; on its own it means "a resume menu we do not
+ * know how to navigate" — hold, never press.
+ */
+export const CLAUDE_RESUME_PROMPT_MENU = /^[ \t]*[❯›]?[ \t]*\d\.[ \t]*Resume (?:full session as-is|from summary)[^\n]*\n[ \t]*[❯›]?[ \t]*\d\.[ \t]*Resume (?:full session as-is|from summary)/m;
+const RESUME_OPTION_ROW = /^[ \t]*[❯›]?[ \t]*\d\.[ \t]*Resume (?:full session as-is|from summary)/;
+const RESUME_DIALOG_FOOTER = /Enter to confirm|Esc to cancel|↑↓|to select|to navigate/i;
+/**
+ * Is the resume menu the CURRENT interactive region of the pane, and is the
+ * cursor on the destructive default? Bottom-anchored on purpose: the LAST pair
+ * of option rows must be followed only by the dialog's own footer (at most two
+ * rows) — a quoted capture of the menu in a transcript is followed by more
+ * transcript and, above all, by the real `❯` input row, so it is not active.
+ */
+export function claudeResumeMenuState(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n");
+    let start = -1;
+    for (let i = rows.length - 2; i >= 0; i--) {
+        if (RESUME_OPTION_ROW.test(rows[i]) && RESUME_OPTION_ROW.test(rows[i + 1])) {
+            start = i;
+            break;
+        }
+    }
+    if (start < 0)
+        return { active: false, defaultCursor: false };
+    const trailing = rows.slice(start + 2).filter(r => r.trim().length > 0);
+    const active = trailing.length <= 2 && trailing.every(r => RESUME_DIALOG_FOOTER.test(r));
+    const defaultCursor = /^[ \t]*[❯›][ \t]*1\.[ \t]*Resume from summary \(recommended\)/.test(rows[start]);
+    return { active, defaultCursor };
+}
+const resumeDefaultActive = (pane) => { const s = claudeResumeMenuState(pane); return s.active && s.defaultCursor; };
+const resumeMenuActive = (pane) => claudeResumeMenuState(pane).active;
 export class ClaudeCodeBackend {
     instanceDir;
     binaryName = "claude";
@@ -58,7 +221,7 @@ export class ClaudeCodeBackend {
         if (config.model) {
             const model = validateModel(config.model);
             warnIfModelMismatch("claude-code", model);
-            cmd += ` --model ${model}`;
+            cmd += ` --model ${shellQuote(model)}`;
         }
         // Additive system prompt: append fleet instructions without overriding Claude's built-in prompt
         const instrFile = join(this.instanceDir, "fleet-instructions.md");
@@ -123,20 +286,28 @@ export class ClaudeCodeBackend {
     }
     /**
      * The live spinner line, which is on screen only while generating. Captured from
-     * two running panes:
+     * running panes and their pipe-pane recordings:
      *
      *   working →  `✢ Accomplishing… (11m 26s · ↓ 38.0k tokens)`
      *   idle    →  `✻ Worked for 6m 49s`
      *
      * Both panes also showed `❯` and the `ok` statusline, which is why neither of
-     * those can carry the distinction. The discriminator is the ellipsis followed by
-     * a parenthesised live elapsed counter; the completed line is past tense with no
-     * `…` and no counter. The verb and the glyph both rotate, so neither is matched.
+     * those can carry the distinction. The discriminator is the rotating glyph plus
+     * Claude's one-word spinner label ending in an ellipsis. The completed line is
+     * past tense with no ellipsis. The verb and glyph both rotate, so neither
+     * specific value is matched.
      *
-     * The leading class is "any non-ASCII symbol, or an asterisk". It used to be
-     * `[^\x00-\x7F\p{L}\p{N}\s]` alone, requiring a non-ASCII glyph — but the
-     * animation cycles through six frames and one of them is a plain ASCII
-     * asterisk. Sampling a continuously working pane 50 times at 250ms:
+     * Claude Code 2.1.239 paints that line incrementally. For roughly the first
+     * three seconds — and briefly during later repaints — capture-pane can see only
+     * `* Nesting…` before `(3s · ↓ 9 tokens)` is appended. It also emits hyphenated
+     * labels such as `Razzle-dazzling…` and `Sock-hopping…`. Requiring the elapsed
+     * counter and a letters-only verb made both real shapes look idle. Since `❯`
+     * remains visible throughout generation, a settled capture in either shape
+     * retired Cancel and the progress bubble while the turn was still running.
+     *
+     * The animation cycles through six measured frames, including one plain ASCII
+     * asterisk. The older leading class required a non-ASCII glyph, so sampling a
+     * continuously working pane 50 times at 250ms produced:
      *
      *   ✻ 11/11   ✽ 10/10   ✢ 10/10   · 9/9   ✶ 4/4   * 0/6  ← U+002A never matched
      *
@@ -146,19 +317,13 @@ export class ClaudeCodeBackend {
      * retired cancel buttons mid-turn. 12% of frames, so it hit some turns and not
      * others.
      *
-     * `*` is spelled out rather than opening the class to all ASCII punctuation:
-     * `> quoted… (2s)` in agent output would otherwise read as a spinner, and a
-     * false positive on a *stable* pane pins the instance in `working` forever.
-     * If a future release adds another ASCII frame this pattern misses it again —
-     * but a missed frame can no longer flip the state on its own, because the
-     * state machine only decides on patterns once output has settled.
-     *
-     * Deliberately narrow, because the cost is asymmetric. Missing the spinner just
-     * restores today's behaviour; matching prose that happens to sit on a *stable*
-     * pane would hold the instance in `working` forever — no auto-pause, no cancel
-     * button retirement, and eventually a bogus hang alert. So the line must start
-     * with a non-ASCII, non-letter glyph and carry a single word ending in `…`:
-     * `- Something… (5s)` and `I waited… (30s) for the build` are both rejected.
+     * Deliberately narrow, because the cost is asymmetric. Matching prose that
+     * happens to sit on a *stable* pane would hold the instance in `working`
+     * forever — no auto-pause, no cancel-button retirement, and eventually a bogus
+     * hang alert. Therefore this accepts only Claude's six measured spinner glyphs,
+     * exactly one word (optionally hyphenated), and the Unicode ellipsis. Markdown
+     * prose such as `* bullet point…`, `- Something…`, and a completed
+     * `✻ Worked for 6m 49s` remain rejected.
      *
      * Note when this actually decides anything: while the CLI really is generating,
      * the elapsed counter ticks, the pane changes, and motion already reports
@@ -166,7 +331,7 @@ export class ClaudeCodeBackend {
      * an in-progress spinner — which is exactly the hang this is meant to surface.
      */
     getBusyPattern() {
-        return /^[ \t]*(?:[^\x00-\x7F\p{L}\p{N}\s]|\*)\s+\p{L}+…\s*\(\d+[hms]\b/mu;
+        return /^[ \t]*[✻✽✢·✶*][ \t]+\p{L}+(?:-\p{L}+)*…(?:[ \t]+\([^\n]*)?[ \t]*$/mu;
     }
     getContextUsage() {
         try {
@@ -192,18 +357,63 @@ export class ClaudeCodeBackend {
     getErrorPatterns() {
         return [
             { pattern: /API Error: Rate limit/i, type: "rate_limit", action: "failover", message: "API rate limit reached" },
-            { pattern: /Login expired|Not logged in|Please run \/login/i, type: "auth_error", action: "notify", message: "Claude login expired — needs re-login (/login)" },
+            // pause (not just notify): an auth-expired CLI keeps accepting queued work
+            // it can never answer. The pause is lifted by /login's post-success
+            // restart, and the lifecycle double-checks with the token-free probe first.
+            { pattern: /Login expired|Not logged in|Please run \/login/i, type: "auth_error", action: "pause", message: "Claude login expired — needs re-login (/login)" },
             { pattern: /API Error: Authentication/i, type: "auth_error", action: "pause", message: "Authentication error" },
+            // A bad /model choice previously failed silently (live-reported): the CLI
+            // prints these and idles without answering. notify (not restart): the
+            // session is healthy, only the model selection needs changing.
+            {
+                // Claude 2.1.250 emits `unrecognized_model` for an unknown ID and
+                // `model_access` / the plan sentence when the ID exists but the
+                // account is not entitled to it. Keep the prose alternatives narrow:
+                // the error monitor also sees normal conversation in pane scrollback.
+                pattern: /\[claude-code:(?:unrecognized_model|model_access)\]|There's an issue with the selected model|\bis not available on your [^\n]{0,80},\s*or ask your admin to enable this model/i,
+                type: "model_error",
+                action: "notify",
+                message: "Selected Claude model unavailable — Claude Code may be using a fallback; use /model to choose another",
+            },
             { pattern: /API Error: Overloaded/i, type: "rate_limit", action: "notify", message: "API overloaded" },
             { pattern: /credit balance is too low/i, type: "quota", action: "pause", message: "Insufficient API credits" },
         ];
     }
     getStartupDialogs() {
         return [
+            // A corrupt claude.json shows a modal whose only options are "1. Exit and
+            // fix manually" / "2. Reset with default configuration" (captured live on
+            // 2.1.250). Neither is dismissable in a useful direction: Enter exits
+            // (crash loop), reset wipes the user's config. The modal's ❯ selector
+            // would satisfy the ready pattern, so without this entry the instance
+            // reports ready and queued messages get typed into the modal. Must stay
+            // FIRST so no dismiss pattern grabs the pane before it.
+            {
+                pattern: /Configuration error[\s\S]{0,800}?contains invalid JSON/,
+                keys: [],
+                description: "Claude corrupt-config modal — not dismissable, reporting config_error",
+                fatal: { type: "config_error", action: "pause", message: "claude.json is corrupt — Claude Code cannot start. Fix or remove the file (Claude backs the corrupt copy up under <config>/backups/), then wake the instance." },
+            },
             // Session resume prompt must be checked BEFORE ready pattern, because ❯ in
             // "❯ 1. Resume from summary" would falsely match the ready pattern /❯/.
-            { pattern: /Resume from summary \(recommended\)/, keys: ["Down", "Enter"], description: "Claude session resume prompt — select 'Resume full session as-is'" },
+            // Only when the cursor is verifiably on option 1 ("❯ 1. Resume from
+            // summary (recommended)") do we know that Down+Enter lands on "Resume
+            // full session as-is". Any other shape is held by the guard below.
+            { pattern: CLAUDE_RESUME_PROMPT_DEFAULT, isActive: resumeDefaultActive, keys: ["Down", "Enter"], description: "Claude session resume prompt — select 'Resume full session as-is'", blocksDelivery: true },
+            // The same prompt in a shape we do not know how to navigate (cursor
+            // elsewhere, wording changed, options reordered): recognised by its
+            // two-option menu structure, never answered — a blind Enter would take
+            // the default and drop the full context. Hold the pane, report for a human.
+            { pattern: CLAUDE_RESUME_PROMPT_MENU, isActive: resumeMenuActive, keys: [], holdOnly: true, blocksDelivery: true, description: "Claude session resume prompt (unrecognised variant) — holding for a human, never auto-selecting" },
             { pattern: /[❯›]\s*\d+\.\s*No/m, keys: ["Down", "Enter"], description: "Claude 'No, exit' confirmation — navigate to Yes" },
+            // The 2.1.250 workspace-trust dialog has no numbered options — the cursor
+            // sits on "❯ No, exit" above "Yes, I trust this folder" (captured live).
+            // It must be matched BEFORE the generic /I trust/ Enter fallback below:
+            // that pattern also matches this screen's "Yes, I trust this folder" text,
+            // and a bare Enter there confirms "No, exit" — the dialog fallback itself
+            // used to exit the CLI. preTrust() normally prevents the dialog entirely;
+            // this is the recovery path when the config write was skipped.
+            { pattern: /[❯›]\s*No, exit/m, keys: ["Down", "Enter"], description: "Claude workspace trust dialog — navigate to 'Yes, I trust this folder'" },
             { pattern: /I accept|I trust/i, keys: ["Enter"], description: "Claude 'Yes, I accept' trust dialog" },
             { pattern: /Resume Session/i, keys: ["Escape"], description: "Claude resume session picker — start fresh" },
         ];
@@ -211,11 +421,24 @@ export class ClaudeCodeBackend {
     getRuntimeDialogs() {
         return [
             {
-                // Claude Code shows a session resume prompt when session is old/large.
+                // Claude Code shows a session resume prompt when session is old/large —
+                // sometimes only after loading the session, i.e. after the startup scan
+                // has already moved on, which is why it is in the runtime table too.
                 // Default cursor is on summary; move down to preserve the full context.
-                pattern: /Resume from summary \(recommended\)/,
+                pattern: CLAUDE_RESUME_PROMPT_DEFAULT,
+                isActive: resumeDefaultActive,
                 keys: ["Down", "Enter"],
                 description: "Claude session resume prompt — select 'Resume full session as-is'",
+                blocksDelivery: true,
+            },
+            // Same variant guard as getStartupDialogs: recognise, hold, report — never Enter.
+            {
+                pattern: CLAUDE_RESUME_PROMPT_MENU,
+                isActive: resumeMenuActive,
+                keys: [],
+                holdOnly: true,
+                blocksDelivery: true,
+                description: "Claude session resume prompt (unrecognised variant) — holding for a human, never auto-selecting",
             },
         ];
     }
@@ -241,39 +464,131 @@ export class ClaudeCodeBackend {
             { id: "Fable", label: "Fable", description: "Claude Fable 5" },
         ];
     }
+    /**
+     * Full account catalog from `GET /v1/models` using the same OAuth token the
+     * usage panel resolves. Each model also gets an `<id>[1m]` 1M-context
+     * variant: the API cannot say which plans may use it, so the variants are
+     * offered and a wrong pick surfaces through the model_error pattern above.
+     * Any failure (no token, network, non-200) degrades to [] — the static
+     * aliases from listModels() always remain available.
+     */
+    async listApiModels() {
+        try {
+            const { getClaudeOAuthToken } = await import("../usage/providers.js");
+            const token = await getClaudeOAuthToken();
+            if (!token)
+                return [];
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), 8_000);
+            timer.unref?.();
+            const res = await fetch("https://api.anthropic.com/v1/models?limit=100", {
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    "anthropic-version": "2023-06-01",
+                    "anthropic-beta": "oauth-2025-04-20",
+                },
+                signal: controller.signal,
+            });
+            clearTimeout(timer);
+            if (!res.ok)
+                return [];
+            const body = await res.json();
+            const options = [];
+            for (const model of body.data ?? []) {
+                if (!model.id)
+                    continue;
+                options.push({ id: model.id, label: model.id, ...(model.display_name ? { description: model.display_name } : {}) });
+                options.push({ id: `${model.id}[1m]`, label: `${model.id}[1m]`, description: "1M context — plan-dependent" });
+            }
+            return options;
+        }
+        catch {
+            return [];
+        }
+    }
     async probeCLIEnv() {
         const { probeCliVersion } = await import("./types.js");
-        return { version: probeCliVersion(this.binaryPath), models: await this.listModels() };
+        return {
+            version: probeCliVersion(this.binaryPath),
+            models: await this.listModels(),
+            apiModels: await this.listApiModels(),
+        };
     }
     cleanup(_config) {
         // mcp-config.json is in instance dir, cleaned up when instance is deleted
     }
-    /** Pre-approve ANTHROPIC_API_KEY in ~/.claude.json to skip the interactive prompt */
+    /**
+     * Pre-accept Claude Code's workspace trust dialog for this working directory.
+     * The interactive TUI blocks a fresh workspace on "Do you trust the files in
+     * this folder?" and nothing in tmux answers it, so the process exits and the
+     * instance crash-loops. No CLI flag skips it interactively (verified on
+     * 2.1.250 — only -p / non-TTY stdout bypass the dialog); the recognised
+     * signal is projects[<cwd>].hasTrustDialogAccepted in claude.json.
+     */
+    preTrust(workingDirectory) {
+        const cwd = workingDirectory?.trim();
+        if (!cwd)
+            return;
+        const literal = resolve(cwd);
+        let canonical = literal;
+        try {
+            canonical = realpathSync(literal);
+        }
+        catch { /* not created yet — trust the literal path */ }
+        // Trust both spellings when they differ: Claude keys projects by the cwd's
+        // realpath but falls back to the unresolved absolute path (see
+        // claudeProjectKey above), and which one the TUI sees depends on how tmux
+        // entered the directory.
+        const paths = canonical === literal ? [canonical] : [canonical, literal];
+        try {
+            updateClaudeJson(cfg => {
+                let projects = cfg.projects;
+                if (!projects || typeof projects !== "object" || Array.isArray(projects)) {
+                    projects = {};
+                    cfg.projects = projects;
+                }
+                let changed = false;
+                for (const p of paths) {
+                    const existing = projects[p];
+                    const entry = existing && typeof existing === "object" && !Array.isArray(existing)
+                        ? existing
+                        : {};
+                    if (entry.hasTrustDialogAccepted === true)
+                        continue;
+                    entry.hasTrustDialogAccepted = true;
+                    projects[p] = entry;
+                    changed = true;
+                }
+                return changed;
+            });
+        }
+        catch { /* best effort — startup dialog auto-dismiss remains the fallback */ }
+    }
+    /** Pre-approve ANTHROPIC_API_KEY in claude.json to skip the interactive prompt */
     preApproveApiKey(_config) {
         const apiKey = process.env.ANTHROPIC_API_KEY;
         if (!apiKey)
             return;
         const fingerprint = apiKey.length > 20 ? apiKey.slice(-20) : apiKey;
-        const claudeJsonPath = join(homedir(), ".claude.json");
-        let claudeCfg = {};
         try {
-            claudeCfg = JSON.parse(readFileSync(claudeJsonPath, "utf-8"));
-        }
-        catch { /* new file or parse error */ }
-        const existing = claudeCfg.customApiKeyResponses;
-        const approved = existing?.approved ?? [];
-        if (!approved.includes(fingerprint)) {
-            claudeCfg.customApiKeyResponses = {
-                approved: [...approved, fingerprint],
-                rejected: existing?.rejected ?? [],
-            };
-            writeFileSync(claudeJsonPath, JSON.stringify(claudeCfg, null, 2));
+            updateClaudeJson(cfg => {
+                const existing = cfg.customApiKeyResponses;
+                const approved = existing?.approved ?? [];
+                if (approved.includes(fingerprint))
+                    return false;
+                cfg.customApiKeyResponses = {
+                    approved: [...approved, fingerprint],
+                    rejected: existing?.rejected ?? [],
+                };
+                return true;
+            });
         }
+        catch { /* best effort — the startup prompt remains the fallback */ }
     }
-    /** Check if user has an active OAuth session in ~/.claude.json */
+    /** Check if user has an active OAuth session in claude.json */
     hasOAuthSession() {
         try {
-            const cfg = JSON.parse(readFileSync(join(homedir(), ".claude.json"), "utf-8"));
+            const cfg = JSON.parse(readFileSync(claudeJsonPath(), "utf-8"));
             return !!cfg.oauthAccount?.accountUuid;
         }
         catch {