agentbox-sdk 0.1.503 → 0.1.508

package/dist/{chunk-34LDITII.js → chunk-BO4J4KSM.js}

@@ -15,11 +15,12 @@ import {
   debugRelay,
   debugRuntime,
   debugSetup,
+  getAvailablePort,
   linesFromTextChunks,
   sleep,
   time,
   waitFor
-} from "./chunk-AVXJMCBC.js";
+} from "./chunk-MTQ2S46C.js";
 import {
   shellQuote
 } from "./chunk-NSJM57Z4.js";
@@ -29,16 +30,86 @@ import {
 } from "./chunk-GOFJNFAD.js";
 
 // src/agents/Agent.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
+import path11 from "path";
 
 // src/agents/providers/claude-code.ts
 import { randomUUID } from "crypto";
+
+// src/agents/transports/spawn.ts
+import { spawn } from "child_process";
+import { createInterface } from "readline";
+function spawnCommand(options) {
+  const child = spawn(options.command, options.args ?? [], {
+    cwd: options.cwd,
+    env: options.env,
+    stdio: "pipe",
+    shell: process.platform === "win32",
+    windowsHide: true,
+    detached: options.processGroup === true && process.platform !== "win32"
+  });
+  const exitPromise = new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("close", (code) => resolve(code ?? 0));
+  });
+  void exitPromise.catch(() => void 0);
+  let killPromise;
+  const signalProcess = (signal) => {
+    try {
+      if (options.processGroup && process.platform !== "win32" && child.pid) process.kill(-child.pid, signal);
+      else child.kill(signal);
+    } catch (error) {
+      if (error.code !== "ESRCH") throw error;
+    }
+  };
+  const waitForExit = async (timeoutMs) => {
+    let timer;
+    try {
+      return await Promise.race([
+        exitPromise.then(() => true, () => true),
+        new Promise((resolve) => {
+          timer = setTimeout(() => resolve(false), timeoutMs);
+        })
+      ]);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  };
+  return {
+    child,
+    wait: () => exitPromise,
+    kill: (signal = "SIGTERM") => killPromise ??= (async () => {
+      signalProcess(signal);
+      if (await waitForExit(options.terminationTimeoutMs ?? 3e3)) {
+        if (options.processGroup && process.platform !== "win32") signalProcess("SIGKILL");
+        return;
+      }
+      signalProcess("SIGKILL");
+      if (!await waitForExit(3e3)) throw new Error("The owned agent process did not stop");
+    })()
+  };
+}
+async function* linesFromNodeStream(stream) {
+  const lineReader = createInterface({ input: stream });
+  try {
+    for await (const line of lineReader) {
+      yield line;
+    }
+  } finally {
+    lineReader.close();
+  }
+}
+
+// src/agents/providers/claude-code.ts
 import path8 from "path";
 
 // src/agents/approval.ts
 function getApprovalMode(options) {
   return options.approvalMode ?? "auto";
 }
+function hasInteractiveQuestions(options) {
+  return options.interactiveQuestions ?? isInteractiveApproval(options);
+}
 function isInteractiveApproval(options) {
   return getApprovalMode(options) === "interactive";
 }
@@ -49,6 +120,58 @@ function shouldAutoApproveClaudeTools(options) {
   return !isInteractiveApproval(options);
 }
 
+// src/agents/questions.ts
+function record(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid agent question");
+  return value;
+}
+function text(value, max) {
+  if (typeof value !== "string" || !value.trim() || value.length > max) throw new Error("Invalid agent question text");
+  return value;
+}
+function normalizeUserQuestions(provider, input) {
+  const questions = record(input).questions;
+  if (!Array.isArray(questions) || !questions.length || questions.length > 10) throw new Error("Unsupported agent question count");
+  return questions.map((value, index) => {
+    const item = record(value);
+    if (item.isSecret === true) throw new Error("Secret questions cannot be answered through task history");
+    const options = item.options ?? [];
+    if (!Array.isArray(options) || options.length > 30) throw new Error("Unsupported agent question options");
+    const result = {
+      id: String(index),
+      question: text(item.question, 1e4),
+      ...item.header ? { header: text(item.header, 200) } : {},
+      options: options.map((value2) => {
+        const option = record(value2);
+        return { label: text(option.label, 1e3), ...option.description ? { description: text(option.description, 1e4) } : {} };
+      }),
+      multiple: provider === "claude-code" ? item.multiSelect === true : provider === "open-code" && item.multiple === true,
+      allowCustom: provider === "open-code" ? item.custom !== false : true
+    };
+    if (new Set(result.options.map((option) => option.label)).size !== result.options.length) throw new Error("Duplicate agent question options");
+    if (!result.options.length && !result.allowCustom) throw new Error("Agent question has no available answers");
+    return result;
+  });
+}
+function validateUserAnswers(questions, answers) {
+  if (!questions?.length || !answers || answers.length !== questions.length || new Set(answers.map((answer) => answer.questionId)).size !== answers.length) throw new Error("Answer each agent question once");
+  return questions.map((question) => {
+    const answer = answers.find((answer2) => answer2.questionId === question.id);
+    if (!answer || !Array.isArray(answer.values) || !answer.values.length || answer.values.length > (question.multiple ? 30 : 1)) throw new Error("Choose an answer for each question");
+    if (new Set(answer.values).size !== answer.values.length || answer.values.some((value) => typeof value !== "string" || !value.trim() || value.length > 1e4 || !question.allowCustom && !question.options.some((option) => option.label === value))) throw new Error("Invalid answer to agent question");
+    return { questionId: question.id, values: [...answer.values] };
+  });
+}
+function questionReply(provider, input, answers) {
+  const normalized = normalizeUserQuestions(provider, input);
+  const ordered = validateUserAnswers(normalized, answers);
+  if (provider === "open-code") return ordered.map((answer) => answer.values);
+  const original = record(input).questions;
+  const keys = original.map((item) => text(record(item)[provider === "codex" ? "id" : "question"], 1e4));
+  if (new Set(keys).size !== keys.length) throw new Error("Duplicate agent question IDs");
+  return Object.fromEntries(keys.map((key, index) => [key, provider === "codex" ? { answers: ordered[index].values } : ordered[index].values.join(", ")]));
+}
+
 // src/agents/input.ts
 import { readFile } from "fs/promises";
 import path from "path";
@@ -894,64 +1017,16 @@ function buildCodexConfigToml(opts = {}) {
 import { mkdir, chmod, rm, writeFile } from "fs/promises";
 import os from "os";
 import path4 from "path";
-
-// src/agents/transports/spawn.ts
-import { spawn } from "child_process";
-import { createInterface } from "readline";
-function spawnCommand(options) {
-  const child = spawn(options.command, options.args ?? [], {
-    cwd: options.cwd,
-    env: options.env,
-    stdio: "pipe",
-    shell: process.platform === "win32",
-    windowsHide: true
-  });
-  const exitPromise = new Promise((resolve, reject) => {
-    child.once("error", reject);
-    child.once("close", (code) => resolve(code ?? 0));
-  });
-  return {
-    child,
-    wait: () => exitPromise,
-    kill: async (signal = "SIGTERM") => {
-      child.kill(signal);
-      await exitPromise.catch(() => void 0);
-    }
-  };
-}
-async function waitForHttpReady(url, options) {
-  await waitFor(
-    async () => {
-      try {
-        const response = await fetch(url, options?.init);
-        return response.ok;
-      } catch {
-        return false;
-      }
-    },
-    {
-      timeoutMs: options?.timeoutMs,
-      intervalMs: options?.intervalMs
-    }
-  );
-}
-async function* linesFromNodeStream(stream) {
-  const lineReader = createInterface({ input: stream });
-  try {
-    for await (const line of lineReader) {
-      yield line;
-    }
-  } finally {
-    lineReader.close();
-  }
-}
-
-// src/agents/config/setup.ts
 function shortLabel(command) {
   const oneLine = command.replace(/\s+/g, " ").trim();
   return oneLine.length > 60 ? `${oneLine.slice(0, 60)}\u2026` : oneLine;
 }
-function agentboxRoot(provider, hasSandbox = true) {
+function agentboxRoot(provider, hasSandbox = true, stateDirectory) {
+  if (stateDirectory !== void 0) {
+    if (hasSandbox) throw new Error("stateDirectory is only supported for host execution.");
+    if (!path4.isAbsolute(stateDirectory)) throw new Error("stateDirectory must be an absolute path.");
+    return path4.join(stateDirectory, provider);
+  }
   return hasSandbox ? `/tmp/agentbox/${provider}` : path4.join(os.tmpdir(), `agentbox-${provider}`);
 }
 function getAgentLayout(rootDir) {
@@ -1004,9 +1079,9 @@ var HostSetupTarget = class {
       async () => {
         await Promise.all(
           files.map(async (entry) => {
-            await mkdir(path4.dirname(entry.path), { recursive: true });
+            await mkdir(path4.dirname(entry.path), { recursive: true, mode: 448 });
             const content = typeof entry.content === "string" ? entry.content : entry.content;
-            await writeFile(entry.path, content);
+            await writeFile(entry.path, content, { mode: entry.mode ?? 384 });
             if (entry.mode && (entry.mode & 73) !== 0) {
               await chmod(entry.path, entry.mode);
             }
@@ -1167,12 +1242,13 @@ async function createSetupTarget(provider, setupId, options) {
   return time(debugRuntime, `createSetupTarget ${provider}`, async () => {
     void setupId;
     const layout = getAgentLayout(
-      agentboxRoot(provider, Boolean(options.sandbox))
+      agentboxRoot(provider, Boolean(options.sandbox), options.stateDirectory)
     );
     if (options.sandbox) {
       return new SandboxSetupTarget(provider, layout, options);
     }
-    await mkdir(layout.homeDir, { recursive: true });
+    await mkdir(layout.homeDir, { recursive: true, mode: 448 });
+    await chmod(layout.homeDir, 448);
     await mkdir(layout.xdgConfigHome, { recursive: true });
     await mkdir(layout.agentsDir, { recursive: true });
     await mkdir(layout.claudeDir, { recursive: true });
@@ -1750,7 +1826,7 @@ function extractOpenCodeCostData(events) {
 }
 
 // src/agents/providers/claude-code.ts
-var DAEMON_PROTOCOL_VERSION = "3";
+var DAEMON_PROTOCOL_VERSION = "4";
 var DAEMON_PORT = 43180;
 var DAEMON_PATH = "/tmp/agentbox/claude-code/daemon.mjs";
 var DAEMON_LOG_PATH = "/tmp/agentbox/claude-code/daemon.log";
@@ -1760,7 +1836,7 @@ var DAEMON_READY_TIMEOUT_MS = 3e4;
 var DAEMON_READY_POLL_INTERVAL_MS = 250;
 function claudeConfigDir(options) {
   return path8.join(
-    agentboxRoot(AgentProvider.ClaudeCode, Boolean(options.sandbox)),
+    agentboxRoot(AgentProvider.ClaudeCode, Boolean(options.sandbox), options.stateDirectory),
     ".claude"
   );
 }
@@ -1768,7 +1844,7 @@ function buildClaudeQueryOptions(params) {
   const provider = params.request.options.provider;
   const run = params.request.run;
   const extraArgs = {
-    "mcp-config": params.mcpConfigPath
+    ...params.mcpConfigPath ? { "mcp-config": params.mcpConfigPath } : {}
   };
   for (const arg of provider?.args ?? []) {
     if (typeof arg !== "string") continue;
@@ -1785,7 +1861,11 @@ function buildClaudeQueryOptions(params) {
     cwd: params.cwd ?? params.request.options.cwd,
     env: params.env,
     pathToClaudeCodeExecutable: provider?.binary ?? "claude",
-    settings: params.settingsPath,
+    ...params.settingsPath ? { settings: params.settingsPath } : {},
+    ...params.request.options.configuration === "native" ? {
+      settingSources: ["user", "project", "local"],
+      systemPrompt: { type: "preset", preset: "claude_code" }
+    } : {},
     extraArgs,
     includePartialMessages: true,
     forwardSubagentText: true,
@@ -1794,8 +1874,8 @@ function buildClaudeQueryOptions(params) {
     ...provider?.additionalDirectories?.length ? { additionalDirectories: provider.additionalDirectories } : {},
     ...run.model ? { model: run.model } : {},
     ...effort ? { effort } : {},
-    ...provider?.permissionMode ? { permissionMode: provider.permissionMode } : {},
-    ...provider?.permissionMode === "bypassPermissions" ? { allowDangerouslySkipPermissions: true } : {},
+    ...run.mode === "plan" ? { permissionMode: "plan" } : params.request.options.fullAccess ? { permissionMode: "bypassPermissions" } : run.mode === "default" ? { permissionMode: "default" } : provider?.permissionMode ? { permissionMode: provider.permissionMode } : {},
+    ...params.request.options.fullAccess || provider?.permissionMode === "bypassPermissions" ? { allowDangerouslySkipPermissions: true } : {},
     ...provider?.allowedTools?.length ? { allowedTools: provider.allowedTools } : {},
     ...run.resumeSessionId ? { resume: run.resumeSessionId } : {},
     // Fork-at-message: claude-agent-sdk natively supports slicing a
@@ -1941,8 +2021,14 @@ function readJsonBody(req) {
   });
 }
 
-function autoApproveCanUseTool(_toolName, input) {
-  return { behavior: "allow", updatedInput: input };
+async function handlePermission(req, res, runId) {
+  const run = liveRuns.get(runId);
+  const body = await readJsonBody(req);
+  const resolve = run?.permissions.get(body.requestId);
+  if (!resolve) { res.writeHead(409); res.end("Request is no longer pending"); return; }
+  run.permissions.delete(body.requestId);
+  resolve(body.response);
+  res.writeHead(204); res.end();
 }
 
 async function handleStart(req, res, runId) {
@@ -1982,6 +2068,25 @@ async function handleStart(req, res, runId) {
   const opts = { ...(options || {}) };
   const autoApprove = !!opts.autoApproveTools;
   delete opts.autoApproveTools;
+  const interactiveQuestions = !!opts.interactiveQuestions;
+  delete opts.interactiveQuestions;
+  let planning = opts.permissionMode === "plan";
+  const permissions = new Map();
+  const clearPermissions = () => { for (const resolve of permissions.values()) resolve({ behavior: "deny", message: "Run ended", interrupt: true }); permissions.clear(); };
+  const canUseTool = async (toolName, input, context) => {
+    const isQuestion = toolName === "AskUserQuestion";
+    const isPlan = toolName === "ExitPlanMode";
+    if (context.signal.aborted) return { behavior: "deny", message: "Run cancelled", interrupt: true };
+    if ((isQuestion || isPlan) && !interactiveQuestions) return { behavior: "deny", message: "No interactive user is available." };
+    if (!isQuestion && !isPlan && planning && toolName !== "EnterPlanMode") return { behavior: "deny", message: "Finish planning before requesting write access." };
+    if (!isQuestion && !isPlan && autoApprove) return { behavior: "allow", updatedInput: input };
+    return new Promise((resolve) => {
+      const abort = () => { permissions.delete(context.toolUseID); resolve({ behavior: "deny", message: "Run cancelled", interrupt: true }); };
+      permissions.set(context.toolUseID, (response) => { context.signal.removeEventListener("abort", abort); if (isPlan && response.behavior === "allow") planning = false; resolve(response); });
+      context.signal.addEventListener("abort", abort, { once: true });
+      res.write(JSON.stringify({ _permission: { requestId: context.toolUseID, toolName, input, title: context.title } }) + "\\n");
+    });
+  };
   opts.pathToClaudeCodeExecutable = resolveClaudeBinary(
     opts.pathToClaudeCodeExecutable,
   );
@@ -2022,7 +2127,12 @@ async function handleStart(req, res, runId) {
       prompt: promptStream,
       options: {
         ...opts,
-        ...(autoApprove ? { canUseTool: autoApproveCanUseTool } : {}),
+        canUseTool,
+        hooks: { PreToolUse: [{ hooks: [async (input) => {
+          planning = input.permission_mode === "plan";
+          return interactiveQuestions && ["AskUserQuestion", "ExitPlanMode"].includes(input.tool_name)
+            ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "ask" } } : {};
+        }] }] },
       },
     });
   } catch (e) {
@@ -2032,11 +2142,12 @@ async function handleStart(req, res, runId) {
     return;
   }
 
-  liveRuns.set(runId, { query: queryHandle, prompt: promptStream });
+  liveRuns.set(runId, { query: queryHandle, prompt: promptStream, permissions });
 
   // Client disconnected (e.g. host process killed) \u2192 tear down.
   req.on("close", () => {
     clearInterval(heartbeat);
+    clearPermissions();
     if (!liveRuns.has(runId)) return;
     liveRuns.delete(runId);
     promptStream.end();
@@ -2052,6 +2163,7 @@ async function handleStart(req, res, runId) {
     res.write(JSON.stringify({ _error: String(e?.message ?? e) }) + "\\n");
   } finally {
     clearInterval(heartbeat);
+    clearPermissions();
     liveRuns.delete(runId);
     promptStream.end();
     res.end();
@@ -2119,6 +2231,11 @@ const server = http.createServer((req, res) => {
     return;
   }
   const url = req.url ?? "";
+  const permissionRoute = url.match(/^\\/runs\\/([^/]+)\\/permission$/);
+  if (req.method === "POST" && permissionRoute) {
+    handlePermission(req, res, decodeURIComponent(permissionRoute[1])).catch(() => { if (!res.headersSent) res.writeHead(400); res.end(); });
+    return;
+  }
   let m;
   if (req.method === "POST" && (m = url.match(/^\\/runs\\/([^/]+)\\/start$/))) {
     handleStart(req, res, decodeURIComponent(m[1]));
@@ -2355,15 +2472,11 @@ var ClaudeCodeAgentAdapter = class {
     ).catch(() => void 0);
   }
   async setup(request) {
+    if (request.options.configuration === "native") return;
     await time(debugClaude, "claude-code setup()", async () => {
       const options = request.options;
       const provider = request.provider;
       const sandbox = options.sandbox;
-      if (!sandbox) {
-        throw new Error(
-          "claude-code requires a sandbox (the SDK transport runs as a daemon inside the sandbox)."
-        );
-      }
       const target = await createSetupTarget(provider, "shared-setup", options);
       const settingsPath = path8.join(target.layout.claudeDir, "settings.json");
       const mcpConfigPath = path8.join(
@@ -2384,6 +2497,7 @@ var ClaudeCodeAgentAdapter = class {
       const claudeSettings = { ...hookSettings, ...workflowSettings };
       const mcpConfigJson = buildClaudeMcpConfig(options.mcps) ?? JSON.stringify({ mcpServers: {} }, null, 2);
       const artifacts = [
+        ...!sandbox ? [{ path: path8.join(target.layout.claudeDir, ".claude-plugin", "plugin.json"), content: JSON.stringify({ name: "agentbox", version: "1.0.0" }) }] : [],
         ...skillArtifacts,
         ...buildClaudeCommandArtifacts(options.commands, target.layout),
         ...buildClaudeSubagentArtifacts(options.subAgents, target.layout),
@@ -2394,11 +2508,11 @@ var ClaudeCodeAgentAdapter = class {
         { path: mcpConfigPath, content: mcpConfigJson }
       ];
       const enableRtk = options.enableRtk === true;
-      const daemonInfo = {
+      const daemonInfo = sandbox ? {
         port: DAEMON_PORT,
         healthPath: "/__version",
         expectedVersionMatch: DAEMON_PROTOCOL_VERSION
-      };
+      } : void 0;
       const setupId = computeSetupId({
         artifacts,
         installCommands,
@@ -2416,7 +2530,7 @@ var ClaudeCodeAgentAdapter = class {
           "applyDifferentialSetup",
           () => applyDifferentialSetup(target, artifacts, installCommands)
         ),
-        ensureClaudeCodeDaemon(options, env)
+        ...sandbox ? [ensureClaudeCodeDaemon(options, env)] : []
       ]);
       if (enableRtk) {
         await time(debugClaude, "activateRtk", () => activateRtk(target));
@@ -2428,11 +2542,7 @@ var ClaudeCodeAgentAdapter = class {
     const executeStartedAt = Date.now();
     debugClaude("execute() start runId=%s", request.runId);
     const sandbox = request.options.sandbox;
-    if (!sandbox) {
-      throw new Error(
-        "claude-code requires a sandbox (the SDK transport runs as a daemon inside the sandbox)."
-      );
-    }
+    if (!sandbox) return executeNativeClaude(request, sink);
     const claudeDir = claudeConfigDir(request.options);
     const settingsPath = path8.join(claudeDir, "settings.json");
     const mcpConfigPath = path8.join(claudeDir, "agentbox-mcp.json");
@@ -2489,7 +2599,8 @@ ${serialized}` : serialized;
         // already set `resume` for the resume path, so only stamp `sessionId` for
         // fresh runs.
         ...request.run.resumeSessionId ? {} : { sessionId: presetSessionId },
-        autoApproveTools
+        autoApproveTools,
+        interactiveQuestions: hasInteractiveQuestions(request.options)
       }
     };
     const fetchAbort = new AbortController();
@@ -2535,9 +2646,9 @@ ${serialized}` : serialized;
       })
     );
     if (!response.ok || !response.body) {
-      const text = await response.text().catch(() => "");
+      const text2 = await response.text().catch(() => "");
       throw new Error(
-        `claude-code daemon /start failed: ${response.status} ${text}`
+        `claude-code daemon /start failed: ${response.status} ${text2}`
       );
     }
     sink.setRaw({ baseUrl, runId: request.runId, claudeDir });
@@ -2554,199 +2665,22 @@ ${serialized}` : serialized;
         { messageId: initialUuid }
       )
     );
-    let accumulatedText = "";
-    let streamedThinkingChars = 0;
-    let pendingMessages = 1;
-    let firstStreamEventLogged = false;
-    let firstTextDeltaLogged = false;
-    let lastTerminalReason;
-    let lastIsError = false;
-    const rawPayloads = [];
-    try {
+    const permissionMessages = async function* () {
       for await (const item of parseNdjsonStream(response.body)) {
-        if (item && typeof item === "object") {
-          const ctrl = item;
-          if ("_error" in ctrl) {
-            throw new Error(
-              String(item._error ?? "daemon error")
-            );
-          }
-          if ("_notice" in ctrl) {
-            debugClaude("daemon notice: %o", ctrl);
-            sink.emitRaw(
-              toRawEvent(
-                request.runId,
-                ctrl,
-                `daemon.${String(ctrl._notice ?? "notice")}`
-              )
-            );
-            continue;
-          }
-        }
-        const message = item;
-        rawPayloads.push(message);
-        sink.emitRaw(toRawEvent(request.runId, message, message.type));
-        if (message.type === "system") {
-          const sub = message.subtype;
-          if (sub === "init") {
-            const sys = message;
-            if (sys.session_id) {
-              debugClaude(
-                "\u2605 session.init session_id=%s (%dms)",
-                sys.session_id.slice(0, 8),
-                Date.now() - executeStartedAt
-              );
-            }
-          } else if (sub === "hook_started") {
-            const h = message;
-            debugClaude(
-              "hook.started name=%s event=%s hook_id=%s",
-              h.hook_name,
-              h.hook_event,
-              h.hook_id
-            );
-          } else if (sub === "hook_response") {
-            const h = message;
-            const stderr = h.stderr && h.stderr.length > 0 ? h.stderr.replace(/\s+$/, "") : void 0;
-            debugClaude(
-              "hook.response name=%s exit=%s outcome=%s%s",
-              h.hook_name,
-              h.exit_code,
-              h.outcome,
-              stderr ? ` stderr=${JSON.stringify(stderr).slice(0, 200)}` : ""
-            );
-          }
-          continue;
-        }
-        if (message.type === "stream_event") {
-          if (!firstStreamEventLogged) {
-            firstStreamEventLogged = true;
-            debugClaude(
-              "\u2605 first stream_event (%dms since execute start)",
-              Date.now() - executeStartedAt
-            );
-          }
-          const partial = message;
-          if (partial.parent_tool_use_id) continue;
-          const streamType = partial.event?.type;
-          if (streamType === "message_start") {
-            accumulatedText = "";
-            streamedThinkingChars = 0;
-          }
-          const { text, thinking } = extractStreamDeltas(partial);
-          if (thinking) {
-            streamedThinkingChars += thinking.length;
-            sink.emitEvent(
-              createNormalizedEvent(
-                "reasoning.delta",
-                { provider: request.provider, runId: request.runId },
-                { delta: thinking }
-              )
-            );
-          }
-          if (text) {
-            if (!firstTextDeltaLogged) {
-              firstTextDeltaLogged = true;
-              debugClaude(
-                "\u2605 first text delta (%dms since execute start)",
-                Date.now() - executeStartedAt
-              );
-            }
-            accumulatedText += text;
-            sink.emitEvent(
-              createNormalizedEvent(
-                "text.delta",
-                { provider: request.provider, runId: request.runId },
-                { delta: text }
-              )
-            );
-          }
-          continue;
-        }
-        if (message.type === "assistant") {
-          const asst = message;
-          if (asst.parent_tool_use_id) continue;
-          const thinking = extractAssistantThinking(asst);
-          if (thinking && streamedThinkingChars === 0) {
-            sink.emitEvent(
-              createNormalizedEvent(
-                "reasoning.delta",
-                { provider: request.provider, runId: request.runId },
-                { delta: thinking }
-              )
-            );
-          }
-          const text = extractAssistantText(asst);
-          sink.emitEvent(
-            createNormalizedEvent(
-              "message.completed",
-              { provider: request.provider, runId: request.runId },
-              {
-                text,
-                ...asst.uuid ? { messageId: String(asst.uuid) } : {}
-              }
-            )
-          );
-          continue;
-        }
-        if (message.type === "result") {
-          const result = message;
-          lastTerminalReason = result.terminal_reason;
-          lastIsError = result.is_error;
-          const resultText = result.subtype === "success" ? result.result : accumulatedText;
-          if (resultText && resultText !== accumulatedText) {
-            accumulatedText = resultText;
-          }
-          pendingMessages--;
-          if (pendingMessages <= 0) break;
+        const control = item;
+        if (!control._permission) {
+          yield item;
           continue;
         }
+        const ask = control._permission;
+        const isQuestion = ask.toolName === "AskUserQuestion";
+        const isPlan = ask.toolName === "ExitPlanMode";
+        const answer = await sink.requestPermission({ type: "permission.requested", provider: request.provider, runId: request.runId, timestamp: (/* @__PURE__ */ new Date()).toISOString(), requestId: ask.requestId, kind: isQuestion ? "question" : isPlan ? "plan" : "tool", toolName: ask.toolName, title: isQuestion ? "Your input is needed" : isPlan ? "Review the plan" : ask.title ?? `Allow ${ask.toolName}?`, input: ask.input, ...isQuestion ? { questions: normalizeUserQuestions("claude-code", ask.input) } : {} });
+        const reply = await fetch(`${baseUrl}/runs/${encodeURIComponent(request.runId)}/permission`, { method: "POST", headers: { "content-type": "application/json", ...authHeaders }, signal: fetchAbort.signal, body: JSON.stringify({ requestId: ask.requestId, response: answer.decision === "allow" ? { behavior: "allow", updatedInput: isQuestion ? { ...ask.input, answers: questionReply("claude-code", ask.input, answer.answers ?? []) } : ask.input } : { behavior: "deny", message: "The user declined this request." } }) });
+        if (!reply.ok) throw new Error(`Claude permission response failed: ${reply.status}`);
       }
-      const finalText = accumulatedText;
-      const isCancelled = lastTerminalReason === "aborted_streaming" || lastTerminalReason === "aborted_tools";
-      const isError = !isCancelled && lastIsError;
-      if (isCancelled) {
-        debugClaude(
-          "\u2605 run.cancelled (%dms since execute start) reason=%s",
-          Date.now() - executeStartedAt,
-          lastTerminalReason
-        );
-        sink.cancel({
-          text: finalText,
-          costData: extractClaudeCostData(rawPayloads)
-        });
-      } else if (isError) {
-        debugClaude(
-          "\u2605 run.error (%dms since execute start) reason=%s",
-          Date.now() - executeStartedAt,
-          lastTerminalReason
-        );
-        sink.fail(
-          new Error(
-            finalText || `claude-code run failed (terminal_reason: ${lastTerminalReason})`
-          )
-        );
-      } else {
-        debugClaude(
-          "\u2605 run.completed (%dms since execute start) chars=%d",
-          Date.now() - executeStartedAt,
-          finalText.length
-        );
-        sink.emitEvent(
-          createNormalizedEvent(
-            "run.completed",
-            { provider: request.provider, runId: request.runId },
-            { text: finalText }
-          )
-        );
-        sink.complete({
-          text: finalText,
-          costData: extractClaudeCostData(rawPayloads)
-        });
-      }
-    } finally {
-      fetchAbort.abort();
-    }
+    };
+    await consumeClaudeMessages(request, sink, permissionMessages(), executeStartedAt, cleanup);
     return async () => void 0;
   }
   /**
@@ -2807,6 +2741,319 @@ ${serialized}` : serialized;
     }
   }
 };
+async function consumeClaudeMessages(request, sink, messages, executeStartedAt, cleanup, wasCancelled = () => false) {
+  let accumulatedText = "";
+  let streamedThinkingChars = 0;
+  let pendingMessages = 1;
+  let sawResult = false;
+  let firstStreamEventLogged = false;
+  let firstTextDeltaLogged = false;
+  let lastTerminalReason;
+  let lastIsError = false;
+  const rawPayloads = [];
+  try {
+    for await (const item of messages) {
+      if (item && typeof item === "object") {
+        const ctrl = item;
+        if ("_error" in ctrl) {
+          throw new Error(
+            String(item._error ?? "daemon error")
+          );
+        }
+        if ("_notice" in ctrl) {
+          debugClaude("daemon notice: %o", ctrl);
+          sink.emitRaw(
+            toRawEvent(
+              request.runId,
+              ctrl,
+              `daemon.${String(ctrl._notice ?? "notice")}`
+            )
+          );
+          continue;
+        }
+      }
+      const message = item;
+      rawPayloads.push(message);
+      sink.emitRaw(toRawEvent(request.runId, message, message.type));
+      if (message.type === "system") {
+        const sub = message.subtype;
+        if (sub === "init") {
+          const sys = message;
+          if (request.run.goal && !sys.slash_commands.some((command) => command.replace(/^\//, "") === "goal")) {
+            await cleanup();
+            throw new Error("This Claude Code installation does not expose the native /goal command.");
+          }
+          if (sys.session_id) {
+            debugClaude(
+              "\u2605 session.init session_id=%s (%dms)",
+              sys.session_id.slice(0, 8),
+              Date.now() - executeStartedAt
+            );
+          }
+        } else if (sub === "hook_started") {
+          const h = message;
+          debugClaude(
+            "hook.started name=%s event=%s hook_id=%s",
+            h.hook_name,
+            h.hook_event,
+            h.hook_id
+          );
+        } else if (sub === "hook_response") {
+          const h = message;
+          const stderr = h.stderr && h.stderr.length > 0 ? h.stderr.replace(/\s+$/, "") : void 0;
+          debugClaude(
+            "hook.response name=%s exit=%s outcome=%s%s",
+            h.hook_name,
+            h.exit_code,
+            h.outcome,
+            stderr ? ` stderr=${JSON.stringify(stderr).slice(0, 200)}` : ""
+          );
+        }
+        continue;
+      }
+      if (message.type === "stream_event") {
+        if (!firstStreamEventLogged) {
+          firstStreamEventLogged = true;
+          debugClaude(
+            "\u2605 first stream_event (%dms since execute start)",
+            Date.now() - executeStartedAt
+          );
+        }
+        const partial = message;
+        if (partial.parent_tool_use_id) continue;
+        const streamType = partial.event?.type;
+        if (streamType === "message_start") {
+          accumulatedText = "";
+          streamedThinkingChars = 0;
+        }
+        const { text: text2, thinking } = extractStreamDeltas(partial);
+        if (thinking) {
+          streamedThinkingChars += thinking.length;
+          sink.emitEvent(
+            createNormalizedEvent(
+              "reasoning.delta",
+              { provider: request.provider, runId: request.runId },
+              { delta: thinking }
+            )
+          );
+        }
+        if (text2) {
+          if (!firstTextDeltaLogged) {
+            firstTextDeltaLogged = true;
+            debugClaude(
+              "\u2605 first text delta (%dms since execute start)",
+              Date.now() - executeStartedAt
+            );
+          }
+          accumulatedText += text2;
+          sink.emitEvent(
+            createNormalizedEvent(
+              "text.delta",
+              { provider: request.provider, runId: request.runId },
+              { delta: text2 }
+            )
+          );
+        }
+        continue;
+      }
+      if (message.type === "assistant") {
+        const asst = message;
+        if (asst.parent_tool_use_id) continue;
+        const thinking = extractAssistantThinking(asst);
+        if (thinking && streamedThinkingChars === 0) {
+          sink.emitEvent(
+            createNormalizedEvent(
+              "reasoning.delta",
+              { provider: request.provider, runId: request.runId },
+              { delta: thinking }
+            )
+          );
+        }
+        const text2 = extractAssistantText(asst);
+        sink.emitEvent(
+          createNormalizedEvent(
+            "message.completed",
+            { provider: request.provider, runId: request.runId },
+            {
+              text: text2,
+              ...asst.uuid ? { messageId: String(asst.uuid) } : {}
+            }
+          )
+        );
+        continue;
+      }
+      if (message.type === "result") {
+        sawResult = true;
+        const result = message;
+        lastTerminalReason = result.terminal_reason;
+        lastIsError = result.is_error;
+        const resultText = result.subtype === "success" ? result.result : accumulatedText;
+        if (resultText && resultText !== accumulatedText) {
+          accumulatedText = resultText;
+        }
+        pendingMessages--;
+        if (pendingMessages <= 0) break;
+        continue;
+      }
+    }
+    await cleanup();
+    if (!sawResult && !wasCancelled()) throw new Error("Claude Code closed before reporting a result");
+    const finalText = accumulatedText;
+    const isCancelled = wasCancelled() || lastTerminalReason === "aborted_streaming" || lastTerminalReason === "aborted_tools";
+    const isError = !isCancelled && lastIsError;
+    if (isCancelled) {
+      debugClaude(
+        "\u2605 run.cancelled (%dms since execute start) reason=%s",
+        Date.now() - executeStartedAt,
+        lastTerminalReason
+      );
+      sink.cancel({
+        text: finalText,
+        costData: extractClaudeCostData(rawPayloads)
+      });
+    } else if (isError) {
+      debugClaude(
+        "\u2605 run.error (%dms since execute start) reason=%s",
+        Date.now() - executeStartedAt,
+        lastTerminalReason
+      );
+      sink.fail(
+        new Error(
+          finalText || `claude-code run failed (terminal_reason: ${lastTerminalReason})`
+        )
+      );
+    } else {
+      debugClaude(
+        "\u2605 run.completed (%dms since execute start) chars=%d",
+        Date.now() - executeStartedAt,
+        finalText.length
+      );
+      sink.emitEvent(
+        createNormalizedEvent(
+          "run.completed",
+          { provider: request.provider, runId: request.runId },
+          { text: finalText }
+        )
+      );
+      sink.complete({
+        text: finalText,
+        costData: extractClaudeCostData(rawPayloads)
+      });
+    }
+  } finally {
+    await cleanup();
+  }
+}
+async function executeNativeClaude(request, sink) {
+  const { query } = await import("@anthropic-ai/claude-agent-sdk");
+  const claudeDir = claudeConfigDir(request.options);
+  const input = await validateProviderUserInput(request.provider, request.run.input);
+  const prompt = new AsyncQueue();
+  const sessionId = request.run.resumeSessionId ?? randomUUID();
+  const controller = new AbortController();
+  let handle;
+  let processHandle;
+  let stopped;
+  let cancelled = false;
+  const stop = () => stopped ??= (async () => {
+    prompt.finish();
+    handle?.close();
+    controller.abort();
+    if (processHandle) await processHandle.kill();
+  })();
+  sink.setAbort(async () => {
+    cancelled = true;
+    await stop();
+  });
+  sink.setSessionId(sessionId);
+  const messageId = randomUUID();
+  prompt.push({ type: "user", uuid: messageId, message: { role: "user", content: mapToClaudeUserContent(input) }, parent_tool_use_id: null });
+  const hostEnv = Object.fromEntries(Object.entries({ ...process.env, ...request.options.env }).filter((entry) => entry[1] !== void 0));
+  if (request.options.customHeaders) {
+    const headers = Object.entries(request.options.customHeaders).map(([name, value]) => `${name}: ${value}`).join("\n");
+    hostEnv.ANTHROPIC_CUSTOM_HEADERS = [hostEnv.ANTHROPIC_CUSTOM_HEADERS, headers].filter(Boolean).join("\n");
+  }
+  const options = buildClaudeQueryOptions({
+    request,
+    ...request.options.configuration === "native" ? {} : {
+      settingsPath: path8.join(claudeDir, "settings.json"),
+      mcpConfigPath: path8.join(claudeDir, "agentbox-mcp.json")
+    },
+    // Auth is deliberately CLI-owned. Never copy the user's credential files
+    // into the generated configuration directory or a task artifact.
+    env: hostEnv
+  });
+  const autoApprove = shouldAutoApproveClaudeTools(request.options);
+  const interactiveQuestions = hasInteractiveQuestions(request.options);
+  let planning = options.permissionMode === "plan";
+  try {
+    handle = query({ prompt, options: {
+      ...options,
+      // Use the SDK-matched CLI by default; an installed CLI is an explicit override.
+      pathToClaudeCodeExecutable: request.options.provider?.binary,
+      abortController: controller,
+      // `sessionId` is rejected alongside `resume` unless `forkSession` is
+      // set, where it names the forked session. Stamping it on forks keeps
+      // the pre-minted id reported via `sink.setSessionId` truthful, so a
+      // later run can resume the fork.
+      ...request.run.resumeSessionId ? {} : { sessionId },
+      ...request.options.configuration === "native" ? {} : { plugins: [{ type: "local", path: claudeDir }] },
+      spawnClaudeCodeProcess(spawnOptions) {
+        if (cancelled || controller.signal.aborted) throw new Error("Local run was cancelled before startup");
+        processHandle = spawnCommand({ ...spawnOptions, processGroup: request.options.processGroup !== "inherited" });
+        return processHandle.child;
+      },
+      hooks: { ...options.hooks, PreToolUse: [...options.hooks?.PreToolUse ?? [], { hooks: [async (input2) => {
+        if (input2.hook_event_name !== "PreToolUse") return {};
+        planning = input2.permission_mode === "plan";
+        return interactiveQuestions && ["AskUserQuestion", "ExitPlanMode"].includes(input2.tool_name) ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "ask" } } : {};
+      }] }] },
+      async canUseTool(toolName, input2, context) {
+        if (cancelled || context.signal.aborted) return { behavior: "deny", message: "Run cancelled", interrupt: true };
+        const isQuestion = toolName === "AskUserQuestion";
+        const isPlan = toolName === "ExitPlanMode";
+        if ((isQuestion || isPlan) && !interactiveQuestions) return { behavior: "deny", message: "No interactive user is available." };
+        if (!isQuestion && !isPlan && planning && toolName !== "EnterPlanMode") return { behavior: "deny", message: "Finish planning before requesting write access." };
+        if (!isQuestion && !isPlan && autoApprove) return { behavior: "allow", updatedInput: input2 };
+        try {
+          const response = await sink.requestPermission({
+            type: "permission.requested",
+            provider: request.provider,
+            runId: request.runId,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            requestId: context.toolUseID,
+            kind: isQuestion ? "question" : isPlan ? "plan" : "tool",
+            toolName,
+            ...isQuestion ? { questions: normalizeUserQuestions("claude-code", input2) } : {},
+            title: isQuestion ? "Your input is needed" : isPlan ? "Review the plan" : context.title ?? `Allow ${toolName}?`,
+            message: context.description ?? context.decisionReason,
+            input: input2,
+            canRemember: false
+          });
+          if (isPlan && response.decision === "allow") planning = false;
+          if (!cancelled && !context.signal.aborted && response.decision === "allow") return {
+            behavior: "allow",
+            updatedInput: isQuestion ? { ...input2, answers: questionReply("claude-code", input2, response.answers ?? []) } : input2
+          };
+          return { behavior: "deny", message: "The user denied this action" };
+        } catch {
+          return { behavior: "deny", message: "Run cancelled", interrupt: true };
+        }
+      }
+    } });
+    sink.setRaw({ query: handle, claudeDir, runId: request.runId });
+    sink.emitEvent(createNormalizedEvent("run.started", { provider: request.provider, runId: request.runId }));
+    sink.emitEvent(createNormalizedEvent("message.started", { provider: request.provider, runId: request.runId }, { messageId }));
+    await consumeClaudeMessages(request, sink, handle, Date.now(), stop, () => cancelled);
+  } catch (error) {
+    await stop();
+    if (cancelled) sink.cancel();
+    else throw error;
+  } finally {
+    await stop();
+  }
+  return stop;
+}
 
 // src/agents/providers/codex.ts
 import crypto2 from "crypto";
@@ -2820,16 +3067,16 @@ async function fetchJson(url, init) {
   if (!response.ok) {
     throw new Error(`Request to ${url} failed with ${response.status}.`);
   }
-  const text = await response.text();
-  if (text.length === 0) {
+  const text2 = await response.text();
+  if (text2.length === 0) {
     throw new Error(
       `Request to ${url} returned status ${response.status} with an empty body.`
     );
   }
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch (error) {
-    const preview = text.length > 200 ? `${text.slice(0, 200)}\u2026` : text;
+    const preview = text2.length > 200 ? `${text2.slice(0, 200)}\u2026` : text2;
     const cause = error instanceof Error ? error.message : String(error);
     throw new Error(
       `Could not parse JSON response from ${url} (status ${response.status}): ${cause}. Body: ${preview}`
@@ -3030,7 +3277,7 @@ var JsonRpcLineClient = class {
 // src/agents/providers/codex.ts
 function codexConfigDir(options) {
   return path9.join(
-    agentboxRoot(AgentProvider.Codex, Boolean(options.sandbox)),
+    agentboxRoot(AgentProvider.Codex, Boolean(options.sandbox), options.stateDirectory),
     ".codex"
   );
 }
@@ -3097,20 +3344,20 @@ function compactEnv(values) {
   );
 }
 function buildCodexSandboxMode(options) {
-  return options.sandbox ? "workspace-write" : "read-only";
+  return options.fullAccess ? "danger-full-access" : options.provider?.sandboxMode ?? (options.configuration === "native" ? void 0 : options.sandbox ? "workspace-write" : "read-only");
 }
 function buildThreadParams(cwd, options, request) {
   return {
     cwd,
     model: request.run.model ?? null,
-    approvalPolicy: isInteractiveApproval(options) ? "untrusted" : "never",
+    ...options.configuration === "native" && !options.fullAccess ? {} : { approvalPolicy: !options.fullAccess && isInteractiveApproval(options) ? "untrusted" : "never" },
     sandbox: buildCodexSandboxMode(options),
     serviceName: "agentbox",
     // Persist the rollout on disk so follow-up runs can call `thread/resume`.
     // `ephemeral: true` threads have no rollout file and resume fails with
     // "no rollout found for thread id ...".
     experimentalRawEvents: true,
-    developerInstructions: request.run.systemPrompt ?? null
+    ...request.run.systemPrompt ? { developerInstructions: request.run.systemPrompt } : options.configuration === "native" ? {} : { developerInstructions: null }
   };
 }
 function buildResumeParams(cwd, options, request) {
@@ -3118,9 +3365,9 @@ function buildResumeParams(cwd, options, request) {
     threadId: request.run.resumeSessionId,
     cwd,
     model: request.run.model ?? null,
-    approvalPolicy: isInteractiveApproval(options) ? "untrusted" : "never",
+    ...options.configuration === "native" && !options.fullAccess ? {} : { approvalPolicy: !options.fullAccess && isInteractiveApproval(options) ? "untrusted" : "never" },
     sandbox: buildCodexSandboxMode(options),
-    developerInstructions: request.run.systemPrompt ?? null,
+    ...request.run.systemPrompt ? { developerInstructions: request.run.systemPrompt } : options.configuration === "native" ? {} : { developerInstructions: null },
     // We only need the thread id back; we never read `thread.turns`.
     // Without this Codex hydrates the full history into the response and
     // emits a `deprecationNotice` ("Full-history hydration is deprecated
@@ -3134,15 +3381,22 @@ function buildForkParams(cwd, options, request) {
     lastTurnId: request.run.forkAtMessageId ?? null,
     cwd,
     model: request.run.model ?? null,
-    approvalPolicy: isInteractiveApproval(options) ? "untrusted" : "never",
+    ...options.configuration === "native" && !options.fullAccess ? {} : { approvalPolicy: !options.fullAccess && isInteractiveApproval(options) ? "untrusted" : "never" },
     sandbox: buildCodexSandboxMode(options),
-    developerInstructions: request.run.systemPrompt ?? null,
+    ...request.run.systemPrompt ? { developerInstructions: request.run.systemPrompt } : options.configuration === "native" ? {} : { developerInstructions: null },
     excludeTurns: true
   };
 }
 function buildTurnSandboxPolicy(options) {
+  if (options.fullAccess || options.provider?.sandboxMode === "danger-full-access") return { type: "dangerFullAccess" };
   if (!options.sandbox) {
-    return void 0;
+    if (buildCodexSandboxMode(options) === void 0) return void 0;
+    if (buildCodexSandboxMode(options) === "read-only") return void 0;
+    return {
+      type: "workspaceWrite",
+      networkAccess: options.provider?.networkAccess ?? false,
+      ...options.provider?.writableRoots?.length ? { writableRoots: options.provider.writableRoots } : {}
+    };
   }
   if (options.sandbox.provider === SandboxProvider.LocalDocker) {
     return {
@@ -3161,10 +3415,16 @@ function buildCodexTurnStartParams(params) {
   return {
     threadId,
     input: inputItems,
-    approvalPolicy: isInteractiveApproval(request.options) ? "untrusted" : "never",
+    ...request.options.configuration === "native" && !request.options.fullAccess ? {} : {
+      approvalPolicy: !request.options.fullAccess && isInteractiveApproval(request.options) ? "untrusted" : "never"
+    },
     ...sandboxPolicy ? { sandboxPolicy } : {},
     model: request.run.model ?? null,
     effort: request.run.reasoning ?? null,
+    ...request.run.mode ? { collaborationMode: {
+      mode: request.run.mode,
+      settings: { model: request.run.model, reasoning_effort: request.run.reasoning ?? null, developer_instructions: null }
+    } } : {},
     outputSchema: null
   };
 }
@@ -3189,7 +3449,7 @@ function buildCodexCommandArgs(binary, args, options) {
     overrides.push(["supports_websockets", "false"]);
   }
   const overrideArgs = overrides.flatMap(([k, v]) => ["-c", `${k}=${v}`]);
-  return ["-u", "XDG_CONFIG_HOME", binary, ...overrideArgs, ...args];
+  return [...options?.configuration === "native" ? [] : ["-u", "XDG_CONFIG_HOME"], binary, ...overrideArgs, ...args];
 }
 function toNormalizedCodexEvents(runId, notification) {
   const base = {
@@ -3261,8 +3521,8 @@ function toNormalizedCodexEvents(runId, notification) {
   }
   if (notification.method === "turn/completed") {
     const turn = notification.params?.turn;
-    const text = typeof turn?.lastAgentMessage === "string" ? turn.lastAgentMessage : void 0;
-    return [createNormalizedEvent("run.completed", base, { text })];
+    const text2 = typeof turn?.lastAgentMessage === "string" ? turn.lastAgentMessage : void 0;
+    return [createNormalizedEvent("run.completed", base, { text: text2 })];
   }
   if (notification.method === "error") {
     const error = notification.params?.error;
@@ -3274,7 +3534,7 @@ function toNormalizedCodexEvents(runId, notification) {
   }
   return [];
 }
-function createCodexPermissionEvent(request, notification) {
+function createCodexPermissionEvent(request, notification, fileChanges) {
   const raw = toRawEvent2(request.runId, notification, notification.method);
   const params = notification.params;
   const requestId = notification.id;
@@ -3317,7 +3577,7 @@ function createCodexPermissionEvent(request, notification) {
         kind: "file-change",
         title: "Approve file changes",
         message: typeof params.reason === "string" ? params.reason : "Codex wants to modify files.",
-        input: params,
+        input: fileChanges ? { ...params, changes: fileChanges } : params,
         canRemember: availableDecisions.includes("acceptForSession")
       }
     );
@@ -3371,7 +3631,7 @@ async function materializeCodexImage(options, part, index) {
   if (data.length === 0) {
     throw new Error("Cannot attach an empty image to Codex.");
   }
-  const root = agentboxRoot(AgentProvider.Codex, Boolean(options.sandbox));
+  const root = agentboxRoot(AgentProvider.Codex, Boolean(options.sandbox), options.stateDirectory);
   const imagePath = path9.join(
     root,
     "inputs",
@@ -3518,6 +3778,7 @@ async function connectRemoteCodexAppServer(url, headers = {}) {
 }
 async function setupCodex(request) {
   const options = request.options;
+  if (options.configuration === "native") return;
   const provider = request.provider;
   const hooks = assertHooksSupported(provider, options);
   assertCommandsSupported(provider, options.commands);
@@ -3715,10 +3976,10 @@ async function createRuntime(request, inputParts) {
   const codexDir = codexConfigDir(options);
   const env = compactEnv({
     ...options.env ?? {},
-    CODEX_HOME: codexDir,
+    ...options.configuration === "native" ? {} : { CODEX_HOME: codexDir },
     ...options.provider?.env ?? {}
   });
-  const runtimeCwd = path9.dirname(codexDir);
+  const runtimeCwd = options.configuration === "native" ? options.cwd : path9.dirname(codexDir);
   const inputItems = await buildCodexInputItems(options, inputParts);
   const usesRemoteWebSocket = options.sandbox && options.sandbox.provider !== SandboxProvider.LocalDocker;
   if (usesRemoteWebSocket && options.sandbox) {
@@ -3788,6 +4049,7 @@ async function createRuntime(request, inputParts) {
     };
   }
   const processHandle = spawnCommand({
+    processGroup: options.processGroup !== "inherited",
     command: "env",
     args: codexArgs,
     cwd: runtimeCwd,
@@ -3796,6 +4058,7 @@ async function createRuntime(request, inputParts) {
       ...env
     }
   });
+  processHandle.child.stderr.resume();
   return {
     source: linesFromNodeStream(processHandle.child.stdout),
     writeLine: async (line) => {
@@ -3916,10 +4179,10 @@ var CodexAgentAdapter = class {
         throw new Error("Cannot send message before thread is started.");
       }
       const parts = normalizeUserInput(content);
-      const text = parts.filter((p) => p.type === "text").map((p) => p.text).join("");
+      const text2 = parts.filter((p) => p.type === "text").map((p) => p.text).join("");
       const inputItems = [];
-      if (text.trim().length > 0) {
-        inputItems.push({ type: "text", text, text_elements: [] });
+      if (text2.trim().length > 0) {
+        inputItems.push({ type: "text", text: text2, text_elements: [] });
       }
       const response = await client.request(
         "turn/start",
@@ -3935,6 +4198,8 @@ var CodexAgentAdapter = class {
     };
     sink.onMessage(sendTurn);
     const rawPayloads = [];
+    const pendingFileChanges = /* @__PURE__ */ new Map();
+    const fileItemKey = (params, itemId) => typeof params?.threadId === "string" && typeof params.turnId === "string" && typeof itemId === "string" ? `${params.threadId}:${params.turnId}:${itemId}` : void 0;
     let streamedText = "";
     const completion = new Promise((resolve, reject) => {
       void (async () => {
@@ -3951,15 +4216,39 @@ var CodexAgentAdapter = class {
           const raw = toRawEvent2(request.runId, message, message.method);
           rawPayloads.push(message);
           sink.emitRaw(raw);
-          if (message.method === "tool/requestUserInput" && message.id !== void 0) {
-            reject(
-              new Error(
-                "Codex tool/requestUserInput approvals are not yet supported by AgentBox."
-              )
-            );
-            return;
+          const item = message.params?.item;
+          const itemKey = fileItemKey(message.params, item?.id);
+          if (itemKey && item?.type === "fileChange") {
+            if (message.method === "item/completed") pendingFileChanges.delete(itemKey);
+            else if (message.method === "item/started" && Array.isArray(item.changes)) {
+              if (pendingFileChanges.size >= 128) pendingFileChanges.delete(pendingFileChanges.keys().next().value);
+              pendingFileChanges.set(itemKey, item.changes);
+            }
+          }
+          if ((message.method === "item/tool/requestUserInput" || message.method === "tool/requestUserInput") && message.id !== void 0) {
+            const questions = normalizeUserQuestions("codex", message.params);
+            const response = hasInteractiveQuestions(request.options) ? await sink.requestPermission(createNormalizedEvent("permission.requested", {
+              provider: request.provider,
+              runId: request.runId,
+              raw
+            }, {
+              requestId: String(message.id),
+              kind: "question",
+              toolName: "request_user_input",
+              title: "Your input is needed",
+              input: message.params,
+              questions,
+              canRemember: false
+            })) : void 0;
+            await client.respond(message.id, { answers: response?.decision === "allow" ? questionReply("codex", message.params, response.answers ?? []) : {} });
+            continue;
           }
-          const permissionEvent = createCodexPermissionEvent(request, message);
+          const approvalKey = fileItemKey(message.params, message.params?.itemId);
+          const permissionEvent = createCodexPermissionEvent(
+            request,
+            message,
+            approvalKey ? pendingFileChanges.get(approvalKey) : void 0
+          );
           if (permissionEvent && message.id !== void 0) {
             const response = interactiveApproval ? await sink.requestPermission(permissionEvent) : {
               requestId: permissionEvent.requestId,
@@ -3968,8 +4257,15 @@ var CodexAgentAdapter = class {
             await client.respond(message.id, {
               decision: toCodexApprovalDecision(message, response)
             });
+            if (approvalKey) pendingFileChanges.delete(approvalKey);
             continue;
           }
+          if (message.method === "item/completed") {
+            const item2 = message.params?.item;
+            if (item2?.type === "plan" && typeof item2.text === "string") {
+              sink.emitEvent(createNormalizedEvent("plan.completed", { provider: request.provider, runId: request.runId }, { text: item2.text }));
+            }
+          }
           for (const event of toNormalizedCodexEvents(request.runId, message)) {
             sink.emitEvent(event);
             if (event.type === "text.delta") {
@@ -4049,6 +4345,13 @@ var CodexAgentAdapter = class {
       sink.emitRaw(
         toRawEvent2(request.runId, threadResponse, threadResultEventName)
       );
+      if (request.run.mode) {
+        const modes = await client.request("collaborationMode/list", {});
+        if (!modes.data.some((mode) => mode.mode === request.run.mode)) throw new Error("This Codex installation does not support the requested planning mode.");
+      }
+      if (request.run.goal) {
+        await client.request("thread/goal/set", { threadId: threadResponse.thread.id, objective: request.run.goal, status: "active" });
+      }
       await client.request(
         "turn/start",
         buildCodexTurnStartParams({
@@ -4078,19 +4381,19 @@ var CodexAgentAdapter = class {
           sink.fail(completionError);
         }
       } else {
-        const { text, interrupted } = completionResult;
+        const { text: text2, interrupted } = completionResult;
         if (abortInvoked || interrupted) {
           debugCodex(
             "\u2605 run.cancelled (%dms since execute start) interrupted=%s",
             Date.now() - executeStartedAt,
             interrupted
           );
-          sink.cancel({ text, costData: extractCodexCostData(rawPayloads) });
+          sink.cancel({ text: text2, costData: extractCodexCostData(rawPayloads) });
         } else {
           debugCodex(
             "\u2605 run.completed (%dms since execute start) chars=%d",
             Date.now() - executeStartedAt,
-            text?.length ?? 0
+            text2?.length ?? 0
           );
           sink.complete({ costData: extractCodexCostData(rawPayloads) });
         }
@@ -4152,14 +4455,14 @@ var CodexAgentAdapter = class {
       );
     }
     const parts = normalizeUserInput(content);
-    const text = joinTextParts(
+    const text2 = joinTextParts(
       parts.filter(
         (part) => part.type === "text"
       )
     );
     const inputItems = [];
-    if (text.trim().length > 0) {
-      inputItems.push({ type: "text", text, text_elements: [] });
+    if (text2.trim().length > 0) {
+      inputItems.push({ type: "text", text: text2, text_elements: [] });
     }
     await withCodexAppServer(request, async (client) => {
       await client.request("turn/start", {
@@ -4175,10 +4478,10 @@ var CodexAgentAdapter = class {
 };
 
 // src/agents/providers/opencode.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash2, randomBytes, randomUUID as randomUUID2 } from "crypto";
+import os2 from "os";
 import path10 from "path";
 var SANDBOX_OPENCODE_PORT = 4096;
-var LOCAL_OPENCODE_PORT = 4096;
 var SANDBOX_OPENCODE_READY_TIMEOUT_MS = 9e4;
 var LOCAL_OPENCODE_READY_TIMEOUT_MS = 2e4;
 var SHARED_OPENCODE_TARGET_ID = "shared-opencode-server";
@@ -4230,30 +4533,13 @@ function hashLlmApiKeys(env) {
   }
   return hasher.digest("hex");
 }
-async function killLocalOpenCodeServer() {
-  await time(debugOpencode, "kill local opencode server", async () => {
-    const killer = spawnCommand({
-      command: "sh",
-      args: [
-        "-c",
-        `lsof -ti tcp:${LOCAL_OPENCODE_PORT} | xargs kill 2>/dev/null || true`
-      ]
-    });
-    await killer.wait().catch(() => void 0);
-    await waitFor(
-      async () => {
-        try {
-          const res = await fetch(
-            `http://127.0.0.1:${LOCAL_OPENCODE_PORT}/global/health`
-          );
-          return !res.ok;
-        } catch {
-          return true;
-        }
-      },
-      { timeoutMs: 5e3, intervalMs: 200 }
-    ).catch(() => void 0);
-  });
+var localOpenCodeServers = /* @__PURE__ */ new WeakMap();
+async function killLocalOpenCodeServer(options) {
+  const pending = localOpenCodeServers.get(options);
+  if (!pending) return;
+  const server = await pending;
+  await server.process.kill();
+  localOpenCodeServers.delete(options);
 }
 async function killSandboxOpenCodeServer(sandbox, pidFilePath, cwd, port) {
   await time(debugOpencode, "kill sandbox opencode server", async () => {
@@ -4332,6 +4618,7 @@ function createOpenCodePermissionEvent(request, raw, payload) {
     },
     {
       requestId: String(properties.id ?? ""),
+      toolName: permission,
       kind: permission === "bash" ? "bash" : permission === "edit" ? "edit" : permission === "external_directory" ? "file-change" : permission === "webfetch" ? "network" : permission === "task" ? "tool" : "unknown",
       title: `Approve ${permission} permission`,
       message: typeof properties.metadata === "object" && properties.metadata !== null ? JSON.stringify(properties.metadata) : `OpenCode requested ${permission} permission.`,
@@ -4353,6 +4640,7 @@ function buildOpenCodeConfig(options, interactiveApproval) {
     prompt: options.systemPrompt || FALLBACK_OPEN_CODE_AGENT_PROMPT,
     permission: buildOpenCodePermissionConfig(interactiveApproval),
     tools: {
+      question: hasInteractiveQuestions(options),
       write: true,
       edit: true,
       bash: true,
@@ -4407,7 +4695,7 @@ async function ensureSandboxOpenCodeServer(request) {
     const port = SANDBOX_OPENCODE_PORT;
     const plugins = assertHooksSupported(request.provider, options);
     assertCommandsSupported(request.provider, options.commands);
-    const interactiveApproval = isInteractiveApproval(options);
+    const interactiveApproval = !options.fullAccess && isInteractiveApproval(options);
     const target = await createSetupTarget(
       request.provider,
       SHARED_OPENCODE_TARGET_ID,
@@ -4475,7 +4763,8 @@ async function ensureSandboxOpenCodeServer(request) {
     const commonEnv = {
       OPENCODE_CONFIG: configPath,
       OPENCODE_CONFIG_DIR: target.layout.opencodeDir,
-      OPENCODE_DISABLE_DEFAULT_PLUGINS: "true"
+      OPENCODE_DISABLE_DEFAULT_PLUGINS: "true",
+      OPENCODE_ENABLE_QUESTION_TOOL: hasInteractiveQuestions(options) ? "true" : "false"
     };
     await applyDifferentialSetup(target, allArtifacts, installCommands);
     if (enableRtk) {
@@ -4604,85 +4893,91 @@ ${lastLog}` : "")
     await markSetupComplete(target, setupId);
   });
 }
-async function ensureLocalOpenCodeServer(request) {
-  const options = request.options;
-  const plugins = assertHooksSupported(request.provider, options);
-  assertCommandsSupported(request.provider, options.commands);
-  const interactiveApproval = isInteractiveApproval(options);
-  const target = await createSetupTarget(
-    request.provider,
-    "shared-setup",
-    options
-  );
-  const { artifacts: skillArtifacts, installCommands } = await prepareSkillArtifacts(
-    request.provider,
-    options.skills,
-    target.layout
-  );
-  const pluginArtifacts = buildOpenCodePluginArtifacts(
-    plugins,
-    target.layout.opencodeDir
-  );
-  const configPath = path10.join(target.layout.opencodeDir, "agentbox.json");
-  const openCodeConfig = buildOpenCodeConfig(options, interactiveApproval);
-  const commonEnv = {
-    OPENCODE_CONFIG: configPath,
-    OPENCODE_CONFIG_DIR: target.layout.opencodeDir,
-    OPENCODE_DISABLE_DEFAULT_PLUGINS: "true"
+async function startLocalOpenCodeServer(request) {
+  const originalOptions = request.options;
+  const options = {
+    ...originalOptions,
+    stateDirectory: path10.join(originalOptions.stateDirectory ?? path10.join(os2.tmpdir(), "agentbox-native"), "instances", randomUUID2())
   };
-  const allArtifacts = [
-    ...skillArtifacts,
-    ...pluginArtifacts,
-    {
-      path: configPath,
-      content: JSON.stringify(openCodeConfig, null, 2)
-    }
-  ];
-  const daemonInfo = {
-    port: LOCAL_OPENCODE_PORT,
-    healthPath: "/global/health"
-  };
-  const setupId = computeSetupId({
-    artifacts: allArtifacts,
-    installCommands,
-    daemon: daemonInfo,
-    extras: [`apiKeys:${hashLlmApiKeys(options.env)}`]
-  });
-  if (await preflightSetup(target, setupId, daemonInfo)) {
-    debugOpencode("local opencode server up-to-date \u2014 reusing");
-    return;
-  }
-  if (await isLocalOpenCodeServerHealthy()) {
-    debugOpencode(
-      "local opencode server already running but setup drifted \u2014 reusing it without restart; call agent.killServer() to apply the new config"
-    );
-    return;
+  let generatedEnv = {};
+  if (options.configuration !== "native") {
+    const plugins = assertHooksSupported(request.provider, options);
+    assertCommandsSupported(request.provider, options.commands);
+    const target = await createSetupTarget(request.provider, "shared-setup", options);
+    const { artifacts: skillArtifacts, installCommands } = await prepareSkillArtifacts(request.provider, options.skills, target.layout);
+    const configPath = path10.join(target.layout.opencodeDir, "agentbox.json");
+    const artifacts = [
+      ...skillArtifacts,
+      ...buildOpenCodePluginArtifacts(plugins, target.layout.opencodeDir),
+      { path: configPath, content: JSON.stringify(buildOpenCodeConfig(options, isInteractiveApproval(options)), null, 2) }
+    ];
+    await applyDifferentialSetup(target, artifacts, installCommands);
+    generatedEnv = {
+      OPENCODE_CONFIG: configPath,
+      OPENCODE_CONFIG_DIR: target.layout.opencodeDir,
+      OPENCODE_DISABLE_DEFAULT_PLUGINS: "true",
+      OPENCODE_ENABLE_QUESTION_TOOL: hasInteractiveQuestions(options) ? "true" : "false"
+    };
   }
-  debugOpencode("local opencode server absent \u2014 spawning");
-  await applyDifferentialSetup(target, allArtifacts, installCommands);
-  await killLocalOpenCodeServer();
-  spawnCommand({
+  const port = await getAvailablePort();
+  const password = randomBytes(32).toString("base64url");
+  const baseUrl = `http://127.0.0.1:${port}`;
+  const headers = { Authorization: `Basic ${Buffer.from(`opencode:${password}`).toString("base64")}` };
+  const processHandle = spawnCommand({
     command: options.provider?.binary ?? "opencode",
-    args: [
-      "serve",
-      "--hostname",
-      "127.0.0.1",
-      "--port",
-      String(LOCAL_OPENCODE_PORT),
-      ...options.provider?.args ?? []
-    ],
+    args: ["serve", ...options.provider?.args ?? [], "--hostname", "127.0.0.1", "--port", String(port)],
     cwd: options.cwd,
+    processGroup: options.processGroup !== "inherited",
     env: {
       ...process.env,
-      ...options.env ?? {},
-      ...commonEnv
+      ...options.env,
+      ...generatedEnv,
+      ...options.fullAccess ? { OPENCODE_PERMISSION: JSON.stringify({ "*": "allow", question: "ask" }) } : {},
+      ...options.interactiveQuestions === true ? { OPENCODE_ENABLE_QUESTION_TOOL: "true" } : {},
+      OPENCODE_SERVER_USERNAME: "opencode",
+      OPENCODE_SERVER_PASSWORD: password
     }
   });
-  await waitForHttpReady(
-    `http://127.0.0.1:${LOCAL_OPENCODE_PORT}/global/health`,
-    { timeoutMs: LOCAL_OPENCODE_READY_TIMEOUT_MS }
-  );
-  await markSetupComplete(target, setupId);
+  processHandle.child.stdout.resume();
+  processHandle.child.stderr.resume();
+  try {
+    let startupError;
+    void processHandle.wait().then(
+      (code) => {
+        startupError = new Error(`Local OpenCode server exited before startup (${code})`);
+      },
+      (error) => {
+        startupError = error instanceof Error ? error : new Error(String(error));
+      }
+    );
+    await waitFor(async () => {
+      if (startupError) throw startupError;
+      try {
+        return (await fetch(`${baseUrl}/global/health`, { headers, signal: AbortSignal.timeout(1e3) })).ok;
+      } catch {
+        return false;
+      }
+    }, { timeoutMs: LOCAL_OPENCODE_READY_TIMEOUT_MS });
+    const unauthenticated = await fetch(`${baseUrl}/global/health`, { signal: AbortSignal.timeout(3e3) });
+    if (unauthenticated.status !== 401) throw new Error("This OpenCode version does not enforce local server authentication. Upgrade OpenCode before running it through AgentBox.");
+    return { baseUrl, headers, process: processHandle };
+  } catch (error) {
+    await processHandle.kill();
+    throw error;
+  }
+}
+async function ensureLocalOpenCodeServer(request) {
+  let pending = localOpenCodeServers.get(request.options);
+  if (!pending) {
+    pending = startLocalOpenCodeServer(request);
+    localOpenCodeServers.set(request.options, pending);
+  }
+  try {
+    await pending;
+  } catch (error) {
+    localOpenCodeServers.delete(request.options);
+    throw error;
+  }
 }
 async function setupOpenCode(request) {
   if (request.options.sandbox) {
@@ -4695,16 +4990,6 @@ async function isSandboxOpenCodeServerHealthy(sandbox, cwd, port) {
   const probe = await sandbox.run(opencodeHealthCurl(port), { cwd, timeoutMs: 5e3 }).catch(() => void 0);
   return probe?.exitCode === 0;
 }
-async function isLocalOpenCodeServerHealthy() {
-  try {
-    const res = await fetch(
-      `http://127.0.0.1:${LOCAL_OPENCODE_PORT}/global/health`
-    );
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
 async function killOpenCodeServer(request) {
   const { options } = request;
   if (options.sandbox) {
@@ -4725,24 +5010,22 @@ async function killOpenCodeServer(request) {
     );
     return;
   }
-  await killLocalOpenCodeServer();
+  await killLocalOpenCodeServer(options);
 }
 async function buildOpenCodeRuntime(options) {
   if (options.sandbox) {
     const sandbox = options.sandbox;
-    const baseUrl2 = (await sandbox.getPreviewLink(SANDBOX_OPENCODE_PORT)).replace(/\/$/, "");
+    const baseUrl = (await sandbox.getPreviewLink(SANDBOX_OPENCODE_PORT)).replace(/\/$/, "");
     return {
-      baseUrl: baseUrl2,
+      baseUrl,
       previewHeaders: await opencodeAuthHeaders(sandbox),
-      raw: { baseUrl: baseUrl2, port: SANDBOX_OPENCODE_PORT }
+      raw: { baseUrl, port: SANDBOX_OPENCODE_PORT }
     };
   }
-  const baseUrl = `http://127.0.0.1:${LOCAL_OPENCODE_PORT}`;
-  return {
-    baseUrl,
-    previewHeaders: {},
-    raw: { baseUrl, port: LOCAL_OPENCODE_PORT }
-  };
+  const pending = localOpenCodeServers.get(options);
+  if (!pending) throw new Error("Local OpenCode server has not been set up by this Agent instance");
+  const server = await pending;
+  return { baseUrl: server.baseUrl, previewHeaders: server.headers, raw: { baseUrl: server.baseUrl } };
 }
 var OpenCodeAgentAdapter = class {
   async setup(request) {
@@ -4841,7 +5124,7 @@ var OpenCodeAgentAdapter = class {
       resolveSessionTerminal();
     });
     try {
-      const interactiveApproval = isInteractiveApproval(request.options);
+      const interactiveApproval = !request.options.fullAccess && isInteractiveApproval(request.options);
       let forkedSession = null;
       if (request.run.forkSessionId) {
         forkedSession = await fetchJson(
@@ -4982,6 +5265,32 @@ var OpenCodeAgentAdapter = class {
                 }
               }
             }
+            if (eventType === "question.asked") {
+              const properties = payload.properties;
+              if (properties && typeof properties.id === "string" && typeof properties.sessionID === "string" && await resolveRunSession(properties.sessionID)) {
+                const questions = normalizeUserQuestions("open-code", properties);
+                const response = hasInteractiveQuestions(request.options) ? await sink.requestPermission(createNormalizedEvent("permission.requested", {
+                  provider: request.provider,
+                  runId: request.runId,
+                  raw
+                }, {
+                  requestId: properties.id,
+                  kind: "question",
+                  toolName: "question",
+                  title: "Your input is needed",
+                  input: properties,
+                  questions,
+                  canRemember: false
+                })) : void 0;
+                const allowed = response?.decision === "allow";
+                await fetchJson(`${runtime.baseUrl}/question/${encodeURIComponent(properties.id)}/${allowed ? "reply" : "reject"}`, {
+                  method: "POST",
+                  headers: { "content-type": "application/json", ...runtime.previewHeaders },
+                  body: JSON.stringify(allowed ? { answers: questionReply("open-code", properties, response.answers ?? []) } : {})
+                });
+              }
+              continue;
+            }
             if (eventType === "permission.asked") {
               const properties = payload.properties;
               if (properties && typeof properties.sessionID === "string" && await resolveRunSession(properties.sessionID)) {
@@ -5129,6 +5438,12 @@ var OpenCodeAgentAdapter = class {
         })
       );
       const agentSlug = openCodeAgentSlug(request.run.reasoning);
+      if (request.run.goal) throw new Error("Native goals are not supported by OpenCode.");
+      if (request.run.mode) {
+        const agents = await fetchJson(`${runtime.baseUrl}/agent`, { headers: runtime.previewHeaders });
+        const name = request.run.mode === "plan" ? "plan" : "build";
+        if (!agents.some((agent) => agent.name === name)) throw new Error(`This OpenCode installation does not expose the ${name} agent.`);
+      }
       const dispatchPrompt = async (parts) => {
         const body = JSON.stringify({
           ...request.run.model ? { model: toOpenCodeModel(request.run.model) } : {},
@@ -5144,7 +5459,8 @@ var OpenCodeAgentAdapter = class {
           // instead. This per-message field stays as a per-run
           // override path that's effective for codex/GPT/Gemini.
           ...request.run.systemPrompt ? { system: request.run.systemPrompt } : {},
-          agent: agentSlug,
+          ...request.options.configuration === "native" ? request.run.reasoning ? { variant: request.run.reasoning } : {} : { agent: agentSlug },
+          ...request.run.mode ? { agent: request.run.mode === "plan" ? "plan" : "build" } : {},
           parts
         });
         const url = `${runtime.baseUrl}/session/${sessionId}/prompt_async`;
@@ -5243,8 +5559,8 @@ var OpenCodeAgentAdapter = class {
           streamedTextFromSse.length
         );
         let lastAssistantText = "";
-        for (const [messageId, text] of assistantTextByMessageId) {
-          lastAssistantText = text;
+        for (const [messageId, text2] of assistantTextByMessageId) {
+          lastAssistantText = text2;
           if (!announcedAssistantCompletions.has(messageId)) {
             announcedAssistantCompletions.add(messageId);
             sink.emitEvent(
@@ -5254,7 +5570,7 @@ var OpenCodeAgentAdapter = class {
                   provider: request.provider,
                   runId: request.runId
                 },
-                { text }
+                { text: text2 }
               )
             );
           }
@@ -5423,6 +5739,17 @@ function createAdapter(provider) {
   }
 }
 function prepareAgentOptions(_provider, options) {
+  if (options.stateDirectory !== void 0) {
+    if (options.sandbox) throw new Error("stateDirectory is only supported for host execution.");
+    if (!path11.isAbsolute(options.stateDirectory)) throw new Error("stateDirectory must be an absolute path.");
+  }
+  if (options.sandbox && options.processGroup !== void 0) throw new Error("processGroup is only supported for host execution.");
+  if (options.configuration === "native") {
+    if (options.sandbox) throw new Error("Native configuration is only supported for host execution.");
+    if (options.mcps?.length || options.skills?.length || options.subAgents?.length || options.commands?.length || options.enableRtk) {
+      throw new Error("Native configuration uses the harness's own skills, MCPs, commands, and hooks.");
+    }
+  }
   return options;
 }
 var AgentRunController = class {
@@ -5552,12 +5879,15 @@ var AgentRunController = class {
         `Permission request ${response.requestId} is not pending for this run.`
       );
     }
+    const answers = pending.event.kind === "question" && response.decision === "allow" ? validateUserAnswers(pending.event.questions, response.answers) : void 0;
+    if (response.answers && !answers) throw new Error("Answers are only accepted for an allowed question request");
     this.pendingPermissions.delete(response.requestId);
     const remember = pending.event.canRemember ? response.remember : void 0;
     const resolvedResponse = {
       requestId: response.requestId,
       decision: response.decision,
-      ...remember !== void 0 ? { remember } : {}
+      ...remember !== void 0 ? { remember } : {},
+      ...answers ? { answers } : {}
     };
     this.pushEvent(
       createNormalizedEvent(
@@ -5569,7 +5899,8 @@ var AgentRunController = class {
         {
           requestId: response.requestId,
           decision: response.decision,
-          ...remember !== void 0 ? { remember } : {}
+          ...remember !== void 0 ? { remember } : {},
+          ...answers ? { answers } : {}
         }
       )
     );
@@ -5666,6 +5997,10 @@ var AgentRunController = class {
     if (this.settled) {
       return;
     }
+    if (this.abortRequested) {
+      this.cancel();
+      return;
+    }
     const normalizedError = asError(error);
     this.clearPendingPermissions(normalizedError);
     this.emitEvent(
@@ -5700,6 +6035,7 @@ var AgentRunController = class {
   }
   async abort() {
     this.abortRequested = true;
+    this.clearPendingPermissions(new Error("Agent run cancelled"));
     await this.abortHandler();
   }
   rawEvents() {
@@ -5812,7 +6148,7 @@ var Agent = class {
     if (runConfig.forkAtMessageId && !runConfig.forkSessionId) {
       throw new Error("AgentRunConfig.forkAtMessageId requires forkSessionId.");
     }
-    const runId = runConfig.runId ?? randomUUID2();
+    const runId = runConfig.runId ?? randomUUID3();
     const streamCalledAt = Date.now();
     debugAgent("stream() provider=%s runId=%s", this.provider, runId);
     const run = new AgentRunController(this.provider, runId);
@@ -5880,8 +6216,33 @@ var Agent = class {
   }
 };
 
+// src/agents/commands.ts
+function harnessCapabilities(provider) {
+  return { commands: provider === "open-code" ? ["plan", "agent"] : ["plan", "agent", "goal"], planning: provider === "codex" ? "explicit" : "agent-directed", questions: true, fullAccess: true };
+}
+function resolveHarnessCommand(provider, input) {
+  const first = typeof input === "string" ? input : input.find((part) => part.type === "text")?.text;
+  const match = first?.match(/^\s*\/(plan|agent|goal)(?:\s+([\s\S]*))?$/);
+  if (!match) return { input };
+  const command = match[1];
+  if (!harnessCapabilities(provider).commands.includes(command)) throw new Error(`/${command} is not supported by ${provider}.`);
+  const body = match[2]?.trim() ?? "";
+  if (command === "goal" && (!body || body.length > 4e3)) throw new Error("/goal requires an objective of 1\u20134000 characters.");
+  if (command === "goal" && provider === "claude-code") return { input, goal: body };
+  const text2 = body || (command === "plan" ? "Plan the requested work." : "Continue with implementation.");
+  let replaced = false;
+  const cleaned = typeof input === "string" ? text2 : input.map((part) => {
+    if (part.type !== "text" || replaced) return part;
+    replaced = true;
+    return { ...part, text: text2 };
+  });
+  return command === "goal" ? { input: cleaned, goal: body } : { input: cleaned, mode: command === "plan" ? "plan" : "default" };
+}
+
 export {
   agentboxRoot,
   getAgentLayout,
-  Agent
+  Agent,
+  harnessCapabilities,
+  resolveHarnessCommand
 };