agentbox-sdk 0.1.503 → 0.1.511

package/dist/{chunk-34LDITII.js → chunk-G3VEVR6Y.js}

@@ -15,11 +15,12 @@ import {
   debugRelay,
   debugRuntime,
   debugSetup,
+  getAvailablePort,
   linesFromTextChunks,
   sleep,
   time,
   waitFor
-} from "./chunk-AVXJMCBC.js";
+} from "./chunk-MTQ2S46C.js";
 import {
   shellQuote
 } from "./chunk-NSJM57Z4.js";
@@ -29,16 +30,86 @@ import {
 } from "./chunk-GOFJNFAD.js";
 
 // src/agents/Agent.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
+import path11 from "path";
 
 // src/agents/providers/claude-code.ts
 import { randomUUID } from "crypto";
+
+// src/agents/transports/spawn.ts
+import { spawn } from "child_process";
+import { createInterface } from "readline";
+function spawnCommand(options) {
+  const child = spawn(options.command, options.args ?? [], {
+    cwd: options.cwd,
+    env: options.env,
+    stdio: "pipe",
+    shell: process.platform === "win32",
+    windowsHide: true,
+    detached: options.processGroup === true && process.platform !== "win32"
+  });
+  const exitPromise = new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("close", (code) => resolve(code ?? 0));
+  });
+  void exitPromise.catch(() => void 0);
+  let killPromise;
+  const signalProcess = (signal) => {
+    try {
+      if (options.processGroup && process.platform !== "win32" && child.pid) process.kill(-child.pid, signal);
+      else child.kill(signal);
+    } catch (error) {
+      if (error.code !== "ESRCH") throw error;
+    }
+  };
+  const waitForExit = async (timeoutMs) => {
+    let timer;
+    try {
+      return await Promise.race([
+        exitPromise.then(() => true, () => true),
+        new Promise((resolve) => {
+          timer = setTimeout(() => resolve(false), timeoutMs);
+        })
+      ]);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  };
+  return {
+    child,
+    wait: () => exitPromise,
+    kill: (signal = "SIGTERM") => killPromise ??= (async () => {
+      signalProcess(signal);
+      if (await waitForExit(options.terminationTimeoutMs ?? 3e3)) {
+        if (options.processGroup && process.platform !== "win32") signalProcess("SIGKILL");
+        return;
+      }
+      signalProcess("SIGKILL");
+      if (!await waitForExit(3e3)) throw new Error("The owned agent process did not stop");
+    })()
+  };
+}
+async function* linesFromNodeStream(stream) {
+  const lineReader = createInterface({ input: stream });
+  try {
+    for await (const line of lineReader) {
+      yield line;
+    }
+  } finally {
+    lineReader.close();
+  }
+}
+
+// src/agents/providers/claude-code.ts
 import path8 from "path";
 
 // src/agents/approval.ts
 function getApprovalMode(options) {
   return options.approvalMode ?? "auto";
 }
+function hasInteractiveQuestions(options) {
+  return options.interactiveQuestions ?? isInteractiveApproval(options);
+}
 function isInteractiveApproval(options) {
   return getApprovalMode(options) === "interactive";
 }
@@ -49,6 +120,58 @@ function shouldAutoApproveClaudeTools(options) {
   return !isInteractiveApproval(options);
 }
 
+// src/agents/questions.ts
+function record(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid agent question");
+  return value;
+}
+function text(value, max) {
+  if (typeof value !== "string" || !value.trim() || value.length > max) throw new Error("Invalid agent question text");
+  return value;
+}
+function normalizeUserQuestions(provider, input) {
+  const questions = record(input).questions;
+  if (!Array.isArray(questions) || !questions.length || questions.length > 10) throw new Error("Unsupported agent question count");
+  return questions.map((value, index) => {
+    const item = record(value);
+    if (item.isSecret === true) throw new Error("Secret questions cannot be answered through task history");
+    const options = item.options ?? [];
+    if (!Array.isArray(options) || options.length > 30) throw new Error("Unsupported agent question options");
+    const result = {
+      id: String(index),
+      question: text(item.question, 1e4),
+      ...item.header ? { header: text(item.header, 200) } : {},
+      options: options.map((value2) => {
+        const option = record(value2);
+        return { label: text(option.label, 1e3), ...option.description ? { description: text(option.description, 1e4) } : {} };
+      }),
+      multiple: provider === "claude-code" ? item.multiSelect === true : provider === "open-code" && item.multiple === true,
+      allowCustom: provider === "open-code" ? item.custom !== false : true
+    };
+    if (new Set(result.options.map((option) => option.label)).size !== result.options.length) throw new Error("Duplicate agent question options");
+    if (!result.options.length && !result.allowCustom) throw new Error("Agent question has no available answers");
+    return result;
+  });
+}
+function validateUserAnswers(questions, answers) {
+  if (!questions?.length || !answers || answers.length !== questions.length || new Set(answers.map((answer) => answer.questionId)).size !== answers.length) throw new Error("Answer each agent question once");
+  return questions.map((question) => {
+    const answer = answers.find((answer2) => answer2.questionId === question.id);
+    if (!answer || !Array.isArray(answer.values) || !answer.values.length || answer.values.length > (question.multiple ? 30 : 1)) throw new Error("Choose an answer for each question");
+    if (new Set(answer.values).size !== answer.values.length || answer.values.some((value) => typeof value !== "string" || !value.trim() || value.length > 1e4 || !question.allowCustom && !question.options.some((option) => option.label === value))) throw new Error("Invalid answer to agent question");
+    return { questionId: question.id, values: [...answer.values] };
+  });
+}
+function questionReply(provider, input, answers) {
+  const normalized = normalizeUserQuestions(provider, input);
+  const ordered = validateUserAnswers(normalized, answers);
+  if (provider === "open-code") return ordered.map((answer) => answer.values);
+  const original = record(input).questions;
+  const keys = original.map((item) => text(record(item)[provider === "codex" ? "id" : "question"], 1e4));
+  if (new Set(keys).size !== keys.length) throw new Error("Duplicate agent question IDs");
+  return Object.fromEntries(keys.map((key, index) => [key, provider === "codex" ? { answers: ordered[index].values } : ordered[index].values.join(", ")]));
+}
+
 // src/agents/input.ts
 import { readFile } from "fs/promises";
 import path from "path";
@@ -894,64 +1017,16 @@ function buildCodexConfigToml(opts = {}) {
 import { mkdir, chmod, rm, writeFile } from "fs/promises";
 import os from "os";
 import path4 from "path";
-
-// src/agents/transports/spawn.ts
-import { spawn } from "child_process";
-import { createInterface } from "readline";
-function spawnCommand(options) {
-  const child = spawn(options.command, options.args ?? [], {
-    cwd: options.cwd,
-    env: options.env,
-    stdio: "pipe",
-    shell: process.platform === "win32",
-    windowsHide: true
-  });
-  const exitPromise = new Promise((resolve, reject) => {
-    child.once("error", reject);
-    child.once("close", (code) => resolve(code ?? 0));
-  });
-  return {
-    child,
-    wait: () => exitPromise,
-    kill: async (signal = "SIGTERM") => {
-      child.kill(signal);
-      await exitPromise.catch(() => void 0);
-    }
-  };
-}
-async function waitForHttpReady(url, options) {
-  await waitFor(
-    async () => {
-      try {
-        const response = await fetch(url, options?.init);
-        return response.ok;
-      } catch {
-        return false;
-      }
-    },
-    {
-      timeoutMs: options?.timeoutMs,
-      intervalMs: options?.intervalMs
-    }
-  );
-}
-async function* linesFromNodeStream(stream) {
-  const lineReader = createInterface({ input: stream });
-  try {
-    for await (const line of lineReader) {
-      yield line;
-    }
-  } finally {
-    lineReader.close();
-  }
-}
-
-// src/agents/config/setup.ts
 function shortLabel(command) {
   const oneLine = command.replace(/\s+/g, " ").trim();
   return oneLine.length > 60 ? `${oneLine.slice(0, 60)}\u2026` : oneLine;
 }
-function agentboxRoot(provider, hasSandbox = true) {
+function agentboxRoot(provider, hasSandbox = true, stateDirectory) {
+  if (stateDirectory !== void 0) {
+    if (hasSandbox) throw new Error("stateDirectory is only supported for host execution.");
+    if (!path4.isAbsolute(stateDirectory)) throw new Error("stateDirectory must be an absolute path.");
+    return path4.join(stateDirectory, provider);
+  }
   return hasSandbox ? `/tmp/agentbox/${provider}` : path4.join(os.tmpdir(), `agentbox-${provider}`);
 }
 function getAgentLayout(rootDir) {
@@ -1004,9 +1079,9 @@ var HostSetupTarget = class {
       async () => {
         await Promise.all(
           files.map(async (entry) => {
-            await mkdir(path4.dirname(entry.path), { recursive: true });
+            await mkdir(path4.dirname(entry.path), { recursive: true, mode: 448 });
             const content = typeof entry.content === "string" ? entry.content : entry.content;
-            await writeFile(entry.path, content);
+            await writeFile(entry.path, content, { mode: entry.mode ?? 384 });
             if (entry.mode && (entry.mode & 73) !== 0) {
               await chmod(entry.path, entry.mode);
             }
@@ -1167,12 +1242,13 @@ async function createSetupTarget(provider, setupId, options) {
   return time(debugRuntime, `createSetupTarget ${provider}`, async () => {
     void setupId;
     const layout = getAgentLayout(
-      agentboxRoot(provider, Boolean(options.sandbox))
+      agentboxRoot(provider, Boolean(options.sandbox), options.stateDirectory)
     );
     if (options.sandbox) {
       return new SandboxSetupTarget(provider, layout, options);
     }
-    await mkdir(layout.homeDir, { recursive: true });
+    await mkdir(layout.homeDir, { recursive: true, mode: 448 });
+    await chmod(layout.homeDir, 448);
     await mkdir(layout.xdgConfigHome, { recursive: true });
     await mkdir(layout.agentsDir, { recursive: true });
     await mkdir(layout.claudeDir, { recursive: true });
@@ -1749,8 +1825,203 @@ function extractOpenCodeCostData(events) {
   }) : null;
 }
 
+// src/agents/background-tasks.ts
+var DEFAULT_BACKGROUND_TASK_TIMEOUT_MS = 30 * 6e4;
+var BACKGROUND_TASK_GRACE_MS = 15e3;
+var CLI_BACKGROUND_WAIT_CEILING_ENV = "CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS";
+var CLI_BACKGROUND_WAIT_CEILING_MS = 3e4;
+function resolveBackgroundTaskTimeoutMs(value) {
+  if (value === void 0) return DEFAULT_BACKGROUND_TASK_TIMEOUT_MS;
+  if (Number.isNaN(value) || value < 0) {
+    throw new Error(
+      "backgroundTaskTimeoutMs must be a non-negative number (Infinity waits forever)."
+    );
+  }
+  return value;
+}
+function applyCliBackgroundWaitCeiling(env) {
+  env[CLI_BACKGROUND_WAIT_CEILING_ENV] ??= String(
+    CLI_BACKGROUND_WAIT_CEILING_MS
+  );
+}
+function asRecord2(value) {
+  return value !== null && typeof value === "object" ? value : void 0;
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+var SCHEDULE_TOOLS = /* @__PURE__ */ new Set(["CronCreate", "ScheduleWakeup"]);
+var DONE_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "killed"]);
+var BackgroundTaskTracker = class {
+  tasks = /* @__PURE__ */ new Map();
+  wakeups = /* @__PURE__ */ new Map();
+  // tool_use seen, tool_result not yet: a failed schedule adds nothing.
+  pendingWakeups = /* @__PURE__ */ new Map();
+  afterResult = false;
+  seenBackgroundWork = false;
+  liveTasks() {
+    return [...this.tasks.values(), ...this.wakeups.values()];
+  }
+  /**
+   * True once any background task or scheduled wakeup was live in this run.
+   * The CLI queues a wake-up for every task that finishes and delivers it as
+   * a new turn once the model is idle — including tasks that finished
+   * mid-turn, whose queued turn starts right after that turn's `result`
+   * with nothing live and nothing observable in between. After background
+   * work has been seen, a `result` is therefore never the end of the run on
+   * its own; only the grace passing without a new turn is.
+   */
+  hasSeenBackgroundWork() {
+    return this.seenBackgroundWork;
+  }
+  /** Feed one SDKMessage. Returns true when it started a follow-up turn. */
+  ingest(message) {
+    const m = asRecord2(message);
+    if (!m) return false;
+    if (m.type === "result") {
+      this.afterResult = true;
+      return false;
+    }
+    if (m.type === "system") return this.ingestSystem(m);
+    if (m.type === "command_lifecycle") {
+      if (m.state !== "started") return false;
+      this.wakeups.clear();
+      return this.startTurn();
+    }
+    if (m.parent_tool_use_id) return false;
+    if (m.type === "assistant") {
+      const started = this.startTurn();
+      this.ingestToolUses(m);
+      return started;
+    }
+    if (m.type === "user") {
+      this.ingestToolResults(m);
+      return false;
+    }
+    if (m.type === "stream_event")
+      return asRecord2(m.event)?.type === "message_start" && this.startTurn();
+    return false;
+  }
+  startTurn() {
+    if (!this.afterResult) return false;
+    this.afterResult = false;
+    return true;
+  }
+  ingestSystem(m) {
+    const id = String(m.task_id ?? "");
+    switch (m.subtype) {
+      case "background_tasks_changed":
+        this.tasks.clear();
+        for (const entry of asArray(m.tasks)) {
+          const task = asRecord2(entry);
+          if (task) this.addTask(task);
+        }
+        return false;
+      case "task_started":
+        if (m.is_backgrounded === true && !m.owned_by_subagent) this.addTask(m);
+        return false;
+      case "task_notification":
+        this.tasks.delete(id);
+        return false;
+      case "task_updated":
+        if (DONE_STATUSES.has(String(asRecord2(m.patch)?.status)))
+          this.tasks.delete(id);
+        return false;
+      case "init":
+        return this.startTurn();
+      default:
+        return false;
+    }
+  }
+  addTask(task) {
+    const id = String(task.task_id ?? "");
+    if (!id) return;
+    this.seenBackgroundWork = true;
+    this.tasks.set(id, {
+      id,
+      type: String(task.task_type ?? "task"),
+      description: String(task.description ?? "")
+    });
+  }
+  ingestToolUses(m) {
+    for (const entry of asArray(asRecord2(m.message)?.content)) {
+      const block = asRecord2(entry);
+      if (block?.type !== "tool_use") continue;
+      const name = String(block.name ?? "");
+      const input = asRecord2(block.input) ?? {};
+      if (name === "CronDelete" || name === "ScheduleWakeup" && input.stop === true) {
+        this.wakeups.clear();
+        continue;
+      }
+      if (!SCHEDULE_TOOLS.has(name)) continue;
+      const id = String(block.id ?? "");
+      if (!id) continue;
+      this.pendingWakeups.set(id, {
+        id,
+        type: "scheduled_wakeup",
+        description: String(input.prompt ?? input.cron ?? name)
+      });
+    }
+  }
+  ingestToolResults(m) {
+    for (const entry of asArray(asRecord2(m.message)?.content)) {
+      const block = asRecord2(entry);
+      if (block?.type !== "tool_result") continue;
+      const id = String(block.tool_use_id ?? "");
+      const pending = this.pendingWakeups.get(id);
+      if (!pending) continue;
+      this.pendingWakeups.delete(id);
+      if (block.is_error) continue;
+      this.seenBackgroundWork = true;
+      this.wakeups.set(id, pending);
+    }
+  }
+};
+var MAX_TIMER_MS = 2 ** 31 - 1;
+var STOP_TASKS_TIMEOUT_MS = 5e3;
+function withTimeout(promise, ms) {
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(void 0), ms);
+  });
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+var BackgroundWait = class {
+  constructor(graceMs, ceilingMs) {
+    this.graceMs = graceMs;
+    this.expired = new Promise((resolve) => {
+      this.expire = resolve;
+    });
+    if (Number.isFinite(ceilingMs)) {
+      this.ceiling = setTimeout(() => this.expire("ceiling"), Math.min(ceilingMs, MAX_TIMER_MS));
+    }
+  }
+  graceMs;
+  expired;
+  expire;
+  grace;
+  ceiling;
+  startedAt = Date.now();
+  /** Arm the grace timer while nothing is live; disarm it once a task appears. */
+  setIdle(idle) {
+    if (!idle) {
+      clearTimeout(this.grace);
+      this.grace = void 0;
+      return;
+    }
+    this.grace ??= setTimeout(() => this.expire("grace"), this.graceMs);
+  }
+  elapsedMs() {
+    return Date.now() - this.startedAt;
+  }
+  clear() {
+    clearTimeout(this.grace);
+    clearTimeout(this.ceiling);
+  }
+};
+
 // src/agents/providers/claude-code.ts
-var DAEMON_PROTOCOL_VERSION = "3";
+var DAEMON_PROTOCOL_VERSION = "5";
 var DAEMON_PORT = 43180;
 var DAEMON_PATH = "/tmp/agentbox/claude-code/daemon.mjs";
 var DAEMON_LOG_PATH = "/tmp/agentbox/claude-code/daemon.log";
@@ -1760,7 +2031,7 @@ var DAEMON_READY_TIMEOUT_MS = 3e4;
 var DAEMON_READY_POLL_INTERVAL_MS = 250;
 function claudeConfigDir(options) {
   return path8.join(
-    agentboxRoot(AgentProvider.ClaudeCode, Boolean(options.sandbox)),
+    agentboxRoot(AgentProvider.ClaudeCode, Boolean(options.sandbox), options.stateDirectory),
     ".claude"
   );
 }
@@ -1768,7 +2039,7 @@ function buildClaudeQueryOptions(params) {
   const provider = params.request.options.provider;
   const run = params.request.run;
   const extraArgs = {
-    "mcp-config": params.mcpConfigPath
+    ...params.mcpConfigPath ? { "mcp-config": params.mcpConfigPath } : {}
   };
   for (const arg of provider?.args ?? []) {
     if (typeof arg !== "string") continue;
@@ -1785,7 +2056,11 @@ function buildClaudeQueryOptions(params) {
     cwd: params.cwd ?? params.request.options.cwd,
     env: params.env,
     pathToClaudeCodeExecutable: provider?.binary ?? "claude",
-    settings: params.settingsPath,
+    ...params.settingsPath ? { settings: params.settingsPath } : {},
+    ...params.request.options.configuration === "native" ? {
+      settingSources: ["user", "project", "local"],
+      systemPrompt: { type: "preset", preset: "claude_code" }
+    } : {},
     extraArgs,
     includePartialMessages: true,
     forwardSubagentText: true,
@@ -1794,8 +2069,8 @@ function buildClaudeQueryOptions(params) {
     ...provider?.additionalDirectories?.length ? { additionalDirectories: provider.additionalDirectories } : {},
     ...run.model ? { model: run.model } : {},
     ...effort ? { effort } : {},
-    ...provider?.permissionMode ? { permissionMode: provider.permissionMode } : {},
-    ...provider?.permissionMode === "bypassPermissions" ? { allowDangerouslySkipPermissions: true } : {},
+    ...run.mode === "plan" ? { permissionMode: "plan" } : params.request.options.fullAccess ? { permissionMode: "bypassPermissions" } : run.mode === "default" ? { permissionMode: "default" } : provider?.permissionMode ? { permissionMode: provider.permissionMode } : {},
+    ...params.request.options.fullAccess || provider?.permissionMode === "bypassPermissions" ? { allowDangerouslySkipPermissions: true } : {},
     ...provider?.allowedTools?.length ? { allowedTools: provider.allowedTools } : {},
     ...run.resumeSessionId ? { resume: run.resumeSessionId } : {},
     // Fork-at-message: claude-agent-sdk natively supports slicing a
@@ -1941,8 +2216,14 @@ function readJsonBody(req) {
   });
 }
 
-function autoApproveCanUseTool(_toolName, input) {
-  return { behavior: "allow", updatedInput: input };
+async function handlePermission(req, res, runId) {
+  const run = liveRuns.get(runId);
+  const body = await readJsonBody(req);
+  const resolve = run?.permissions.get(body.requestId);
+  if (!resolve) { res.writeHead(409); res.end("Request is no longer pending"); return; }
+  run.permissions.delete(body.requestId);
+  resolve(body.response);
+  res.writeHead(204); res.end();
 }
 
 async function handleStart(req, res, runId) {
@@ -1982,10 +2263,52 @@ async function handleStart(req, res, runId) {
   const opts = { ...(options || {}) };
   const autoApprove = !!opts.autoApproveTools;
   delete opts.autoApproveTools;
+  const interactiveQuestions = !!opts.interactiveQuestions;
+  delete opts.interactiveQuestions;
+  let planning = opts.permissionMode === "plan";
+  const permissions = new Map();
+  const clearPermissions = () => { for (const resolve of permissions.values()) resolve({ behavior: "deny", message: "Run ended", interrupt: true }); permissions.clear(); };
+  const canUseTool = async (toolName, input, context) => {
+    const isQuestion = toolName === "AskUserQuestion";
+    const isPlan = toolName === "ExitPlanMode";
+    if (context.signal.aborted) return { behavior: "deny", message: "Run cancelled", interrupt: true };
+    if ((isQuestion || isPlan) && !interactiveQuestions) return { behavior: "deny", message: "No interactive user is available." };
+    if (!isQuestion && !isPlan && planning && toolName !== "EnterPlanMode") return { behavior: "deny", message: "Finish planning before requesting write access." };
+    if (!isQuestion && !isPlan && autoApprove) return { behavior: "allow", updatedInput: input };
+    return new Promise((resolve) => {
+      const abort = () => { permissions.delete(context.toolUseID); resolve({ behavior: "deny", message: "Run cancelled", interrupt: true }); };
+      permissions.set(context.toolUseID, (response) => { context.signal.removeEventListener("abort", abort); if (isPlan && response.behavior === "allow") planning = false; resolve(response); });
+      context.signal.addEventListener("abort", abort, { once: true });
+      res.write(JSON.stringify({ _permission: { requestId: context.toolUseID, toolName, input, title: context.title } }) + "\\n");
+    });
+  };
   opts.pathToClaudeCodeExecutable = resolveClaudeBinary(
     opts.pathToClaudeCodeExecutable,
   );
 
+  let queryHandle;
+  let clientGone = false;
+  // This run's own teardown. The liveRuns entry is only removed when it is
+  // still ours: hosts reuse a runId across retry attempts, and a successor
+  // registered while our CLI winds down must not be evicted by our exit.
+  const releaseRun = () => {
+    clearInterval(heartbeat);
+    clearPermissions();
+    if (liveRuns.get(runId)?.query === queryHandle) liveRuns.delete(runId);
+    promptStream.end();
+  };
+  // Host gone (settled, cancelled or crashed) \u2192 end the prompt so the CLI
+  // winds down instead of living on with its background work. Detected on
+  // the response: \`req\` emits "close" as soon as its body is consumed (Node
+  // >= 16), long before any disconnect, while the response only closes
+  // early when the socket dies before the stream finished.
+  res.on("close", () => {
+    if (res.writableFinished) return;
+    clientGone = true;
+    releaseRun();
+    queryHandle?.interrupt().catch(() => {});
+  });
+
   // Resume-if-exists gate. \`claude --resume <id>\` errors hard with "No
   // conversation found with session ID" when the local session jsonl is
   // missing \u2014 most often because a prior post-task snapshot failed and the
@@ -2016,13 +2339,19 @@ async function handleStart(req, res, runId) {
     }
   }
 
-  let queryHandle;
+  // Nobody left to stream to: do not start a CLI for it.
+  if (clientGone) { res.end(); return; }
   try {
     queryHandle = query({
       prompt: promptStream,
       options: {
         ...opts,
-        ...(autoApprove ? { canUseTool: autoApproveCanUseTool } : {}),
+        canUseTool,
+        hooks: { PreToolUse: [{ hooks: [async (input) => {
+          planning = input.permission_mode === "plan";
+          return interactiveQuestions && ["AskUserQuestion", "ExitPlanMode"].includes(input.tool_name)
+            ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "ask" } } : {};
+        }] }] },
       },
     });
   } catch (e) {
@@ -2032,28 +2361,21 @@ async function handleStart(req, res, runId) {
     return;
   }
 
-  liveRuns.set(runId, { query: queryHandle, prompt: promptStream });
-
-  // Client disconnected (e.g. host process killed) \u2192 tear down.
-  req.on("close", () => {
-    clearInterval(heartbeat);
-    if (!liveRuns.has(runId)) return;
-    liveRuns.delete(runId);
-    promptStream.end();
-    queryHandle.interrupt().catch(() => {});
-  });
+  liveRuns.set(runId, { query: queryHandle, prompt: promptStream, permissions });
 
+  // Forward every SDKMessage, not just up to the first result: in
+  // streaming-input mode the CLI keeps running after a turn ends and
+  // re-prompts the model when background work finishes. The host decides
+  // when the run is over and disconnects (res "close" above), which ends
+  // the prompt and lets the CLI wind down.
   try {
     for await (const message of queryHandle) {
       res.write(JSON.stringify(message) + "\\n");
-      if (message.type === "result") break;
     }
   } catch (e) {
     res.write(JSON.stringify({ _error: String(e?.message ?? e) }) + "\\n");
   } finally {
-    clearInterval(heartbeat);
-    liveRuns.delete(runId);
-    promptStream.end();
+    releaseRun();
     res.end();
   }
 }
@@ -2119,6 +2441,11 @@ const server = http.createServer((req, res) => {
     return;
   }
   const url = req.url ?? "";
+  const permissionRoute = url.match(/^\\/runs\\/([^/]+)\\/permission$/);
+  if (req.method === "POST" && permissionRoute) {
+    handlePermission(req, res, decodeURIComponent(permissionRoute[1])).catch(() => { if (!res.headersSent) res.writeHead(400); res.end(); });
+    return;
+  }
   let m;
   if (req.method === "POST" && (m = url.match(/^\\/runs\\/([^/]+)\\/start$/))) {
     handleStart(req, res, decodeURIComponent(m[1]));
@@ -2355,15 +2682,11 @@ var ClaudeCodeAgentAdapter = class {
     ).catch(() => void 0);
   }
   async setup(request) {
+    if (request.options.configuration === "native") return;
     await time(debugClaude, "claude-code setup()", async () => {
       const options = request.options;
       const provider = request.provider;
       const sandbox = options.sandbox;
-      if (!sandbox) {
-        throw new Error(
-          "claude-code requires a sandbox (the SDK transport runs as a daemon inside the sandbox)."
-        );
-      }
       const target = await createSetupTarget(provider, "shared-setup", options);
       const settingsPath = path8.join(target.layout.claudeDir, "settings.json");
       const mcpConfigPath = path8.join(
@@ -2384,6 +2707,7 @@ var ClaudeCodeAgentAdapter = class {
       const claudeSettings = { ...hookSettings, ...workflowSettings };
       const mcpConfigJson = buildClaudeMcpConfig(options.mcps) ?? JSON.stringify({ mcpServers: {} }, null, 2);
       const artifacts = [
+        ...!sandbox ? [{ path: path8.join(target.layout.claudeDir, ".claude-plugin", "plugin.json"), content: JSON.stringify({ name: "agentbox", version: "1.0.0" }) }] : [],
         ...skillArtifacts,
         ...buildClaudeCommandArtifacts(options.commands, target.layout),
         ...buildClaudeSubagentArtifacts(options.subAgents, target.layout),
@@ -2394,11 +2718,11 @@ var ClaudeCodeAgentAdapter = class {
         { path: mcpConfigPath, content: mcpConfigJson }
       ];
       const enableRtk = options.enableRtk === true;
-      const daemonInfo = {
+      const daemonInfo = sandbox ? {
         port: DAEMON_PORT,
         healthPath: "/__version",
         expectedVersionMatch: DAEMON_PROTOCOL_VERSION
-      };
+      } : void 0;
       const setupId = computeSetupId({
         artifacts,
         installCommands,
@@ -2416,7 +2740,7 @@ var ClaudeCodeAgentAdapter = class {
           "applyDifferentialSetup",
           () => applyDifferentialSetup(target, artifacts, installCommands)
         ),
-        ensureClaudeCodeDaemon(options, env)
+        ...sandbox ? [ensureClaudeCodeDaemon(options, env)] : []
       ]);
       if (enableRtk) {
         await time(debugClaude, "activateRtk", () => activateRtk(target));
@@ -2428,11 +2752,7 @@ var ClaudeCodeAgentAdapter = class {
     const executeStartedAt = Date.now();
     debugClaude("execute() start runId=%s", request.runId);
     const sandbox = request.options.sandbox;
-    if (!sandbox) {
-      throw new Error(
-        "claude-code requires a sandbox (the SDK transport runs as a daemon inside the sandbox)."
-      );
-    }
+    if (!sandbox) return executeNativeClaude(request, sink);
     const claudeDir = claudeConfigDir(request.options);
     const settingsPath = path8.join(claudeDir, "settings.json");
     const mcpConfigPath = path8.join(claudeDir, "agentbox-mcp.json");
@@ -2445,6 +2765,7 @@ var ClaudeCodeAgentAdapter = class {
       // user inside our images.
       IS_SANDBOX: "1"
     };
+    applyCliBackgroundWaitCeiling(env);
     const customHeaders = request.options.customHeaders;
     if (customHeaders && Object.keys(customHeaders).length > 0) {
       const serialized = Object.entries(customHeaders).map(([name, value]) => `${name}: ${value}`).join("\n");
@@ -2489,21 +2810,28 @@ ${serialized}` : serialized;
         // already set `resume` for the resume path, so only stamp `sessionId` for
         // fresh runs.
         ...request.run.resumeSessionId ? {} : { sessionId: presetSessionId },
-        autoApproveTools
+        autoApproveTools,
+        interactiveQuestions: hasInteractiveQuestions(request.options)
       }
     };
     const fetchAbort = new AbortController();
+    const runUrl = `${baseUrl}/runs/${encodeURIComponent(request.runId)}`;
     const cleanup = async () => {
       try {
-        await fetch(
-          `${baseUrl}/runs/${encodeURIComponent(request.runId)}/abort`,
-          { method: "POST", headers: authHeaders }
-        );
+        await fetch(`${runUrl}/abort`, { method: "POST", headers: authHeaders });
+      } catch {
+      }
+      try {
+        await fetch(runUrl, { method: "DELETE", headers: authHeaders, signal: AbortSignal.timeout(3e3) });
       } catch {
       }
       fetchAbort.abort();
     };
-    sink.setAbort(cleanup);
+    let cancelled = false;
+    sink.setAbort(async () => {
+      cancelled = true;
+      await cleanup();
+    });
     sink.onMessage(async (content) => {
       const parts = await validateProviderUserInput(request.provider, content);
       const mapped = mapToClaudeUserContent(parts);
@@ -2535,9 +2863,9 @@ ${serialized}` : serialized;
       })
     );
     if (!response.ok || !response.body) {
-      const text = await response.text().catch(() => "");
+      const text2 = await response.text().catch(() => "");
       throw new Error(
-        `claude-code daemon /start failed: ${response.status} ${text}`
+        `claude-code daemon /start failed: ${response.status} ${text2}`
       );
     }
     sink.setRaw({ baseUrl, runId: request.runId, claudeDir });
@@ -2554,199 +2882,22 @@ ${serialized}` : serialized;
         { messageId: initialUuid }
       )
     );
-    let accumulatedText = "";
-    let streamedThinkingChars = 0;
-    let pendingMessages = 1;
-    let firstStreamEventLogged = false;
-    let firstTextDeltaLogged = false;
-    let lastTerminalReason;
-    let lastIsError = false;
-    const rawPayloads = [];
-    try {
+    const permissionMessages = async function* () {
       for await (const item of parseNdjsonStream(response.body)) {
-        if (item && typeof item === "object") {
-          const ctrl = item;
-          if ("_error" in ctrl) {
-            throw new Error(
-              String(item._error ?? "daemon error")
-            );
-          }
-          if ("_notice" in ctrl) {
-            debugClaude("daemon notice: %o", ctrl);
-            sink.emitRaw(
-              toRawEvent(
-                request.runId,
-                ctrl,
-                `daemon.${String(ctrl._notice ?? "notice")}`
-              )
-            );
-            continue;
-          }
-        }
-        const message = item;
-        rawPayloads.push(message);
-        sink.emitRaw(toRawEvent(request.runId, message, message.type));
-        if (message.type === "system") {
-          const sub = message.subtype;
-          if (sub === "init") {
-            const sys = message;
-            if (sys.session_id) {
-              debugClaude(
-                "\u2605 session.init session_id=%s (%dms)",
-                sys.session_id.slice(0, 8),
-                Date.now() - executeStartedAt
-              );
-            }
-          } else if (sub === "hook_started") {
-            const h = message;
-            debugClaude(
-              "hook.started name=%s event=%s hook_id=%s",
-              h.hook_name,
-              h.hook_event,
-              h.hook_id
-            );
-          } else if (sub === "hook_response") {
-            const h = message;
-            const stderr = h.stderr && h.stderr.length > 0 ? h.stderr.replace(/\s+$/, "") : void 0;
-            debugClaude(
-              "hook.response name=%s exit=%s outcome=%s%s",
-              h.hook_name,
-              h.exit_code,
-              h.outcome,
-              stderr ? ` stderr=${JSON.stringify(stderr).slice(0, 200)}` : ""
-            );
-          }
-          continue;
-        }
-        if (message.type === "stream_event") {
-          if (!firstStreamEventLogged) {
-            firstStreamEventLogged = true;
-            debugClaude(
-              "\u2605 first stream_event (%dms since execute start)",
-              Date.now() - executeStartedAt
-            );
-          }
-          const partial = message;
-          if (partial.parent_tool_use_id) continue;
-          const streamType = partial.event?.type;
-          if (streamType === "message_start") {
-            accumulatedText = "";
-            streamedThinkingChars = 0;
-          }
-          const { text, thinking } = extractStreamDeltas(partial);
-          if (thinking) {
-            streamedThinkingChars += thinking.length;
-            sink.emitEvent(
-              createNormalizedEvent(
-                "reasoning.delta",
-                { provider: request.provider, runId: request.runId },
-                { delta: thinking }
-              )
-            );
-          }
-          if (text) {
-            if (!firstTextDeltaLogged) {
-              firstTextDeltaLogged = true;
-              debugClaude(
-                "\u2605 first text delta (%dms since execute start)",
-                Date.now() - executeStartedAt
-              );
-            }
-            accumulatedText += text;
-            sink.emitEvent(
-              createNormalizedEvent(
-                "text.delta",
-                { provider: request.provider, runId: request.runId },
-                { delta: text }
-              )
-            );
-          }
-          continue;
-        }
-        if (message.type === "assistant") {
-          const asst = message;
-          if (asst.parent_tool_use_id) continue;
-          const thinking = extractAssistantThinking(asst);
-          if (thinking && streamedThinkingChars === 0) {
-            sink.emitEvent(
-              createNormalizedEvent(
-                "reasoning.delta",
-                { provider: request.provider, runId: request.runId },
-                { delta: thinking }
-              )
-            );
-          }
-          const text = extractAssistantText(asst);
-          sink.emitEvent(
-            createNormalizedEvent(
-              "message.completed",
-              { provider: request.provider, runId: request.runId },
-              {
-                text,
-                ...asst.uuid ? { messageId: String(asst.uuid) } : {}
-              }
-            )
-          );
-          continue;
-        }
-        if (message.type === "result") {
-          const result = message;
-          lastTerminalReason = result.terminal_reason;
-          lastIsError = result.is_error;
-          const resultText = result.subtype === "success" ? result.result : accumulatedText;
-          if (resultText && resultText !== accumulatedText) {
-            accumulatedText = resultText;
-          }
-          pendingMessages--;
-          if (pendingMessages <= 0) break;
+        const control = item;
+        if (!control._permission) {
+          yield item;
           continue;
         }
+        const ask = control._permission;
+        const isQuestion = ask.toolName === "AskUserQuestion";
+        const isPlan = ask.toolName === "ExitPlanMode";
+        const answer = await sink.requestPermission({ type: "permission.requested", provider: request.provider, runId: request.runId, timestamp: (/* @__PURE__ */ new Date()).toISOString(), requestId: ask.requestId, kind: isQuestion ? "question" : isPlan ? "plan" : "tool", toolName: ask.toolName, title: isQuestion ? "Your input is needed" : isPlan ? "Review the plan" : ask.title ?? `Allow ${ask.toolName}?`, input: ask.input, ...isQuestion ? { questions: normalizeUserQuestions("claude-code", ask.input) } : {} });
+        const reply = await fetch(`${baseUrl}/runs/${encodeURIComponent(request.runId)}/permission`, { method: "POST", headers: { "content-type": "application/json", ...authHeaders }, signal: fetchAbort.signal, body: JSON.stringify({ requestId: ask.requestId, response: answer.decision === "allow" ? { behavior: "allow", updatedInput: isQuestion ? { ...ask.input, answers: questionReply("claude-code", ask.input, answer.answers ?? []) } : ask.input } : { behavior: "deny", message: "The user declined this request." } }) });
+        if (!reply.ok) throw new Error(`Claude permission response failed: ${reply.status}`);
       }
-      const finalText = accumulatedText;
-      const isCancelled = lastTerminalReason === "aborted_streaming" || lastTerminalReason === "aborted_tools";
-      const isError = !isCancelled && lastIsError;
-      if (isCancelled) {
-        debugClaude(
-          "\u2605 run.cancelled (%dms since execute start) reason=%s",
-          Date.now() - executeStartedAt,
-          lastTerminalReason
-        );
-        sink.cancel({
-          text: finalText,
-          costData: extractClaudeCostData(rawPayloads)
-        });
-      } else if (isError) {
-        debugClaude(
-          "\u2605 run.error (%dms since execute start) reason=%s",
-          Date.now() - executeStartedAt,
-          lastTerminalReason
-        );
-        sink.fail(
-          new Error(
-            finalText || `claude-code run failed (terminal_reason: ${lastTerminalReason})`
-          )
-        );
-      } else {
-        debugClaude(
-          "\u2605 run.completed (%dms since execute start) chars=%d",
-          Date.now() - executeStartedAt,
-          finalText.length
-        );
-        sink.emitEvent(
-          createNormalizedEvent(
-            "run.completed",
-            { provider: request.provider, runId: request.runId },
-            { text: finalText }
-          )
-        );
-        sink.complete({
-          text: finalText,
-          costData: extractClaudeCostData(rawPayloads)
-        });
-      }
-    } finally {
-      fetchAbort.abort();
-    }
+    };
+    await consumeClaudeMessages(request, sink, permissionMessages(), executeStartedAt, cleanup, () => cancelled);
     return async () => void 0;
   }
   /**
@@ -2806,7 +2957,395 @@ ${serialized}` : serialized;
       );
     }
   }
-};
+};
+async function consumeClaudeMessages(request, sink, messages, executeStartedAt, cleanup, wasCancelled = () => false, wait = {}) {
+  let accumulatedText = "";
+  let streamedThinkingChars = 0;
+  let sawResult = false;
+  let firstStreamEventLogged = false;
+  let firstTextDeltaLogged = false;
+  let lastTerminalReason;
+  let lastIsError = false;
+  const rawPayloads = [];
+  const tracker = new BackgroundTaskTracker();
+  const timeoutMs = resolveBackgroundTaskTimeoutMs(request.options.backgroundTaskTimeoutMs);
+  const graceMs = wait.graceMs ?? BACKGROUND_TASK_GRACE_MS;
+  let pendingWait;
+  let waitedMs = 0;
+  let expiry;
+  let lastTasksKey = JSON.stringify({ tasks: [], waiting: false });
+  const emitTasks = (tasks, waiting) => {
+    const key = JSON.stringify({ tasks, waiting });
+    if (key === lastTasksKey) return;
+    lastTasksKey = key;
+    sink.emitEvent(createNormalizedEvent("background.tasks", { provider: request.provider, runId: request.runId }, { tasks, waiting }));
+  };
+  const isAborted = () => wasCancelled() || lastTerminalReason === "aborted_streaming" || lastTerminalReason === "aborted_tools";
+  const endWait = () => {
+    if (!pendingWait) return;
+    waitedMs += pendingWait.elapsedMs();
+    pendingWait.clear();
+    pendingWait = void 0;
+  };
+  const settleOnFailure = (error) => {
+    if (!pendingWait || !sawResult || lastIsError) return false;
+    debugClaude("\u2605 transport failed during background wait; settling on the last result: %o", error);
+    expiry = "transport";
+    return true;
+  };
+  const iterator = messages[Symbol.asyncIterator]();
+  try {
+    for (let next = iterator.next(); ; next = iterator.next()) {
+      let step;
+      try {
+        step = pendingWait ? await Promise.race([
+          next.then((result) => ({ result })),
+          pendingWait.expired.then((reason) => ({ reason }))
+        ]) : { result: await next };
+      } catch (error) {
+        if (!settleOnFailure(error)) throw error;
+        break;
+      }
+      if ("reason" in step) {
+        expiry = step.reason;
+        break;
+      }
+      if (step.result.done) break;
+      const item = step.result.value;
+      if (item && typeof item === "object") {
+        const ctrl = item;
+        if ("_error" in ctrl) {
+          const error = new Error(String(ctrl._error ?? "daemon error"));
+          if (!settleOnFailure(error)) throw error;
+          break;
+        }
+        if ("_notice" in ctrl) {
+          debugClaude("daemon notice: %o", ctrl);
+          sink.emitRaw(
+            toRawEvent(
+              request.runId,
+              ctrl,
+              `daemon.${String(ctrl._notice ?? "notice")}`
+            )
+          );
+          continue;
+        }
+      }
+      const message = item;
+      rawPayloads.push(message);
+      sink.emitRaw(toRawEvent(request.runId, message, message.type));
+      if (tracker.ingest(message) && pendingWait) {
+        debugClaude("\u2605 follow-up turn started; background wait over (%dms since execute start)", Date.now() - executeStartedAt);
+        endWait();
+      }
+      emitTasks(tracker.liveTasks(), pendingWait !== void 0);
+      pendingWait?.setIdle(tracker.liveTasks().length === 0);
+      if (message.type === "system") {
+        const sub = message.subtype;
+        if (sub === "init") {
+          const sys = message;
+          if (request.run.goal && !sys.slash_commands.some((command) => command.replace(/^\//, "") === "goal")) {
+            await cleanup();
+            throw new Error("This Claude Code installation does not expose the native /goal command.");
+          }
+          if (sys.session_id) {
+            debugClaude(
+              "\u2605 session.init session_id=%s (%dms)",
+              sys.session_id.slice(0, 8),
+              Date.now() - executeStartedAt
+            );
+          }
+        } else if (sub === "hook_started") {
+          const h = message;
+          debugClaude(
+            "hook.started name=%s event=%s hook_id=%s",
+            h.hook_name,
+            h.hook_event,
+            h.hook_id
+          );
+        } else if (sub === "hook_response") {
+          const h = message;
+          const stderr = h.stderr && h.stderr.length > 0 ? h.stderr.replace(/\s+$/, "") : void 0;
+          debugClaude(
+            "hook.response name=%s exit=%s outcome=%s%s",
+            h.hook_name,
+            h.exit_code,
+            h.outcome,
+            stderr ? ` stderr=${JSON.stringify(stderr).slice(0, 200)}` : ""
+          );
+        }
+        continue;
+      }
+      if (message.type === "stream_event") {
+        if (!firstStreamEventLogged) {
+          firstStreamEventLogged = true;
+          debugClaude(
+            "\u2605 first stream_event (%dms since execute start)",
+            Date.now() - executeStartedAt
+          );
+        }
+        const partial = message;
+        if (partial.parent_tool_use_id) continue;
+        const streamType = partial.event?.type;
+        if (streamType === "message_start") {
+          accumulatedText = "";
+          streamedThinkingChars = 0;
+        }
+        const { text: text2, thinking } = extractStreamDeltas(partial);
+        if (thinking) {
+          streamedThinkingChars += thinking.length;
+          sink.emitEvent(
+            createNormalizedEvent(
+              "reasoning.delta",
+              { provider: request.provider, runId: request.runId },
+              { delta: thinking }
+            )
+          );
+        }
+        if (text2) {
+          if (!firstTextDeltaLogged) {
+            firstTextDeltaLogged = true;
+            debugClaude(
+              "\u2605 first text delta (%dms since execute start)",
+              Date.now() - executeStartedAt
+            );
+          }
+          accumulatedText += text2;
+          sink.emitEvent(
+            createNormalizedEvent(
+              "text.delta",
+              { provider: request.provider, runId: request.runId },
+              { delta: text2 }
+            )
+          );
+        }
+        continue;
+      }
+      if (message.type === "assistant") {
+        const asst = message;
+        if (asst.parent_tool_use_id) continue;
+        const thinking = extractAssistantThinking(asst);
+        if (thinking && streamedThinkingChars === 0) {
+          sink.emitEvent(
+            createNormalizedEvent(
+              "reasoning.delta",
+              { provider: request.provider, runId: request.runId },
+              { delta: thinking }
+            )
+          );
+        }
+        const text2 = extractAssistantText(asst);
+        sink.emitEvent(
+          createNormalizedEvent(
+            "message.completed",
+            { provider: request.provider, runId: request.runId },
+            {
+              text: text2,
+              ...asst.uuid ? { messageId: String(asst.uuid) } : {}
+            }
+          )
+        );
+        continue;
+      }
+      if (message.type === "result") {
+        sawResult = true;
+        const result = message;
+        lastTerminalReason = result.terminal_reason;
+        lastIsError = result.is_error;
+        const resultText = result.subtype === "success" ? result.result : accumulatedText;
+        if (resultText && resultText !== accumulatedText) {
+          accumulatedText = resultText;
+        }
+        const live = tracker.liveTasks();
+        if (timeoutMs === 0 || !tracker.hasSeenBackgroundWork() || isAborted()) break;
+        debugClaude("\u2605 turn ended with %d background task(s); waiting", live.length);
+        endWait();
+        pendingWait = new BackgroundWait(graceMs, Math.max(0, timeoutMs - waitedMs));
+        pendingWait.setIdle(live.length === 0);
+        emitTasks(live, true);
+        continue;
+      }
+    }
+    if (expiry === "ceiling") {
+      const ids = tracker.liveTasks().filter((task) => task.type !== "scheduled_wakeup").map((task) => task.id);
+      debugClaude("\u2605 background wait ceiling (%dms) hit; stopping %d task(s)", timeoutMs, ids.length);
+      if (wait.stopTasks) {
+        await withTimeout(wait.stopTasks(ids), wait.stopTimeoutMs ?? STOP_TASKS_TIMEOUT_MS).catch(() => void 0);
+      }
+    } else if (expiry === "grace") {
+      debugClaude("\u2605 background set emptied with no follow-up turn; settling");
+    }
+    if (pendingWait) {
+      endWait();
+      emitTasks([], false);
+    }
+    await cleanup();
+    if (!sawResult && !wasCancelled()) throw new Error("Claude Code closed before reporting a result");
+    const finalText = accumulatedText;
+    const isCancelled = isAborted();
+    const isError = !isCancelled && lastIsError;
+    if (isCancelled) {
+      debugClaude(
+        "\u2605 run.cancelled (%dms since execute start) reason=%s",
+        Date.now() - executeStartedAt,
+        lastTerminalReason
+      );
+      sink.cancel({
+        text: finalText,
+        costData: extractClaudeCostData(rawPayloads)
+      });
+    } else if (isError) {
+      debugClaude(
+        "\u2605 run.error (%dms since execute start) reason=%s",
+        Date.now() - executeStartedAt,
+        lastTerminalReason
+      );
+      sink.fail(
+        new Error(
+          finalText || `claude-code run failed (terminal_reason: ${lastTerminalReason})`
+        )
+      );
+    } else {
+      debugClaude(
+        "\u2605 run.completed (%dms since execute start) chars=%d",
+        Date.now() - executeStartedAt,
+        finalText.length
+      );
+      sink.emitEvent(
+        createNormalizedEvent(
+          "run.completed",
+          { provider: request.provider, runId: request.runId },
+          { text: finalText }
+        )
+      );
+      sink.complete({
+        text: finalText,
+        costData: extractClaudeCostData(rawPayloads)
+      });
+    }
+  } finally {
+    pendingWait?.clear();
+    await cleanup();
+  }
+}
+async function executeNativeClaude(request, sink, wait = {}) {
+  const { query } = await import("@anthropic-ai/claude-agent-sdk");
+  const claudeDir = claudeConfigDir(request.options);
+  const input = await validateProviderUserInput(request.provider, request.run.input);
+  const prompt = new AsyncQueue();
+  const sessionId = request.run.resumeSessionId ?? randomUUID();
+  const controller = new AbortController();
+  let handle;
+  let processHandle;
+  let stopped;
+  let cancelled = false;
+  const stop = () => stopped ??= (async () => {
+    prompt.finish();
+    handle?.close();
+    controller.abort();
+    if (processHandle) await processHandle.kill();
+  })();
+  sink.setAbort(async () => {
+    cancelled = true;
+    await stop();
+  });
+  sink.setSessionId(sessionId);
+  const messageId = randomUUID();
+  prompt.push({ type: "user", uuid: messageId, message: { role: "user", content: mapToClaudeUserContent(input) }, parent_tool_use_id: null });
+  const hostEnv = Object.fromEntries(Object.entries({ ...process.env, ...request.options.env }).filter((entry) => entry[1] !== void 0));
+  applyCliBackgroundWaitCeiling(hostEnv);
+  if (request.options.customHeaders) {
+    const headers = Object.entries(request.options.customHeaders).map(([name, value]) => `${name}: ${value}`).join("\n");
+    hostEnv.ANTHROPIC_CUSTOM_HEADERS = [hostEnv.ANTHROPIC_CUSTOM_HEADERS, headers].filter(Boolean).join("\n");
+  }
+  const options = buildClaudeQueryOptions({
+    request,
+    ...request.options.configuration === "native" ? {} : {
+      settingsPath: path8.join(claudeDir, "settings.json"),
+      mcpConfigPath: path8.join(claudeDir, "agentbox-mcp.json")
+    },
+    // Auth is deliberately CLI-owned. Never copy the user's credential files
+    // into the generated configuration directory or a task artifact.
+    env: hostEnv
+  });
+  const autoApprove = shouldAutoApproveClaudeTools(request.options);
+  const interactiveQuestions = hasInteractiveQuestions(request.options);
+  let planning = options.permissionMode === "plan";
+  try {
+    handle = query({ prompt, options: {
+      ...options,
+      // Use the SDK-matched CLI by default; an installed CLI is an explicit override.
+      pathToClaudeCodeExecutable: request.options.provider?.binary,
+      abortController: controller,
+      // `sessionId` is rejected alongside `resume` unless `forkSession` is
+      // set, where it names the forked session. Stamping it on forks keeps
+      // the pre-minted id reported via `sink.setSessionId` truthful, so a
+      // later run can resume the fork.
+      ...request.run.resumeSessionId ? {} : { sessionId },
+      ...request.options.configuration === "native" ? {} : { plugins: [{ type: "local", path: claudeDir }] },
+      spawnClaudeCodeProcess(spawnOptions) {
+        if (cancelled || controller.signal.aborted) throw new Error("Local run was cancelled before startup");
+        processHandle = spawnCommand({ ...spawnOptions, processGroup: request.options.processGroup !== "inherited" });
+        return processHandle.child;
+      },
+      hooks: { ...options.hooks, PreToolUse: [...options.hooks?.PreToolUse ?? [], { hooks: [async (input2) => {
+        if (input2.hook_event_name !== "PreToolUse") return {};
+        planning = input2.permission_mode === "plan";
+        return interactiveQuestions && ["AskUserQuestion", "ExitPlanMode"].includes(input2.tool_name) ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "ask" } } : {};
+      }] }] },
+      async canUseTool(toolName, input2, context) {
+        if (cancelled || context.signal.aborted) return { behavior: "deny", message: "Run cancelled", interrupt: true };
+        const isQuestion = toolName === "AskUserQuestion";
+        const isPlan = toolName === "ExitPlanMode";
+        if ((isQuestion || isPlan) && !interactiveQuestions) return { behavior: "deny", message: "No interactive user is available." };
+        if (!isQuestion && !isPlan && planning && toolName !== "EnterPlanMode") return { behavior: "deny", message: "Finish planning before requesting write access." };
+        if (!isQuestion && !isPlan && autoApprove) return { behavior: "allow", updatedInput: input2 };
+        try {
+          const response = await sink.requestPermission({
+            type: "permission.requested",
+            provider: request.provider,
+            runId: request.runId,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            requestId: context.toolUseID,
+            kind: isQuestion ? "question" : isPlan ? "plan" : "tool",
+            toolName,
+            ...isQuestion ? { questions: normalizeUserQuestions("claude-code", input2) } : {},
+            title: isQuestion ? "Your input is needed" : isPlan ? "Review the plan" : context.title ?? `Allow ${toolName}?`,
+            message: context.description ?? context.decisionReason,
+            input: input2,
+            canRemember: false
+          });
+          if (isPlan && response.decision === "allow") planning = false;
+          if (!cancelled && !context.signal.aborted && response.decision === "allow") return {
+            behavior: "allow",
+            updatedInput: isQuestion ? { ...input2, answers: questionReply("claude-code", input2, response.answers ?? []) } : input2
+          };
+          return { behavior: "deny", message: "The user denied this action" };
+        } catch {
+          return { behavior: "deny", message: "Run cancelled", interrupt: true };
+        }
+      }
+    } });
+    const live = handle;
+    sink.setRaw({ query: live, claudeDir, runId: request.runId });
+    sink.emitEvent(createNormalizedEvent("run.started", { provider: request.provider, runId: request.runId }));
+    sink.emitEvent(createNormalizedEvent("message.started", { provider: request.provider, runId: request.runId }, { messageId }));
+    await consumeClaudeMessages(request, sink, live, Date.now(), stop, () => cancelled, {
+      ...wait,
+      // Native owns the CLI: ask it to stop leftover tasks before closing it.
+      stopTasks: async (ids) => {
+        await Promise.all(ids.map((id) => live.stopTask(id).catch(() => void 0)));
+      }
+    });
+  } catch (error) {
+    await stop();
+    if (cancelled) sink.cancel();
+    else throw error;
+  } finally {
+    await stop();
+  }
+  return stop;
+}
 
 // src/agents/providers/codex.ts
 import crypto2 from "crypto";
@@ -2820,16 +3359,16 @@ async function fetchJson(url, init) {
   if (!response.ok) {
     throw new Error(`Request to ${url} failed with ${response.status}.`);
   }
-  const text = await response.text();
-  if (text.length === 0) {
+  const text2 = await response.text();
+  if (text2.length === 0) {
     throw new Error(
       `Request to ${url} returned status ${response.status} with an empty body.`
     );
   }
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch (error) {
-    const preview = text.length > 200 ? `${text.slice(0, 200)}\u2026` : text;
+    const preview = text2.length > 200 ? `${text2.slice(0, 200)}\u2026` : text2;
     const cause = error instanceof Error ? error.message : String(error);
     throw new Error(
       `Could not parse JSON response from ${url} (status ${response.status}): ${cause}. Body: ${preview}`
@@ -3030,7 +3569,7 @@ var JsonRpcLineClient = class {
 // src/agents/providers/codex.ts
 function codexConfigDir(options) {
   return path9.join(
-    agentboxRoot(AgentProvider.Codex, Boolean(options.sandbox)),
+    agentboxRoot(AgentProvider.Codex, Boolean(options.sandbox), options.stateDirectory),
     ".codex"
   );
 }
@@ -3097,20 +3636,20 @@ function compactEnv(values) {
   );
 }
 function buildCodexSandboxMode(options) {
-  return options.sandbox ? "workspace-write" : "read-only";
+  return options.fullAccess ? "danger-full-access" : options.provider?.sandboxMode ?? (options.configuration === "native" ? void 0 : options.sandbox ? "workspace-write" : "read-only");
 }
 function buildThreadParams(cwd, options, request) {
   return {
     cwd,
     model: request.run.model ?? null,
-    approvalPolicy: isInteractiveApproval(options) ? "untrusted" : "never",
+    ...options.provider?.approvalPolicy ? { approvalPolicy: options.provider.approvalPolicy } : options.configuration === "native" && !options.fullAccess ? {} : { approvalPolicy: !options.fullAccess && isInteractiveApproval(options) ? "untrusted" : "never" },
     sandbox: buildCodexSandboxMode(options),
     serviceName: "agentbox",
     // Persist the rollout on disk so follow-up runs can call `thread/resume`.
     // `ephemeral: true` threads have no rollout file and resume fails with
     // "no rollout found for thread id ...".
     experimentalRawEvents: true,
-    developerInstructions: request.run.systemPrompt ?? null
+    ...request.run.systemPrompt ? { developerInstructions: request.run.systemPrompt } : options.configuration === "native" ? {} : { developerInstructions: null }
   };
 }
 function buildResumeParams(cwd, options, request) {
@@ -3118,9 +3657,9 @@ function buildResumeParams(cwd, options, request) {
     threadId: request.run.resumeSessionId,
     cwd,
     model: request.run.model ?? null,
-    approvalPolicy: isInteractiveApproval(options) ? "untrusted" : "never",
+    ...options.provider?.approvalPolicy ? { approvalPolicy: options.provider.approvalPolicy } : options.configuration === "native" && !options.fullAccess ? {} : { approvalPolicy: !options.fullAccess && isInteractiveApproval(options) ? "untrusted" : "never" },
     sandbox: buildCodexSandboxMode(options),
-    developerInstructions: request.run.systemPrompt ?? null,
+    ...request.run.systemPrompt ? { developerInstructions: request.run.systemPrompt } : options.configuration === "native" ? {} : { developerInstructions: null },
     // We only need the thread id back; we never read `thread.turns`.
     // Without this Codex hydrates the full history into the response and
     // emits a `deprecationNotice` ("Full-history hydration is deprecated
@@ -3134,15 +3673,22 @@ function buildForkParams(cwd, options, request) {
     lastTurnId: request.run.forkAtMessageId ?? null,
     cwd,
     model: request.run.model ?? null,
-    approvalPolicy: isInteractiveApproval(options) ? "untrusted" : "never",
+    ...options.provider?.approvalPolicy ? { approvalPolicy: options.provider.approvalPolicy } : options.configuration === "native" && !options.fullAccess ? {} : { approvalPolicy: !options.fullAccess && isInteractiveApproval(options) ? "untrusted" : "never" },
     sandbox: buildCodexSandboxMode(options),
-    developerInstructions: request.run.systemPrompt ?? null,
+    ...request.run.systemPrompt ? { developerInstructions: request.run.systemPrompt } : options.configuration === "native" ? {} : { developerInstructions: null },
     excludeTurns: true
   };
 }
 function buildTurnSandboxPolicy(options) {
+  if (options.fullAccess || options.provider?.sandboxMode === "danger-full-access") return { type: "dangerFullAccess" };
   if (!options.sandbox) {
-    return void 0;
+    if (buildCodexSandboxMode(options) === void 0) return void 0;
+    if (buildCodexSandboxMode(options) === "read-only") return void 0;
+    return {
+      type: "workspaceWrite",
+      networkAccess: options.provider?.networkAccess ?? false,
+      ...options.provider?.writableRoots?.length ? { writableRoots: options.provider.writableRoots } : {}
+    };
   }
   if (options.sandbox.provider === SandboxProvider.LocalDocker) {
     return {
@@ -3161,13 +3707,53 @@ function buildCodexTurnStartParams(params) {
   return {
     threadId,
     input: inputItems,
-    approvalPolicy: isInteractiveApproval(request.options) ? "untrusted" : "never",
+    ...request.options.provider?.approvalPolicy ? { approvalPolicy: request.options.provider.approvalPolicy } : request.options.configuration === "native" && !request.options.fullAccess ? {} : {
+      approvalPolicy: !request.options.fullAccess && isInteractiveApproval(request.options) ? "untrusted" : "never"
+    },
     ...sandboxPolicy ? { sandboxPolicy } : {},
     model: request.run.model ?? null,
     effort: request.run.reasoning ?? null,
+    ...request.run.mode ? { collaborationMode: {
+      mode: request.run.mode,
+      settings: { model: request.run.model, reasoning_effort: request.run.reasoning ?? null, developer_instructions: null }
+    } } : {},
     outputSchema: null
   };
 }
+var BACKGROUND_OUTPUT_TAIL_CHARS = 4e3;
+function buildCodexBackgroundFollowUp(items) {
+  const reports = items.map((item) => {
+    const tail = (item.aggregatedOutput ?? "").slice(-BACKGROUND_OUTPUT_TAIL_CHARS).trimEnd();
+    const duration = item.durationMs === void 0 ? "an unknown time" : `${Math.round(item.durationMs / 1e3)}s`;
+    return `\`${item.command}\` exited with code ${item.exitCode ?? "unknown"} after ${duration}.
+Output (last ${BACKGROUND_OUTPUT_TAIL_CHARS} chars):
+\`\`\`
+${tail || "(no output)"}
+\`\`\`
+`;
+  });
+  return `Background command finished while you were idle.
+
+${reports.join("")}
+Continue from here: verify the outcome and finish the task. Do not restart the command.`;
+}
+var CODEX_CANCEL_TURN_TEXT = "Run cancelled by the host.";
+async function terminateBackgroundTerminals(client, threadId) {
+  await withTimeout((async () => {
+    try {
+      const listed = await client.request(
+        "thread/backgroundTerminals/list",
+        { threadId }
+      );
+      for (const terminal of listed?.data ?? []) {
+        if (typeof terminal?.processId !== "string") continue;
+        await client.request("thread/backgroundTerminals/terminate", { threadId, processId: terminal.processId });
+      }
+    } catch (error) {
+      debugCodex("background terminal termination stopped early: %o", error);
+    }
+  })(), STOP_TASKS_TIMEOUT_MS);
+}
 function toRawEvent2(runId, payload, type) {
   return {
     provider: AgentProvider.Codex,
@@ -3189,7 +3775,7 @@ function buildCodexCommandArgs(binary, args, options) {
     overrides.push(["supports_websockets", "false"]);
   }
   const overrideArgs = overrides.flatMap(([k, v]) => ["-c", `${k}=${v}`]);
-  return ["-u", "XDG_CONFIG_HOME", binary, ...overrideArgs, ...args];
+  return [...options?.configuration === "native" ? [] : ["-u", "XDG_CONFIG_HOME"], binary, ...overrideArgs, ...args];
 }
 function toNormalizedCodexEvents(runId, notification) {
   const base = {
@@ -3261,8 +3847,8 @@ function toNormalizedCodexEvents(runId, notification) {
   }
   if (notification.method === "turn/completed") {
     const turn = notification.params?.turn;
-    const text = typeof turn?.lastAgentMessage === "string" ? turn.lastAgentMessage : void 0;
-    return [createNormalizedEvent("run.completed", base, { text })];
+    const text2 = typeof turn?.lastAgentMessage === "string" ? turn.lastAgentMessage : void 0;
+    return [createNormalizedEvent("run.completed", base, { text: text2 })];
   }
   if (notification.method === "error") {
     const error = notification.params?.error;
@@ -3274,7 +3860,7 @@ function toNormalizedCodexEvents(runId, notification) {
   }
   return [];
 }
-function createCodexPermissionEvent(request, notification) {
+function createCodexPermissionEvent(request, notification, fileChanges) {
   const raw = toRawEvent2(request.runId, notification, notification.method);
   const params = notification.params;
   const requestId = notification.id;
@@ -3317,13 +3903,49 @@ function createCodexPermissionEvent(request, notification) {
         kind: "file-change",
         title: "Approve file changes",
         message: typeof params.reason === "string" ? params.reason : "Codex wants to modify files.",
-        input: params,
+        input: fileChanges ? { ...params, changes: fileChanges } : params,
         canRemember: availableDecisions.includes("acceptForSession")
       }
     );
   }
   return null;
 }
+var CODEX_ELICITATION_METHOD = "mcpServer/elicitation/request";
+function createCodexElicitationPermissionEvent(request, notification) {
+  if (notification.method !== CODEX_ELICITATION_METHOD || notification.id === void 0) {
+    return null;
+  }
+  const params = notification.params ?? {};
+  const meta = params._meta ?? {};
+  if (meta.codex_approval_kind !== "mcp_tool_call") {
+    return null;
+  }
+  const raw = toRawEvent2(request.runId, notification, notification.method);
+  const toolName = typeof meta.tool_name === "string" ? meta.tool_name : void 0;
+  const server = typeof params.serverName === "string" ? params.serverName : void 0;
+  const persist = Array.isArray(meta.persist) ? meta.persist : [];
+  return createNormalizedEvent(
+    "permission.requested",
+    { provider: request.provider, runId: request.runId, raw },
+    {
+      requestId: String(notification.id),
+      kind: "tool",
+      toolName: toolName ?? server,
+      title: "Approve tool call",
+      message: typeof params.message === "string" && params.message.trim() ? params.message : `Codex wants to call ${toolName ?? "an MCP tool"}${server ? ` on ${server}` : ""}.`,
+      input: { server, tool: toolName, arguments: meta.tool_params, ...params },
+      canRemember: persist.includes("session")
+    }
+  );
+}
+function toCodexElicitationResult(notification, response) {
+  if (response.decision === "deny") {
+    return { action: "decline", content: null };
+  }
+  const meta = notification.params?._meta ?? {};
+  const persist = Array.isArray(meta.persist) ? meta.persist : [];
+  return response.remember && persist.includes("session") ? { action: "accept", content: null, _meta: { persist: "session" } } : { action: "accept", content: null };
+}
 function toCodexApprovalDecision(notification, response) {
   const params = notification.params ?? {};
   const availableDecisions = Array.isArray(params.availableDecisions) ? params.availableDecisions : [];
@@ -3371,7 +3993,7 @@ async function materializeCodexImage(options, part, index) {
   if (data.length === 0) {
     throw new Error("Cannot attach an empty image to Codex.");
   }
-  const root = agentboxRoot(AgentProvider.Codex, Boolean(options.sandbox));
+  const root = agentboxRoot(AgentProvider.Codex, Boolean(options.sandbox), options.stateDirectory);
   const imagePath = path9.join(
     root,
     "inputs",
@@ -3518,6 +4140,7 @@ async function connectRemoteCodexAppServer(url, headers = {}) {
 }
 async function setupCodex(request) {
   const options = request.options;
+  if (options.configuration === "native") return;
   const provider = request.provider;
   const hooks = assertHooksSupported(provider, options);
   assertCommandsSupported(provider, options.commands);
@@ -3715,10 +4338,10 @@ async function createRuntime(request, inputParts) {
   const codexDir = codexConfigDir(options);
   const env = compactEnv({
     ...options.env ?? {},
-    CODEX_HOME: codexDir,
+    ...options.configuration === "native" ? {} : { CODEX_HOME: codexDir },
     ...options.provider?.env ?? {}
   });
-  const runtimeCwd = path9.dirname(codexDir);
+  const runtimeCwd = options.configuration === "native" ? options.cwd : path9.dirname(codexDir);
   const inputItems = await buildCodexInputItems(options, inputParts);
   const usesRemoteWebSocket = options.sandbox && options.sandbox.provider !== SandboxProvider.LocalDocker;
   if (usesRemoteWebSocket && options.sandbox) {
@@ -3788,6 +4411,7 @@ async function createRuntime(request, inputParts) {
     };
   }
   const processHandle = spawnCommand({
+    processGroup: options.processGroup !== "inherited",
     command: "env",
     args: codexArgs,
     cwd: runtimeCwd,
@@ -3796,6 +4420,7 @@ async function createRuntime(request, inputParts) {
       ...env
     }
   });
+  processHandle.child.stderr.resume();
   return {
     source: linesFromNodeStream(processHandle.child.stdout),
     writeLine: async (line) => {
@@ -3916,10 +4541,10 @@ var CodexAgentAdapter = class {
         throw new Error("Cannot send message before thread is started.");
       }
       const parts = normalizeUserInput(content);
-      const text = parts.filter((p) => p.type === "text").map((p) => p.text).join("");
+      const text2 = parts.filter((p) => p.type === "text").map((p) => p.text).join("");
       const inputItems = [];
-      if (text.trim().length > 0) {
-        inputItems.push({ type: "text", text, text_elements: [] });
+      if (text2.trim().length > 0) {
+        inputItems.push({ type: "text", text: text2, text_elements: [] });
       }
       const response = await client.request(
         "turn/start",
@@ -3935,11 +4560,95 @@ var CodexAgentAdapter = class {
     };
     sink.onMessage(sendTurn);
     const rawPayloads = [];
+    const pendingFileChanges = /* @__PURE__ */ new Map();
+    const fileItemKey = (params, itemId) => typeof params?.threadId === "string" && typeof params.turnId === "string" && typeof itemId === "string" ? `${params.threadId}:${params.turnId}:${itemId}` : void 0;
     let streamedText = "";
+    const timeoutMs = resolveBackgroundTaskTimeoutMs(request.options.backgroundTaskTimeoutMs);
+    const isRootThread = (params) => !params?.threadId || params.threadId === rootThreadId;
+    const inFlight = /* @__PURE__ */ new Map();
+    const finished = [];
+    let pendingWait;
+    let waitedMs = 0;
+    let followUpSent = false;
+    let turnMessageText = "";
+    let lastTurn;
+    let lastTasksKey = JSON.stringify({ tasks: [], waiting: false });
+    const liveTasks = () => [...inFlight.values()].filter((item) => item.outlived).map((item) => ({ id: item.id, type: "command", description: item.command }));
+    const emitTasks = (tasks, waiting) => {
+      const key = JSON.stringify({ tasks, waiting });
+      if (key === lastTasksKey) return;
+      lastTasksKey = key;
+      sink.emitEvent(createNormalizedEvent("background.tasks", { provider: request.provider, runId: request.runId }, { tasks, waiting }));
+    };
+    const endWait = () => {
+      if (!pendingWait) return;
+      waitedMs += pendingWait.elapsedMs();
+      pendingWait.clear();
+      pendingWait = void 0;
+      followUpSent = false;
+    };
+    const sendBackgroundFollowUp = async () => {
+      if (!rootThreadId || !pendingWait || followUpSent || finished.length === 0 || abortInvoked) return;
+      if (timeoutMs - waitedMs - pendingWait.elapsedMs() <= 0) return;
+      followUpSent = true;
+      const text2 = buildCodexBackgroundFollowUp(finished.splice(0));
+      try {
+        const response = await client.request(
+          "turn/start",
+          buildCodexTurnStartParams({
+            threadId: rootThreadId,
+            inputItems: [{ type: "text", text: text2, text_elements: [] }],
+            request
+          })
+        );
+        endWait();
+        sink.emitEvent(createNormalizedEvent("message.injected", { provider: request.provider, runId: request.runId }, {
+          content: text2,
+          ...typeof response?.turn?.id === "string" ? { messageId: response.turn.id } : {}
+        }));
+      } catch (error) {
+        debugCodex("background follow-up turn/start failed: %o", error);
+      }
+    };
     const completion = new Promise((resolve, reject) => {
+      const settle = () => {
+        endWait();
+        emitTasks([], false);
+        sink.emitEvent(createNormalizedEvent("run.completed", { provider: request.provider, runId: request.runId }, { text: lastTurn?.messageText || void 0 }));
+        resolve({ text: lastTurn?.text ?? streamedText, turnId, threadId: rootThreadId, interrupted: false });
+      };
+      const settleOnFailure = (error) => {
+        if (!pendingWait || !lastTurn || abortInvoked) return false;
+        debugCodex("\u2605 transport failed during background wait; settling on the last turn: %o", error);
+        settle();
+        return true;
+      };
       void (async () => {
         let firstClientMessageLogged = false;
-        for await (const message of client.messages()) {
+        const iterator = client.messages()[Symbol.asyncIterator]();
+        for (let next = iterator.next(); ; next = iterator.next()) {
+          let step;
+          try {
+            step = pendingWait ? await Promise.race([
+              next.then((result) => ({ result })),
+              pendingWait.expired.then((reason) => ({ reason }))
+            ]) : { result: await next };
+          } catch (error) {
+            if (settleOnFailure(error)) return;
+            throw error;
+          }
+          if ("reason" in step) {
+            if (!abortInvoked) {
+              debugCodex("\u2605 background wait over (%s) with %d command(s) in flight", step.reason, inFlight.size);
+              if (step.reason === "ceiling" && rootThreadId) await terminateBackgroundTerminals(client, rootThreadId);
+              settle();
+              return;
+            }
+            endWait();
+            step = { result: await next };
+          }
+          if (step.result.done) break;
+          const message = step.result.value;
           if (!firstClientMessageLogged) {
             firstClientMessageLogged = true;
             debugCodex(
@@ -3951,15 +4660,39 @@ var CodexAgentAdapter = class {
           const raw = toRawEvent2(request.runId, message, message.method);
           rawPayloads.push(message);
           sink.emitRaw(raw);
-          if (message.method === "tool/requestUserInput" && message.id !== void 0) {
-            reject(
-              new Error(
-                "Codex tool/requestUserInput approvals are not yet supported by AgentBox."
-              )
-            );
-            return;
+          const item = message.params?.item;
+          const itemKey = fileItemKey(message.params, item?.id);
+          if (itemKey && item?.type === "fileChange") {
+            if (message.method === "item/completed") pendingFileChanges.delete(itemKey);
+            else if (message.method === "item/started" && Array.isArray(item.changes)) {
+              if (pendingFileChanges.size >= 128) pendingFileChanges.delete(pendingFileChanges.keys().next().value);
+              pendingFileChanges.set(itemKey, item.changes);
+            }
+          }
+          if ((message.method === "item/tool/requestUserInput" || message.method === "tool/requestUserInput") && message.id !== void 0) {
+            const questions = normalizeUserQuestions("codex", message.params);
+            const response = hasInteractiveQuestions(request.options) ? await sink.requestPermission(createNormalizedEvent("permission.requested", {
+              provider: request.provider,
+              runId: request.runId,
+              raw
+            }, {
+              requestId: String(message.id),
+              kind: "question",
+              toolName: "request_user_input",
+              title: "Your input is needed",
+              input: message.params,
+              questions,
+              canRemember: false
+            })) : void 0;
+            await client.respond(message.id, { answers: response?.decision === "allow" ? questionReply("codex", message.params, response.answers ?? []) : {} });
+            continue;
           }
-          const permissionEvent = createCodexPermissionEvent(request, message);
+          const approvalKey = fileItemKey(message.params, message.params?.itemId);
+          const permissionEvent = createCodexPermissionEvent(
+            request,
+            message,
+            approvalKey ? pendingFileChanges.get(approvalKey) : void 0
+          );
           if (permissionEvent && message.id !== void 0) {
             const response = interactiveApproval ? await sink.requestPermission(permissionEvent) : {
               requestId: permissionEvent.requestId,
@@ -3968,32 +4701,99 @@ var CodexAgentAdapter = class {
             await client.respond(message.id, {
               decision: toCodexApprovalDecision(message, response)
             });
+            if (approvalKey) pendingFileChanges.delete(approvalKey);
+            continue;
+          }
+          const elicitation = createCodexElicitationPermissionEvent(request, message);
+          if (elicitation && message.id !== void 0) {
+            const response = interactiveApproval ? await sink.requestPermission(elicitation) : { requestId: elicitation.requestId, decision: "allow" };
+            await client.respond(message.id, toCodexElicitationResult(message, response));
+            continue;
+          }
+          if (message.id !== void 0) {
+            debugCodex("unsupported server request %s; declining", message.method);
+            await (message.method === CODEX_ELICITATION_METHOD ? client.respond(message.id, { action: "cancel", content: null }) : client.respondError(message.id, {
+              code: -32601,
+              message: `Unsupported request ${message.method}`
+            }));
             continue;
           }
+          if (message.method === "item/completed") {
+            const item2 = message.params?.item;
+            if (item2?.type === "plan" && typeof item2.text === "string") {
+              sink.emitEvent(createNormalizedEvent("plan.completed", { provider: request.provider, runId: request.runId }, { text: item2.text }));
+            }
+          }
+          const turn = message.params?.turn;
+          const rootTurnCompleted = message.method === "turn/completed" && isRootThread(message.params);
+          const waitAfterTurn = rootTurnCompleted && pendingTurns <= 1 && timeoutMs !== 0 && !abortInvoked && turn?.status === "completed" && (inFlight.size > 0 || finished.length > 0);
           for (const event of toNormalizedCodexEvents(request.runId, message)) {
+            if (event.type === "run.completed" && (waitAfterTurn || turn?.status === "interrupted")) continue;
             sink.emitEvent(event);
             if (event.type === "text.delta") {
               streamedText += event.delta;
+            } else if (event.type === "message.completed" && event.text) {
+              turnMessageText = event.text;
             }
           }
           if (message.method === "thread/started" && !rootThreadId) {
             rootThreadId = message.params?.thread?.id ?? rootThreadId;
           }
           if (message.method === "turn/started") {
-            turnId = message.params?.turn?.id ?? turnId;
+            turnId = turn?.id ?? turnId;
+            if (isRootThread(message.params)) {
+              streamedText = "";
+              turnMessageText = "";
+              if (pendingWait) debugCodex("\u2605 follow-up turn started; background wait over");
+              endWait();
+              emitTasks(liveTasks(), false);
+            }
           }
-          if (message.method === "turn/completed" && (!message.params?.threadId || message.params.threadId === rootThreadId)) {
+          if (item?.type === "commandExecution" && typeof item.id === "string" && isRootThread(message.params)) {
+            if (message.method === "item/started") {
+              inFlight.set(item.id, {
+                id: item.id,
+                command: String(item.command ?? ""),
+                processId: typeof item.processId === "string" ? item.processId : void 0,
+                outlived: false
+              });
+            } else if (message.method === "item/completed") {
+              const tracked = inFlight.get(item.id);
+              inFlight.delete(item.id);
+              if (tracked?.outlived && pendingWait) {
+                finished.push({
+                  ...tracked,
+                  aggregatedOutput: typeof item.aggregatedOutput === "string" ? item.aggregatedOutput : void 0,
+                  exitCode: typeof item.exitCode === "number" ? item.exitCode : void 0,
+                  durationMs: typeof item.durationMs === "number" ? item.durationMs : void 0
+                });
+              }
+              emitTasks(liveTasks(), pendingWait !== void 0);
+              pendingWait?.setIdle(inFlight.size === 0);
+              if (pendingWait && inFlight.size === 0) await sendBackgroundFollowUp();
+            }
+          }
+          if (rootTurnCompleted) {
             pendingTurns--;
             if (pendingTurns <= 0) {
-              const turn = message.params?.turn;
-              const interrupted = turn?.status === "interrupted";
-              resolve({
-                text: streamedText,
-                turnId,
-                threadId: rootThreadId,
-                interrupted
-              });
-              return;
+              const previousText = lastTurn?.text;
+              lastTurn = { text: streamedText, messageText: turnMessageText };
+              if (!waitAfterTurn) {
+                resolve({
+                  text: streamedText || previousText,
+                  turnId,
+                  threadId: rootThreadId,
+                  interrupted: turn?.status === "interrupted"
+                });
+                return;
+              }
+              for (const tracked of inFlight.values()) tracked.outlived = true;
+              debugCodex("\u2605 turn ended with %d command(s) in flight; waiting", inFlight.size);
+              endWait();
+              pendingWait = new BackgroundWait(BACKGROUND_TASK_GRACE_MS, Math.max(0, timeoutMs - waitedMs));
+              pendingWait.setIdle(inFlight.size === 0);
+              emitTasks(liveTasks(), true);
+              if (inFlight.size === 0) await sendBackgroundFollowUp();
             }
           }
           if (message.method === "error" && !shouldIgnoreCodexError(message)) {
@@ -4001,6 +4801,7 @@ var CodexAgentAdapter = class {
             return;
           }
         }
+        if (settleOnFailure(new Error("Codex transport closed."))) return;
         reject(new Error("Codex transport closed before run completed."));
       })().catch(reject);
     });
@@ -4049,6 +4850,13 @@ var CodexAgentAdapter = class {
       sink.emitRaw(
         toRawEvent2(request.runId, threadResponse, threadResultEventName)
       );
+      if (request.run.mode) {
+        const modes = await client.request("collaborationMode/list", {});
+        if (!modes.data.some((mode) => mode.mode === request.run.mode)) throw new Error("This Codex installation does not support the requested planning mode.");
+      }
+      if (request.run.goal) {
+        await client.request("thread/goal/set", { threadId: threadResponse.thread.id, objective: request.run.goal, status: "active" });
+      }
       await client.request(
         "turn/start",
         buildCodexTurnStartParams({
@@ -4064,6 +4872,8 @@ var CodexAgentAdapter = class {
       } catch (err) {
         completionError = err;
       }
+      endWait();
+      emitTasks([], false);
       if (completionError !== void 0) {
         if (abortInvoked) {
           debugCodex(
@@ -4071,31 +4881,32 @@ var CodexAgentAdapter = class {
             Date.now() - executeStartedAt
           );
           sink.cancel({
-            text: streamedText || void 0,
+            text: streamedText || lastTurn?.text || void 0,
             costData: extractCodexCostData(rawPayloads)
           });
         } else {
           sink.fail(completionError);
         }
       } else {
-        const { text, interrupted } = completionResult;
+        const { text: text2, interrupted } = completionResult;
         if (abortInvoked || interrupted) {
           debugCodex(
             "\u2605 run.cancelled (%dms since execute start) interrupted=%s",
             Date.now() - executeStartedAt,
             interrupted
           );
-          sink.cancel({ text, costData: extractCodexCostData(rawPayloads) });
+          sink.cancel({ text: text2, costData: extractCodexCostData(rawPayloads) });
         } else {
           debugCodex(
             "\u2605 run.completed (%dms since execute start) chars=%d",
             Date.now() - executeStartedAt,
-            text?.length ?? 0
+            text2?.length ?? 0
           );
           sink.complete({ costData: extractCodexCostData(rawPayloads) });
         }
       }
     } finally {
+      pendingWait?.clear();
       await runtime.cleanup().catch(() => void 0);
     }
     return async () => void 0;
@@ -4108,36 +4919,51 @@ var CodexAgentAdapter = class {
    * driven by the normalized `message.started` event whose
    * `messageId` IS the codex turnId).
    *
-   * If `sessionId` or `turnId` is missing the call is a no-op.
+   * When that interrupt is rejected — the thread is idle in a background
+   * wait, or the turn id is stale or missing — a turn is started only to be
+   * interrupted, so the originating run still observes an interrupted turn
+   * and cancels; the model's leftover processes are then terminated.
+   * Without `sessionId` the call is a no-op.
    */
   async attachAbort(request) {
     const threadId = request.sessionId;
-    const turnId = request.turnId;
-    if (!threadId || !turnId) {
-      debugCodex(
-        "attachAbort runId=%s skipped: threadId=%s turnId=%s",
-        request.runId,
-        threadId,
-        turnId
-      );
+    if (!threadId) {
+      debugCodex("attachAbort runId=%s skipped: no threadId", request.runId);
       return;
     }
     await withCodexAppServer(request, async (client) => {
-      await Promise.race([
-        client.request("turn/interrupt", { threadId, turnId }),
+      const bounded = (what, promise) => Promise.race([
+        promise,
         new Promise(
-          (_, reject) => setTimeout(
-            () => reject(new Error("codex turn/interrupt timed out")),
-            3e3
-          )
+          (_, reject) => setTimeout(() => reject(new Error(`codex ${what} timed out`)), 3e3)
         )
-      ]).catch((error) => {
-        debugCodex(
-          "attachAbort runId=%s turn/interrupt failed: %o",
-          request.runId,
-          error
+      ]);
+      const interrupt = (turnId) => bounded("turn/interrupt", client.request("turn/interrupt", { threadId, turnId }));
+      if (request.turnId) {
+        try {
+          await interrupt(request.turnId);
+          return;
+        } catch (error) {
+          debugCodex("attachAbort runId=%s turn/interrupt failed: %o", request.runId, error);
+        }
+      }
+      try {
+        const response = await bounded(
+          "turn/start",
+          client.request("turn/start", {
+            threadId,
+            input: [{ type: "text", text: CODEX_CANCEL_TURN_TEXT, text_elements: [] }],
+            approvalPolicy: "never",
+            model: null,
+            effort: null,
+            outputSchema: null
+          })
         );
-      });
+        if (typeof response?.turn?.id === "string") await interrupt(response.turn.id);
+      } catch (error) {
+        debugCodex("attachAbort runId=%s cancel turn failed: %o", request.runId, error);
+      }
+      await terminateBackgroundTerminals(client, threadId);
     });
   }
   /**
@@ -4152,14 +4978,14 @@ var CodexAgentAdapter = class {
       );
     }
     const parts = normalizeUserInput(content);
-    const text = joinTextParts(
+    const text2 = joinTextParts(
       parts.filter(
         (part) => part.type === "text"
       )
     );
     const inputItems = [];
-    if (text.trim().length > 0) {
-      inputItems.push({ type: "text", text, text_elements: [] });
+    if (text2.trim().length > 0) {
+      inputItems.push({ type: "text", text: text2, text_elements: [] });
     }
     await withCodexAppServer(request, async (client) => {
       await client.request("turn/start", {
@@ -4175,10 +5001,10 @@ var CodexAgentAdapter = class {
 };
 
 // src/agents/providers/opencode.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash2, randomBytes, randomUUID as randomUUID2 } from "crypto";
+import os2 from "os";
 import path10 from "path";
 var SANDBOX_OPENCODE_PORT = 4096;
-var LOCAL_OPENCODE_PORT = 4096;
 var SANDBOX_OPENCODE_READY_TIMEOUT_MS = 9e4;
 var LOCAL_OPENCODE_READY_TIMEOUT_MS = 2e4;
 var SHARED_OPENCODE_TARGET_ID = "shared-opencode-server";
@@ -4230,30 +5056,13 @@ function hashLlmApiKeys(env) {
   }
   return hasher.digest("hex");
 }
-async function killLocalOpenCodeServer() {
-  await time(debugOpencode, "kill local opencode server", async () => {
-    const killer = spawnCommand({
-      command: "sh",
-      args: [
-        "-c",
-        `lsof -ti tcp:${LOCAL_OPENCODE_PORT} | xargs kill 2>/dev/null || true`
-      ]
-    });
-    await killer.wait().catch(() => void 0);
-    await waitFor(
-      async () => {
-        try {
-          const res = await fetch(
-            `http://127.0.0.1:${LOCAL_OPENCODE_PORT}/global/health`
-          );
-          return !res.ok;
-        } catch {
-          return true;
-        }
-      },
-      { timeoutMs: 5e3, intervalMs: 200 }
-    ).catch(() => void 0);
-  });
+var localOpenCodeServers = /* @__PURE__ */ new WeakMap();
+async function killLocalOpenCodeServer(options) {
+  const pending = localOpenCodeServers.get(options);
+  if (!pending) return;
+  const server = await pending;
+  await server.process.kill();
+  localOpenCodeServers.delete(options);
 }
 async function killSandboxOpenCodeServer(sandbox, pidFilePath, cwd, port) {
   await time(debugOpencode, "kill sandbox opencode server", async () => {
@@ -4283,6 +5092,9 @@ function toRawEvent3(runId, payload, type) {
     payload
   };
 }
+function injectedTaskResultChild(text2) {
+  return /<task id="?([^"\s>]+)"? state="?(?:completed|error)"?>/.exec(text2)?.[1];
+}
 function toOpenCodeModel(model) {
   if (!model) {
     return void 0;
@@ -4332,6 +5144,7 @@ function createOpenCodePermissionEvent(request, raw, payload) {
     },
     {
       requestId: String(properties.id ?? ""),
+      toolName: permission,
       kind: permission === "bash" ? "bash" : permission === "edit" ? "edit" : permission === "external_directory" ? "file-change" : permission === "webfetch" ? "network" : permission === "task" ? "tool" : "unknown",
       title: `Approve ${permission} permission`,
       message: typeof properties.metadata === "object" && properties.metadata !== null ? JSON.stringify(properties.metadata) : `OpenCode requested ${permission} permission.`,
@@ -4353,6 +5166,7 @@ function buildOpenCodeConfig(options, interactiveApproval) {
     prompt: options.systemPrompt || FALLBACK_OPEN_CODE_AGENT_PROMPT,
     permission: buildOpenCodePermissionConfig(interactiveApproval),
     tools: {
+      question: hasInteractiveQuestions(options),
       write: true,
       edit: true,
       bash: true,
@@ -4407,7 +5221,7 @@ async function ensureSandboxOpenCodeServer(request) {
     const port = SANDBOX_OPENCODE_PORT;
     const plugins = assertHooksSupported(request.provider, options);
     assertCommandsSupported(request.provider, options.commands);
-    const interactiveApproval = isInteractiveApproval(options);
+    const interactiveApproval = !options.fullAccess && isInteractiveApproval(options);
     const target = await createSetupTarget(
       request.provider,
       SHARED_OPENCODE_TARGET_ID,
@@ -4475,7 +5289,8 @@ async function ensureSandboxOpenCodeServer(request) {
     const commonEnv = {
       OPENCODE_CONFIG: configPath,
       OPENCODE_CONFIG_DIR: target.layout.opencodeDir,
-      OPENCODE_DISABLE_DEFAULT_PLUGINS: "true"
+      OPENCODE_DISABLE_DEFAULT_PLUGINS: "true",
+      OPENCODE_ENABLE_QUESTION_TOOL: hasInteractiveQuestions(options) ? "true" : "false"
     };
     await applyDifferentialSetup(target, allArtifacts, installCommands);
     if (enableRtk) {
@@ -4604,85 +5419,91 @@ ${lastLog}` : "")
     await markSetupComplete(target, setupId);
   });
 }
-async function ensureLocalOpenCodeServer(request) {
-  const options = request.options;
-  const plugins = assertHooksSupported(request.provider, options);
-  assertCommandsSupported(request.provider, options.commands);
-  const interactiveApproval = isInteractiveApproval(options);
-  const target = await createSetupTarget(
-    request.provider,
-    "shared-setup",
-    options
-  );
-  const { artifacts: skillArtifacts, installCommands } = await prepareSkillArtifacts(
-    request.provider,
-    options.skills,
-    target.layout
-  );
-  const pluginArtifacts = buildOpenCodePluginArtifacts(
-    plugins,
-    target.layout.opencodeDir
-  );
-  const configPath = path10.join(target.layout.opencodeDir, "agentbox.json");
-  const openCodeConfig = buildOpenCodeConfig(options, interactiveApproval);
-  const commonEnv = {
-    OPENCODE_CONFIG: configPath,
-    OPENCODE_CONFIG_DIR: target.layout.opencodeDir,
-    OPENCODE_DISABLE_DEFAULT_PLUGINS: "true"
-  };
-  const allArtifacts = [
-    ...skillArtifacts,
-    ...pluginArtifacts,
-    {
-      path: configPath,
-      content: JSON.stringify(openCodeConfig, null, 2)
-    }
-  ];
-  const daemonInfo = {
-    port: LOCAL_OPENCODE_PORT,
-    healthPath: "/global/health"
+async function startLocalOpenCodeServer(request) {
+  const originalOptions = request.options;
+  const options = {
+    ...originalOptions,
+    stateDirectory: path10.join(originalOptions.stateDirectory ?? path10.join(os2.tmpdir(), "agentbox-native"), "instances", randomUUID2())
   };
-  const setupId = computeSetupId({
-    artifacts: allArtifacts,
-    installCommands,
-    daemon: daemonInfo,
-    extras: [`apiKeys:${hashLlmApiKeys(options.env)}`]
-  });
-  if (await preflightSetup(target, setupId, daemonInfo)) {
-    debugOpencode("local opencode server up-to-date \u2014 reusing");
-    return;
-  }
-  if (await isLocalOpenCodeServerHealthy()) {
-    debugOpencode(
-      "local opencode server already running but setup drifted \u2014 reusing it without restart; call agent.killServer() to apply the new config"
-    );
-    return;
+  let generatedEnv = {};
+  if (options.configuration !== "native") {
+    const plugins = assertHooksSupported(request.provider, options);
+    assertCommandsSupported(request.provider, options.commands);
+    const target = await createSetupTarget(request.provider, "shared-setup", options);
+    const { artifacts: skillArtifacts, installCommands } = await prepareSkillArtifacts(request.provider, options.skills, target.layout);
+    const configPath = path10.join(target.layout.opencodeDir, "agentbox.json");
+    const artifacts = [
+      ...skillArtifacts,
+      ...buildOpenCodePluginArtifacts(plugins, target.layout.opencodeDir),
+      { path: configPath, content: JSON.stringify(buildOpenCodeConfig(options, isInteractiveApproval(options)), null, 2) }
+    ];
+    await applyDifferentialSetup(target, artifacts, installCommands);
+    generatedEnv = {
+      OPENCODE_CONFIG: configPath,
+      OPENCODE_CONFIG_DIR: target.layout.opencodeDir,
+      OPENCODE_DISABLE_DEFAULT_PLUGINS: "true",
+      OPENCODE_ENABLE_QUESTION_TOOL: hasInteractiveQuestions(options) ? "true" : "false"
+    };
   }
-  debugOpencode("local opencode server absent \u2014 spawning");
-  await applyDifferentialSetup(target, allArtifacts, installCommands);
-  await killLocalOpenCodeServer();
-  spawnCommand({
+  const port = await getAvailablePort();
+  const password = randomBytes(32).toString("base64url");
+  const baseUrl = `http://127.0.0.1:${port}`;
+  const headers = { Authorization: `Basic ${Buffer.from(`opencode:${password}`).toString("base64")}` };
+  const processHandle = spawnCommand({
     command: options.provider?.binary ?? "opencode",
-    args: [
-      "serve",
-      "--hostname",
-      "127.0.0.1",
-      "--port",
-      String(LOCAL_OPENCODE_PORT),
-      ...options.provider?.args ?? []
-    ],
+    args: ["serve", ...options.provider?.args ?? [], "--hostname", "127.0.0.1", "--port", String(port)],
     cwd: options.cwd,
+    processGroup: options.processGroup !== "inherited",
     env: {
       ...process.env,
-      ...options.env ?? {},
-      ...commonEnv
+      ...options.env,
+      ...generatedEnv,
+      ...options.fullAccess ? { OPENCODE_PERMISSION: JSON.stringify({ "*": "allow", question: "ask" }) } : {},
+      ...options.interactiveQuestions === true ? { OPENCODE_ENABLE_QUESTION_TOOL: "true" } : {},
+      OPENCODE_SERVER_USERNAME: "opencode",
+      OPENCODE_SERVER_PASSWORD: password
     }
   });
-  await waitForHttpReady(
-    `http://127.0.0.1:${LOCAL_OPENCODE_PORT}/global/health`,
-    { timeoutMs: LOCAL_OPENCODE_READY_TIMEOUT_MS }
-  );
-  await markSetupComplete(target, setupId);
+  processHandle.child.stdout.resume();
+  processHandle.child.stderr.resume();
+  try {
+    let startupError;
+    void processHandle.wait().then(
+      (code) => {
+        startupError = new Error(`Local OpenCode server exited before startup (${code})`);
+      },
+      (error) => {
+        startupError = error instanceof Error ? error : new Error(String(error));
+      }
+    );
+    await waitFor(async () => {
+      if (startupError) throw startupError;
+      try {
+        return (await fetch(`${baseUrl}/global/health`, { headers, signal: AbortSignal.timeout(1e3) })).ok;
+      } catch {
+        return false;
+      }
+    }, { timeoutMs: LOCAL_OPENCODE_READY_TIMEOUT_MS });
+    const unauthenticated = await fetch(`${baseUrl}/global/health`, { signal: AbortSignal.timeout(3e3) });
+    if (unauthenticated.status !== 401) throw new Error("This OpenCode version does not enforce local server authentication. Upgrade OpenCode before running it through AgentBox.");
+    return { baseUrl, headers, process: processHandle };
+  } catch (error) {
+    await processHandle.kill();
+    throw error;
+  }
+}
+async function ensureLocalOpenCodeServer(request) {
+  let pending = localOpenCodeServers.get(request.options);
+  if (!pending) {
+    pending = startLocalOpenCodeServer(request);
+    localOpenCodeServers.set(request.options, pending);
+  }
+  try {
+    await pending;
+  } catch (error) {
+    localOpenCodeServers.delete(request.options);
+    throw error;
+  }
 }
 async function setupOpenCode(request) {
   if (request.options.sandbox) {
@@ -4695,16 +5516,6 @@ async function isSandboxOpenCodeServerHealthy(sandbox, cwd, port) {
   const probe = await sandbox.run(opencodeHealthCurl(port), { cwd, timeoutMs: 5e3 }).catch(() => void 0);
   return probe?.exitCode === 0;
 }
-async function isLocalOpenCodeServerHealthy() {
-  try {
-    const res = await fetch(
-      `http://127.0.0.1:${LOCAL_OPENCODE_PORT}/global/health`
-    );
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
 async function killOpenCodeServer(request) {
   const { options } = request;
   if (options.sandbox) {
@@ -4725,24 +5536,22 @@ async function killOpenCodeServer(request) {
     );
     return;
   }
-  await killLocalOpenCodeServer();
+  await killLocalOpenCodeServer(options);
 }
 async function buildOpenCodeRuntime(options) {
   if (options.sandbox) {
     const sandbox = options.sandbox;
-    const baseUrl2 = (await sandbox.getPreviewLink(SANDBOX_OPENCODE_PORT)).replace(/\/$/, "");
+    const baseUrl = (await sandbox.getPreviewLink(SANDBOX_OPENCODE_PORT)).replace(/\/$/, "");
     return {
-      baseUrl: baseUrl2,
+      baseUrl,
       previewHeaders: await opencodeAuthHeaders(sandbox),
-      raw: { baseUrl: baseUrl2, port: SANDBOX_OPENCODE_PORT }
+      raw: { baseUrl, port: SANDBOX_OPENCODE_PORT }
     };
   }
-  const baseUrl = `http://127.0.0.1:${LOCAL_OPENCODE_PORT}`;
-  return {
-    baseUrl,
-    previewHeaders: {},
-    raw: { baseUrl, port: LOCAL_OPENCODE_PORT }
-  };
+  const pending = localOpenCodeServers.get(options);
+  if (!pending) throw new Error("Local OpenCode server has not been set up by this Agent instance");
+  const server = await pending;
+  return { baseUrl: server.baseUrl, previewHeaders: server.headers, raw: { baseUrl: server.baseUrl } };
 }
 var OpenCodeAgentAdapter = class {
   async setup(request) {
@@ -4811,37 +5620,151 @@ var OpenCodeAgentAdapter = class {
       resolveSessionTerminal = resolve;
     });
     let lastSseActivityAt = Date.now();
+    const postAbort = async (id) => {
+      try {
+        await Promise.race([
+          fetchJson(`${runtime.baseUrl}/session/${id}/abort`, {
+            method: "POST",
+            headers: {
+              "content-type": "application/json",
+              ...runtime.previewHeaders
+            }
+          }),
+          new Promise(
+            (_, reject) => setTimeout(
+              () => reject(new Error("opencode POST /session/abort timed out")),
+              3e3
+            )
+          )
+        ]);
+      } catch {
+      }
+    };
     let userAbortRequested = false;
     sink.setAbort(async () => {
       userAbortRequested = true;
       const sessionIdAtAbort = capturedSessionId;
-      if (sessionIdAtAbort) {
-        try {
-          await Promise.race([
-            fetchJson(
-              `${runtime.baseUrl}/session/${sessionIdAtAbort}/abort`,
-              {
-                method: "POST",
-                headers: {
-                  "content-type": "application/json",
-                  ...runtime.previewHeaders
-                }
-              }
-            ),
-            new Promise(
-              (_, reject) => setTimeout(
-                () => reject(new Error("opencode POST /session/abort timed out")),
-                3e3
-              )
-            )
-          ]);
-        } catch {
-        }
-      }
+      if (sessionIdAtAbort) await postAbort(sessionIdAtAbort);
       resolveSessionTerminal();
     });
+    const backgroundTimeoutMs = resolveBackgroundTaskTimeoutMs(
+      request.options.backgroundTaskTimeoutMs
+    );
+    const trackChildren = backgroundTimeoutMs !== 0;
+    const children = /* @__PURE__ */ new Map();
+    const liveChildren = () => [...children.values()].filter((child) => child.live).map((child) => ({
+      id: child.id,
+      type: "subagent",
+      description: child.title
+    }));
+    const shouldWait = () => [...children.values()].some((child) => child.background) && liveChildren().length > 0;
+    let pendingWait;
+    let waitedMs = 0;
+    let expiry;
+    let sawParentIdle = false;
+    let lastTasksKey = JSON.stringify({ tasks: [], waiting: false });
+    const emitTasks = (tasks, waiting) => {
+      const key = JSON.stringify({ tasks, waiting });
+      if (key === lastTasksKey) return;
+      lastTasksKey = key;
+      sink.emitEvent(
+        createNormalizedEvent(
+          "background.tasks",
+          { provider: request.provider, runId: request.runId },
+          { tasks, waiting }
+        )
+      );
+    };
+    const endWait = () => {
+      if (!pendingWait) return;
+      waitedMs += pendingWait.elapsedMs();
+      pendingWait.clear();
+      pendingWait = void 0;
+    };
+    const onChildrenChanged = () => {
+      if (!pendingWait) return;
+      const live = liveChildren();
+      emitTasks(live, true);
+      pendingWait.setIdle(live.length === 0);
+    };
+    const registerChild = (id, title, background = false) => {
+      const known = children.get(id);
+      if (known) {
+        known.background ||= background;
+        if (title && title !== known.title) {
+          known.title = title;
+          onChildrenChanged();
+        }
+        return;
+      }
+      children.set(id, { id, title: title ?? "", live: true, background });
+      onChildrenChanged();
+    };
+    const setChildLive = (id, live) => {
+      const child = children.get(id);
+      if (!child || child.live === live) return;
+      child.live = live;
+      onChildrenChanged();
+    };
+    const reconcileChildren = async () => {
+      const live = [...children.values()].filter((child) => child.live);
+      if (live.length === 0) return;
+      const statuses = await withTimeout(
+        fetchJson(
+          `${runtime.baseUrl}/session/status`,
+          { headers: runtime.previewHeaders }
+        ).catch(() => void 0),
+        3e3
+      );
+      if (!statuses || typeof statuses !== "object") return;
+      for (const child of live) {
+        const status = statuses[child.id];
+        if (!status || status.type === "idle") setChildLive(child.id, false);
+      }
+    };
+    const onParentIdle = async () => {
+      sawParentIdle = true;
+      if (pendingWait || sessionIdleFromSse) return;
+      const tracking = trackChildren && !userAbortRequested;
+      if (tracking && shouldWait()) await reconcileChildren();
+      if (!tracking || !shouldWait()) {
+        sessionIdleFromSse = true;
+        resolveSessionTerminal();
+        return;
+      }
+      const live = liveChildren();
+      debugOpencode(
+        "\u2605 parent idle with %d live subagent(s); waiting",
+        live.length
+      );
+      const wait = new BackgroundWait(
+        BACKGROUND_TASK_GRACE_MS,
+        Math.max(0, backgroundTimeoutMs - waitedMs)
+      );
+      pendingWait = wait;
+      void wait.expired.then((reason) => {
+        if (pendingWait !== wait) return;
+        expiry = reason;
+        resolveSessionTerminal();
+      });
+      emitTasks(live, true);
+    };
+    const onParentBusy = () => {
+      if (!pendingWait) return;
+      debugOpencode(
+        "\u2605 parent resumed after %dms of background wait",
+        pendingWait.elapsedMs()
+      );
+      endWait();
+      emitTasks(liveChildren(), false);
+    };
+    const onInjectedResult = (childId) => {
+      if (!children.has(childId)) return;
+      setChildLive(childId, false);
+      onParentBusy();
+    };
     try {
-      const interactiveApproval = isInteractiveApproval(request.options);
+      const interactiveApproval = !request.options.fullAccess && isInteractiveApproval(request.options);
       let forkedSession = null;
       if (request.run.forkSessionId) {
         forkedSession = await fetchJson(
@@ -4942,6 +5865,12 @@ var OpenCodeAgentAdapter = class {
               const info = properties?.info;
               if (info && typeof info.id === "string" && typeof info.parentID === "string" && runSessionIds.has(info.parentID)) {
                 runSessionIds.add(info.id);
+                if (trackChildren && info.parentID === sessionId) {
+                  registerChild(
+                    info.id,
+                    typeof info.title === "string" ? info.title : void 0
+                  );
+                }
               }
             }
             if (eventType === "message.updated") {
@@ -4982,6 +5911,32 @@ var OpenCodeAgentAdapter = class {
                 }
               }
             }
+            if (eventType === "question.asked") {
+              const properties = payload.properties;
+              if (properties && typeof properties.id === "string" && typeof properties.sessionID === "string" && await resolveRunSession(properties.sessionID)) {
+                const questions = normalizeUserQuestions("open-code", properties);
+                const response = hasInteractiveQuestions(request.options) ? await sink.requestPermission(createNormalizedEvent("permission.requested", {
+                  provider: request.provider,
+                  runId: request.runId,
+                  raw
+                }, {
+                  requestId: properties.id,
+                  kind: "question",
+                  toolName: "question",
+                  title: "Your input is needed",
+                  input: properties,
+                  questions,
+                  canRemember: false
+                })) : void 0;
+                const allowed = response?.decision === "allow";
+                await fetchJson(`${runtime.baseUrl}/question/${encodeURIComponent(properties.id)}/${allowed ? "reply" : "reject"}`, {
+                  method: "POST",
+                  headers: { "content-type": "application/json", ...runtime.previewHeaders },
+                  body: JSON.stringify(allowed ? { answers: questionReply("open-code", properties, response.answers ?? []) } : {})
+                });
+              }
+              continue;
+            }
             if (eventType === "permission.asked") {
               const properties = payload.properties;
               if (properties && typeof properties.sessionID === "string" && await resolveRunSession(properties.sessionID)) {
@@ -5024,28 +5979,35 @@ var OpenCodeAgentAdapter = class {
                     const errMsg = typeof errData?.data?.message === "string" ? errData.data.message : typeof errData?.message === "string" ? errData.message : "OpenCode session error";
                     sessionErrorFromSse = new Error(errMsg);
                   }
+                  resolveSessionTerminal();
                 } else {
-                  sessionIdleFromSse = true;
+                  await onParentIdle();
                 }
                 debugOpencode(
                   "\u2605 %s for session=%s",
                   payloadRecord.type,
                   sessionId
                 );
-                resolveSessionTerminal();
+              } else if (trackChildren && payloadRecord.type === "session.idle") {
+                setChildLive(eventSessionId, false);
               }
             }
             if (payloadRecord?.type === "session.status") {
               const properties = payloadRecord.properties;
               const status = properties?.status;
               const eventSessionId = typeof properties?.sessionID === "string" ? properties.sessionID : void 0;
-              if ((!eventSessionId || eventSessionId === sessionId) && status?.type === "idle") {
-                sessionIdleFromSse = true;
-                debugOpencode(
-                  "\u2605 session.status{idle} for session=%s",
-                  sessionId
-                );
-                resolveSessionTerminal();
+              if (!eventSessionId || eventSessionId === sessionId) {
+                if (status?.type === "idle") {
+                  debugOpencode(
+                    "\u2605 session.status{idle} for session=%s",
+                    sessionId
+                  );
+                  await onParentIdle();
+                } else if (status?.type === "busy" || status?.type === "retry") {
+                  onParentBusy();
+                }
+              } else if (trackChildren) {
+                setChildLive(eventSessionId, status?.type !== "idle");
               }
             }
             if (payloadRecord?.type === "message.part.updated") {
@@ -5054,6 +6016,22 @@ var OpenCodeAgentAdapter = class {
               if (part && typeof part.id === "string" && typeof part.type === "string") {
                 partTypeById.set(part.id, part.type);
               }
+              if (trackChildren && part?.type === "tool" && part.tool === "task" && part.sessionID === sessionId) {
+                const state = part.state;
+                const metadata = state?.metadata;
+                const childId = metadata?.sessionId ?? metadata?.jobId;
+                if (metadata?.background === true && typeof childId === "string") {
+                  registerChild(
+                    childId,
+                    typeof state?.title === "string" ? state.title : void 0,
+                    true
+                  );
+                }
+              }
+              if (trackChildren && part?.type === "text" && part.synthetic === true && part.sessionID === sessionId && typeof part.text === "string") {
+                const childId = injectedTaskResultChild(part.text);
+                if (childId) onInjectedResult(childId);
+              }
             }
             if (payloadRecord?.type === "message.part.delta") {
               const properties = payloadRecord.properties;
@@ -5064,6 +6042,9 @@ var OpenCodeAgentAdapter = class {
               if (isForeignSession) {
                 continue;
               }
+              if (eventMessageId !== void 0 && announcedUserMessageIds.has(eventMessageId)) {
+                continue;
+              }
               const delta = typeof properties?.delta === "string" ? properties.delta : "";
               const field = typeof properties?.field === "string" ? properties.field : void 0;
               const partType = eventPartId ? partTypeById.get(eventPartId) : void 0;
@@ -5129,6 +6110,12 @@ var OpenCodeAgentAdapter = class {
         })
       );
       const agentSlug = openCodeAgentSlug(request.run.reasoning);
+      if (request.run.goal) throw new Error("Native goals are not supported by OpenCode.");
+      if (request.run.mode) {
+        const agents = await fetchJson(`${runtime.baseUrl}/agent`, { headers: runtime.previewHeaders });
+        const name = request.run.mode === "plan" ? "plan" : "build";
+        if (!agents.some((agent) => agent.name === name)) throw new Error(`This OpenCode installation does not expose the ${name} agent.`);
+      }
       const dispatchPrompt = async (parts) => {
         const body = JSON.stringify({
           ...request.run.model ? { model: toOpenCodeModel(request.run.model) } : {},
@@ -5144,7 +6131,8 @@ var OpenCodeAgentAdapter = class {
           // instead. This per-message field stays as a per-run
           // override path that's effective for codex/GPT/Gemini.
           ...request.run.systemPrompt ? { system: request.run.systemPrompt } : {},
-          agent: agentSlug,
+          ...request.options.configuration === "native" ? request.run.reasoning ? { variant: request.run.reasoning } : {} : { agent: agentSlug },
+          ...request.run.mode ? { agent: request.run.mode === "plan" ? "plan" : "build" } : {},
           parts
         });
         const url = `${runtime.baseUrl}/session/${sessionId}/prompt_async`;
@@ -5207,13 +6195,22 @@ var OpenCodeAgentAdapter = class {
       const SSE_POLL_INTERVAL_MS = 5e3;
       lastSseActivityAt = Date.now();
       let sseSilent = false;
-      while (!sessionIdleFromSse && !sessionErrorFromSse && !sessionAbortedFromSse && !userAbortRequested && !dispatchError) {
+      while (!sessionIdleFromSse && !sessionErrorFromSse && !sessionAbortedFromSse && !userAbortRequested && !dispatchError && !expiry) {
         const silence = Date.now() - lastSseActivityAt;
         if (silence > SSE_SILENCE_THRESHOLD_MS) {
+          if (pendingWait && sawParentIdle) {
+            debugOpencode(
+              "SSE went silent (%dms) during background wait; settling",
+              silence
+            );
+            expiry = "transport";
+            break;
+          }
           sseSilent = true;
           debugOpencode("SSE went silent (%dms) \u2014 giving up", silence);
           break;
         }
+        if (pendingWait && liveChildren().length > 0) await reconcileChildren();
         await Promise.race([
           sessionTerminal,
           new Promise(
@@ -5223,6 +6220,16 @@ var OpenCodeAgentAdapter = class {
       }
       sseAbort.abort();
       await sseTask;
+      if (expiry === "ceiling" || (sessionErrorFromSse || dispatchError) && liveChildren().length > 0) {
+        debugOpencode(
+          "\u2605 run over (%s) with %d subagent(s) live; aborting them",
+          expiry ?? "failure",
+          liveChildren().length
+        );
+        await postAbort(sessionId);
+      }
+      endWait();
+      emitTasks([], false);
       if (userAbortRequested || sessionAbortedFromSse) {
         debugOpencode(
           "\u2605 run.cancelled (%dms since execute start)",
@@ -5236,15 +6243,15 @@ var OpenCodeAgentAdapter = class {
         sink.fail(sessionErrorFromSse);
       } else if (dispatchError) {
         sink.fail(dispatchError);
-      } else if (sessionIdleFromSse) {
+      } else if (sessionIdleFromSse || expiry) {
         debugOpencode(
           "\u2605 run.completed (%dms since execute start) chars=%d",
           Date.now() - executeStartedAt,
           streamedTextFromSse.length
         );
         let lastAssistantText = "";
-        for (const [messageId, text] of assistantTextByMessageId) {
-          lastAssistantText = text;
+        for (const [messageId, text2] of assistantTextByMessageId) {
+          lastAssistantText = text2;
           if (!announcedAssistantCompletions.has(messageId)) {
             announcedAssistantCompletions.add(messageId);
             sink.emitEvent(
@@ -5254,7 +6261,7 @@ var OpenCodeAgentAdapter = class {
                   provider: request.provider,
                   runId: request.runId
                 },
-                { text }
+                { text: text2 }
               )
             );
           }
@@ -5281,6 +6288,7 @@ var OpenCodeAgentAdapter = class {
         sink.fail(new Error("opencode run ended without a terminal signal"));
       }
     } finally {
+      endWait();
       sseAbort.abort();
       if (sseTask) {
         await sseTask.catch(() => void 0);
@@ -5423,6 +6431,18 @@ function createAdapter(provider) {
   }
 }
 function prepareAgentOptions(_provider, options) {
+  if (options.stateDirectory !== void 0) {
+    if (options.sandbox) throw new Error("stateDirectory is only supported for host execution.");
+    if (!path11.isAbsolute(options.stateDirectory)) throw new Error("stateDirectory must be an absolute path.");
+  }
+  if (options.sandbox && options.processGroup !== void 0) throw new Error("processGroup is only supported for host execution.");
+  resolveBackgroundTaskTimeoutMs(options.backgroundTaskTimeoutMs);
+  if (options.configuration === "native") {
+    if (options.sandbox) throw new Error("Native configuration is only supported for host execution.");
+    if (options.mcps?.length || options.skills?.length || options.subAgents?.length || options.commands?.length || options.enableRtk) {
+      throw new Error("Native configuration uses the harness's own skills, MCPs, commands, and hooks.");
+    }
+  }
   return options;
 }
 var AgentRunController = class {
@@ -5552,12 +6572,15 @@ var AgentRunController = class {
         `Permission request ${response.requestId} is not pending for this run.`
       );
     }
+    const answers = pending.event.kind === "question" && response.decision === "allow" ? validateUserAnswers(pending.event.questions, response.answers) : void 0;
+    if (response.answers && !answers) throw new Error("Answers are only accepted for an allowed question request");
     this.pendingPermissions.delete(response.requestId);
     const remember = pending.event.canRemember ? response.remember : void 0;
     const resolvedResponse = {
       requestId: response.requestId,
       decision: response.decision,
-      ...remember !== void 0 ? { remember } : {}
+      ...remember !== void 0 ? { remember } : {},
+      ...answers ? { answers } : {}
     };
     this.pushEvent(
       createNormalizedEvent(
@@ -5569,7 +6592,8 @@ var AgentRunController = class {
         {
           requestId: response.requestId,
           decision: response.decision,
-          ...remember !== void 0 ? { remember } : {}
+          ...remember !== void 0 ? { remember } : {},
+          ...answers ? { answers } : {}
         }
       )
     );
@@ -5666,6 +6690,10 @@ var AgentRunController = class {
     if (this.settled) {
       return;
     }
+    if (this.abortRequested) {
+      this.cancel();
+      return;
+    }
     const normalizedError = asError(error);
     this.clearPendingPermissions(normalizedError);
     this.emitEvent(
@@ -5700,6 +6728,7 @@ var AgentRunController = class {
   }
   async abort() {
     this.abortRequested = true;
+    this.clearPendingPermissions(new Error("Agent run cancelled"));
     await this.abortHandler();
   }
   rawEvents() {
@@ -5812,7 +6841,7 @@ var Agent = class {
     if (runConfig.forkAtMessageId && !runConfig.forkSessionId) {
       throw new Error("AgentRunConfig.forkAtMessageId requires forkSessionId.");
     }
-    const runId = runConfig.runId ?? randomUUID2();
+    const runId = runConfig.runId ?? randomUUID3();
     const streamCalledAt = Date.now();
     debugAgent("stream() provider=%s runId=%s", this.provider, runId);
     const run = new AgentRunController(this.provider, runId);
@@ -5880,8 +6909,33 @@ var Agent = class {
   }
 };
 
+// src/agents/commands.ts
+function harnessCapabilities(provider) {
+  return { commands: provider === "open-code" ? ["plan", "agent"] : ["plan", "agent", "goal"], planning: provider === "codex" ? "explicit" : "agent-directed", questions: true, fullAccess: true };
+}
+function resolveHarnessCommand(provider, input) {
+  const first = typeof input === "string" ? input : input.find((part) => part.type === "text")?.text;
+  const match = first?.match(/^\s*\/(plan|agent|goal)(?:\s+([\s\S]*))?$/);
+  if (!match) return { input };
+  const command = match[1];
+  if (!harnessCapabilities(provider).commands.includes(command)) throw new Error(`/${command} is not supported by ${provider}.`);
+  const body = match[2]?.trim() ?? "";
+  if (command === "goal" && (!body || body.length > 4e3)) throw new Error("/goal requires an objective of 1\u20134000 characters.");
+  if (command === "goal" && provider === "claude-code") return { input, goal: body };
+  const text2 = body || (command === "plan" ? "Plan the requested work." : "Continue with implementation.");
+  let replaced = false;
+  const cleaned = typeof input === "string" ? text2 : input.map((part) => {
+    if (part.type !== "text" || replaced) return part;
+    replaced = true;
+    return { ...part, text: text2 };
+  });
+  return command === "goal" ? { input: cleaned, goal: body } : { input: cleaned, mode: command === "plan" ? "plan" : "default" };
+}
+
 export {
   agentboxRoot,
   getAgentLayout,
-  Agent
+  Agent,
+  harnessCapabilities,
+  resolveHarnessCommand
 };