agor-live 0.18.0 → 0.19.1

package/dist/executor/sdk-handlers/claude/permissions/permission-hooks.js

@@ -5,8 +5,8 @@
  * Fires AFTER SDK checks settings.json, respects user's existing permissions.
  * Uses SDK's built-in permission persistence via updatedPermissions.
  */
-import { generateId } from '@agor/core';
-import { InputRequestStatus, MessageRole, PermissionScope, PermissionStatus, SessionStatus, TaskStatus, } from '@agor/core/types';
+import { generateId, shortId } from '@agor/core';
+import { MessageRole, PermissionScope, PermissionStatus, SessionStatus, TaskStatus, } from '@agor/core/types';
 /**
  * Create canUseTool callback for permission handling
  *
@@ -16,140 +16,6 @@ import { InputRequestStatus, MessageRole, PermissionScope, PermissionStatus, Ses
  */
 export function createCanUseToolCallback(sessionId, taskId, deps) {
     return async (toolName, toolInput, options) => {
-        // Intercept AskUserQuestion tool calls (BEFORE permission flow)
-        // This tool is Claude's way of asking the user interactive questions with options.
-        // We route it through Agor's UI instead of the CLI.
-        if (toolName === 'AskUserQuestion' && deps.inputRequestService) {
-            console.log(`❓ [canUseTool] Intercepting AskUserQuestion tool call`);
-            try {
-                const requestId = generateId();
-                const timestamp = new Date().toISOString();
-                // Extract questions from tool input
-                const questions = toolInput.questions || [];
-                // Get current message index for this session
-                const existingMessages = await deps.messagesRepo.findBySessionId(sessionId);
-                const nextIndex = existingMessages.length;
-                // Create input_request message
-                const inputMessage = {
-                    message_id: generateId(),
-                    session_id: sessionId,
-                    task_id: taskId,
-                    type: 'input_request',
-                    role: MessageRole.SYSTEM,
-                    index: nextIndex,
-                    timestamp,
-                    content_preview: questions.length > 0
-                        ? `Question: ${questions[0].question.substring(0, 100)}`
-                        : 'User input required',
-                    content: {
-                        request_id: requestId,
-                        task_id: taskId,
-                        questions,
-                        status: InputRequestStatus.PENDING,
-                    },
-                };
-                if (deps.messagesService) {
-                    await deps.messagesService.create(inputMessage);
-                    console.log(`✅ [canUseTool] Input request message created`);
-                }
-                // Update task status to 'awaiting_input'
-                await deps.tasksService.patch(taskId, {
-                    status: TaskStatus.AWAITING_INPUT,
-                });
-                // Update session status to 'awaiting_input'
-                if (deps.sessionsService) {
-                    await deps.sessionsService.patch(sessionId, {
-                        status: SessionStatus.AWAITING_INPUT,
-                    });
-                }
-                // Emit WebSocket event for UI
-                await deps.inputRequestService.emitRequest(sessionId, {
-                    requestId,
-                    taskId,
-                    questions,
-                    timestamp,
-                });
-                // Wait for user response (Promise pauses SDK execution)
-                const response = await deps.inputRequestService.waitForResponse(requestId, taskId, sessionId, options.signal);
-                // Handle timeout
-                if (response.timedOut) {
-                    console.log(`⏰ [canUseTool] Input request timed out, setting timed_out state...`);
-                    // Update message status
-                    if (deps.messagesService) {
-                        await deps.messagesService.patch(inputMessage.message_id, {
-                            content: {
-                                ...inputMessage.content,
-                                status: InputRequestStatus.TIMED_OUT,
-                            },
-                        });
-                    }
-                    await deps.tasksService.patch(taskId, {
-                        status: TaskStatus.TIMED_OUT,
-                        completed_at: new Date().toISOString(),
-                    });
-                    if (deps.sessionsService) {
-                        await deps.sessionsService.patch(sessionId, {
-                            status: SessionStatus.TIMED_OUT,
-                            ready_for_prompt: true,
-                        });
-                    }
-                    return {
-                        behavior: 'deny',
-                        message: 'User input request timed out. Send a new prompt to retry.',
-                    };
-                }
-                // Update message with answer
-                if (deps.messagesService) {
-                    await deps.messagesService.patch(inputMessage.message_id, {
-                        content: {
-                            ...inputMessage.content,
-                            status: InputRequestStatus.ANSWERED,
-                            answers: response.answers,
-                            annotations: response.annotations,
-                            answered_by: response.respondedBy,
-                            answered_at: new Date().toISOString(),
-                        },
-                    });
-                }
-                // Restore task/session status to running
-                await deps.tasksService.patch(taskId, {
-                    status: TaskStatus.RUNNING,
-                });
-                if (deps.sessionsService) {
-                    await deps.sessionsService.patch(sessionId, {
-                        status: SessionStatus.RUNNING,
-                    });
-                }
-                // Return allow with answers injected into the tool input
-                return {
-                    behavior: 'allow',
-                    updatedInput: {
-                        ...toolInput,
-                        answers: response.answers,
-                        annotations: response.annotations,
-                    },
-                };
-            }
-            catch (error) {
-                console.error('[canUseTool] Error in AskUserQuestion flow:', error);
-                return {
-                    behavior: 'deny',
-                    message: error instanceof Error ? error.message : 'Error processing user question',
-                };
-            }
-        }
-        // Bypass-mode fast-path: when permissionMode is `bypassPermissions`, the SDK
-        // would normally skip canUseTool entirely. We register the callback anyway
-        // so AskUserQuestion (handled above) still routes through Agor's UI — but
-        // every other tool should be auto-allowed without prompting, matching the
-        // mode's semantics. Without this, registering canUseTool in bypass mode
-        // would force every tool through the WebSocket permission flow.
-        if (deps.permissionMode === 'bypassPermissions') {
-            return {
-                behavior: 'allow',
-                updatedInput: toolInput,
-            };
-        }
         // Auto-approve MCP tools only if they belong to an attached MCP server
         // MCP tool names follow pattern: mcp__<server_name>__<tool_name>
         if (toolName.startsWith('mcp__')) {
@@ -221,7 +87,7 @@ export function createCanUseToolCallback(sessionId, taskId, deps) {
             // STEP 1: Wait for any pending permission check to finish (queue serialization)
             const existingLock = deps.permissionLocks.get(sessionId);
             if (existingLock) {
-                console.log(`⏳ [canUseTool] Waiting for pending permission check (session ${sessionId.substring(0, 8)})`);
+                console.log(`⏳ [canUseTool] Waiting for pending permission check (session ${shortId(sessionId)})`);
                 await existingLock;
                 console.log(`✅ [canUseTool] Permission check complete, proceeding...`);
             }
@@ -416,7 +282,7 @@ export function createCanUseToolCallback(sessionId, taskId, deps) {
             if (releaseLock) {
                 releaseLock();
                 deps.permissionLocks.delete(sessionId);
-                console.log(`🔓 [canUseTool] Released permission lock for session ${sessionId.substring(0, 8)}`);
+                console.log(`🔓 [canUseTool] Released permission lock for session ${shortId(sessionId)}`);
             }
         }
     };

package/dist/executor/sdk-handlers/claude/prompt-service.d.ts

@@ -8,7 +8,7 @@ import type { PermissionMode } from '@agor/core/sdk';
 import type { MCPServerRepository, MessagesRepository, SessionMCPServerRepository, SessionRepository, UsersRepository, WorktreeRepository } from '../../db/feathers-repositories.js';
 import type { PermissionService } from '../../permissions/permission-service.js';
 import type { SessionID, TaskID } from '../../types.js';
-import type { SessionsService, TasksService } from './claude-tool.js';
+import type { MessagesService, SessionsPatchClient, TasksService } from '../base/index.js';
 import { type ProcessedEvent } from './message-processor.js';
 export interface PromptResult {
     /** Assistant messages (can be multiple: tool invocation, then response) */
@@ -44,7 +44,6 @@ export declare class ClaudePromptService {
     private reposRepo?;
     private messagesService?;
     private mcpEnabled?;
-    private inputRequestService?;
     private usersRepo?;
     /** Enable token-level streaming from Claude Agent SDK */
     private static readonly ENABLE_TOKEN_STREAMING;
@@ -52,9 +51,9 @@ export declare class ClaudePromptService {
     private static readonly IDLE_TIMEOUT_MS;
     /** Serialize permission checks per session to prevent duplicate prompts for concurrent tool calls */
     private permissionLocks;
-    constructor(messagesRepo: MessagesRepository, sessionsRepo: SessionRepository, apiKey?: string | undefined, sessionMCPRepo?: SessionMCPServerRepository | undefined, mcpServerRepo?: MCPServerRepository | undefined, permissionService?: PermissionService | undefined, tasksService?: TasksService | undefined, sessionsService?: SessionsService | undefined, // FeathersJS Sessions service for WebSocket broadcasting
-    worktreesRepo?: WorktreeRepository | undefined, reposRepo?: import("../../db/feathers-repositories").RepoRepository | undefined, messagesService?: import("./claude-tool").MessagesService | undefined, // FeathersJS Messages service for creating permission requests
-    mcpEnabled?: boolean | undefined, inputRequestService?: import("../../input-requests/input-request-service").InputRequestService | undefined, usersRepo?: UsersRepository | undefined);
+    constructor(messagesRepo: MessagesRepository, sessionsRepo: SessionRepository, apiKey?: string | undefined, sessionMCPRepo?: SessionMCPServerRepository | undefined, mcpServerRepo?: MCPServerRepository | undefined, permissionService?: PermissionService | undefined, tasksService?: TasksService | undefined, sessionsService?: SessionsPatchClient | undefined, // FeathersJS Sessions service for WebSocket broadcasting
+    worktreesRepo?: WorktreeRepository | undefined, reposRepo?: import("../../db/feathers-repositories").RepoRepository | undefined, messagesService?: MessagesService | undefined, // FeathersJS Messages service for creating permission requests
+    mcpEnabled?: boolean | undefined, usersRepo?: UsersRepository | undefined);
     /**
      * Build help message for CLI-only commands that don't work through the SDK
      */

package/dist/executor/sdk-handlers/claude/prompt-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-service.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/prompt-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EACnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,KAAK,cAAc,EAAuB,MAAM,wBAAwB,CAAC;AAGlF,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,QAAQ,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACjC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,KAAK,CAAC;YACf,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAChC,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,mBAAmB;IAW5B,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,MAAM,CAAC;IACf,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,aAAa,CAAC;IACtB,OAAO,CAAC,iBAAiB,CAAC;IAC1B,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,aAAa,CAAC;IACtB,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,UAAU,CAAC;IACnB,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,SAAS,CAAC;IAvBpB,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAEtD,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAU;IAEjD,qGAAqG;IACrG,OAAO,CAAC,eAAe,CAAuC;gBAGpD,YAAY,EAAE,kBAAkB,EAChC,YAAY,EAAE,iBAAiB,EAC/B,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,cAAc,CAAC,EAAE,0BAA0B,YAAA,EAC3C,aAAa,CAAC,EAAE,mBAAmB,YAAA,EACnC,iBAAiB,CAAC,EAAE,iBAAiB,YAAA,EACrC,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,eAAe,CAAC,EAAE,eAAe,YAAA,EAAE,yDAAyD;IAC5F,aAAa,CAAC,EAAE,kBAAkB,YAAA,EAClC,SAAS,CAAC,EAAE,OAAO,gCAAgC,EAAE,cAAc,YAAA,EACnE,eAAe,CAAC,EAAE,OAAO,eAAe,EAAE,eAAe,YAAA,EAAE,+DAA+D;IAC1H,UAAU,CAAC,EAAE,OAAO,YAAA,EACpB,mBAAmB,CAAC,EAAE,OAAO,4CAA4C,EAAE,mBAAmB,YAAA,EAC9F,SAAS,CAAC,EAAE,eAAe,YAAA;IAKrC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;;;;;;;;;;;;OAaG;IACI,sBAAsB,CAC3B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,EAC3D,eAAe,CAAC,EAAE,eAAe,GAChC,cAAc,CAAC,cAAc,CAAC;IAsNjC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAyHhF;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAQrF"}
+{"version":3,"file":"prompt-service.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/prompt-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EACnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,KAAK,cAAc,EAAuB,MAAM,wBAAwB,CAAC;AAGlF,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,QAAQ,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACjC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,KAAK,CAAC;YACf,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAChC,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,mBAAmB;IAW5B,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,MAAM,CAAC;IACf,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,aAAa,CAAC;IACtB,OAAO,CAAC,iBAAiB,CAAC;IAC1B,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,aAAa,CAAC;IACtB,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,UAAU,CAAC;IACnB,OAAO,CAAC,SAAS,CAAC;IAtBpB,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAEtD,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAU;IAEjD,qGAAqG;IACrG,OAAO,CAAC,eAAe,CAAuC;gBAGpD,YAAY,EAAE,kBAAkB,EAChC,YAAY,EAAE,iBAAiB,EAC/B,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,cAAc,CAAC,EAAE,0BAA0B,YAAA,EAC3C,aAAa,CAAC,EAAE,mBAAmB,YAAA,EACnC,iBAAiB,CAAC,EAAE,iBAAiB,YAAA,EACrC,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,eAAe,CAAC,EAAE,mBAAmB,YAAA,EAAE,yDAAyD;IAChG,aAAa,CAAC,EAAE,kBAAkB,YAAA,EAClC,SAAS,CAAC,EAAE,OAAO,gCAAgC,EAAE,cAAc,YAAA,EACnE,eAAe,CAAC,EAAE,eAAe,YAAA,EAAE,+DAA+D;IAClG,UAAU,CAAC,EAAE,OAAO,YAAA,EACpB,SAAS,CAAC,EAAE,eAAe,YAAA;IAKrC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;;;;;;;;;;;;OAaG;IACI,sBAAsB,CAC3B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,EAC3D,eAAe,CAAC,EAAE,eAAe,GAChC,cAAc,CAAC,cAAc,CAAC;IAmNjC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAwHhF;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAQrF"}

package/dist/executor/sdk-handlers/claude/prompt-service.js

@@ -4,6 +4,7 @@
  * Handles live execution of prompts against Claude sessions using Claude Agent SDK.
  * Automatically loads CLAUDE.md and uses preset system prompts matching Claude Code CLI.
  */
+import { shortId } from '@agor/core/db';
 import { MessageRole } from '../../types.js';
 import { SDKMessageProcessor } from './message-processor.js';
 import { setupQuery } from './query-builder.js';
@@ -20,7 +21,6 @@ export class ClaudePromptService {
     reposRepo;
     messagesService;
     mcpEnabled;
-    inputRequestService;
     usersRepo;
     /** Enable token-level streaming from Claude Agent SDK */
     static ENABLE_TOKEN_STREAMING = true;
@@ -30,7 +30,7 @@ export class ClaudePromptService {
     permissionLocks = new Map();
     constructor(messagesRepo, sessionsRepo, apiKey, sessionMCPRepo, mcpServerRepo, permissionService, tasksService, sessionsService, // FeathersJS Sessions service for WebSocket broadcasting
     worktreesRepo, reposRepo, messagesService, // FeathersJS Messages service for creating permission requests
-    mcpEnabled, inputRequestService, usersRepo) {
+    mcpEnabled, usersRepo) {
         this.messagesRepo = messagesRepo;
         this.sessionsRepo = sessionsRepo;
         this.apiKey = apiKey;
@@ -43,7 +43,6 @@ export class ClaudePromptService {
         this.reposRepo = reposRepo;
         this.messagesService = messagesService;
         this.mcpEnabled = mcpEnabled;
-        this.inputRequestService = inputRequestService;
         this.usersRepo = usersRepo;
         // No client initialization needed - Agent SDK is stateless
     }
@@ -143,7 +142,6 @@ If you continue to see authentication errors, please contact your Agor administr
             sessionMCPRepo: this.sessionMCPRepo,
             mcpServerRepo: this.mcpServerRepo,
             permissionService: this.permissionService,
-            inputRequestService: this.inputRequestService,
             tasksService: this.tasksService,
             mcpEnabled: this.mcpEnabled,
             sessionsService: this.sessionsService,
@@ -192,7 +190,7 @@ If you continue to see authentication errors, please contact your Agor administr
                             console.log(`💾 Stored Agent SDK session_id in database`);
                         }
                         else if (existingSdkSessionId && existingSdkSessionId !== event.agentSessionId) {
-                            console.warn(`⚠️  SDK returned new session_id ${event.agentSessionId.substring(0, 8)} but session already has ${existingSdkSessionId.substring(0, 8)} — keeping original`);
+                            console.warn(`⚠️  SDK returned new session_id ${shortId(event.agentSessionId)} but session already has ${shortId(existingSdkSessionId)} — keeping original`);
                         }
                         continue; // Don't yield this event upstream
                     }
@@ -236,7 +234,7 @@ If you continue to see authentication errors, please contact your Agor administr
             // This is EXPECTED during stop - the SDK throws AbortError when cancelled
             if (error instanceof Error &&
                 (error.name === 'AbortError' || error.message.includes('abort'))) {
-                console.log(`🛑 [Stop] Query aborted for session ${sessionId.substring(0, 8)} - this is expected`);
+                console.log(`🛑 [Stop] Query aborted for session ${shortId(sessionId)} - this is expected`);
                 // Yield stopped event to signal execution was halted
                 yield { type: 'stopped' };
                 // Don't throw - this is a clean stop, not an error
@@ -252,7 +250,7 @@ If you continue to see authentication errors, please contact your Agor administr
                 enhancedError.stack = error.stack;
             }
             console.error(`❌ SDK iteration failed:`, {
-                sessionId: sessionId.substring(0, 8),
+                sessionId: shortId(sessionId),
                 messageCount: state.messageCount,
                 error: error instanceof Error ? error.message : String(error),
                 stderr: stderrOutput || '(no stderr output)',
@@ -281,7 +279,6 @@ If you continue to see authentication errors, please contact your Agor administr
             sessionMCPRepo: this.sessionMCPRepo,
             mcpServerRepo: this.mcpServerRepo,
             permissionService: this.permissionService,
-            inputRequestService: this.inputRequestService,
             tasksService: this.tasksService,
             mcpEnabled: this.mcpEnabled,
             sessionsService: this.sessionsService,
@@ -335,7 +332,7 @@ If you continue to see authentication errors, please contact your Agor administr
             // Check if this is an AbortError from interrupt() - this is EXPECTED during stop
             if (error instanceof Error &&
                 (error.name === 'AbortError' || error.message.includes('abort'))) {
-                console.log(`🛑 [Stop] Query aborted via interrupt() for session ${sessionId.substring(0, 8)} (non-streaming) - this is expected`);
+                console.log(`🛑 [Stop] Query aborted via interrupt() for session ${shortId(sessionId)} (non-streaming) - this is expected`);
                 // Don't throw - this is a clean stop, not an error
                 // Return empty result since we were stopped
                 return {
@@ -366,7 +363,7 @@ If you continue to see authentication errors, please contact your Agor administr
      * @returns Success status (always true since actual stop is via AbortController)
      */
     async stopTask(sessionId) {
-        console.log(`🛑 [Deprecated] stopTask called for session ${sessionId.substring(0, 8)} - actual stop handled by AbortController`);
+        console.log(`🛑 [Deprecated] stopTask called for session ${shortId(sessionId)} - actual stop handled by AbortController`);
         // Cancellation is now handled by AbortController passed to SDK
         // This method is kept for API compatibility
         return { success: true };

package/dist/executor/sdk-handlers/claude/query-builder.d.ts

@@ -9,7 +9,7 @@ type PermissionMode = Claude.PermissionMode;
 import type { MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository, UsersRepository, WorktreeRepository } from '../../db/feathers-repositories.js';
 import type { PermissionService } from '../../permissions/permission-service.js';
 import type { SessionID, TaskID } from '../../types.js';
-import type { MessagesService, SessionsService, TasksService } from './claude-tool.js';
+import type { MessagesService, SessionsPatchClient, TasksService } from '../base/index.js';
 export interface QuerySetupDeps {
     sessionsRepo: SessionRepository;
     reposRepo?: RepoRepository;
@@ -18,9 +18,8 @@ export interface QuerySetupDeps {
     sessionMCPRepo?: SessionMCPServerRepository;
     mcpServerRepo?: MCPServerRepository;
     permissionService?: PermissionService;
-    inputRequestService?: import('../../input-requests/input-request-service.js').InputRequestService;
     tasksService?: TasksService;
-    sessionsService?: SessionsService;
+    sessionsService?: SessionsPatchClient;
     messagesService?: MessagesService;
     worktreesRepo?: WorktreeRepository;
     usersRepo?: UsersRepository;

package/dist/executor/sdk-handlers/claude/query-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query-builder.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/query-builder.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAKxC,KAAK,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;AAI5C,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EACnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAoB,SAAS,EAAE,MAAM,EAAU,MAAM,gBAAgB,CAAC;AAElF,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAqEvF,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,iBAAiB,CAAC;IAChC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAC5C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,mBAAmB,CAAC,EAAE,OAAO,+CAA+C,EAAE,mBAAmB,CAAC;IAClG,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,eAAe,IAAI,OAAO,CAAC,OAAO,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;IACvF;;;;OAIG;IACH,YAAY,IAAI,IAAI,CAAC;IAErB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;CAC9C;AAED,wBAAsB,UAAU,CAC9B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,eAAe,CAAC;CAC9B,GACL,OAAO,CAAC;IACT,KAAK,EAAE,kBAAkB,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,MAAM,CAAC;CACzB,CAAC,CAmhBD"}
+{"version":3,"file":"query-builder.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/query-builder.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAKxC,KAAK,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;AAI5C,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EACnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAoB,SAAS,EAAE,MAAM,EAAU,MAAM,gBAAgB,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAuE3F,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,iBAAiB,CAAC;IAChC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAC5C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,eAAe,IAAI,OAAO,CAAC,OAAO,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;IACvF;;;;OAIG;IACH,YAAY,IAAI,IAAI,CAAC;IAErB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;CAC9C;AAED,wBAAsB,UAAU,CAC9B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,eAAe,CAAC;CAC9B,GACL,OAAO,CAAC;IACT,KAAK,EAAE,kBAAkB,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,MAAM,CAAC;CACzB,CAAC,CA6gBD"}

package/dist/executor/sdk-handlers/claude/query-builder.js

@@ -6,13 +6,14 @@
  */
 import { execSync } from 'node:child_process';
 import * as fs from 'node:fs/promises';
-import { validateDirectory } from '@agor/core';
+import { shortId, validateDirectory } from '@agor/core';
 import { Claude } from '@agor/core/sdk';
 import { renderAgorSystemPrompt } from '@agor/core/templates/session-context';
 import { resolveMCPAuthHeaders } from '@agor/core/tools/mcp/jwt-auth';
 const { query } = Claude;
 import { getDaemonUrl, resolveUserEnvironment } from '../../config.js';
 import { getMcpServersForSession } from '../base/mcp-scoping.js';
+import { CLAUDE_CODE_DISALLOWED_TOOLS } from './constants.js';
 import { parseModelWithBetas } from './model-utils.js';
 import { DEFAULT_CLAUDE_MODEL } from './models.js';
 import { createCanUseToolCallback } from './permissions/permission-hooks.js';
@@ -64,7 +65,7 @@ function getClaudeCodePath() {
  * Log prompt start with context
  */
 function logPromptStart(sessionId, _prompt, _cwd, agentSessionId) {
-    console.log(`🤖 Prompting Claude for session ${sessionId.substring(0, 8)}...`);
+    console.log(`🤖 Prompting Claude for session ${shortId(sessionId)}...`);
     if (agentSessionId) {
         console.log(`   Resuming session: ${agentSessionId}`);
     }
@@ -170,6 +171,8 @@ export async function setupQuery(sessionId, prompt, deps, options = {}) {
             append: agorSystemPrompt, // Append rich Agor context (session, worktree, repo)
         },
         settingSources: ['user', 'project', 'local'], // Load user + project + local permissions, auto-loads CLAUDE.md
+        // Defensive copy — the const is readonly but the SDK option is typed `string[]`.
+        disallowedTools: [...CLAUDE_CODE_DISALLOWED_TOOLS],
         model, // Use configured model or default
         pathToClaudeCodeExecutable: claudeCodePath,
         // Allow access to common directories outside CWD (e.g., /tmp)
@@ -217,35 +220,29 @@ export async function setupQuery(sessionId, prompt, deps, options = {}) {
         queryOptions.betas = betas;
         console.log(`🔬 Beta flags: ${betas.join(', ')}`);
     }
-    // Add canUseTool callback if permission service is available and taskId provided
-    // This enables Agor's custom permission UI (WebSocket-based) when SDK would show a prompt
-    // Fires AFTER SDK checks settings.json - respects user's existing Claude CLI permissions!
+    // Add canUseTool callback if permission service is available and taskId provided.
+    // This enables Agor's custom permission UI (WebSocket-based) when the SDK would
+    // show a prompt. Fires AFTER the SDK checks settings.json — respects user's
+    // existing Claude CLI permissions.
     //
-    // We register canUseTool even in `bypassPermissions` mode. AskUserQuestion's tool
-    // descriptor sets `requiresUserInteraction: true`, which makes the SDK's permission
-    // resolver return `{behavior: "ask", message: "Answer questions?"}` BEFORE checking
-    // the bypass-mode shortcut (see @anthropic-ai/claude-agent-sdk 0.2.x). With no
-    // canUseTool registered, the SDK's default deny fires and the model receives
-    // "Answer questions?" as the tool error — bypassing Agor's input-request UI.
-    // The callback itself fast-paths non-AskUserQuestion tools to `allow` when in
-    // bypass mode so the rest of bypass semantics are preserved.
-    if (deps.permissionService && taskId && deps.sessionMCPRepo && deps.mcpServerRepo) {
+    // Skip in bypassPermissions mode: the SDK skips canUseTool there anyway, and
+    // we no longer need a workaround to intercept AskUserQuestion (now disallowed).
+    if (deps.permissionService &&
+        taskId &&
+        deps.sessionMCPRepo &&
+        deps.mcpServerRepo &&
+        effectivePermissionMode !== 'bypassPermissions') {
         queryOptions.canUseTool = createCanUseToolCallback(sessionId, taskId, {
             permissionService: deps.permissionService,
-            inputRequestService: deps.inputRequestService,
             tasksService: deps.tasksService,
-            sessionsRepo: deps.sessionsRepo,
             messagesRepo: deps.messagesRepo,
             messagesService: deps.messagesService,
             sessionsService: deps.sessionsService,
             permissionLocks: deps.permissionLocks,
             mcpServerRepo: deps.mcpServerRepo,
             sessionMCPRepo: deps.sessionMCPRepo,
-            permissionMode: effectivePermissionMode,
         });
         console.log(`✅ canUseTool callback added (permission mode: ${effectivePermissionMode})`);
-        console.log(`   SDK will check settings.json first, then call Agor UI if needed`);
-        console.log(`   Using SDK's built-in permission persistence (updatedPermissions)`);
     }
     // Add optional apiKey if provided
     // NOTE: Don't require API key - user may have used `claude login` (OAuth)
@@ -266,7 +263,7 @@ export async function setupQuery(sessionId, prompt, deps, options = {}) {
             const totalVarCount = Object.keys(userEnv.env).length;
             userEnvCount = totalVarCount - systemVarCount;
             if (userEnvCount > 0) {
-                console.log(`🔐 Using ${userEnvCount} environment vars for user ${contextUserId.substring(0, 8)}`);
+                console.log(`🔐 Using ${userEnvCount} environment vars for user ${shortId(contextUserId)}`);
             }
         }
         catch (err) {
@@ -288,17 +285,17 @@ export async function setupQuery(sessionId, prompt, deps, options = {}) {
             if (parentSession?.sdk_session_id) {
                 queryOptions.resume = parentSession.sdk_session_id;
                 queryOptions.forkSession = true; // SDK will create new session ID from parent's history
-                console.log(`🍴 Forking from parent session: ${parentSession.sdk_session_id.substring(0, 8)}`);
+                console.log(`🍴 Forking from parent session: ${shortId(parentSession.sdk_session_id)}`);
                 console.log(`   SDK will return new session ID for this fork`);
             }
             else {
-                console.warn(`⚠️  Parent session ${forkedFromSessionId.substring(0, 8)} has no sdk_session_id - starting fresh`);
+                console.warn(`⚠️  Parent session ${shortId(forkedFromSessionId)} has no sdk_session_id - starting fresh`);
             }
         }
         // CASE 1b: Spawn on first prompt (has parent_session_id but NOT forked_from_session_id)
         else if (parentSessionId && !forkedFromSessionId && !session.sdk_session_id) {
             // This is a SPAWN - start FRESH, do NOT resume from parent
-            console.log(`🌱 Spawning fresh session (parent: ${parentSessionId.substring(0, 8)}) - NOT forking SDK session`);
+            console.log(`🌱 Spawning fresh session (parent: ${shortId(parentSessionId)}) - NOT forking SDK session`);
             console.log(`   Child will start with clean context (spawns don't inherit parent history)`);
             // Don't set queryOptions.resume - let it start completely fresh
         }
@@ -332,7 +329,7 @@ export async function setupQuery(sessionId, prompt, deps, options = {}) {
             if (mcpServersAddedAfterCreation) {
                 console.warn(`⚠️  [MCP] MCP servers were added after the last SDK sync - current session won't see them!`);
                 console.warn(`   🔧 SOLUTION: Clearing sdk_session_id to force fresh session start`);
-                console.warn(`   Previous SDK session: ${session.sdk_session_id.substring(0, 8)} (will be discarded)`);
+                console.warn(`   Previous SDK session: ${shortId(session.sdk_session_id)} (will be discarded)`);
                 // Clear SDK session ID to force fresh start with new MCP config
                 if (deps.sessionsRepo) {
                     await deps.sessionsRepo.update(sessionId, { sdk_session_id: undefined });
@@ -349,7 +346,7 @@ export async function setupQuery(sessionId, prompt, deps, options = {}) {
                 const isLikelyStale = hoursSinceUpdate > 24 || // Session older than 24 hours
                     !session.worktree_id; // No worktree = can't resume properly
                 if (isLikelyStale) {
-                    console.warn(`⚠️  Resume session ${session.sdk_session_id.substring(0, 8)} appears stale (${Math.round(hoursSinceUpdate)}h old) - starting fresh`);
+                    console.warn(`⚠️  Resume session ${shortId(session.sdk_session_id)} appears stale (${Math.round(hoursSinceUpdate)}h old) - starting fresh`);
                     // Clear stale session ID to prevent exit code 1
                     if (deps.sessionsRepo) {
                         await deps.sessionsRepo.update(sessionId, { sdk_session_id: undefined });
@@ -358,7 +355,7 @@ export async function setupQuery(sessionId, prompt, deps, options = {}) {
                 }
                 else {
                     queryOptions.resume = session.sdk_session_id;
-                    console.log(`   Resuming SDK session: ${session.sdk_session_id.substring(0, 8)}`);
+                    console.log(`   Resuming SDK session: ${shortId(session.sdk_session_id)}`);
                 }
             }
         }
@@ -384,7 +381,7 @@ export async function setupQuery(sessionId, prompt, deps, options = {}) {
             queryOptions.mcpServers = mcpConfig;
         }
         else {
-            console.warn(`⚠️  No MCP token found for session ${sessionId.substring(0, 8)} - MCP tools unavailable`);
+            console.warn(`⚠️  No MCP token found for session ${shortId(sessionId)} - MCP tools unavailable`);
         }
     }
     // Fetch and configure MCP servers for this session

package/dist/executor/sdk-handlers/claude/safe-message-service.d.ts

@@ -5,7 +5,7 @@
  * sessions deleted during async operations.
  */
 import type { Message } from '@agor/core/types';
-import type { MessagesService } from './claude-tool.js';
+import type { MessagesService } from '../base/index.js';
 /**
  * Safely create a message, handling FK constraint errors gracefully.
  *

package/dist/executor/sdk-handlers/claude/safe-message-service.js

@@ -4,7 +4,7 @@
  * Provides defensive message creation that gracefully handles
  * sessions deleted during async operations.
  */
-import { isForeignKeyConstraintError } from '@agor/core/db';
+import { isForeignKeyConstraintError, shortId } from '@agor/core/db';
 /**
  * Safely create a message, handling FK constraint errors gracefully.
  *
@@ -19,7 +19,7 @@ export async function safeCreateMessage(messagesService, message) {
     }
     catch (error) {
         if (isForeignKeyConstraintError(error)) {
-            console.warn(`⚠️  Session ${message.session_id.substring(0, 8)} deleted during message creation, skipping`);
+            console.warn(`⚠️  Session ${shortId(message.session_id)} deleted during message creation, skipping`);
             return null;
         }
         // Re-throw non-FK errors (actual problems)

package/dist/executor/sdk-handlers/claude/session-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-context.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/session-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAuB1F;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,SAAS,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED;;GAEG;AACH,wBAAsB,gCAAgC,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB1F"}
+{"version":3,"file":"session-context.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/session-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAuB1F;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,SAAS,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED;;GAEG;AACH,wBAAsB,gCAAgC,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB1F"}

package/dist/executor/sdk-handlers/claude/session-context.js

@@ -6,6 +6,7 @@
  */
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
+import { shortId } from '@agor/core/db';
 /**
  * Generate Agor session context block to append to CLAUDE.md
  *
@@ -13,7 +14,7 @@ import * as path from 'node:path';
  * @param sdkSessionId - Claude SDK session ID (for conversation continuity, optional)
  */
 export function generateSessionContext(sessionId, sdkSessionId) {
-    const shortId = sessionId.substring(0, 8);
+    const sessionShort = shortId(sessionId);
     let sdkSessionLine = '';
     if (sdkSessionId) {
         sdkSessionLine = `\n- **Claude SDK Session ID:** \`${sdkSessionId}\` (used by Claude CLI for conversation continuity)`;
@@ -27,7 +28,7 @@ export function generateSessionContext(sessionId, sdkSessionId) {
 You are currently running within **Agor** (https://agor.live), a multiplayer canvas for orchestrating AI coding agents.
 
 **Session IDs:**
-- **Agor Session ID:** \`${sessionId}\` (short: \`${shortId}\`) - Agor's internal session tracking${sdkSessionLine}
+- **Agor Session ID:** \`${sessionId}\` (short: \`${sessionShort}\`) - Agor's internal session tracking${sdkSessionLine}
 
 When you see these IDs referenced in prompts or tool calls, they refer to THIS session you're currently in.
 
@@ -65,7 +66,7 @@ export async function appendSessionContextToCLAUDEmd(worktreePath, sessionId, sd
         const sessionContext = generateSessionContext(sessionId, sdkSessionId);
         const newContent = existingContent + sessionContext;
         await fs.writeFile(claudeMdPath, newContent, 'utf-8');
-        console.log(`✅ Appended session context to CLAUDE.md for session ${sessionId.substring(0, 8)}`);
+        console.log(`✅ Appended session context to CLAUDE.md for session ${shortId(sessionId)}`);
     }
     catch (error) {
         console.error(`❌ Failed to append session context to CLAUDE.md:`, error);

package/dist/executor/sdk-handlers/claude-cli/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Executor-side adapter for the Claude Code CLI agentic tool.
+ *
+ * The "runtime" is the `claude` binary running interactively in a Zellij
+ * pane — there is no in-process loop here. All the pure utilities the
+ * adapter needs (spawn argv builder, JSONL event translator, path slug)
+ * live in `@agor/core/claude-cli` so both daemon and executor can use
+ * them; this file is currently just a marker for the directory's place
+ * in the executor's adapter layout.
+ *
+ * Re-exporting the core surface here is intentionally avoided because the
+ * executor build currently does NOT depend on the core's claude-cli
+ * subpath at TS-resolution time, and adding a re-export here would force
+ * a build-order coupling we don't need.
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/executor/sdk-handlers/claude-cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude-cli/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC"}

package/dist/executor/sdk-handlers/claude-cli/index.js

@@ -0,0 +1 @@
+export {};

package/dist/executor/sdk-handlers/codex/app-server-client.d.ts

@@ -0,0 +1,36 @@
+export interface CodexAppServerClientOptions {
+    /** Extra env values to pass to the spawned `codex app-server` process. */
+    env?: NodeJS.ProcessEnv;
+    /** Request timeout for initialize/fork calls. Defaults to 10s. */
+    timeoutMs?: number;
+    /** Override executable for tests or non-standard installs. Defaults to `codex`. */
+    command?: string;
+}
+/**
+ * Minimal JSONL client for Codex's local App Server.
+ *
+ * This intentionally implements only the `thread/fork` sidecar operation so
+ * Agor can keep using `@openai/codex-sdk` for normal streaming execution. The
+ * App Server is spawned, initialized, asked to fork one stored thread, then
+ * torn down immediately.
+ */
+export declare class CodexAppServerClient {
+    private readonly options;
+    private readonly timeoutMs;
+    private readonly command;
+    private child?;
+    private nextId;
+    private readonly pending;
+    private stderr;
+    private startPromise?;
+    constructor(options?: CodexAppServerClientOptions);
+    forkThread(threadId: string): Promise<string>;
+    close(): Promise<void>;
+    private start;
+    private request;
+    private sendNotification;
+    private handleLine;
+    private rejectAll;
+}
+export declare function forkCodexThreadViaAppServer(threadId: string, options?: CodexAppServerClientOptions): Promise<string>;
+//# sourceMappingURL=app-server-client.d.ts.map

package/dist/executor/sdk-handlers/codex/app-server-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-server-client.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/codex/app-server-client.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,2BAA2B;IAC1C,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAoB;IAgBnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAfpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,KAAK,CAAC,CAAiC;IAC/C,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAOpB;IACJ,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,YAAY,CAAC,CAAgB;gBAER,OAAO,GAAE,2BAAgC;IAKhE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAsBd,KAAK;IA4CnB,OAAO,CAAC,OAAO;IA6Bf,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,UAAU;IA8BlB,OAAO,CAAC,SAAS;CAOlB;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,MAAM,CAAC,CAOjB"}