open-claude-p 1.1.2 → 1.2.1

package/bin/cli.js

@@ -29,6 +29,7 @@ process.on('uncaughtException', (e) => {
 import { parseArgv } from '../src/options/parse-argv.js';
 import { validate } from '../src/options/validate.js';
 import { OPTION_SPEC } from '../src/options/spec.js';
+import { forwardedRequestFields } from '../src/options/forward.js';
 import { createDriver } from '../src/index.js';
 import { sendToDaemon } from '../src/daemon/client.js';
 import { daemonKey, socketPath, resolveCwd } from '../src/daemon/socket.js';
@@ -65,7 +66,7 @@ const EXIT = {
 };
 
 async function main() {
-  const { options, positional, unknown, errors } = parseArgv(process.argv.slice(2));
+  const { options, positional, unknown, errors, supplied } = parseArgv(process.argv.slice(2));
 
   if (errors.length > 0) {
     process.stderr.write(errors.map((e) => `error: ${e}`).join('\n') + '\n');
@@ -95,12 +96,47 @@ async function main() {
   // retain the safer default (`false`) — this flip only changes the
   // CLI default. The opt-in `OCP_DEFAULT_SKIP_PERMS=1` from 1.0 is
   // still honoured but is now a no-op (the default already matches it).
+  //
+  // `--restricted` is the one case where the permissive default must
+  // stand down. Upstream refuses the combination outright ("Error:
+  // bypassPermissions not supported in restricted mode") and exits, so
+  // leaving the default on would make `ocp --restricted` fail every
+  // time with no output. Asking for restricted mode IS an explicit
+  // choice to keep the permission gates, so we honour it.
+  //
+  // NOTE on the `supplied` check: every option with a `default` is
+  // pre-seeded into `options`, so `options[x] === false` is ALSO true
+  // when the user passed nothing at all. Testing the value alone made
+  // this opt-out fire on every single invocation, which quietly turned
+  // the whole block into dead code — the default-on behaviour was in
+  // fact coming from `runOneShot`'s `?? true`, and an explicit
+  // `--dangerously-skip-permissions=false` was being ignored. Only a
+  // flag actually present in argv counts as an opt-out.
   const skipPermsOptOut = process.env.OCP_NO_SKIP_PERMS === '1'
                        || process.env.OCP_NO_SKIP_PERMS === 'true'
-                       || options['dangerously-skip-permissions'] === false;
+                       || (supplied.has('dangerously-skip-permissions')
+                           && options['dangerously-skip-permissions'] === false)
+                       || options.restricted === true;
   if (options['dangerously-skip-permissions'] !== true && !skipPermsOptOut) {
     options['dangerously-skip-permissions'] = true;
   }
+  if (options.restricted === true && options['dangerously-skip-permissions'] === true) {
+    process.stderr.write(
+      'error: `--restricted` cannot be combined with ' +
+      '`--dangerously-skip-permissions` — the upstream CLI refuses ' +
+      'bypassPermissions in restricted mode.\n',
+    );
+    return EXIT.VALIDATION_ERROR;
+  }
+
+  // With the bypass gone, something still has to answer permission
+  // prompts, and PTY automation cannot. `--permission-prompts=none`
+  // denies anything that would prompt instead of hanging on it, which
+  // is the only setting that keeps a restricted run headless. The
+  // caller can still ask for `host` explicitly.
+  if (options.restricted === true && options['permission-prompts'] === undefined) {
+    options['permission-prompts'] = 'none';
+  }
 
   // CLI-only default: honour `OCP_NO_SESSION_PERSISTENCE=1` when the user
   // has not explicitly set `--no-session-persistence`. Stateless
@@ -116,12 +152,13 @@ async function main() {
   }
 
   // CLI-only default: pre-approve the read-only network tools so that a
-  // plain `ocp "오늘 날씨"` actually uses WebSearch/WebFetch instead of
-  // silently no-op'ing with "I can't access real-time info". These are
-  // safe-by-construction (no filesystem mutation, no shell exec); a
-  // headless tool that refuses to fetch the web for an automation
-  // surface is the wrong default. Caller-supplied `--allowed-tools`
-  // takes precedence (additive — we merge rather than replace).
+  // plain `ocp "what is the weather today"` actually uses WebSearch /
+  // WebFetch instead of silently no-op'ing with "I can't access
+  // real-time info". These are safe-by-construction (no filesystem
+  // mutation, no shell exec); a headless tool that refuses to fetch the
+  // web for an automation surface is the wrong default. Caller-supplied
+  // `--allowed-tools` takes precedence (additive — we merge rather than
+  // replace).
   // Set OCP_NO_DEFAULT_TOOLS=1 to opt out entirely.
   if (process.env.OCP_NO_DEFAULT_TOOLS !== '1') {
     const DEFAULT_SAFE_TOOLS = ['WebSearch', 'WebFetch'];
@@ -144,10 +181,11 @@ async function main() {
 
   // CLI-only default: encourage tool use for current/time-sensitive
   // queries via the same SDK-wide DEFAULT_APPEND_SYSTEM_PROMPT the
-  // chat client already uses. Without this, a plain `ocp "오늘 날씨"`
-  // refuses with "I can't access real-time data" instead of calling
-  // WebSearch — because Claude's print-mode default behaviour leans
-  // toward declining over tool-use when it can answer with disclaimers.
+  // chat client already uses. Without this, a plain prompt such as
+  // `ocp "what is the weather today"` refuses with "I can't access
+  // real-time data" instead of calling WebSearch — because Claude's
+  // print-mode default behaviour leans toward declining over tool-use
+  // when it can answer with disclaimers.
   // This is a generic, ONE-LINE rule ("use tools when you need to look
   // something up"), not tool-by-tool guidance, so it stays within the
   // "common rules" policy. Caller-supplied `--append-system-prompt`
@@ -248,19 +286,18 @@ async function main() {
       // regardless of what the requester intended. Daemon rejects on
       // mismatch.
       claudeBin: process.env.OCP_CLAUDE_BIN || 'claude',
-      model: options.model,
-      systemPrompt: options['system-prompt'],
-      appendSystemPrompt: options['append-system-prompt'],
-      allowedTools: options['allowed-tools'],
-      disallowedTools: options['disallowed-tools'],
-      dangerouslySkipPermissions: options['dangerously-skip-permissions'],
-      permissionMode: options['permission-mode'],
-      debug: options.debug,
-      verbose: options.verbose,
+      ...forwardedRequestFields(options),
+      // Always a concrete boolean. `forwardedRequestFields` omits `false`
+      // (there is no argv to emit for it), but `runOneShot` resolves a
+      // missing field with `?? true` — so omitting it would silently
+      // re-enable the permission bypass the caller just opted out of via
+      // `OCP_NO_SKIP_PERMS=1`, `--dangerously-skip-permissions=false`, or
+      // `--restricted`.
+      dangerouslySkipPermissions: options['dangerously-skip-permissions'] === true,
+      // Shim-enforced options: no upstream flag, handled by the driver.
       maxTurns: options['max-turns'],
       maxBudgetUsd: options['max-budget-usd'],
       taskBudget: options['task-budget'],
-      noSessionPersistence: options['no-session-persistence'],
       passThroughArgv: unknown,
     };
 
@@ -328,21 +365,17 @@ async function main() {
         prompt,
         cwd: options.cwd,
         outputFormat,
-        model: options.model,
-        systemPrompt: options['system-prompt'],
-        appendSystemPrompt: options['append-system-prompt'],
-        allowedTools: options['allowed-tools'],
-        disallowedTools: options['disallowed-tools'],
-        dangerouslySkipPermissions: options['dangerously-skip-permissions'],
-        permissionMode: options['permission-mode'],
-        verbose: options.verbose,
-        continue: options.continue,
-        resume: options.resume,
-        forkSession: options['fork-session'],
-        noSessionPersistence: options['no-session-persistence'],
-        sessionId: options['session-id'],
+        ...forwardedRequestFields(options, { printMode: true }),
+        // Always a concrete boolean. `forwardedRequestFields` omits `false`
+        // (there is no argv to emit for it), but `runOneShot` resolves a
+        // missing field with `?? true` — so omitting it would silently
+        // re-enable the permission bypass the caller just opted out of via
+        // `OCP_NO_SKIP_PERMS=1`, `--dangerously-skip-permissions=false`, or
+        // `--restricted`.
+        dangerouslySkipPermissions: options['dangerously-skip-permissions'] === true,
         passThroughArgv: unknown,
         abortSignal: ac.signal,
+        // Shim-enforced options: no upstream flag, handled by the driver.
         maxTurns: options['max-turns'],
         maxBudgetUsd: options['max-budget-usd'],
         printSink: process.stdout,
@@ -401,25 +434,20 @@ async function runOneTurn({ driver, adapter, options, unknown, ac, prompt, resum
   const result = await driver.runOneShot({
     prompt,
     cwd: options.cwd,
-    model: options.model,
-    systemPrompt: options['system-prompt'],
-    appendSystemPrompt: options['append-system-prompt'],
-    allowedTools: options['allowed-tools'],
-    disallowedTools: options['disallowed-tools'],
-    dangerouslySkipPermissions: options['dangerously-skip-permissions'],
-    permissionMode: options['permission-mode'],
-    debug: options.debug,
-    verbose: options.verbose,
-    continue: options.continue,
+    ...forwardedRequestFields(options),
+    // Always a concrete boolean. `forwardedRequestFields` omits `false`
+    // (there is no argv to emit for it), but `runOneShot` resolves a
+    // missing field with `?? true` — so omitting it would silently
+    // re-enable the permission bypass the caller just opted out of via
+    // `OCP_NO_SKIP_PERMS=1`, `--dangerously-skip-permissions=false`, or
+    // `--restricted`.
+    dangerouslySkipPermissions: options['dangerously-skip-permissions'] === true,
+    // The stream-json input loop threads each turn's session id back in
+    // so turn N+1 resumes turn N; it must win over `--resume` from argv.
     resume: resumeOverride ?? options.resume,
-    forkSession: options['fork-session'],
-    noSessionPersistence: options['no-session-persistence'],
-    resumeSessionAt: options['resume-session-at'],
-    rewindFiles: options['rewind-files'],
-    sessionId: options['session-id'],
-    name: options.name,
     passThroughArgv: unknown,
     abortSignal: ac.signal,
+    // Shim-enforced options: no upstream flag, handled by the driver.
     maxTurns: options['max-turns'],
     maxBudgetUsd: options['max-budget-usd'],
     taskBudget: options['task-budget'],
@@ -432,14 +460,18 @@ async function runOneTurn({ driver, adapter, options, unknown, ac, prompt, resum
   // alone cannot scrub; the JSONL file is what claude itself stores
   // and contains only the assistant's message verbatim. We call
   // readSessionText even when sessionId is null — it falls back to the
-  // most-recently-modified JSONL written during this request window.
+  // most-recently-modified JSONL written during this request window,
+  // gated on the transcript actually containing the prompt we sent so a
+  // concurrent session in the same cwd cannot answer for us.
   let finalText = result.text;
   let usage = null;
   let toolsFromSession = [];
   if (!result.isError) {
     try {
       const { readSessionText } = await import('../src/chat/index.js');
-      const sessionRead = await readSessionText(result.sessionId, startTime, options.cwd);
+      const sessionRead = await readSessionText(
+        result.sessionId, startTime, options.cwd, { expectPrompt: prompt },
+      );
       if (sessionRead?.text) finalText = sessionRead.text;
       if (sessionRead?.usage) usage = sessionRead.usage;
       if (sessionRead?.tools) toolsFromSession = sessionRead.tools;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-claude-p",
-  "version": "1.1.2",
+  "version": "1.2.1",
   "description": "A PTY-backed compatibility shim for `claude -p` (Claude Code headless/print mode). Drives the interactive `claude` CLI via node-pty and exposes the same option surface and stream-json contract. Ships as both a library and an `ocp` CLI binary.",
   "type": "module",
   "main": "./src/index.js",

package/src/chat/index.js

@@ -1092,7 +1092,11 @@ export function createChatClient(opts = {}) {
  * @param {string} [cwd]   Directory used to derive the project dir key.
  * @returns {Promise<{ text: string, usage: object|null, tools: string[] } | null>}
  */
-export async function readSessionText(sessionId, t0 = 0, cwd = process.cwd()) {
+export async function readSessionText(sessionId, t0 = 0, cwd = process.cwd(), opts = {}) {
+  // `expectPrompt` is the prompt this request actually sent. It is used
+  // ONLY on the no-sessionId scan path below, to confirm a candidate
+  // transcript is ours before its text is returned as our answer.
+  const expectPrompt = typeof opts.expectPrompt === 'string' ? opts.expectPrompt : '';
   // Claude encodes the project cwd into a single token used as the
   // directory name under ~/.claude/projects/. The mapping replaces BOTH
   // path separators (`/`) and underscores (`_`) with a literal `-`, so
@@ -1233,12 +1237,57 @@ export async function readSessionText(sessionId, t0 = 0, cwd = process.cwd()) {
     .filter((c) => c.mtime >= t0)
     .sort((a, b) => b.mtime - a.mtime);
   for (const { f } of recent.slice(0, 5)) {
-    const r = await extractFromFile(path.join(projectDir, f), t0);
+    const full = path.join(projectDir, f);
+    // Ownership gate. Without a sessionId the only thing separating our
+    // transcript from a neighbour's is "most recently modified", and a
+    // concurrently-running session in the same cwd wins that race
+    // routinely (a daemon holding a warm PTY appends to its JSONL the
+    // whole time). Returning that file's text hands the caller somebody
+    // else's answer — the same leak the strict path above refuses to
+    // risk. When the caller tells us what it asked, require the file to
+    // contain that prompt before trusting it.
+    if (expectPrompt && !(await fileHasUserPrompt(full, expectPrompt))) continue;
+    const r = await extractFromFile(full, t0);
     if (r) return r;
   }
   return null;
 }
 
+/**
+ * Does this transcript contain the prompt we sent?
+ *
+ * Matching is deliberately loose at the tail and strict at the head: ocp
+ * appends its end-of-reply marker instruction to the prompt before typing
+ * it, and the TUI may reflow or truncate what it records, so an equality
+ * check would reject our own file. A leading-substring match on the first
+ * line is enough to tell our transcript apart from an unrelated one.
+ *
+ * @param {string} filePath
+ * @param {string} prompt
+ * @returns {Promise<boolean>}
+ */
+async function fileHasUserPrompt(filePath, prompt) {
+  const head = prompt.replace(/\s+/g, ' ').trim().slice(0, 120);
+  // Too short to identify anything — do not use it as evidence either way.
+  if (head.length < 8) return true;
+  let raw;
+  try { raw = await readFile(filePath, 'utf8'); } catch { return false; }
+  for (const line of raw.split('\n')) {
+    if (!line.trim()) continue;
+    let ev;
+    try { ev = JSON.parse(line); } catch { continue; }
+    if (ev.message?.role !== 'user') continue;
+    const content = ev.message.content;
+    const text = typeof content === 'string'
+      ? content
+      : Array.isArray(content)
+        ? content.filter((c) => c?.type === 'text').map((c) => c.text ?? '').join(' ')
+        : '';
+    if (text.replace(/\s+/g, ' ').includes(head)) return true;
+  }
+  return false;
+}
+
 /**
  * Strip TUI chrome (prompt chars, box borders, status bars, mode lines)
  * from the PTY-stripped buffer text. Use as a fallback when the JSONL

package/src/completion/detector.js

@@ -37,6 +37,20 @@ export class CompletionDetector {
    *                                        turn; when the (N+1)th turn
    *                                        opens, the request is aborted
    *                                        with reason 'max-turns'.
+   * @param {boolean} [opts.allowIdleWithoutResponse=false]
+   *                                        Permit `_onTick`'s idle fallback
+   *                                        even when no assistant region has
+   *                                        opened. Set this for prompts that
+   *                                        legitimately produce no assistant
+   *                                        turn — slash commands (`/compact`,
+   *                                        `/clear`, `/help`, …) whose
+   *                                        upstream handler runs a local
+   *                                        operation and returns directly to
+   *                                        the input box. Without this flag
+   *                                        the request would block until
+   *                                        `maxResponseMs` (24 h default)
+   *                                        because `hadAssistantText` stays
+   *                                        false for the entire turn.
    */
   constructor({
     nonce,
@@ -44,6 +58,7 @@ export class CompletionDetector {
     preIdleMs = 8000,
     maxResponseMs = 60000,
     maxTurns,
+    allowIdleWithoutResponse = false,
   } = {}) {
     if (!nonce) throw new Error('CompletionDetector: nonce is required');
     this.nonce = nonce;
@@ -51,6 +66,7 @@ export class CompletionDetector {
     this.preIdleMs = preIdleMs;
     this.maxResponseMs = maxResponseMs;
     this.maxTurns = Number.isFinite(maxTurns) && maxTurns >= 0 ? maxTurns : null;
+    this.allowIdleWithoutResponse = !!allowIdleWithoutResponse;
 
     this.startTime = Date.now();
     this.regionEntered = false;
@@ -142,7 +158,10 @@ export class CompletionDetector {
     // Pre-sentinel fallback: only valid once we've seen any assistant
     // signal, with the longer `preIdleMs` threshold so that brief render
     // pauses (common during `--resume`) do not trip premature completion.
-    if (this.hadAssistantText) {
+    // `allowIdleWithoutResponse` relaxes the gate for callers that know
+    // the turn legitimately produces no assistant region (e.g. slash
+    // commands like `/compact`).
+    if (this.hadAssistantText || this.allowIdleWithoutResponse) {
       if (idleFor >= this.preIdleMs) {
         this._complete('idle', false);
       }

package/src/index.js

@@ -53,6 +53,7 @@ const UNSAFE_PASSTHROUGH_FLAGS = new Set([
   // Load untrusted agents / plugins
   '--agents',
   '--plugin-dir',
+  '--plugin-url',
   // Bypass permission gates
   '--dangerously-skip-permissions',
   '--allow-dangerously-skip-permissions',
@@ -92,7 +93,13 @@ export function redactArgvForLog(argv) {
         out.push(`${flag}=<redacted len=${tok.length - eq - 1}>`);
       } else {
         out.push(flag);
-        if (i + 1 < argv.length && !argv[i + 1].startsWith('-')) {
+        // Variadic flags (`--mcp-config a.json '{"env":{"TOKEN":"…"}}'`)
+        // carry every value token after the flag, so redacting only the
+        // first left inline MCP/settings JSON — credentials included —
+        // in the log. Consume the whole run of non-flag tokens.
+        while (i + 1 < argv.length
+               && typeof argv[i + 1] === 'string'
+               && !argv[i + 1].startsWith('-')) {
           out.push(`<redacted len=${argv[i + 1].length}>`);
           i++;
         }
@@ -273,6 +280,39 @@ class Driver {
 
     const spawnArgs = buildSpawnArgs(req);
 
+    // Local-builtin slash command detection. Claude TUI has two distinct
+    // `/`-prefixed prompt classes:
+    //
+    //   - **Local builtins** (this list) — handled entirely by the TUI's
+    //     command dispatcher. No LLM turn runs, no `⏺` region opens, no
+    //     sentinel can ever arrive. `/compact` is the motivating case:
+    //     57 s of compaction activity, then chevron returns silently,
+    //     then ocp would block until `maxResponseMs` (24 h default)
+    //     waiting for a response that by design never comes.
+    //
+    //   - **LLM-bearing slash invocations** — skills (`/init`, `/review`,
+    //     `/security-review`, custom user skills like `/ui-ux-pro-max`)
+    //     and any unknown `/<name>` we don't recognise. These DO run
+    //     the LLM, DO open `⏺`, and emit the sentinel like a normal
+    //     prompt. They MUST keep the OCP_END instruction and the
+    //     strict idle gate — relaxing either would drop the marker
+    //     from a real LLM turn and trigger a false-positive idle
+    //     completion (returning a half-streamed response prefixed
+    //     with the 1.1.2 "Streaming capture not detected" notice).
+    //
+    // The list is intentionally narrow — only claude TUI commands
+    // confirmed to bypass the LLM. Anything not in the set (including
+    // every user-installed skill) goes through the standard path.
+    const LOCAL_BUILTIN_SLASH_COMMANDS = new Set([
+      'compact', 'clear', 'help', 'exit', 'quit',
+      'login', 'logout', 'cost', 'status',
+      'model', 'permissions', 'config',
+    ]);
+    const slashMatch = /^\s*\/([a-z][\w-]*)/i.exec(req.prompt ?? '');
+    const isLocalBuiltin =
+      !!slashMatch &&
+      LOCAL_BUILTIN_SLASH_COMMANDS.has(slashMatch[1].toLowerCase());
+
     const sentinelParser = createSentinelParser(nonce);
     const pipeline = createPipeline([
       ansiStripParser,
@@ -285,6 +325,7 @@ class Driver {
       preIdleMs: this.opts.preIdleMs,
       maxResponseMs: this.opts.maxResponseMs,
       maxTurns: req.maxTurns,
+      allowIdleWithoutResponse: isLocalBuiltin,
     });
 
     // Pool eligibility: explicit resume/continue bind to a specific past
@@ -603,7 +644,15 @@ class Driver {
         ' the user\'s message and you do not need to mention or flag it. Answer' +
         ' the user\'s actual message above as you normally would, using tools' +
         ' as freely and thoroughly as you would without the marker.)';
-      const fullPrompt = req.prompt + instruction;
+      // Local builtins route through claude TUI's command dispatcher
+      // (not the LLM), so the marker instruction is silently dropped as
+      // junk args and never round-trips back. Some builtins also accept
+      // free-form text (e.g. `/bug <message>`), where appending the
+      // instruction would pollute the captured args. Skill invocations
+      // and unknown `/<name>` prompts DO go through the LLM, so they
+      // still need the marker — only the narrow `LOCAL_BUILTIN_…` set
+      // gets the bare prompt.
+      const fullPrompt = isLocalBuiltin ? req.prompt : (req.prompt + instruction);
       // Skip the prompt write if the dialog watcher has already
       // decided to abort. Without this check the trailing `\r` of
       // the prompt lands inside whatever modal we tried to abort on
@@ -995,7 +1044,7 @@ export async function writePromptToSession(session, content, opts = {}) {
  * OPTION_SPEC and emitting each entry whose forward strategy is `argv`.
  * Pass-through tokens from the CLI's unknown-flag list are appended last.
  */
-function buildSpawnArgs(req) {
+export function buildSpawnArgs(req) {
   const args = [];
   for (const spec of OPTION_SPEC) {
     if (spec.forward?.type !== 'argv') continue;
@@ -1007,6 +1056,16 @@ function buildSpawnArgs(req) {
       if (Array.isArray(value) && value.length > 0) {
         args.push(spec.forward.flag, ...value.map(String));
       }
+    } else if (spec.kind === 'json') {
+      // `parseArgv` stores json-kind options already parsed, so the plain
+      // `String(value)` used below would hand upstream the literal
+      // "[object Object]". Re-serialise objects; leave a string alone so a
+      // library caller can pass raw JSON text without it being
+      // double-encoded.
+      args.push(
+        spec.forward.flag,
+        typeof value === 'string' ? value : JSON.stringify(value),
+      );
     } else {
       args.push(spec.forward.flag, String(value));
     }
@@ -1073,12 +1132,24 @@ async function listSessionFiles(cwd) {
  * This avoids picking up an unrelated neighbour session created by
  * another claude process that happened to finish around the same time.
  *
+ * Class (a) beats class (b) outright, and only the highest-mtime file
+ * WITHIN the winning class is returned. Ranking both classes together by
+ * mtime made this function pick a neighbour whenever one was touched
+ * later than our own session — which is the normal state of affairs when
+ * a background daemon holds a warm PTY in the same cwd: its JSONL keeps
+ * being appended, so it reliably out-races the file we just created.
+ * The wrong id then flows straight into `readSessionText`, whose
+ * strict-by-session-id path faithfully returns SOMEBODY ELSE'S
+ * transcript as this request's answer. A fresh spawn always creates a
+ * new file, so preferring class (a) removes that race; class (b) still
+ * covers the legitimate `--resume` append, where no new file appears.
+ *
  * @param {string|undefined} cwd
  * @param {number} since                  epoch-ms taken at the start of the request
  * @param {Map<string,number>} before     baseline filename -> mtimeMs from listSessionFiles
  * @returns {Promise<string|null>}
  */
-async function findRecentSessionId(cwd, since, before) {
+export async function findRecentSessionId(cwd, since, before) {
   // See listSessionFiles for the rationale on realpath + the `/_` -> `-`
   // mapping. Both helpers must agree, or the "did this file exist
   // before our request?" comparison silently misses every entry.
@@ -1087,21 +1158,32 @@ async function findRecentSessionId(cwd, since, before) {
   let entries;
   try { entries = await readdir(dir); } catch { return null; }
   const threshold = since - 1500;
-  let best = null;
-  let bestMtime = 0;
+  // Tracked separately so a newly-created file always wins over a
+  // neighbour that merely got appended to during our window.
+  let newBest = null; let newBestMtime = 0;
+  let movedBest = null; let movedBestMtime = 0;
   for (const name of entries) {
     if (!/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\.jsonl$/.test(name)) continue;
     let st;
     try { st = await stat(path.join(dir, name)); } catch { continue; }
     if (st.mtimeMs < threshold) continue;
     const baseline = before?.get(name);
-    if (baseline !== undefined && st.mtimeMs <= baseline + 100) continue; // existed before, didn't move
-    if (st.mtimeMs > bestMtime) {
-      bestMtime = st.mtimeMs;
-      best = name.replace(/\.jsonl$/, '');
+    if (baseline === undefined) {
+      // (a) Created during our run.
+      if (st.mtimeMs > newBestMtime) {
+        newBestMtime = st.mtimeMs;
+        newBest = name.replace(/\.jsonl$/, '');
+      }
+      continue;
+    }
+    if (st.mtimeMs <= baseline + 100) continue; // existed before, didn't move
+    // (b) Existed before and was appended to during our run.
+    if (st.mtimeMs > movedBestMtime) {
+      movedBestMtime = st.mtimeMs;
+      movedBest = name.replace(/\.jsonl$/, '');
     }
   }
-  return best;
+  return newBest ?? movedBest;
 }
 
 /**

package/src/options/forward.js

@@ -0,0 +1,70 @@
+// Parsed-argv options -> driver request fields.
+//
+// `buildSpawnArgs()` in the driver is fully spec-driven: it walks
+// OPTION_SPEC and emits `--flag value` for every entry whose
+// `forward.type` is `'argv'`, reading the value from
+// `req[camelCase(spec.name)]`. This module is the other half of that
+// contract — it lifts those same options out of the parsed argv map and
+// onto the request object under the field names the driver expects.
+//
+// The two halves used to be maintained by hand at each call site, and
+// they drifted: roughly thirty documented flags (`--effort`,
+// `--thinking`, `--add-dir`, `--mcp-config`, `--settings`, `--agents`,
+// `--betas`, `--fallback-model`, `--tools`, `--bare`, …) parsed cleanly,
+// passed validation, and appeared in `--help`, but nothing ever copied
+// them into the request, so they were silently dropped before the
+// upstream process could see them. Deriving both directions from the
+// same spec keeps them in lockstep: appending an entry to OPTION_SPEC is
+// once again the only edit a newly-supported upstream flag needs.
+
+import { OPTION_SPEC } from './spec.js';
+
+/**
+ * Canonical option name -> driver request field name.
+ * Must stay identical to `fieldNameOf()` in `src/index.js`.
+ *
+ * @param {string} name  e.g. 'no-session-persistence'
+ * @returns {string}     e.g. 'noSessionPersistence'
+ */
+export function fieldNameFor(name) {
+  return name.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+}
+
+/**
+ * Build the driver request fields implied by a parsed option map.
+ *
+ * Only options that forward to upstream argv are included; shim-enforced
+ * options (`--max-turns`, `--max-budget-usd`, `--task-budget`,
+ * `--output-format`, …) are the caller's responsibility because they map
+ * onto driver behaviour rather than onto spawn argv.
+ *
+ * Callers should spread the result FIRST and apply their own explicit
+ * fields afterwards, so per-path overrides still win.
+ *
+ * A few upstream flags abort the process unless `claude` is also given
+ * `--print` (currently `--include-partial-messages`). Those are marked
+ * `printModeOnly` in the spec and are withheld unless the caller says it
+ * is running the print-mode path.
+ *
+ * @param {Record<string, unknown>} options  parsed argv options
+ * @param {object} [ctx]
+ * @param {boolean} [ctx.printMode=false]    is this the `--print-mode` path?
+ * @returns {Record<string, unknown>}        driver request fields
+ */
+export function forwardedRequestFields(options, { printMode = false } = {}) {
+  /** @type {Record<string, unknown>} */
+  const fields = {};
+  if (!options || typeof options !== 'object') return fields;
+  for (const spec of OPTION_SPEC) {
+    if (spec.forward?.type !== 'argv') continue;
+    if (spec.printModeOnly && !printMode) continue;
+    const value = options[spec.name];
+    // `buildSpawnArgs` already skips undefined / null / false, but we drop
+    // them here too so request objects stay readable in debug dumps and
+    // daemon payloads stay small.
+    if (value === undefined || value === null || value === false) continue;
+    if (Array.isArray(value) && value.length === 0) continue;
+    fields[fieldNameFor(spec.name)] = value;
+  }
+  return fields;
+}

package/src/options/index.js

@@ -2,3 +2,4 @@
 export { OPTION_SPEC, getOption } from './spec.js';
 export { parseArgv } from './parse-argv.js';
 export { CROSS_RULES, validate } from './validate.js';
+export { forwardedRequestFields, fieldNameFor } from './forward.js';