open-claude-p 1.1.3 → 1.2.2

package/bin/cli.js

@@ -29,6 +29,7 @@ process.on('uncaughtException', (e) => {
 import { parseArgv } from '../src/options/parse-argv.js';
 import { validate } from '../src/options/validate.js';
 import { OPTION_SPEC } from '../src/options/spec.js';
+import { forwardedRequestFields } from '../src/options/forward.js';
 import { createDriver } from '../src/index.js';
 import { sendToDaemon } from '../src/daemon/client.js';
 import { daemonKey, socketPath, resolveCwd } from '../src/daemon/socket.js';
@@ -64,8 +65,29 @@ const EXIT = {
   NOT_IMPLEMENTED: 8,
 };
 
+/**
+ * Scrub TUI chrome out of PTY-extracted text.
+ *
+ * Only for text reconstructed from terminal frames. Text read from the
+ * upstream session JSONL is already clean and must be passed through
+ * untouched. Failures are swallowed: a scrub that throws must never cost
+ * the caller their answer.
+ *
+ * @param {string} text
+ * @returns {Promise<string>}
+ */
+async function scrubPtyText(text) {
+  if (typeof text !== 'string' || text === '') return text;
+  try {
+    const { cleanResponse } = await import('../src/chat/index.js');
+    return cleanResponse(text);
+  } catch {
+    return text;
+  }
+}
+
 async function main() {
-  const { options, positional, unknown, errors } = parseArgv(process.argv.slice(2));
+  const { options, positional, unknown, errors, supplied } = parseArgv(process.argv.slice(2));
 
   if (errors.length > 0) {
     process.stderr.write(errors.map((e) => `error: ${e}`).join('\n') + '\n');
@@ -95,12 +117,47 @@ async function main() {
   // retain the safer default (`false`) — this flip only changes the
   // CLI default. The opt-in `OCP_DEFAULT_SKIP_PERMS=1` from 1.0 is
   // still honoured but is now a no-op (the default already matches it).
+  //
+  // `--restricted` is the one case where the permissive default must
+  // stand down. Upstream refuses the combination outright ("Error:
+  // bypassPermissions not supported in restricted mode") and exits, so
+  // leaving the default on would make `ocp --restricted` fail every
+  // time with no output. Asking for restricted mode IS an explicit
+  // choice to keep the permission gates, so we honour it.
+  //
+  // NOTE on the `supplied` check: every option with a `default` is
+  // pre-seeded into `options`, so `options[x] === false` is ALSO true
+  // when the user passed nothing at all. Testing the value alone made
+  // this opt-out fire on every single invocation, which quietly turned
+  // the whole block into dead code — the default-on behaviour was in
+  // fact coming from `runOneShot`'s `?? true`, and an explicit
+  // `--dangerously-skip-permissions=false` was being ignored. Only a
+  // flag actually present in argv counts as an opt-out.
   const skipPermsOptOut = process.env.OCP_NO_SKIP_PERMS === '1'
                        || process.env.OCP_NO_SKIP_PERMS === 'true'
-                       || options['dangerously-skip-permissions'] === false;
+                       || (supplied.has('dangerously-skip-permissions')
+                           && options['dangerously-skip-permissions'] === false)
+                       || options.restricted === true;
   if (options['dangerously-skip-permissions'] !== true && !skipPermsOptOut) {
     options['dangerously-skip-permissions'] = true;
   }
+  if (options.restricted === true && options['dangerously-skip-permissions'] === true) {
+    process.stderr.write(
+      'error: `--restricted` cannot be combined with ' +
+      '`--dangerously-skip-permissions` — the upstream CLI refuses ' +
+      'bypassPermissions in restricted mode.\n',
+    );
+    return EXIT.VALIDATION_ERROR;
+  }
+
+  // With the bypass gone, something still has to answer permission
+  // prompts, and PTY automation cannot. `--permission-prompts=none`
+  // denies anything that would prompt instead of hanging on it, which
+  // is the only setting that keeps a restricted run headless. The
+  // caller can still ask for `host` explicitly.
+  if (options.restricted === true && options['permission-prompts'] === undefined) {
+    options['permission-prompts'] = 'none';
+  }
 
   // CLI-only default: honour `OCP_NO_SESSION_PERSISTENCE=1` when the user
   // has not explicitly set `--no-session-persistence`. Stateless
@@ -116,12 +173,13 @@ async function main() {
   }
 
   // CLI-only default: pre-approve the read-only network tools so that a
-  // plain `ocp "오늘 날씨"` actually uses WebSearch/WebFetch instead of
-  // silently no-op'ing with "I can't access real-time info". These are
-  // safe-by-construction (no filesystem mutation, no shell exec); a
-  // headless tool that refuses to fetch the web for an automation
-  // surface is the wrong default. Caller-supplied `--allowed-tools`
-  // takes precedence (additive — we merge rather than replace).
+  // plain `ocp "what is the weather today"` actually uses WebSearch /
+  // WebFetch instead of silently no-op'ing with "I can't access
+  // real-time info". These are safe-by-construction (no filesystem
+  // mutation, no shell exec); a headless tool that refuses to fetch the
+  // web for an automation surface is the wrong default. Caller-supplied
+  // `--allowed-tools` takes precedence (additive — we merge rather than
+  // replace).
   // Set OCP_NO_DEFAULT_TOOLS=1 to opt out entirely.
   if (process.env.OCP_NO_DEFAULT_TOOLS !== '1') {
     const DEFAULT_SAFE_TOOLS = ['WebSearch', 'WebFetch'];
@@ -144,10 +202,11 @@ async function main() {
 
   // CLI-only default: encourage tool use for current/time-sensitive
   // queries via the same SDK-wide DEFAULT_APPEND_SYSTEM_PROMPT the
-  // chat client already uses. Without this, a plain `ocp "오늘 날씨"`
-  // refuses with "I can't access real-time data" instead of calling
-  // WebSearch — because Claude's print-mode default behaviour leans
-  // toward declining over tool-use when it can answer with disclaimers.
+  // chat client already uses. Without this, a plain prompt such as
+  // `ocp "what is the weather today"` refuses with "I can't access
+  // real-time data" instead of calling WebSearch — because Claude's
+  // print-mode default behaviour leans toward declining over tool-use
+  // when it can answer with disclaimers.
   // This is a generic, ONE-LINE rule ("use tools when you need to look
   // something up"), not tool-by-tool guidance, so it stays within the
   // "common rules" policy. Caller-supplied `--append-system-prompt`
@@ -248,19 +307,18 @@ async function main() {
       // regardless of what the requester intended. Daemon rejects on
       // mismatch.
       claudeBin: process.env.OCP_CLAUDE_BIN || 'claude',
-      model: options.model,
-      systemPrompt: options['system-prompt'],
-      appendSystemPrompt: options['append-system-prompt'],
-      allowedTools: options['allowed-tools'],
-      disallowedTools: options['disallowed-tools'],
-      dangerouslySkipPermissions: options['dangerously-skip-permissions'],
-      permissionMode: options['permission-mode'],
-      debug: options.debug,
-      verbose: options.verbose,
+      ...forwardedRequestFields(options),
+      // Always a concrete boolean. `forwardedRequestFields` omits `false`
+      // (there is no argv to emit for it), but `runOneShot` resolves a
+      // missing field with `?? true` — so omitting it would silently
+      // re-enable the permission bypass the caller just opted out of via
+      // `OCP_NO_SKIP_PERMS=1`, `--dangerously-skip-permissions=false`, or
+      // `--restricted`.
+      dangerouslySkipPermissions: options['dangerously-skip-permissions'] === true,
+      // Shim-enforced options: no upstream flag, handled by the driver.
       maxTurns: options['max-turns'],
       maxBudgetUsd: options['max-budget-usd'],
       taskBudget: options['task-budget'],
-      noSessionPersistence: options['no-session-persistence'],
       passThroughArgv: unknown,
     };
 
@@ -272,8 +330,10 @@ async function main() {
         process.stdout,
       );
       for (const ev of (result.events ?? [])) adapter.onEvent(ev);
+      // Daemon results are always PTY-extracted — the daemon does not read
+      // the upstream session file — so they need the same scrub.
       adapter.end({
-        text: result.text,
+        text: await scrubPtyText(result.text),
         isError: result.isError,
         sessionId: result.sessionId,
         cost: result.cost,
@@ -328,21 +388,17 @@ async function main() {
         prompt,
         cwd: options.cwd,
         outputFormat,
-        model: options.model,
-        systemPrompt: options['system-prompt'],
-        appendSystemPrompt: options['append-system-prompt'],
-        allowedTools: options['allowed-tools'],
-        disallowedTools: options['disallowed-tools'],
-        dangerouslySkipPermissions: options['dangerously-skip-permissions'],
-        permissionMode: options['permission-mode'],
-        verbose: options.verbose,
-        continue: options.continue,
-        resume: options.resume,
-        forkSession: options['fork-session'],
-        noSessionPersistence: options['no-session-persistence'],
-        sessionId: options['session-id'],
+        ...forwardedRequestFields(options, { printMode: true }),
+        // Always a concrete boolean. `forwardedRequestFields` omits `false`
+        // (there is no argv to emit for it), but `runOneShot` resolves a
+        // missing field with `?? true` — so omitting it would silently
+        // re-enable the permission bypass the caller just opted out of via
+        // `OCP_NO_SKIP_PERMS=1`, `--dangerously-skip-permissions=false`, or
+        // `--restricted`.
+        dangerouslySkipPermissions: options['dangerously-skip-permissions'] === true,
         passThroughArgv: unknown,
         abortSignal: ac.signal,
+        // Shim-enforced options: no upstream flag, handled by the driver.
         maxTurns: options['max-turns'],
         maxBudgetUsd: options['max-budget-usd'],
         printSink: process.stdout,
@@ -401,25 +457,20 @@ async function runOneTurn({ driver, adapter, options, unknown, ac, prompt, resum
   const result = await driver.runOneShot({
     prompt,
     cwd: options.cwd,
-    model: options.model,
-    systemPrompt: options['system-prompt'],
-    appendSystemPrompt: options['append-system-prompt'],
-    allowedTools: options['allowed-tools'],
-    disallowedTools: options['disallowed-tools'],
-    dangerouslySkipPermissions: options['dangerously-skip-permissions'],
-    permissionMode: options['permission-mode'],
-    debug: options.debug,
-    verbose: options.verbose,
-    continue: options.continue,
+    ...forwardedRequestFields(options),
+    // Always a concrete boolean. `forwardedRequestFields` omits `false`
+    // (there is no argv to emit for it), but `runOneShot` resolves a
+    // missing field with `?? true` — so omitting it would silently
+    // re-enable the permission bypass the caller just opted out of via
+    // `OCP_NO_SKIP_PERMS=1`, `--dangerously-skip-permissions=false`, or
+    // `--restricted`.
+    dangerouslySkipPermissions: options['dangerously-skip-permissions'] === true,
+    // The stream-json input loop threads each turn's session id back in
+    // so turn N+1 resumes turn N; it must win over `--resume` from argv.
     resume: resumeOverride ?? options.resume,
-    forkSession: options['fork-session'],
-    noSessionPersistence: options['no-session-persistence'],
-    resumeSessionAt: options['resume-session-at'],
-    rewindFiles: options['rewind-files'],
-    sessionId: options['session-id'],
-    name: options.name,
     passThroughArgv: unknown,
     abortSignal: ac.signal,
+    // Shim-enforced options: no upstream flag, handled by the driver.
     maxTurns: options['max-turns'],
     maxBudgetUsd: options['max-budget-usd'],
     taskBudget: options['task-budget'],
@@ -432,19 +483,30 @@ async function runOneTurn({ driver, adapter, options, unknown, ac, prompt, resum
   // alone cannot scrub; the JSONL file is what claude itself stores
   // and contains only the assistant's message verbatim. We call
   // readSessionText even when sessionId is null — it falls back to the
-  // most-recently-modified JSONL written during this request window.
+  // most-recently-modified JSONL written during this request window,
+  // gated on the transcript actually containing the prompt we sent so a
+  // concurrent session in the same cwd cannot answer for us.
   let finalText = result.text;
   let usage = null;
   let toolsFromSession = [];
+  let fromSessionFile = false;
   if (!result.isError) {
     try {
       const { readSessionText } = await import('../src/chat/index.js');
-      const sessionRead = await readSessionText(result.sessionId, startTime, options.cwd);
-      if (sessionRead?.text) finalText = sessionRead.text;
+      const sessionRead = await readSessionText(
+        result.sessionId, startTime, options.cwd, { expectPrompt: prompt },
+      );
+      if (sessionRead?.text) { finalText = sessionRead.text; fromSessionFile = true; }
       if (sessionRead?.usage) usage = sessionRead.usage;
       if (sessionRead?.tools) toolsFromSession = sessionRead.tools;
     } catch { /* keep PTY-extracted fallback */ }
   }
+  // The JSONL is always clean; PTY-extracted text is not. `cleanResponse`
+  // exists as the last line of defence for exactly this fallback, but the
+  // CLI never called it — only the chat client did — so a run that could
+  // not read the session file printed the TUI's spinner cell and usage
+  // meters around the answer.
+  if (!fromSessionFile) finalText = await scrubPtyText(finalText);
 
   adapter.end({
     text: finalText,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-claude-p",
-  "version": "1.1.3",
+  "version": "1.2.2",
   "description": "A PTY-backed compatibility shim for `claude -p` (Claude Code headless/print mode). Drives the interactive `claude` CLI via node-pty and exposes the same option surface and stream-json contract. Ships as both a library and an `ocp` CLI binary.",
   "type": "module",
   "main": "./src/index.js",

package/src/chat/index.js

@@ -1092,7 +1092,11 @@ export function createChatClient(opts = {}) {
  * @param {string} [cwd]   Directory used to derive the project dir key.
  * @returns {Promise<{ text: string, usage: object|null, tools: string[] } | null>}
  */
-export async function readSessionText(sessionId, t0 = 0, cwd = process.cwd()) {
+export async function readSessionText(sessionId, t0 = 0, cwd = process.cwd(), opts = {}) {
+  // `expectPrompt` is the prompt this request actually sent. It is used
+  // ONLY on the no-sessionId scan path below, to confirm a candidate
+  // transcript is ours before its text is returned as our answer.
+  const expectPrompt = typeof opts.expectPrompt === 'string' ? opts.expectPrompt : '';
   // Claude encodes the project cwd into a single token used as the
   // directory name under ~/.claude/projects/. The mapping replaces BOTH
   // path separators (`/`) and underscores (`_`) with a literal `-`, so
@@ -1233,12 +1237,57 @@ export async function readSessionText(sessionId, t0 = 0, cwd = process.cwd()) {
     .filter((c) => c.mtime >= t0)
     .sort((a, b) => b.mtime - a.mtime);
   for (const { f } of recent.slice(0, 5)) {
-    const r = await extractFromFile(path.join(projectDir, f), t0);
+    const full = path.join(projectDir, f);
+    // Ownership gate. Without a sessionId the only thing separating our
+    // transcript from a neighbour's is "most recently modified", and a
+    // concurrently-running session in the same cwd wins that race
+    // routinely (a daemon holding a warm PTY appends to its JSONL the
+    // whole time). Returning that file's text hands the caller somebody
+    // else's answer — the same leak the strict path above refuses to
+    // risk. When the caller tells us what it asked, require the file to
+    // contain that prompt before trusting it.
+    if (expectPrompt && !(await fileHasUserPrompt(full, expectPrompt))) continue;
+    const r = await extractFromFile(full, t0);
     if (r) return r;
   }
   return null;
 }
 
+/**
+ * Does this transcript contain the prompt we sent?
+ *
+ * Matching is deliberately loose at the tail and strict at the head: ocp
+ * appends its end-of-reply marker instruction to the prompt before typing
+ * it, and the TUI may reflow or truncate what it records, so an equality
+ * check would reject our own file. A leading-substring match on the first
+ * line is enough to tell our transcript apart from an unrelated one.
+ *
+ * @param {string} filePath
+ * @param {string} prompt
+ * @returns {Promise<boolean>}
+ */
+async function fileHasUserPrompt(filePath, prompt) {
+  const head = prompt.replace(/\s+/g, ' ').trim().slice(0, 120);
+  // Too short to identify anything — do not use it as evidence either way.
+  if (head.length < 8) return true;
+  let raw;
+  try { raw = await readFile(filePath, 'utf8'); } catch { return false; }
+  for (const line of raw.split('\n')) {
+    if (!line.trim()) continue;
+    let ev;
+    try { ev = JSON.parse(line); } catch { continue; }
+    if (ev.message?.role !== 'user') continue;
+    const content = ev.message.content;
+    const text = typeof content === 'string'
+      ? content
+      : Array.isArray(content)
+        ? content.filter((c) => c?.type === 'text').map((c) => c.text ?? '').join(' ')
+        : '';
+    if (text.replace(/\s+/g, ' ').includes(head)) return true;
+  }
+  return false;
+}
+
 /**
  * Strip TUI chrome (prompt chars, box borders, status bars, mode lines)
  * from the PTY-stripped buffer text. Use as a fallback when the JSONL
@@ -1279,7 +1328,28 @@ export const TUI_CHROME_PATTERNS = [
 // 2 MCPs | 4 hooks - Zero-config…"). These must NOT drop the whole
 // line — only the matched fragment. Order matters: longer / more
 // specific variants first so the shorter ones don't partial-match.
+// Spinner glyphs the TUI cycles through. Kept in sync with
+// `PATTERNS.spinnerLeading` in `src/parsers/tui-frame.js`.
+const SPINNER_GLYPHS = '✻✶✺✹✸✷✵●✢✳✽·✾✿❀❁❂❃❄❅❆❇❈❉❊❋';
+
 export const TUI_CHROME_INLINE_PATTERNS = [
+  // Rate-limit meters painted to the right of a streamed reply:
+  // `Usage ██░░░░░░░░ 16% (resets in 3h 18m)`, `| Weekly ░░░ 3% (resets in 6d 1h)`.
+  // Anchored on the bar glyphs so ordinary prose with a percentage is safe.
+  new RegExp(
+    String.raw`\s*\|?\s*(?:Usage|Weekly)\s*[█░▒▓]+\s*\d+%\s*\(resets in [^)]*\)`,
+    'gi',
+  ),
+  // Bare context meter: `██████░░░░ 22% │`.
+  /\s*[█░▒▓]{2,}\s*\d+%\s*│?/g,
+  // The animated status cell the TUI paints to the LEFT of a reply,
+  // carrying token counters: `63✢      88  `. Two guards keep real prose
+  // safe: a digit must sit beside the glyph, and the cell must be
+  // separated from the content by the multi-space padding the TUI uses.
+  // That padding is what distinguishes the chrome `✳ 128  Here is …`
+  // from an ordinary bullet like `· 5 minutes later`.
+  new RegExp(String.raw`^\s*\d+\s*[${SPINNER_GLYPHS}]\s*\d*\s{2,}`, 'g'),
+  new RegExp(String.raw`^\s*[${SPINNER_GLYPHS}]\s*\d+\s{2,}`, 'g'),
   /\s*\d+\s+CLAUDE\.md\s*\|\s*\d+\s+rules?\s*\|\s*\d+\s+MCPs?\s*\|\s*\d+\s+hooks?/gi,
   /\s*\d+\s+rules?\s*\|\s*\d+\s+MCPs?\s*\|\s*\d+\s+hooks?/gi,
   /\s*\d+\s+MCP servers?\s+need(?:s)?\s+auth\s*·\s*\/mcp/gi,
@@ -1295,7 +1365,7 @@ export const TUI_CHROME_INLINE_PATTERNS = [
  * @param {string} text
  */
 export function cleanResponse(text) {
-  return String(text ?? '')
+  const cleaned = String(text ?? '')
     .replace(/\r/g, '\n')
     .split('\n')
     .map((l) => l.trimEnd())
@@ -1319,4 +1389,19 @@ export function cleanResponse(text) {
     .replace(/\n{3,}/g, '\n\n')
     .replace(SENTINEL_REGEX, '')
     .trim();
+
+  // The TUI paints bare token counters (`63`, `128`) around a streamed
+  // reply, and once the surrounding chrome is gone they are left stranded
+  // on their own lines. Drop them — but ONLY when other content survives,
+  // so a reply that is legitimately just a number ("what is 6*7" -> "42")
+  // is never swallowed.
+  const lines = cleaned.split('\n');
+  // A counter cell is a bare integer, optionally still carrying the
+  // spinner glyph it was painted next to.
+  const isBareCounter = (l) =>
+    new RegExp(String.raw`^\s*[${SPINNER_GLYPHS}]?\s*\d{1,6}\s*$`).test(l);
+  if (lines.some((l) => l.trim() !== '' && !isBareCounter(l))) {
+    return lines.filter((l) => !isBareCounter(l)).join('\n').trim();
+  }
+  return cleaned;
 }

package/src/index.js

@@ -53,6 +53,7 @@ const UNSAFE_PASSTHROUGH_FLAGS = new Set([
   // Load untrusted agents / plugins
   '--agents',
   '--plugin-dir',
+  '--plugin-url',
   // Bypass permission gates
   '--dangerously-skip-permissions',
   '--allow-dangerously-skip-permissions',
@@ -92,7 +93,13 @@ export function redactArgvForLog(argv) {
         out.push(`${flag}=<redacted len=${tok.length - eq - 1}>`);
       } else {
         out.push(flag);
-        if (i + 1 < argv.length && !argv[i + 1].startsWith('-')) {
+        // Variadic flags (`--mcp-config a.json '{"env":{"TOKEN":"…"}}'`)
+        // carry every value token after the flag, so redacting only the
+        // first left inline MCP/settings JSON — credentials included —
+        // in the log. Consume the whole run of non-flag tokens.
+        while (i + 1 < argv.length
+               && typeof argv[i + 1] === 'string'
+               && !argv[i + 1].startsWith('-')) {
           out.push(`<redacted len=${argv[i + 1].length}>`);
           i++;
         }
@@ -136,6 +143,51 @@ export function sanitizePassThroughArgv(argv) {
  * `runOneShot()` spawns a fresh PTY session; pass `poolSize: N` to opt
  * into warm-session reuse.
  */
+// Environment variables that identify the *calling* Claude Code session —
+// its id, its IPC bridge, its resolved binary — rather than configuring
+// Claude generally. When `ocp` itself runs inside a Claude Code session
+// (an agent driving it, or a developer testing from one) the child
+// `claude` inherits all of them and concludes it is a continuation of the
+// parent rather than a new session. The visible consequence is that it
+// writes no session JSONL at all: `sessionId` comes back null, the clean
+// transcript ocp prefers is unavailable so answers fall back to
+// PTY-scraped text, and `--continue` / `--resume` have nothing to resume.
+//
+// The child is a new, independent session, so these must not carry over.
+// User-facing configuration (`CLAUDE_CODE_SIMPLE`, `CLAUDE_CODE_SAFE_MODE`,
+// provider toggles, …) is deliberately NOT in this list and passes through
+// untouched. Set OCP_KEEP_PARENT_SESSION_ENV=1 to disable the scrub.
+const PARENT_SESSION_ENV = [
+  'CLAUDE_CODE_SESSION_ID',
+  'CLAUDE_CODE_BRIDGE_SESSION_ID',
+  'CLAUDE_CODE_CHILD_SESSION',
+  'CLAUDE_CODE_ENTRYPOINT',
+  'CLAUDE_CODE_MESSAGING_SOCKET',
+  'CLAUDE_CODE_MESSAGING_TOKEN',
+  'CLAUDE_CODE_EXECPATH',
+];
+
+/**
+ * Remove the calling Claude Code session's identity from a spawn env.
+ *
+ * Returns a new object; the input is not mutated. An explicit value in
+ * `opts.env` wins — if a caller deliberately sets one of these, we honour
+ * it rather than second-guessing them.
+ *
+ * @param {Record<string, string|undefined>} env
+ * @param {Record<string, string|undefined>} [explicit]  caller-supplied overrides
+ * @returns {Record<string, string|undefined>}
+ */
+export function scrubParentSessionEnv(env, explicit = {}) {
+  if (process.env.OCP_KEEP_PARENT_SESSION_ENV === '1') return { ...env };
+  const out = { ...env };
+  for (const key of PARENT_SESSION_ENV) {
+    if (Object.prototype.hasOwnProperty.call(explicit, key)) continue;
+    delete out[key];
+  }
+  return out;
+}
+
 export function createDriver(driverOpts = {}) {
   return new Driver(driverOpts);
 }
@@ -245,7 +297,7 @@ class Driver {
       process.env.OCP_PRINT_MODE === 'true';
     if (printMode) {
       const cwd = req.cwd ?? this.opts.cwd;
-      const env = { ...process.env, ...this.opts.env };
+      const env = scrubParentSessionEnv({ ...process.env, ...this.opts.env }, this.opts.env);
       const r = await runPrintMode({
         bin: this.opts.claudeBin,
         req,
@@ -324,7 +376,7 @@ class Driver {
     // Pool eligibility: explicit resume/continue bind to a specific past
     // session and are not poolable (they bypass the pool entirely).
     const cwd = req.cwd ?? this.opts.cwd;
-    const env = { ...process.env, ...this.opts.env };
+    const env = scrubParentSessionEnv({ ...process.env, ...this.opts.env }, this.opts.env);
     const pool = this._getPool();
     const isResumeLike =
       (typeof req.resume === 'string' && req.resume !== '') ||
@@ -1037,7 +1089,7 @@ export async function writePromptToSession(session, content, opts = {}) {
  * OPTION_SPEC and emitting each entry whose forward strategy is `argv`.
  * Pass-through tokens from the CLI's unknown-flag list are appended last.
  */
-function buildSpawnArgs(req) {
+export function buildSpawnArgs(req) {
   const args = [];
   for (const spec of OPTION_SPEC) {
     if (spec.forward?.type !== 'argv') continue;
@@ -1049,6 +1101,16 @@ function buildSpawnArgs(req) {
       if (Array.isArray(value) && value.length > 0) {
         args.push(spec.forward.flag, ...value.map(String));
       }
+    } else if (spec.kind === 'json') {
+      // `parseArgv` stores json-kind options already parsed, so the plain
+      // `String(value)` used below would hand upstream the literal
+      // "[object Object]". Re-serialise objects; leave a string alone so a
+      // library caller can pass raw JSON text without it being
+      // double-encoded.
+      args.push(
+        spec.forward.flag,
+        typeof value === 'string' ? value : JSON.stringify(value),
+      );
     } else {
       args.push(spec.forward.flag, String(value));
     }
@@ -1115,12 +1177,24 @@ async function listSessionFiles(cwd) {
  * This avoids picking up an unrelated neighbour session created by
  * another claude process that happened to finish around the same time.
  *
+ * Class (a) beats class (b) outright, and only the highest-mtime file
+ * WITHIN the winning class is returned. Ranking both classes together by
+ * mtime made this function pick a neighbour whenever one was touched
+ * later than our own session — which is the normal state of affairs when
+ * a background daemon holds a warm PTY in the same cwd: its JSONL keeps
+ * being appended, so it reliably out-races the file we just created.
+ * The wrong id then flows straight into `readSessionText`, whose
+ * strict-by-session-id path faithfully returns SOMEBODY ELSE'S
+ * transcript as this request's answer. A fresh spawn always creates a
+ * new file, so preferring class (a) removes that race; class (b) still
+ * covers the legitimate `--resume` append, where no new file appears.
+ *
  * @param {string|undefined} cwd
  * @param {number} since                  epoch-ms taken at the start of the request
  * @param {Map<string,number>} before     baseline filename -> mtimeMs from listSessionFiles
  * @returns {Promise<string|null>}
  */
-async function findRecentSessionId(cwd, since, before) {
+export async function findRecentSessionId(cwd, since, before) {
   // See listSessionFiles for the rationale on realpath + the `/_` -> `-`
   // mapping. Both helpers must agree, or the "did this file exist
   // before our request?" comparison silently misses every entry.
@@ -1129,21 +1203,32 @@ async function findRecentSessionId(cwd, since, before) {
   let entries;
   try { entries = await readdir(dir); } catch { return null; }
   const threshold = since - 1500;
-  let best = null;
-  let bestMtime = 0;
+  // Tracked separately so a newly-created file always wins over a
+  // neighbour that merely got appended to during our window.
+  let newBest = null; let newBestMtime = 0;
+  let movedBest = null; let movedBestMtime = 0;
   for (const name of entries) {
     if (!/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\.jsonl$/.test(name)) continue;
     let st;
     try { st = await stat(path.join(dir, name)); } catch { continue; }
     if (st.mtimeMs < threshold) continue;
     const baseline = before?.get(name);
-    if (baseline !== undefined && st.mtimeMs <= baseline + 100) continue; // existed before, didn't move
-    if (st.mtimeMs > bestMtime) {
-      bestMtime = st.mtimeMs;
-      best = name.replace(/\.jsonl$/, '');
+    if (baseline === undefined) {
+      // (a) Created during our run.
+      if (st.mtimeMs > newBestMtime) {
+        newBestMtime = st.mtimeMs;
+        newBest = name.replace(/\.jsonl$/, '');
+      }
+      continue;
+    }
+    if (st.mtimeMs <= baseline + 100) continue; // existed before, didn't move
+    // (b) Existed before and was appended to during our run.
+    if (st.mtimeMs > movedBestMtime) {
+      movedBestMtime = st.mtimeMs;
+      movedBest = name.replace(/\.jsonl$/, '');
     }
   }
-  return best;
+  return newBest ?? movedBest;
 }
 
 /**

package/src/options/forward.js

@@ -0,0 +1,70 @@
+// Parsed-argv options -> driver request fields.
+//
+// `buildSpawnArgs()` in the driver is fully spec-driven: it walks
+// OPTION_SPEC and emits `--flag value` for every entry whose
+// `forward.type` is `'argv'`, reading the value from
+// `req[camelCase(spec.name)]`. This module is the other half of that
+// contract — it lifts those same options out of the parsed argv map and
+// onto the request object under the field names the driver expects.
+//
+// The two halves used to be maintained by hand at each call site, and
+// they drifted: roughly thirty documented flags (`--effort`,
+// `--thinking`, `--add-dir`, `--mcp-config`, `--settings`, `--agents`,
+// `--betas`, `--fallback-model`, `--tools`, `--bare`, …) parsed cleanly,
+// passed validation, and appeared in `--help`, but nothing ever copied
+// them into the request, so they were silently dropped before the
+// upstream process could see them. Deriving both directions from the
+// same spec keeps them in lockstep: appending an entry to OPTION_SPEC is
+// once again the only edit a newly-supported upstream flag needs.
+
+import { OPTION_SPEC } from './spec.js';
+
+/**
+ * Canonical option name -> driver request field name.
+ * Must stay identical to `fieldNameOf()` in `src/index.js`.
+ *
+ * @param {string} name  e.g. 'no-session-persistence'
+ * @returns {string}     e.g. 'noSessionPersistence'
+ */
+export function fieldNameFor(name) {
+  return name.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+}
+
+/**
+ * Build the driver request fields implied by a parsed option map.
+ *
+ * Only options that forward to upstream argv are included; shim-enforced
+ * options (`--max-turns`, `--max-budget-usd`, `--task-budget`,
+ * `--output-format`, …) are the caller's responsibility because they map
+ * onto driver behaviour rather than onto spawn argv.
+ *
+ * Callers should spread the result FIRST and apply their own explicit
+ * fields afterwards, so per-path overrides still win.
+ *
+ * A few upstream flags abort the process unless `claude` is also given
+ * `--print` (currently `--include-partial-messages`). Those are marked
+ * `printModeOnly` in the spec and are withheld unless the caller says it
+ * is running the print-mode path.
+ *
+ * @param {Record<string, unknown>} options  parsed argv options
+ * @param {object} [ctx]
+ * @param {boolean} [ctx.printMode=false]    is this the `--print-mode` path?
+ * @returns {Record<string, unknown>}        driver request fields
+ */
+export function forwardedRequestFields(options, { printMode = false } = {}) {
+  /** @type {Record<string, unknown>} */
+  const fields = {};
+  if (!options || typeof options !== 'object') return fields;
+  for (const spec of OPTION_SPEC) {
+    if (spec.forward?.type !== 'argv') continue;
+    if (spec.printModeOnly && !printMode) continue;
+    const value = options[spec.name];
+    // `buildSpawnArgs` already skips undefined / null / false, but we drop
+    // them here too so request objects stay readable in debug dumps and
+    // daemon payloads stay small.
+    if (value === undefined || value === null || value === false) continue;
+    if (Array.isArray(value) && value.length === 0) continue;
+    fields[fieldNameFor(spec.name)] = value;
+  }
+  return fields;
+}