openmausbot 0.1.70 → 0.1.72

package/dist-server/server/drivers/claude.js

@@ -16,9 +16,12 @@ import { join, dirname, isAbsolute, normalize } from "node:path";
 import { DATA_DIR, stripWorkspaceCredentialEnv } from "../config.js";
 import { augmentedPath } from "../env-path.js";
 import { brokerSocketPath, describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
+import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
 import { ClaudeLoginController } from "./claude-login-auth.js";
 import { computerProxyEnv } from "../container-computer.js";
+import { gateServer, resultBudget } from "../mcp-gate-config.js";
 import { newEventId, newId } from "../contracts.js";
+import { askInputSummary, commandSummary } from "../tool-summary.js";
 import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS } from "./retry.js";
 import { applyClaudeInject, decodeInjectId, mergeLocalInject, probeLocalInjects, resolveInjectId, } from "./local-inject.js";
 import { appendNative } from "./native.js";
@@ -45,10 +48,14 @@ function claudeAuthStatus(cli, env, run = execCli) {
                 const candidateEmail = boundedText(identity.email, 254);
                 const email = candidateEmail && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(candidateEmail) ? candidateEmail : undefined;
                 const organization = boundedText(identity.orgName, 160);
-                resolve({
-                    authenticated: true,
-                    ...(email || organization ? { account: { ...(email ? { email } : {}), ...(organization ? { organization } : {}) } } : {}),
-                });
+                // An API key is a workspace decision, not a person: say so instead
+                // of showing an empty identity.
+                const account = {
+                    ...(email ? { email } : {}),
+                    ...(organization ? { organization } : {}),
+                    ...(identity.authMethod === "api_key" ? { method: "api-key" } : {}),
+                };
+                resolve({ authenticated: true, ...(Object.keys(account).length ? { account } : {}) });
             }
             catch {
                 resolve({ authenticated: false });
@@ -127,10 +134,140 @@ function claudeEnvironment(model, source = process.env, configDir, instanceEnvir
     // env-injected at boot); none of them are this CLI's to see.
     stripWorkspaceCredentialEnv(env);
     const applied = applyClaudeInject(env, model);
-    if (!applied.injected)
+    // A key set on purpose for this workspace (Settings → Connections, carried
+    // in the instance environment) stays. One riding along in the parent's
+    // env never does: it would flip a subscription login to pay-as-you-go.
+    if (!applied.injected && !instanceEnvironment.ANTHROPIC_API_KEY)
         delete env.ANTHROPIC_API_KEY;
     return env;
 }
+/** Escape hatch back to the pre-isolation launch, where a bot inherited this
+ * machine's Claude Code setup: its MCP servers and connectors, skills,
+ * agents, hooks and personal CLAUDE.md. Set it only to recover a bot that
+ * genuinely depended on a user- or local-scope MCP server; the supported way
+ * to give a bot a server is the app's own `mcpServers` config or the bot
+ * project's `.mcp.json`. */
+function inheritsUserConfig(env) {
+    return env.OMB_CLAUDE_INHERIT_USER_CONFIG === "1";
+}
+/** MCP servers the bot's own project declares in `<cwd>/.mcp.json`.
+ *
+ * The CLI would find this file itself, but the harness launches it with
+ * --strict-mcp-config, which makes the harness's config the only source.
+ * The project file IS part of the bot's definition (its cwd is chosen per
+ * bot), so it is forwarded verbatim — including `type: "http"`/`"sse"`
+ * entries the harness never mounts itself, because the CLI, not this code,
+ * is what has to understand them. A malformed file is ignored rather than
+ * failing the turn: an unreadable project config must not brick a bot. */
+function projectMcpServers(cwd) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(join(cwd, ".mcp.json"), "utf8"));
+    }
+    catch {
+        return {};
+    }
+    const servers = parsed?.mcpServers;
+    if (!servers || typeof servers !== "object" || Array.isArray(servers))
+        return {};
+    const out = {};
+    for (const [name, server] of Object.entries(servers)) {
+        if (server && typeof server === "object" && !Array.isArray(server))
+            out[name] = server;
+    }
+    return out;
+}
+/** The CLI compacts its own session when it approaches a window. Left alone
+ * that window is the model's, so a Sonnet 5 session runs to something near a
+ * million tokens before anything happens — and every model call until then
+ * re-reads the whole thing. The measured food-ordering thread sat at 330k
+ * tokens per call and looked perfectly healthy to the CLI.
+ *
+ * So the harness picks the window instead. This delegates the actual
+ * compaction to the CLI, which owns the session and already has a summarizer
+ * for it; the harness only decides when it is worth paying for.
+ *
+ * OMB_CLAUDE_AUTOCOMPACT takes a token count, "auto" to hand the decision
+ * back to the CLI, or "off" to pass nothing at all. The CLI rejects a window
+ * outside 100k-1M as a hard argument error, so a configured value is clamped
+ * rather than passed through: a mistyped setting must not fail every turn. */
+export function autoCompactWindow(env) {
+    const raw = (env.OMB_CLAUDE_AUTOCOMPACT ?? "").trim().toLowerCase();
+    if (raw === "off")
+        return null;
+    if (raw === "auto")
+        return "auto";
+    const parsed = raw ? Number(raw) : DEFAULT_AUTOCOMPACT_TOKENS;
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return String(DEFAULT_AUTOCOMPACT_TOKENS);
+    return String(Math.min(1_000_000, Math.max(100_000, Math.floor(parsed))));
+}
+/** Generous for real work, and still a third of where a 1M-window session
+ * would otherwise get to. With bot tool results gated (mcp-gate.ts) most
+ * threads never reach it; this is the backstop for the ones that do. */
+const DEFAULT_AUTOCOMPACT_TOKENS = 200_000;
+/** The Claude CLI version that first accepted each flag the harness passes
+ * for context control. An unknown flag is a hard argument error, so passing
+ * one to an older CLI would fail every turn rather than degrade; each flag
+ * is therefore only passed to a CLI known to accept it.
+ *
+ * Verified against the published binaries, not the changelog (which never
+ * records `--autocompact`): `--strict-mcp-config` is present in 1.0.60 and
+ * absent from 1.0.0; `--setting-sources` first appears in 1.0.122 (1.0.120
+ * lacks it); `--autocompact` first appears in 2.1.122 (2.1.121 lacks it). */
+export const CLAUDE_FLAG_FLOORS = {
+    "--strict-mcp-config": [1, 0, 60],
+    "--setting-sources": [1, 0, 122],
+    "--autocompact": [2, 1, 122],
+};
+/** The newest floor above: a CLI at or past it accepts everything the
+ * harness sends. Below it the engine still works, minus the flags the CLI
+ * predates, and the Engines page suggests an update. */
+export const CLAUDE_CONTEXT_CONTROL_MIN_VERSION = CLAUDE_FLAG_FLOORS["--autocompact"];
+/** `claude --version` prints "2.1.232 (Claude Code)"; the first dotted triple
+ * is the version. Null when nothing parses, e.g. a wrapper that prints its
+ * own banner first — see claudeCliSupports for how that is treated. */
+export function parseClaudeCliVersion(stdout) {
+    const match = /(\d+)\.(\d+)\.(\d+)/.exec(stdout ?? "");
+    if (!match)
+        return null;
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function versionAtLeast(installed, floor) {
+    for (let i = 0; i < 3; i += 1) {
+        if (installed[i] !== floor[i])
+            return installed[i] > floor[i];
+    }
+    return true;
+}
+/** Whether a CLI reporting `version` accepts `flag`. A version that could
+ * not be parsed counts as current: every CLI that predates a floor prints a
+ * plain "x.y.z (Claude Code)", so an unreadable version is far more likely
+ * a newer wrapper than an old build, and withholding the flags from a modern
+ * CLI would silently re-open the context leak this file exists to close. */
+export function claudeCliSupports(version, flag) {
+    return version === null || versionAtLeast(version, CLAUDE_FLAG_FLOORS[flag]);
+}
+/** The Engines-page notice for a CLI older than the newest floor. The engine
+ * keeps working: turns run without the flags the CLI predates, which means
+ * no harness-picked compaction window and, on a very old CLI, no isolation
+ * from this machine's own Claude Code setup. */
+export function claudeCliUpdate(version, cli) {
+    const parsed = parseClaudeCliVersion(version);
+    if (!parsed || versionAtLeast(parsed, CLAUDE_CONTEXT_CONTROL_MIN_VERSION))
+        return undefined;
+    const floor = CLAUDE_CONTEXT_CONTROL_MIN_VERSION.join(".");
+    const missing = Object.keys(CLAUDE_FLAG_FLOORS)
+        .filter((flag) => !claudeCliSupports(parsed, flag));
+    return {
+        title: "Update Claude Code for context controls",
+        message: `Claude Code ${parsed.join(".")} predates ${floor}, so bots run without ${missing.join(", ")}: ` +
+            "no compaction window picked by OpenMausBot" +
+            (missing.includes("--setting-sources") ? ", and bots still see this machine's own Claude Code setup" : "") +
+            ". Update it, then refresh Engines.",
+        command: cli === "claude" ? "claude update" : `${cli} update`,
+    };
+}
 const DRIVER_KIND = "claudeAgent";
 // model catalog ported from upstream packages/contracts/src/model.ts
 export const STATIC_CLAUDE_MODELS = {
@@ -235,15 +372,7 @@ function systemEndedReply(kind) {
 }
 /** One human-readable line for an ask — what the card subtitle shows. */
 function askSummary(ask) {
-    const input = ask.input ?? {};
-    if (typeof input.question === "string")
-        return input.question.slice(0, 300);
-    if (typeof input.command === "string")
-        return input.command.slice(0, 200);
-    if (typeof input.url === "string")
-        return input.url.slice(0, 200);
-    const text = JSON.stringify(input);
-    return text === "{}" ? (ask.tool ?? "tool") : text.slice(0, 200);
+    return askInputSummary(ask.input) ?? ask.tool ?? "tool";
 }
 export function permissionSocketPath(threadId) {
     // A readable prefix alone is not unique: ids that agree on their first
@@ -435,7 +564,7 @@ export async function createPermissionBroker(opts) {
     if (!server)
         throw new Error("claude: permission broker could not bind a local socket");
     const drain = () => {
-        for (const p of [...pending.values()]) {
+        for (const p of Array.from(pending.values())) {
             const { behavior, message } = systemEndedReply(p.ask.kind);
             p.finish(behavior, message, "system");
         }
@@ -524,6 +653,17 @@ function firstText(content) {
 /** Claude's stream-json input accepts the same image source blocks as the
  * Anthropic Messages API. Keep the old string form for text-only turns so a
  * CLI update cannot disturb the overwhelmingly common path. */
+/** How a mid-session change to the volatile half of the system prompt
+ * reaches a model whose process was launched with the old copy. The CLI's
+ * own out-of-band convention inside a user turn, and it costs one short
+ * append rather than a relaunch that re-uploads the whole prompt cache. */
+function withVolatileNote(text, volatile) {
+    const body = volatile.trim()
+        ? `This part of your instructions changed since this session started. It replaces the earlier copy:\n\n${volatile.trim()}`
+        : "The notes that were in your instructions when this session started have been cleared.";
+    const note = `<system-reminder>\n${body}\n</system-reminder>`;
+    return text ? `${note}\n\n${text}` : note;
+}
 function claudeUserMessage(text, images) {
     if (!images?.length)
         return { type: "user", message: { role: "user", content: text } };
@@ -594,6 +734,15 @@ export const ClaudeDriver = {
             }
         };
         await refreshModels();
+        // The installed CLI's version as snapshot() last read it, so a flag the
+        // CLI does not know is never passed to it (CLAUDE_FLAG_FLOORS). The
+        // harness snapshots every instance whenever it describes them — app
+        // load, the Engines page, and right after `claude update`, which is
+        // exactly when the answer changes — so a turn normally finds it filled.
+        // A turn before any snapshot assumes a current CLI rather than paying a
+        // CLI start-up of its own: the flags are the default, the exception is
+        // the older install, and the next snapshot corrects it.
+        let cliVersion = null;
         const listeners = new Set();
         // one active turn per thread; a second send while busy is a caller bug
         const active = new Map();
@@ -659,7 +808,7 @@ export const ClaudeDriver = {
             });
         };
         const emit = (event) => {
-            for (const l of [...listeners])
+            for (const l of Array.from(listeners))
                 l(event);
         };
         const base = (threadId, turnId) => ({
@@ -718,6 +867,26 @@ export const ClaudeDriver = {
                 args.push("--disallowedTools", config.disallowedTools.join(","));
             }
             const turnEnvironment = environment();
+            const isolated = !inheritsUserConfig(turnEnvironment);
+            if (isolated) {
+                // A bot gets the tools and instructions its owner gave it, not
+                // whatever this machine's Claude Code happens to be set up with.
+                // Without these the CLI silently adds, to EVERY turn of every bot:
+                // the desktop's own MCP servers and claude.ai connectors (one
+                // measured desktop mounted 407 extra tools, ~10k tokens), its skill
+                // and agent listings, its hooks, and its personal CLAUDE.md. Every
+                // model call in the session then re-reads all of it.
+                // Each flag only on a CLI that accepts it: an unknown flag is an
+                // argument error that would fail every turn (CLAUDE_FLAG_FLOORS).
+                if (claudeCliSupports(cliVersion, "--strict-mcp-config"))
+                    args.push("--strict-mcp-config");
+                if (claudeCliSupports(cliVersion, "--setting-sources"))
+                    args.push("--setting-sources", "project");
+            }
+            const compactWindow = autoCompactWindow(turnEnvironment);
+            if (compactWindow && claudeCliSupports(cliVersion, "--autocompact")) {
+                args.push("--autocompact", compactWindow);
+            }
             const turnModel = await resolveClaudeTurnModel(turn.model, turnEnvironment);
             const injected = applyClaudeInject({ ...turnEnvironment }, turnModel);
             if (injected.model)
@@ -794,10 +963,39 @@ export const ClaudeDriver = {
             // routes every custom tool call through the ogb permission broker
             // into an Allow/Deny card. Reserved names were filtered upstream;
             // skip any residual collision instead of clobbering a built-in.
+            // Bot-owned servers, gated below: they are the ones that answer for a
+            // machine rather than for a context window.
+            const botOwned = new Set();
             for (const [name, server] of Object.entries(turn.integrations?.custom ?? {})) {
-                if (name in mcpServers)
+                if (Object.hasOwn(mcpServers, name))
                     continue;
                 mcpServers[name] = { ...server };
+                botOwned.add(name);
+            }
+            // --strict-mcp-config (above) makes this config the CLI's only source
+            // of MCP servers, so a server the bot's OWN project declares would
+            // otherwise vanish with the machine's. Merge it last: a project file
+            // can add servers but never shadow a harness-owned mount.
+            if (isolated && turn.cwd) {
+                for (const [name, server] of Object.entries(projectMcpServers(turn.cwd))) {
+                    if (Object.hasOwn(mcpServers, name))
+                        continue;
+                    mcpServers[name] = server;
+                    botOwned.add(name);
+                }
+            }
+            // One tool call can put more into the conversation than the whole rest
+            // of the session: a single product search measured 60-140 KB of JSON,
+            // and the CLI re-reads it on every later model call. The harness never
+            // sees these calls — the CLI runs the server itself — so the only place
+            // to stand is between the two processes. Harness-owned mounts (the
+            // permission broker, computer, browser, agents, dweb) are already
+            // bounded and are deliberately left alone.
+            const budget = resultBudget(turnEnvironment);
+            for (const name of botOwned) {
+                const gated = gateServer({ name, server: mcpServers[name], threadId, budget, nodeEnv: NODE_ENV_FLAG });
+                if (gated)
+                    mcpServers[name] = gated;
             }
             // Keep ask_user available even in Full access. Native bypass skips
             // permission prompts, not questions requiring a person's answer.
@@ -832,7 +1030,9 @@ export const ClaudeDriver = {
             const keyArgs = args.filter((a, i) => !privateFileFlags.has(a) && !privateFileFlags.has(args[i - 1] ?? ""));
             const argsKey = JSON.stringify({
                 args: keyArgs,
-                system: turn.system ?? null,
+                // the volatile half is deliberately absent: it must not respawn a
+                // healthy session (see Session.volatile)
+                system: turn.systemStable ?? turn.system ?? null,
                 mcpServers,
                 cwd,
                 model: injected.model ?? null,
@@ -852,7 +1052,12 @@ export const ClaudeDriver = {
                         killCliTree(live.child);
                     }, turnId, broker: live.broker });
                 emit({ ...base(threadId, turnId), type: "turn.started" });
-                const written = await writeUser(live, threadId, promptMsg);
+                const volatile = turn.systemVolatile ?? "";
+                const message = volatile === live.volatile
+                    ? promptMsg
+                    : claudeUserMessage(withVolatileNote(turn.text, volatile), turn.images);
+                live.volatile = volatile;
+                const written = await writeUser(live, threadId, message);
                 if (!written) {
                     active.delete(threadId);
                     live.turn = null;
@@ -982,7 +1187,9 @@ export const ClaudeDriver = {
                 mcpConfigPath,
                 systemPromptPath,
                 argsKey,
+                volatile: turn.systemVolatile ?? "",
                 sessionId: sessionId ?? newSessionId,
+                sawInit: false,
                 turn: { turnId, settled: false, sawStreamDelta: false },
                 idleTimer: null,
                 closing: false,
@@ -1035,6 +1242,7 @@ export const ClaudeDriver = {
                 switch (o.type) {
                     case "system":
                         if (o.subtype === "init") {
+                            session.sawInit = true;
                             if (typeof o.session_id === "string")
                                 session.sessionId = o.session_id;
                             emit({ ...base(threadId, currentTurnId()), type: "session.started", sessionId: o.session_id, model: o.model });
@@ -1087,7 +1295,14 @@ export const ClaudeDriver = {
                         }
                         for (const b of Array.isArray(msg.content) ? msg.content : []) {
                             if (b.type === "tool_use") {
-                                emit({ ...base(threadId, currentTurnId()), type: "item.started", itemType: "tool", itemId: b.id, title: b.name });
+                                emit({
+                                    ...base(threadId, currentTurnId()),
+                                    type: "item.started",
+                                    itemType: "tool",
+                                    itemId: b.id,
+                                    title: b.name,
+                                    summary: commandSummary(b.input),
+                                });
                             }
                         }
                         if (msg.usage) {
@@ -1240,6 +1455,67 @@ export const ClaudeDriver = {
                         })();
                         return;
                     }
+                    // A --resume that the CLI never acknowledged: it exited without
+                    // an `init` frame, so it never read the prompt and this turn has
+                    // caused nothing. Without this the thread is BRICKED — the dead
+                    // cursor is never cleared, so every later turn resumes the same
+                    // missing session and fails identically, and the user has no way
+                    // back except switching engines. One fresh session, carrying the
+                    // harness's rebuild of the conversation. Exactly one: the relaunch
+                    // offers no cursor, so `attempted` is false there and a second
+                    // failure is reported like any other.
+                    const resumeFailure = classifyResumeFailure({
+                        attempted: Boolean(sessionId),
+                        rejected: !session.sawInit,
+                        promptSubmitted: session.sawInit,
+                        producedOutput: session.turn.sawStreamDelta,
+                    });
+                    if (mayReplay(resumeFailure) && !retry.cancelled) {
+                        const recovery = recoveryPromptFor({
+                            recoveryText: turn.recoveryText,
+                            currentText: turn.text,
+                            failure: resumeFailure,
+                        });
+                        session.broker?.close();
+                        session.broker = undefined;
+                        if (session.mcpConfigPath) {
+                            try {
+                                rmSync(dirname(session.mcpConfigPath), { recursive: true, force: true });
+                            }
+                            catch { }
+                            session.mcpConfigPath = null;
+                        }
+                        if (session.systemPromptPath) {
+                            removePrivateTempDir(session.systemPromptPath);
+                            session.systemPromptPath = null;
+                        }
+                        sessions.delete(threadId);
+                        session.turn = null;
+                        active.delete(threadId);
+                        emit({
+                            ...base(threadId, turnId),
+                            type: "turn.retrying",
+                            attempt: retry.attempt + 1,
+                            delayMs: 0,
+                            reason: "resume_rejected",
+                        });
+                        void (async () => {
+                            try {
+                                // no cursor: a fresh session, carrying the rebuild
+                                await sendTurn({ ...turn, resumeCursor: undefined, recoveryText: undefined, text: recovery.text });
+                            }
+                            catch (e) {
+                                retryState.delete(threadId);
+                                emit({
+                                    ...base(threadId, turnId),
+                                    type: "runtime.error",
+                                    message: e instanceof Error ? e.message : String(e),
+                                });
+                                emit({ ...base(threadId, turnId), type: "turn.completed", ok: false, stopReason: "exit_before_result", cost: null });
+                            }
+                        })();
+                        return;
+                    }
                     retryState.delete(threadId);
                     emit({
                         ...base(threadId, currentTurnId()),
@@ -1298,11 +1574,13 @@ export const ClaudeDriver = {
             });
             if (!version)
                 return { state: "unavailable", reason: `\`${config.cli}\` CLI not found` };
+            cliVersion = parseClaudeCliVersion(version);
             const auth = await claudeAuthStatus(config.cli, env);
             // claudeEnvironment strips ANTHROPIC_API_KEY, so turns run on the
             // CLI's own login (Pro/Max): the cost it reports is what the call
             // WOULD bill, not a charge
-            return { state: "available", version, ...auth, billing: "subscription" };
+            const update = claudeCliUpdate(version, config.cli);
+            return { state: "available", version, ...auth, ...(update ? { update } : {}), billing: "subscription" };
         };
         /** One-shot Claude call with the prompt on stdin, never argv. Approval
          * summaries can contain paths, commands, or secrets, so the generic
@@ -1413,7 +1691,7 @@ export const ClaudeDriver = {
                 stopAll: async () => {
                     for (const { stop } of active.values())
                         stop();
-                    for (const threadId of [...sessions.keys()])
+                    for (const threadId of Array.from(sessions.keys()))
                         closeSession(threadId, "stopAll");
                 },
                 onEvent: (listener) => {
@@ -1430,7 +1708,7 @@ export const ClaudeDriver = {
                 finally {
                     for (const { stop } of active.values())
                         stop();
-                    for (const threadId of [...sessions.keys()])
+                    for (const threadId of Array.from(sessions.keys()))
                         closeSession(threadId, "dispose");
                     listeners.clear();
                 }

package/dist-server/server/drivers/codex.js

@@ -22,6 +22,7 @@ import { codexLocalProviderArgs } from "./local-inject.js";
 import { augmentedPath, splitCliString } from "../env-path.js";
 import { classifyError, computeBackoff, RETRY_MAX_ATTEMPTS } from "./retry.js";
 import { appendNative } from "./native.js";
+import { commandSummary } from "../tool-summary.js";
 import { codexDeveloperInstructions, syncCodexInstructions } from "./codex-instructions.js";
 import { CodexDeviceAuthController } from "./codex-device-auth.js";
 import { codexAccountEmail } from "./codex-identity.js";
@@ -434,7 +435,7 @@ export const CodexDriver = {
         const listeners = new Set();
         const active = new Map();
         const emit = (event) => {
-            for (const l of [...listeners])
+            for (const l of Array.from(listeners))
                 l(event);
         };
         const base = (threadId, turnId) => ({
@@ -571,7 +572,7 @@ export const CodexDriver = {
                     if (state.settled)
                         return;
                     state.settled = true;
-                    for (const finish of [...asks.values()])
+                    for (const finish of Array.from(asks.values()))
                         finish("deny", "OpenMausBot: the turn ended", "system");
                     for (const p of rpcPending.values())
                         p.reject(new Error("turn settled"));
@@ -738,8 +739,16 @@ export const CodexDriver = {
                                         : item.type === "webSearch"
                                             ? "web_search"
                                             : null;
-                            if (title)
-                                emit({ ...base(threadId, turnId), type: "item.started", itemType: "tool", itemId: item.id, title });
+                            if (title) {
+                                emit({
+                                    ...base(threadId, turnId),
+                                    type: "item.started",
+                                    itemType: "tool",
+                                    itemId: item.id,
+                                    title,
+                                    summary: item.type === "commandExecution" ? commandSummary({ command: item.command }) : undefined,
+                                });
+                            }
                             break;
                         }
                         case "item/completed": {

package/dist-server/server/drivers/pi.js

@@ -389,7 +389,7 @@ export const PiDriver = {
         // one active turn per thread
         const active = new Map();
         const emit = (event) => {
-            for (const l of [...listeners])
+            for (const l of Array.from(listeners))
                 l(event);
         };
         const base = (threadId, turnId) => ({