openmausbot 0.1.73 → 0.1.75

package/dist-server/server/drivers/acp/core.js

@@ -101,6 +101,28 @@ function decodeAcpConfig(defaultCli) {
  * ACP JSON-RPC-over-stdio driver. Harness differences (argv, auth, catalog)
  * live in `support`; this is the shared handshake and turn runtime.
  */
+/** What "the same operation" means for a remembered session allow: the
+ * tool call's shape with keys sorted, so two identical requests key alike
+ * however the agent ordered its JSON. null when nothing identifies it. */
+function sessionOperationKey(toolCall) {
+    const rawInput = toolCall?.rawInput;
+    const command = typeof rawInput?.command === "string" ? rawInput.command : undefined;
+    const hasInput = rawInput && typeof rawInput === "object" && Object.keys(rawInput).length > 0;
+    if (!command && !hasInput)
+        return null;
+    const stable = (value) => Array.isArray(value)
+        ? value.map(stable)
+        : value && typeof value === "object"
+            ? Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable(value[key])]))
+            : value;
+    return JSON.stringify(stable({
+        kind: toolCall?.kind,
+        title: toolCall?.title,
+        command,
+        input: rawInput,
+        locations: toolCall?.locations,
+    }));
+}
 export function createAcpDriver(support) {
     const DRIVER_KIND = support.driverKind;
     const SOURCE = support.nativeSource;
@@ -155,6 +177,13 @@ export function createAcpDriver(support) {
                 await refreshModels();
             const listeners = new Set();
             const active = new Map();
+            // "Always allow this session", remembered by the driver when the agent
+            // offered no `allow_always` of its own: the exact operations (kind,
+            // title, command, input, locations) a person allowed for the session,
+            // per thread. A repeat is answered the way they did, once, for as long
+            // as the native session lasts. A generic title with no input identifies
+            // nothing and is never remembered.
+            const sessionAllows = new Map();
             const emit = (event) => {
                 for (const listener of listeners)
                     listener(event);
@@ -455,6 +484,7 @@ export function createAcpDriver(support) {
                     const optionFor = (want) => options.find((o) => o.kind === `${want}_once` && typeof o.optionId === "string")?.optionId
                         ?? options.find((o) => String(o.kind ?? "").startsWith(want) && typeof o.optionId === "string")?.optionId
                         ?? null;
+                    const optionAlways = options.find((o) => o.kind === "allow_always" && typeof o.optionId === "string")?.optionId ?? null;
                     const cancelled = { outcome: { outcome: "cancelled" } };
                     const missing = (want) => emit({
                         ...base(threadId, turnId),
@@ -474,14 +504,23 @@ export function createAcpDriver(support) {
                         });
                     }
                     const kind = String(toolCall.kind ?? "");
+                    // an earlier "Always allow this session" on this exact operation
+                    const operationKey = isQuestion || controlsHost ? null : sessionOperationKey(toolCall);
+                    if (operationKey && sessionAllows.get(threadId)?.has(operationKey)) {
+                        const allow = optionFor("allow");
+                        if (allow) {
+                            return send({ jsonrpc: "2.0", id: msg.id, result: { outcome: { outcome: "selected", optionId: allow } } });
+                        }
+                    }
                     const tool = kind === "execute" ? "shell" : kind === "edit" ? "edit" : kind || "tool";
                     const summary = String(toolCall.rawInput?.command ?? toolCall.title ?? tool).slice(0, 200);
                     const requestId = newId();
-                    const finish = (behavior, source = "user", message) => {
+                    const finish = (behavior, source = "user", message, always) => {
                         if (!asks.delete(requestId))
                             return;
                         clearTimeout(timer);
                         const want = behavior === "allow" ? "allow" : "reject";
+                        const forSession = want === "allow" && always === true && !isQuestion && !controlsHost;
                         const named = isQuestion && behavior === "answer"
                             ? options.filter((option) => option.optionId === message || option.name?.trim() === message)
                             : [];
@@ -489,7 +528,16 @@ export function createAcpDriver(support) {
                             ? null
                             : isQuestion
                                 ? named.length === 1 && typeof named[0].optionId === "string" ? named[0].optionId : null
-                                : optionFor(want);
+                                : forSession
+                                    ? optionAlways ?? optionFor("allow")
+                                    : optionFor(want);
+                        // the agent keeps its own allow_always; when it offered none, the
+                        // driver keeps the operation for the session instead
+                        if (forSession && !optionAlways && optionId && operationKey) {
+                            const remembered = sessionAllows.get(threadId) ?? new Set();
+                            remembered.add(operationKey);
+                            sessionAllows.set(threadId, remembered);
+                        }
                         if (behavior !== "cancel" && !optionId)
                             missing(isQuestion ? "matching answer" : want);
                         send({
@@ -523,6 +571,8 @@ export function createAcpDriver(support) {
                             ? options.flatMap((option) => typeof option.name === "string" && option.name.trim() ? [option.name.trim()] : [])
                             : undefined,
                         approvalScope: controlsHost ? "local-computer" : undefined,
+                        // the driver can honor a session-wide allow either way
+                        allowSession: !isQuestion && !controlsHost ? true : undefined,
                     });
                 };
                 const handleNotification = (msg) => {
@@ -695,11 +745,15 @@ export function createAcpDriver(support) {
                             }
                         }
                         const images = turn.images ?? [];
-                        const runtimeAcceptsImages = init?.agentCapabilities?.promptCapabilities?.image === true;
+                        const runtimeAcceptsImages = init?.agentCapabilities?.promptCapabilities?.image === true ||
+                            support.acceptsUnadvertisedImages?.(init) === true;
                         if (images.length && support.images === true && !runtimeAcceptsImages) {
                             throw new Error(`${support.displayName} is configured for image attachments, but this installed runtime does not advertise ACP image input. Update the ${support.displayName} CLI or send the message without an image.`);
                         }
                         const cursor = typeof turn.resumeCursor === "string" ? turn.resumeCursor : null;
+                        // a fresh native session forgets what the previous one allowed
+                        if (!cursor)
+                            sessionAllows.delete(threadId);
                         let sessionResult = null;
                         if (cursor) {
                             try {
@@ -878,7 +932,7 @@ export function createAcpDriver(support) {
                         const finish = turn?.asks.get(requestId);
                         if (!finish)
                             return "unavailable"; // settled, timed out, or turn gone
-                        finish(decision.behavior, "user", decision.message);
+                        finish(decision.behavior, "user", decision.message, decision.always === true);
                         return decision.behavior === "allow"
                             ? "allowed-once"
                             : decision.behavior === "answer"

package/dist-server/server/drivers/acp/grok.js

@@ -175,10 +175,21 @@ export function ensureGrokInjectSlug(modelId, env = process.env) {
     writeFileSync(path, next);
     return slug;
 }
+/** Grok 1.0.25 consumes native image blocks but advertises image:false.
+ * Verified with the real CLI and a loopback model: scripts/verify-grok-images.ts.
+ * Keep unknown/older runtimes on the normal capability negotiation path. */
+export function grokAcceptsUnadvertisedImages(init) {
+    const meta = init?._meta;
+    if (meta?.grokShell !== true || typeof meta.agentVersion !== "string")
+        return false;
+    const version = /^1\.0\.(\d+)$/.exec(meta.agentVersion);
+    return Boolean(version && Number(version[1]) >= 25);
+}
 const support = {
     driverKind: "grokAgent",
     displayName: "Grok",
-    images: false,
+    images: true,
+    acceptsUnadvertisedImages: grokAcceptsUnadvertisedImages,
     models: STATIC_GROK_MODELS,
     resolveModels: (env) => mergeLocalInject(readGrokModelCatalog(env), env),
     // Grok's accepted levels vary by model and the CLI validates lazily — a
@@ -214,7 +225,9 @@ const support = {
     // crates/codegen/xai-grok-pager-bin/src/main.rs:1259-1273.
     spawnArgs: (config, turn) => [
         "--permission-mode",
-        config.fullAuto ? "bypassPermissions" : turn.approvalMode === "auto" ? "auto" : "default",
+        config.fullAuto
+            ? "bypassPermissions"
+            : turn.approvalMode === "auto" ? "auto" : turn.approvalMode === "edits" ? "acceptEdits" : "default",
         "agent",
         ...(turn.model ? ["-m", turn.model] : []),
         // long form on purpose: `--effort` is documented as an alias, and an

package/dist-server/server/drivers/antigravity-acp.js

@@ -148,6 +148,7 @@ export class AntigravityAcpClient {
     startupDiagnosticBytes = 0;
     nativeStartupHint;
     closed = false;
+    stopping;
     onAuthorizationUrl;
     /** Settles once the runtime process is gone. On Windows a running
      * executable pins its file and its directory, so an installer must not
@@ -291,10 +292,10 @@ export class AntigravityAcpClient {
             return;
         this.closed = true;
         this.failAll(new Error("Antigravity ACP was closed."));
-        killCliTree(this.child);
+        this.stopping = killCliTree(this.child);
     }
-    /** Close, then wait (bounded) for the process to be gone. */
-    async closeAndWait(timeoutMs = 5_000) {
+    /** Allow the shared 5s TERM grace and 1s force-stop verification to finish. */
+    async closeAndWait(timeoutMs = 7_000) {
         this.close();
         let timer;
         const timedOut = new Promise((resolve) => {
@@ -302,7 +303,7 @@ export class AntigravityAcpClient {
             timer.unref?.();
         });
         try {
-            return await Promise.race([this.exited.then(() => true), timedOut]);
+            return await Promise.race([this.stopping, timedOut]);
         }
         finally {
             clearTimeout(timer);

package/dist-server/server/drivers/antigravity.js

@@ -11,8 +11,13 @@ export const STATIC_ANTIGRAVITY_MODELS = {
         { id: "gemini-3.8-flash-low", label: "Gemini 3.8 Flash (Low)" },
     ],
 };
-export function antigravityPermissionMode(fullAuto) {
-    return fullAuto ? "yolo" : "default";
+/** Antigravity's own session modes: `yolo` for Full access, `auto_edit` for
+ * auto-accept edits, `default` otherwise (Ask, and Auto, which it has no
+ * reviewer for). */
+export function antigravityPermissionMode(fullAuto, approvalMode) {
+    if (fullAuto)
+        return "yolo";
+    return approvalMode === "edits" ? "auto_edit" : "default";
 }
 export function antigravityModelsFromSession(value) {
     return catalogFromAntigravityConfigOptions(value, STATIC_ANTIGRAVITY_MODELS.default);
@@ -88,8 +93,8 @@ const support = {
             return { state: "unavailable", reason: error instanceof Error ? error.message : String(error) };
         }
     },
-    configureSession: async ({ request, sessionId, config }) => {
-        const wanted = antigravityPermissionMode(config.fullAuto);
+    configureSession: async ({ request, sessionId, config, turn }) => {
+        const wanted = antigravityPermissionMode(config.fullAuto, turn.approvalMode);
         const result = await request("session/set_config_option", {
             sessionId,
             configId: "mode",

package/dist-server/server/drivers/claude.js

@@ -26,6 +26,7 @@ import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS }
 import { applyClaudeInject, decodeInjectId, mergeLocalInject, probeLocalInjects, resolveInjectId, } from "./local-inject.js";
 import { appendNative } from "./native.js";
 import { SPAWNED_PROXIES } from "../proxy-paths.js";
+import { ASK_USER_QUESTION_TOOL, askQuestionSummary, parseAskQuestions, questionChoices, } from "../../shared/ask-question.js";
 /** Whether `claude` has been signed in.
  *
  * Credential storage is deliberately not inspected here. Claude Code uses the
@@ -150,6 +151,30 @@ function claudeEnvironment(model, source = process.env, configDir, instanceEnvir
 function inheritsUserConfig(env) {
     return env.OMB_CLAUDE_INHERIT_USER_CONFIG === "1";
 }
+/** Retain the selected CLI account's authentication without importing its
+ * hooks, permissions, MCP servers or personal instructions. Explicit OMB
+ * connections/local endpoints own their entire routing + credential pair. */
+export function readClaudeAuthSettings(env, instanceEnvironment = {}) {
+    if (CLAUDE_ACCOUNT_ENV_KEYS.some((key) => instanceEnvironment[key]))
+        return {};
+    try {
+        const settings = JSON.parse(readFileSync(join(resolveClaudeConfigDir(undefined, env), "settings.json"), "utf8"));
+        const authEnv = {};
+        for (const key of CLAUDE_ACCOUNT_ENV_KEYS) {
+            if (!key.endsWith("_FILE_DESCRIPTOR") && typeof settings?.env?.[key] === "string") {
+                authEnv[key] = settings.env[key];
+            }
+        }
+        return {
+            ...(Object.keys(authEnv).length ? { env: authEnv } : {}),
+            ...(typeof settings?.apiKeyHelper === "string" && settings.apiKeyHelper.trim()
+                ? { apiKeyHelper: settings.apiKeyHelper } : {}),
+        };
+    }
+    catch {
+        return {};
+    }
+}
 /** MCP servers the bot's own project declares in `<cwd>/.mcp.json`.
  *
  * The CLI would find this file itself, but the harness launches it with
@@ -370,8 +395,17 @@ function systemEndedReply(kind) {
         ? { behavior: "answer", message: "OpenMausBot: the turn is ending — wrap up." }
         : { behavior: "deny", message: "OpenMausBot: the turn ended" };
 }
+/** The structured questions behind an ask, when it is one. Claude's own
+ * AskUserQuestion carries them; everything else answers null and keeps the
+ * plain summary/choices card. */
+function askQuestions(ask) {
+    return ask.tool === ASK_USER_QUESTION_TOOL ? parseAskQuestions(ask.input) : null;
+}
 /** One human-readable line for an ask — what the card subtitle shows. */
 function askSummary(ask) {
+    const questions = askQuestions(ask);
+    if (questions)
+        return askQuestionSummary(questions).slice(0, 300);
     return askInputSummary(ask.input) ?? ask.tool ?? "tool";
 }
 export function permissionSocketPath(threadId) {
@@ -482,12 +516,18 @@ export async function createPermissionBroker(opts) {
                     continue;
                 }
                 const ask = { id: askId, kind, tool: msg.tool ?? "tool", input: msg.input ?? {}, at: Date.now() };
-                const finish = (behavior, message, source) => {
+                const finish = (behavior, message, source, always) => {
                     if (!pending.delete(askId))
                         return;
                     clearTimeout(timer);
                     try {
-                        conn.write(JSON.stringify({ t: "answer", id: askId, behavior, message }) + "\n");
+                        // `always` rides to the proxy, which hands the CLI's own suggested
+                        // permission rules back as updatedPermissions: Claude remembers
+                        // the allow for the session, the harness remembers nothing.
+                        // `source` travels with the answer too: a proxy that cannot tell
+                        // the human's words from a timeout note would file the timeout
+                        // note as the human's words.
+                        conn.write(JSON.stringify({ t: "answer", id: askId, behavior, message, source, ...(always ? { always: true } : {}) }) + "\n");
                     }
                     catch { }
                     opts.onResolve({ ...ask, behavior, source });
@@ -570,13 +610,13 @@ export async function createPermissionBroker(opts) {
         }
     };
     return {
-        answer(askId, behavior, message) {
+        answer(askId, behavior, message, always) {
             const p = pending.get(askId);
             if (!p)
                 return false;
             if (p.ask.kind === "question" ? behavior !== "answer" : behavior === "answer")
                 return false;
-            p.finish(behavior, message, "user");
+            p.finish(behavior, message, "user", always && behavior === "allow");
             return true;
         },
         pause() {
@@ -752,6 +792,12 @@ export const ClaudeDriver = {
             ? configuredIdleMinimum
             : 10_000;
         const SESSION_IDLE_MS = Math.max(sessionIdleMinimum, Number(process.env.OMB_CLAUDE_SESSION_IDLE_MS) || 10 * 60_000);
+        const stopSession = (session) => {
+            void killCliTree(session.child).then((stopped) => {
+                if (stopped)
+                    void session.finishClose?.();
+            });
+        };
         const closeSession = (threadId, why) => {
             const s = sessions.get(threadId);
             if (!s || s.closing)
@@ -772,8 +818,7 @@ export const ClaudeDriver = {
             }
             catch { }
             const kill = setTimeout(() => {
-                if (s.child.exitCode === null)
-                    killCliTree(s.child);
+                stopSession(s);
             }, 5_000);
             kill.unref?.();
         };
@@ -833,7 +878,8 @@ export const ClaudeDriver = {
             const permissionMode = turn.approvalMode === undefined
                 ? config.permissionMode
                 : turn.approvalMode === "full" ? "bypassPermissions"
-                    : turn.approvalMode === "auto" ? "auto" : "default";
+                    : turn.approvalMode === "auto" ? "auto"
+                        : turn.approvalMode === "edits" ? "acceptEdits" : "default";
             const controlsHost = turn.integrations?.localComputer?.scope === "local-computer";
             if (controlsHost && permissionMode === "bypassPermissions" && turn.approvalMode !== "full") {
                 throw new Error("local computer control requires the interactive approval broker");
@@ -1019,6 +1065,12 @@ export const ClaudeDriver = {
                 args.push("--allowedTools", allowed.join(","));
             }
             const env = environment(turnModel);
+            const authSettings = isolated && !injected.injected
+                ? readClaudeAuthSettings(env, input.environment) : {};
+            const authSettingsPath = mcpConfigPath && Object.keys(authSettings).length
+                ? join(dirname(mcpConfigPath), "auth-settings.json") : null;
+            if (authSettingsPath)
+                args.push("--settings", authSettingsPath);
             // Our approvals and browser credentials expire at the user-turn
             // boundary. Native background workers cannot outlive that boundary;
             // parallel bot work must use the harness's durable delegate_bot path.
@@ -1026,7 +1078,7 @@ export const ClaudeDriver = {
             const cwd = turn.cwd ?? homedir();
             // Everything that shapes the process, minus session/turn-specific temp
             // paths. Their contents are represented directly in the key instead.
-            const privateFileFlags = new Set(["--mcp-config"]);
+            const privateFileFlags = new Set(["--mcp-config", "--settings"]);
             const keyArgs = args.filter((a, i) => !privateFileFlags.has(a) && !privateFileFlags.has(args[i - 1] ?? ""));
             const argsKey = JSON.stringify({
                 args: keyArgs,
@@ -1038,6 +1090,11 @@ export const ClaudeDriver = {
                 model: injected.model ?? null,
                 base: env.ANTHROPIC_BASE_URL ?? null,
                 configDir: env.CLAUDE_CONFIG_DIR ?? null,
+                // Rotating an account's key/helper must not reuse the old process.
+                auth: createHash("sha256").update(JSON.stringify({
+                    settings: authSettings,
+                    env: Object.fromEntries(CLAUDE_ACCOUNT_ENV_KEYS.map((key) => [key, env[key]])),
+                })).digest("hex"),
             });
             // Reuse the live process when it is idle, unchanged, and is the session
             // the harness wants resumed. Anything else: close it and spawn fresh
@@ -1049,7 +1106,7 @@ export const ClaudeDriver = {
                 live.turn = { turnId, settled: false, sawStreamDelta: false };
                 active.set(threadId, { stop: () => {
                         closeSession(threadId, "interrupted");
-                        killCliTree(live.child);
+                        stopSession(live);
                     }, turnId, broker: live.broker });
                 emit({ ...base(threadId, turnId), type: "turn.started" });
                 const volatile = turn.systemVolatile ?? "";
@@ -1121,6 +1178,14 @@ export const ClaudeDriver = {
                         onAsk: (ask) => {
                             const eventTurnId = sessions.get(threadId)?.turn?.turnId ?? turnId;
                             askTools.set(ask.id, typeof ask.tool === "string" ? ask.tool : undefined);
+                            // Auto was requested: say whether the CLI's reviewer is actually
+                            // running, from init, so the harness can tell a classifier's
+                            // verdict from a Manual session asking about everything.
+                            const nativeMode = sessions.get(threadId)?.nativePermissionMode ?? null;
+                            const nativeReview = permissionMode === "auto" && nativeMode !== null
+                                ? nativeMode === "auto" ? "active" : "inactive"
+                                : undefined;
+                            const questions = askQuestions(ask);
                             emit({
                                 ...base(threadId, eventTurnId),
                                 type: "request.opened",
@@ -1128,10 +1193,19 @@ export const ClaudeDriver = {
                                 requestType: ask.kind,
                                 tool: ask.tool,
                                 summary: askSummary(ask),
+                                nativeReview,
+                                // the proxy hands Claude its own suggested rules on `always`;
+                                // host control stays one action at a time
+                                allowSession: ask.kind === "permission" && !(controlsHost && typeof ask.tool === "string" && ask.tool.startsWith("mcp__computer")) ? true : undefined,
                                 approvalScope: typeof ask.tool === "string" && controlsHost && ask.tool.startsWith("mcp__computer")
                                     ? "local-computer"
                                     : undefined,
-                                choices: Array.isArray(ask.input?.choices) ? ask.input.choices.slice(0, 5) : undefined,
+                                questions: questions ?? undefined,
+                                // A structured ask still offers flat labels, for the phone
+                                // companions and any client that predates the question card.
+                                choices: questions
+                                    ? questionChoices(questions)
+                                    : Array.isArray(ask.input?.choices) ? ask.input.choices.slice(0, 5) : undefined,
                             });
                         },
                         onResolve: (resolved) => {
@@ -1160,6 +1234,9 @@ export const ClaudeDriver = {
                 if (mcpConfigPath) {
                     writeFileSync(mcpConfigPath, JSON.stringify({ mcpServers }), { mode: 0o600 });
                 }
+                if (authSettingsPath) {
+                    writeFileSync(authSettingsPath, JSON.stringify(authSettings), { mode: 0o600 });
+                }
                 if (sessionId)
                     args.push("--resume", sessionId);
                 else
@@ -1190,6 +1267,7 @@ export const ClaudeDriver = {
                 volatile: turn.systemVolatile ?? "",
                 sessionId: sessionId ?? newSessionId,
                 sawInit: false,
+                nativePermissionMode: null,
                 turn: { turnId, settled: false, sawStreamDelta: false },
                 idleTimer: null,
                 closing: false,
@@ -1231,6 +1309,8 @@ export const ClaudeDriver = {
             };
             const currentTurnId = () => session.turn?.turnId ?? turnId;
             const handleLine = (line) => {
+                if (session.closing)
+                    return;
                 let o;
                 try {
                     o = JSON.parse(line);
@@ -1243,6 +1323,7 @@ export const ClaudeDriver = {
                     case "system":
                         if (o.subtype === "init") {
                             session.sawInit = true;
+                            session.nativePermissionMode = typeof o.permissionMode === "string" ? o.permissionMode : null;
                             if (typeof o.session_id === "string")
                                 session.sessionId = o.session_id;
                             emit({ ...base(threadId, currentTurnId()), type: "session.started", sessionId: o.session_id, model: o.model });
@@ -1371,7 +1452,22 @@ export const ClaudeDriver = {
                 emit({ ...base(threadId, currentTurnId()), type: "runtime.error", ...describeSpawnFailure(e, config.cli) });
                 settle(false, "spawn_error");
             });
-            child.on("close", (code) => {
+            let closeFinalized = false;
+            const finalizeClose = async (code) => {
+                if (closeFinalized)
+                    return;
+                // The root can close while its MCP helpers are still running. Join
+                // an in-flight stop (or reap its remaining group) before releasing
+                // the turn so a replacement cannot overlap the old helpers.
+                if (!(await killCliTree(child, 0))) {
+                    session.broker?.close();
+                    session.broker = undefined;
+                    emit({ ...base(threadId, currentTurnId()), type: "runtime.error", message: "Claude could not be confirmed stopped; its helper processes may still be running." });
+                    return;
+                }
+                if (closeFinalized)
+                    return;
+                closeFinalized = true;
                 // a turn still running when the process died is a failed turn; a
                 // process that exited between turns (idle close, contract change)
                 // is just a session ending
@@ -1536,6 +1632,10 @@ export const ClaudeDriver = {
                 removePrivateTempDir(session.systemPromptPath);
                 if (sessions.get(threadId) === session)
                     sessions.delete(threadId);
+            };
+            child.on("close", (code) => {
+                session.finishClose = () => finalizeClose(code);
+                void session.finishClose();
             });
             const stop = () => {
                 // taskkill is asynchronous on Windows. Retire steering and approvals
@@ -1543,7 +1643,7 @@ export const ClaudeDriver = {
                 closeSession(threadId, "interrupted");
                 retry.cancelled = true;
                 retryAbort.abort();
-                killCliTree(child);
+                stopSession(session);
             };
             active.set(threadId, { stop, turnId, broker });
             emit({ ...base(threadId, turnId), type: "turn.started" });
@@ -1683,7 +1783,7 @@ export const ClaudeDriver = {
                     if (!broker)
                         return "unavailable";
                     const behavior = decision.behavior === "answer" ? "answer" : decision.behavior;
-                    if (!broker.answer(requestId, behavior, decision.message))
+                    if (!broker.answer(requestId, behavior, decision.message, decision.always))
                         return "unavailable";
                     return behavior === "allow" ? "allowed-once" : behavior === "answer" ? "answered" : "rejected";
                 },

package/dist-server/server/drivers/codex.js

@@ -181,6 +181,9 @@ function mcpAppApprovalForm(params) {
 /** Codex persists these values on its native thread. Keep them explicit on
  * start, resume, and every turn so switching modes cannot leave a more
  * permissive sandbox/reviewer stuck to the next request. */
+/** Ask and Edits both run Codex's workspace-write sandbox with the person as
+ * reviewer: Codex has no narrower "edits only" mode, so the selector never
+ * offers Edits for it (supportsApprovalMode) and a stray value asks. */
 function namedApprovalParams(mode) {
     if (mode === "full") {
         return {
@@ -521,6 +524,7 @@ export const CodexDriver = {
                 const earlyNotifications = [];
                 const state = {
                     settled: false,
+                    lastError: "",
                     lastText: "",
                     sawStreamDelta: false,
                     // codex reports token usage as a running THREAD total; the harness
@@ -582,10 +586,18 @@ export const CodexDriver = {
                     send({ jsonrpc: "2.0", id, method, params });
                 });
                 let stopping;
-                const terminate = () => stopping ??= killCliTree(child);
-                const stop = () => {
+                const terminate = () => stopping ??= killCliTree(child).then((stopped) => {
+                    if (!stopped)
+                        stopping = undefined;
+                    return stopped;
+                });
+                let completeStoppedTurn;
+                const stop = async () => {
                     stopRequested = true;
-                    return terminate();
+                    const stopped = await terminate();
+                    if (stopped)
+                        completeStoppedTurn?.();
+                    return stopped;
                 };
                 const settle = async (ok, stopReason) => {
                     if (state.settled)
@@ -602,15 +614,9 @@ export const CodexDriver = {
                         active.delete(threadId);
                         emit({ ...base(threadId, turnId), type: "turn.completed", ok, stopReason, cost: null, ...(state.usage ? { usage: state.usage } : {}) });
                     };
-                    if (await stop()) {
-                        complete();
-                    }
-                    else {
+                    completeStoppedTurn = complete;
+                    if (!(await stop())) {
                         emit({ ...base(threadId, turnId), type: "runtime.error", message: "codex did not shut down after termination was requested" });
-                        if (child.exitCode !== null || child.signalCode !== null)
-                            complete();
-                        else
-                            child.once("close", complete);
                     }
                 };
                 // server→client approval request → canonical request.opened
@@ -873,7 +879,15 @@ export const CodexDriver = {
                         }
                         case "turn/completed": {
                             const t = p.turn ?? {};
-                            void settle(t.status === "completed", t.status === "completed" ? null : (t.error?.message ?? t.status ?? "failed"));
+                            const message = typeof t.error?.message === "string" ? t.error.message.slice(0, 400) : "";
+                            if (t.status !== "completed" && message && message !== state.lastError) {
+                                state.lastError = message;
+                                emit({ ...base(threadId, turnId), type: "runtime.error", message,
+                                    ...(classifyError({ text: message }).reason === "auth" ? { setup: true } : {}),
+                                });
+                            }
+                            void settle(t.status === "completed", t.status === "completed" ? null :
+                                (classifyError({ text: message || state.lastError }).reason === "provider_safety" ? "provider_safety" : (message || t.status || "failed")));
                             break;
                         }
                         case "error":
@@ -881,8 +895,10 @@ export const CodexDriver = {
                             // {error:{message}} — surface either (agentcal armor)
                             {
                                 const message = p.message ?? p.error?.message;
-                                if (message)
-                                    emit({ ...base(threadId, turnId), type: "runtime.error", message: String(message).slice(0, 400) });
+                                if (message) {
+                                    state.lastError = String(message).slice(0, 400);
+                                    emit({ ...base(threadId, turnId), type: "runtime.error", message: state.lastError });
+                                }
                             }
                             break;
                     }
@@ -943,6 +959,12 @@ export const CodexDriver = {
                 child.on("close", (code) => {
                     if (abandoned)
                         return;
+                    if (state.settled) {
+                        // Root exit alone cannot release a turn after an uncertain stop.
+                        // Recheck its group; an explicit later Stop can also retry this.
+                        void stop();
+                        return;
+                    }
                     if (!state.settled) {
                         emit({
                             ...base(threadId, turnId),
@@ -1134,7 +1156,7 @@ export const CodexDriver = {
                             message,
                             ...(needsAuth ? { setup: true } : {}),
                         });
-                        await settle(false, needsAuth ? "auth_required" : "rpc_error");
+                        await settle(false, needsAuth ? "auth_required" : verdict.reason === "provider_safety" ? "provider_safety" : "rpc_error");
                     }
                 }
             };

package/dist-server/server/drivers/retry.js

@@ -1,3 +1,4 @@
+import { isProviderSafetyBlock } from "../../shared/provider-safety.js";
 export const RETRY_MAX_ATTEMPTS = 3;
 /** Backoff schedule before attempt N (N is 1-based over retries): 1s / 3s / 8s. */
 export const BACKOFF_BASE_MS = [1_000, 3_000, 8_000];
@@ -42,6 +43,9 @@ const messageOf = (err) => {
  */
 export function classifyError(err) {
     const text = messageOf(err);
+    // A surrounding HTTP 5xx/429 must not replay a provider safety block.
+    if (isProviderSafetyBlock(text))
+        return { transient: false, reason: "provider_safety" };
     if (err && "exitCode" in err) {
         const { exitCode: code } = err;
         if (code !== null && code < 0)