openmausbot 0.1.74 → 0.1.76

package/dist-server/server/drivers/agents-proxy.js

@@ -36,6 +36,7 @@
 import readline from "node:readline";
 import { CREDENTIAL_TARGETS, isCredentialTargetId } from "../../shared/credential-request.js";
 import { agentToolAnnotations } from "../agent-tool-policy.js";
+import { peerName } from "../peer-roster.js";
 const HARNESS = process.env.OMB_HARNESS_URL ?? "http://127.0.0.1:8799";
 const BOT_ID = process.env.OMB_BOT_ID ?? "";
 const THREAD_ID = process.env.OMB_THREAD_ID ?? "";
@@ -342,14 +343,30 @@ const ROUTINE_FIELDS_SCHEMA = {
     },
 };
 const TOOLS = [
+    {
+        name: "list_room_targets",
+        description: "Discover actual OpenMausBot teammates and rooms in your allowed teams. Works in a normal bot conversation too; no room is required. Returns bot and room IDs, roles and working folders, never other conversations' history. Use these bots, not native coding helpers with similar names, when the user asks their team to work together.",
+        inputSchema: { type: "object", properties: {}, additionalProperties: false },
+    },
+    {
+        name: "coordinate_bots",
+        description: "Ask existing OpenMausBot teammates for advice or assign concrete work. From normal chat each assignment gets a separate recipient conversation; from a room it defaults to this room. Use group_id from list_room_targets for a specific room. Name 1-4 bot_ids: they receive only your brief and use their own model, tools and permissions. Busy bots queue. They can consult their specialists; all results return here and resume you automatically. Include exact file paths, constraints and what must be verified. After sending all assignments, END your turn; do not poll or wait. On return, resolve tradeoffs, verify the requested outcome and request concrete corrections if necessary before giving one final answer. Do not send acknowledgements as new work.",
+        inputSchema: { type: "object", additionalProperties: false, properties: {
+                group_id: { type: "string", description: "Optional destination room. Omit for this room, or separate recipient tasks when chatting directly." },
+                bot_ids: { type: "array", items: { type: "string" }, minItems: 1, maxItems: 4, uniqueItems: true },
+                message: { type: "string", minLength: 1, maxLength: 4000, description: "Self-contained question or task for these teammates. Send separate requests when responsibilities differ." },
+                request_key: { type: "string", description: "A short unique assignment key. Reuse for an identical retry." },
+                rework: { type: "boolean", description: "True only for concrete additional work from someone who already completed a request." },
+            }, required: ["bot_ids", "message", "request_key"] },
+    },
     {
         name: "list_bots",
-        description: "List the other bots (agents) in your OpenMausBot section, with their model and whether they're busy. Call this before delegate_bot or ask_bot to discover who's available. Use delegate_bot for assignments; use ask_bot only for a short consultation needed inline.",
+        description: "List the other bots (agents) you may contact in your own team and any additional teams the owner has explicitly allowed you to coordinate, with their team, model and current status. Call this to discover exact teammate IDs before assigning work or requesting advice through your available coordination tools.",
         inputSchema: { type: "object", properties: {} },
     },
     {
         name: "list_rooms",
-        description: "List the shared rooms (team channels) you belong to, with the other members of each. Call this before post_to_room — it is the only place room ids come from. One-to-one bot channels are never listed (reach a single bot with ask_bot or delegate_bot). A room you are in but cannot post into — one containing someone outside your section — is named without an id, together with the reason, so you can tell the user why.",
+        description: "List the shared rooms (team channels) you belong to, with the other members of each. Call this before post_to_room. One-to-one bot channels are never listed; discover individual teammates with list_bots. A room you are in but cannot post into is named without an id, together with the reason, so you can tell the user why.",
         inputSchema: { type: "object", additionalProperties: false, properties: {} },
     },
     {
@@ -402,12 +419,12 @@ const TOOLS = [
     },
     {
         name: "list_threads",
-        description: "See your own threads and the threads you opened on teammates, newest first: each with its bot, title, state (running, waiting on the person, queued, or idle), whether the person has unread there, and the delegation id if it was a handoff. Use it to check how the threads you started are going before reporting to the person; write a thread's title as #Title when you mention it. A teammate's other threads are never listed — only the ones you opened. This is a read: it starts nothing and changes nothing.",
+        description: "See your own threads and the threads you opened on teammates, newest first: each with its bot, title, state (running, waiting on the person, queued, idle, or closed), whether the person has unread there, and the delegation id if it was a handoff. Use it to check how the threads you started are going before reporting to the person; write a thread's title as #Title when you mention it. A teammate's other threads are never listed — only the ones you opened. This is a read: it starts nothing and changes nothing.",
         inputSchema: { type: "object", additionalProperties: false, properties: {} },
     },
     {
         name: "close_thread",
-        description: "Mark a thread you opened (or one of your own) as finished once you have read its result: it goes idle in the person's sidebar with a note saying you closed it. Nothing is deleted — deleting stays the person's decision — and a thread that is still running cannot be closed; wait for it or leave it. Use the thread id from list_threads or from the start_thread result. If a close is refused, do not retry it.",
+        description: "Mark a thread you opened (or one of your own) as finished once you have read its result: it leaves the person's default sidebar list (still under all threads, with a note saying you closed it) and list_threads reports it as closed. Nothing is deleted — deleting stays the person's decision — and a thread that is still running cannot be closed; wait for it or leave it. Use the thread id from list_threads or from the start_thread result. If a close is refused, do not retry it.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -456,6 +473,45 @@ const TOOLS = [
             required: ["name", "role", "instructions"],
         },
     },
+    {
+        name: "list_team_setup",
+        description: "Chief of Staff only: list authorized teams, teammate IDs, and exact engine/model choices for team setup. Call before proposing configuration; never invent model IDs. Existing thread models are independent of bot defaults.",
+        inputSchema: { type: "object", additionalProperties: false, properties: {} },
+    },
+    {
+        name: "propose_team_setup",
+        description: "Chief of Staff only: propose all requested specialist creation, profile/model configuration, and authorized team moves in ONE combined review card. Nothing changes until the user applies it. Use exact catalog engine/model IDs from list_team_setup. Combine all fields for each bot; use the same create key or botId to coalesce repeated entries. New teams must be named explicitly in newTeams and have a specialist in this plan; the card also asks to authorize your access to just those new teams. Existing unauthorized teams cannot be included. Models change bot defaults for groups/new threads; existing threads and execution permissions stay unchanged. After proposing, end your turn. The decision and structured result automatically resume you once; do not ask again, poll, or repeat the proposal.",
+        inputSchema: {
+            type: "object", additionalProperties: false,
+            properties: {
+                reason: { type: "string", minLength: 1, maxLength: 500 },
+                newTeams: { type: "array", maxItems: 8, items: { type: "string", minLength: 1, maxLength: 60 } },
+                operations: { type: "array", minItems: 1, maxItems: 24, items: {
+                        type: "object", additionalProperties: false,
+                        properties: {
+                            action: { type: "string", enum: ["create", "update"] },
+                            key: { type: "string", description: "For create: your stable short name for this new bot in this plan." },
+                            botId: { type: "string", description: "For update: exact existing bot ID from list_team_setup." },
+                            fields: { type: "object", additionalProperties: false, properties: {
+                                    name: { type: "string", maxLength: 100 }, title: { type: "string", maxLength: 200 },
+                                    description: { type: "string", maxLength: 4000 }, soul: { type: "string", description: "Standing instructions; required with name/title/modelSelection for every new bot." },
+                                    section: { type: "string", maxLength: 60, description: "Exact authorized existing team, or a team explicitly named in newTeams. Empty string means General." },
+                                    modelSelection: { type: "object", additionalProperties: false, properties: {
+                                            instanceId: { type: "string" }, model: { type: "string" }, effort: { type: "string" },
+                                        }, required: ["instanceId", "model"] },
+                                } },
+                        }, required: ["action", "fields"],
+                    } },
+            }, required: ["reason", "operations"],
+        },
+    },
+    {
+        name: "propose_bot_deletion",
+        description: "Chief of Staff only: when the user explicitly asks to delete a named teammate, create a separate confirmation card for that exact bot. Deletion removes its conversations, memory, instructions and skills; generated project files remain. Running work and owned computers can block deletion. Never delete yourself, substitute an archive, or put deletion into a setup batch. End your turn after proposing; the decision and result resume you once.",
+        inputSchema: { type: "object", additionalProperties: false, properties: {
+                bot_id: { type: "string", minLength: 1 }, reason: { type: "string", minLength: 1, maxLength: 500 },
+            }, required: ["bot_id", "reason"] },
+    },
     {
         name: "create_room",
         description: "Create a room in your own section when the user asks for one (maximum four per turn). Chiefs only. Choose active peers from list_bots; you are included automatically as the default responder. This creates no turns or messages. Section moves stay with the user. If peer approval is enabled, ask the user to make the room change instead.",
@@ -694,9 +750,18 @@ const TOOLS = [
     return annotations ? { ...tool, annotations } : tool;
 });
 const SKILL_TOOL_NAMES = new Set(["skills_list", "skill_manage"]);
-const AVAILABLE_TOOLS = SKILL_AUTHORING_ENABLED
+const AUTHORING_TOOLS = SKILL_AUTHORING_ENABLED
     ? TOOLS
     : TOOLS.filter((tool) => !SKILL_TOOL_NAMES.has(tool.name));
+// One teamwork path in room turns; keep all unrelated integrations available.
+// Ordinary direct chats use this same bounded coordinator. Goal-owned turns
+// retain their independent loop and cannot start a second coordinator.
+const ROOM_ONLY_TOOLS = new Set(["list_room_targets", "coordinate_bots"]);
+const ROOM_REPLACED_TOOLS = new Set(["ask_bot", "delegate_bot", "check_delegation", "wait_delegation", "start_thread", "send_to_thread", "wait_thread"]);
+const COORDINATING = process.env.OMB_ROOM_TURN === "1";
+const AVAILABLE_TOOLS = COORDINATING
+    ? AUTHORING_TOOLS.filter(tool => !ROOM_REPLACED_TOOLS.has(tool.name))
+    : AUTHORING_TOOLS.filter(tool => !ROOM_ONLY_TOOLS.has(tool.name));
 const send = (msg) => process.stdout.write(JSON.stringify(msg) + "\n");
 const ok = (id, result) => send({ jsonrpc: "2.0", id, result });
 const rpcErr = (id, code, message) => send({ jsonrpc: "2.0", id, error: { code, message } });
@@ -799,18 +864,35 @@ function recallSpeaker(hit) {
     return hit.role === "user" ? "user" : "you";
 }
 async function callTool(name, args) {
+    if (name === "list_room_targets") {
+        const r = await api("/api/internal/room-targets");
+        return { text: JSON.stringify(r), ...(r.error ? { isError: true } : {}) };
+    }
+    if (name === "coordinate_bots") {
+        const r = await api("/api/internal/coordinate-bots", { method: "POST", body: JSON.stringify({
+                groupId: args.group_id, botIds: args.bot_ids, message: args.message,
+                requestKey: args.request_key, rework: args.rework,
+            }) });
+        return { text: JSON.stringify(r), ...(r.error ? { isError: true } : {}) };
+    }
     if (name === "list_bots") {
         const r = await api(`/api/internal/agents?self=${encodeURIComponent(BOT_ID)}`);
         const bots = r.bots ?? [];
         if (!bots.length)
-            return { text: "No other bots in this section yet." };
+            return { text: "No other reachable bots yet." };
         const lines = bots.map((b) => {
             const role = b.title ? ` — ${b.title}` : "";
             const about = b.description ? ` (${String(b.description).slice(0, 120)})` : "";
-            return `- ${b.name}${role}${about} [id: ${b.id}, model: ${b.model}${b.busy ? ", busy" : ""}]`;
+            // statusText is the server's own wording for what the teammate is
+            // doing; an older server only sends busy, so fall back to that.
+            const state = typeof b.statusText === "string"
+                ? (b.status === "available" ? "" : b.statusText)
+                : (b.busy ? "busy" : "");
+            const team = typeof b.section === "string" ? `, team: ${peerName(b.section) || "General"}` : "";
+            return `- ${b.name}${role}${about} [id: ${b.id}, model: ${b.model}${team}${state ? `, ${state}` : ""}]`;
         });
         return {
-            text: `Other bots in your section:\n${lines.join("\n")}\n\nAssign work with delegate_bot. Use ask_bot only for a short answer you need inline.`,
+            text: `Reachable teammates:\n${lines.join("\n")}\n\n${COORDINATING ? "Use coordinate_bots for advice or concrete work, then end your turn. Busy teammates queue and results resume you automatically." : "Assign work with delegate_bot. Use ask_bot only for a short answer you need inline."}`,
         };
     }
     if (name === "list_rooms") {
@@ -943,7 +1025,16 @@ async function callTool(name, args) {
         if (r.status === "done")
             return { text: `${who} finished task ${taskId}:\n${String(r.result || "(no reply text)")}` };
         if (r.status === "queued") {
-            return { text: `Task ${taskId} is still queued — ${who} hasn't picked it up yet${waitMs ? ` after ${timeout}s` : ""}. Keep working and check again later.` };
+            const why = r.targetStatus === "waiting-on-user"
+                ? ` ${who} is waiting on the user, so it goes through after they answer.`
+                : r.targetStatus === "working" ? ` ${who} is busy with other work.` : "";
+            const expiresInMs = Number(r.expiresInMs);
+            const expiry = !Number.isFinite(expiresInMs)
+                ? ""
+                : expiresInMs <= 0
+                    ? " It is past its 24-hour limit and will expire the next time it cannot be delivered."
+                    : ` It expires if not picked up within ${Math.ceil(expiresInMs / 3_600_000)} hour${Math.ceil(expiresInMs / 3_600_000) === 1 ? "" : "s"}.`;
+            return { text: `Task ${taskId} is still queued — ${who} hasn't picked it up yet${waitMs ? ` after ${timeout}s` : ""}.${why}${expiry} Keep working and check again later.` };
         }
         if (r.status === "running") {
             const elapsedMs = Number.isFinite(r.elapsedMs) ? Number(r.elapsedMs) : 0;
@@ -1041,6 +1132,18 @@ async function callTool(name, args) {
             text: `${opened}${timing}${approval} Its result will be delivered to this conversation automatically (delegation id: ${delegationId || "unknown"}). Acknowledge it, mention it to the person as #${threadTitle}, and finish your turn; do not check or wait for it in this turn.`,
         };
     }
+    if (name === "list_team_setup") {
+        return { text: JSON.stringify(await api("/api/internal/team-setup-catalog")) };
+    }
+    if (name === "propose_team_setup" || name === "propose_bot_deletion") {
+        const deleting = name === "propose_bot_deletion";
+        const result = await api(deleting ? "/api/internal/bot-deletion-requests" : "/api/internal/team-setup-requests", {
+            method: "POST", body: JSON.stringify({ fromBotId: BOT_ID, fromThreadId: THREAD_ID,
+                ...(deleting ? { targetBotId: args.bot_id, reason: args.reason } : { plan: args }),
+            }),
+        });
+        return { text: `One review card is visible: ${String(result.title)}. Nothing has been applied. End this turn; the decision and structured result resume you automatically once. Do not ask again, poll, or repeat this proposal.` };
+    }
     if (name === "create_bot") {
         const botName = String(args.name ?? "").trim();
         const role = String(args.role ?? "").trim();
@@ -1063,7 +1166,7 @@ async function callTool(name, args) {
         });
         createdThisTurn += 1;
         return {
-            text: `Created @${r.name ?? botName} in ${r.section ?? "General"} [id: ${r.id}]. Assign work with delegate_bot.`,
+            text: `Created @${r.name ?? botName} in ${r.section ?? "General"} [id: ${r.id}]. Assign work with ${COORDINATING ? "coordinate_bots" : "delegate_bot"}.`,
         };
     }
     if (name === "create_room") {

package/dist-server/server/drivers/claude.js

@@ -26,6 +26,7 @@ import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS }
 import { applyClaudeInject, decodeInjectId, mergeLocalInject, probeLocalInjects, resolveInjectId, } from "./local-inject.js";
 import { appendNative } from "./native.js";
 import { SPAWNED_PROXIES } from "../proxy-paths.js";
+import { ASK_USER_QUESTION_TOOL, askQuestionSummary, parseAskQuestions, questionChoices, } from "../../shared/ask-question.js";
 /** Whether `claude` has been signed in.
  *
  * Credential storage is deliberately not inspected here. Claude Code uses the
@@ -150,6 +151,30 @@ function claudeEnvironment(model, source = process.env, configDir, instanceEnvir
 function inheritsUserConfig(env) {
     return env.OMB_CLAUDE_INHERIT_USER_CONFIG === "1";
 }
+/** Retain the selected CLI account's authentication without importing its
+ * hooks, permissions, MCP servers or personal instructions. Explicit OMB
+ * connections/local endpoints own their entire routing + credential pair. */
+export function readClaudeAuthSettings(env, instanceEnvironment = {}) {
+    if (CLAUDE_ACCOUNT_ENV_KEYS.some((key) => instanceEnvironment[key]))
+        return {};
+    try {
+        const settings = JSON.parse(readFileSync(join(resolveClaudeConfigDir(undefined, env), "settings.json"), "utf8"));
+        const authEnv = {};
+        for (const key of CLAUDE_ACCOUNT_ENV_KEYS) {
+            if (!key.endsWith("_FILE_DESCRIPTOR") && typeof settings?.env?.[key] === "string") {
+                authEnv[key] = settings.env[key];
+            }
+        }
+        return {
+            ...(Object.keys(authEnv).length ? { env: authEnv } : {}),
+            ...(typeof settings?.apiKeyHelper === "string" && settings.apiKeyHelper.trim()
+                ? { apiKeyHelper: settings.apiKeyHelper } : {}),
+        };
+    }
+    catch {
+        return {};
+    }
+}
 /** MCP servers the bot's own project declares in `<cwd>/.mcp.json`.
  *
  * The CLI would find this file itself, but the harness launches it with
@@ -370,11 +395,20 @@ function systemEndedReply(kind) {
         ? { behavior: "answer", message: "OpenMausBot: the turn is ending — wrap up." }
         : { behavior: "deny", message: "OpenMausBot: the turn ended" };
 }
+/** The structured questions behind an ask, when it is one. Claude's own
+ * AskUserQuestion carries them; everything else answers null and keeps the
+ * plain summary/choices card. */
+function askQuestions(ask) {
+    return ask.tool === ASK_USER_QUESTION_TOOL ? parseAskQuestions(ask.input) : null;
+}
 /** One human-readable line for an ask — what the card subtitle shows. */
 function askSummary(ask) {
+    const questions = askQuestions(ask);
+    if (questions)
+        return askQuestionSummary(questions).slice(0, 300);
     return askInputSummary(ask.input) ?? ask.tool ?? "tool";
 }
-export function permissionSocketPath(threadId) {
+export function permissionSocketPath(threadId, botId) {
     // A readable prefix alone is not unique: ids that agree on their first
     // characters ("t-perm-dup-1", "t-perm-dup-2") would share a socket. POSIX
     // hides that — a new broker's listen replaces the socket FILE, so the name
@@ -384,8 +418,16 @@ export function permissionSocketPath(threadId) {
     // id so distinct threads get distinct sockets; the tag stays at 8 chars
     // total because the POSIX path already brushes the 104-byte sun_path
     // limit under deep tmp home dirs.
+    //
+    // botId is folded into the digest too (#1017): the driver's session/broker
+    // maps are a single process-wide table keyed on threadId alone, so a
+    // delegated child turn whose threadId ever coincides with its still-open
+    // parent's (or any other bot's) would otherwise collide on the exact same
+    // socket. Namespacing by bot makes that collision structurally impossible
+    // regardless of how two turns end up sharing a threadId.
+    const key = botId ? `${botId}\0${threadId}` : threadId;
     const prefix = threadId.replace(/[^\w-]/g, "").slice(0, 4);
-    const digest = createHash("sha256").update(threadId).digest("hex").slice(0, 4);
+    const digest = createHash("sha256").update(key).digest("hex").slice(0, 4);
     return brokerSocketPath(DATA_DIR, `${prefix}${digest}`);
 }
 /** Paths the broker may bind, tried in order. Windows named pipes are never
@@ -395,11 +437,11 @@ export function permissionSocketPath(threadId) {
  * longer than its small `sun_path` limit; a deep test HOME or long username
  * can otherwise make every approval silently unavailable. The proxy learns
  * the actual bound path from its argv, so either fallback is transparent. */
-export function brokerSocketCandidates(threadId) {
-    const base = permissionSocketPath(threadId);
+export function brokerSocketCandidates(threadId, botId) {
+    const base = permissionSocketPath(threadId, botId);
     if (process.platform !== "win32") {
         const scope = createHash("sha256")
-            .update(`${DATA_DIR}\0${process.pid}\0${threadId}`)
+            .update(`${DATA_DIR}\0${process.pid}\0${botId ?? ""}\0${threadId}`)
             .digest("hex")
             .slice(0, 16);
         return [base, join(tmpdir(), `omb-perm-${scope}.sock`)];
@@ -490,7 +532,10 @@ export async function createPermissionBroker(opts) {
                         // `always` rides to the proxy, which hands the CLI's own suggested
                         // permission rules back as updatedPermissions: Claude remembers
                         // the allow for the session, the harness remembers nothing.
-                        conn.write(JSON.stringify({ t: "answer", id: askId, behavior, message, ...(always ? { always: true } : {}) }) + "\n");
+                        // `source` travels with the answer too: a proxy that cannot tell
+                        // the human's words from a timeout note would file the timeout
+                        // note as the human's words.
+                        conn.write(JSON.stringify({ t: "answer", id: askId, behavior, message, source, ...(always ? { always: true } : {}) }) + "\n");
                     }
                     catch { }
                     opts.onResolve({ ...ask, behavior, source });
@@ -829,8 +874,8 @@ export const ClaudeDriver = {
         // retry bookkeeping lives PER THREAD, not per sendTurn call: a relaunch
         // is a fresh sendTurn, and the attempt cap must survive across launches
         const retryState = new Map();
-        const sendTurn = async (turn) => {
-            const { threadId } = turn;
+        const sendTurn = async (turn, logicalTurnId) => {
+            const { threadId, botId } = turn;
             if (active.has(threadId))
                 throw new Error("a turn is already running on this thread");
             // A bot-level mode is authoritative for this turn. In particular, an
@@ -850,7 +895,10 @@ export const ClaudeDriver = {
             // Materialize before creating a broker or process. A missing/corrupt
             // attachment must fail this call without leaving a live session behind.
             const promptMsg = claudeUserMessage(turn.text, turn.images);
-            const turnId = newId();
+            // Internal relaunches are still the turn acknowledged to the harness.
+            // A new user message gets a fresh id, but retry/recovery must not orphan
+            // its capability, coordination result or queued continuation ownership.
+            const turnId = logicalTurnId ?? newId();
             const retryAbort = new AbortController();
             const retry = retryState.get(threadId) ?? { attempt: 0, cancelled: false };
             retry.cancelled = false;
@@ -1009,7 +1057,7 @@ export const ClaudeDriver = {
             // Keep ask_user available even in Full access. Native bypass skips
             // permission prompts, not questions requiring a person's answer.
             let broker;
-            const socketPath = permissionSocketPath(threadId);
+            const socketPath = permissionSocketPath(threadId, botId);
             if (permissionMode !== "bypassPermissions") {
                 args.push("--permission-prompt-tool", "mcp__ogb__approve");
             }
@@ -1028,6 +1076,12 @@ export const ClaudeDriver = {
                 args.push("--allowedTools", allowed.join(","));
             }
             const env = environment(turnModel);
+            const authSettings = isolated && !injected.injected
+                ? readClaudeAuthSettings(env, input.environment) : {};
+            const authSettingsPath = mcpConfigPath && Object.keys(authSettings).length
+                ? join(dirname(mcpConfigPath), "auth-settings.json") : null;
+            if (authSettingsPath)
+                args.push("--settings", authSettingsPath);
             // Our approvals and browser credentials expire at the user-turn
             // boundary. Native background workers cannot outlive that boundary;
             // parallel bot work must use the harness's durable delegate_bot path.
@@ -1035,7 +1089,7 @@ export const ClaudeDriver = {
             const cwd = turn.cwd ?? homedir();
             // Everything that shapes the process, minus session/turn-specific temp
             // paths. Their contents are represented directly in the key instead.
-            const privateFileFlags = new Set(["--mcp-config"]);
+            const privateFileFlags = new Set(["--mcp-config", "--settings"]);
             const keyArgs = args.filter((a, i) => !privateFileFlags.has(a) && !privateFileFlags.has(args[i - 1] ?? ""));
             const argsKey = JSON.stringify({
                 args: keyArgs,
@@ -1047,6 +1101,11 @@ export const ClaudeDriver = {
                 model: injected.model ?? null,
                 base: env.ANTHROPIC_BASE_URL ?? null,
                 configDir: env.CLAUDE_CONFIG_DIR ?? null,
+                // Rotating an account's key/helper must not reuse the old process.
+                auth: createHash("sha256").update(JSON.stringify({
+                    settings: authSettings,
+                    env: Object.fromEntries(CLAUDE_ACCOUNT_ENV_KEYS.map((key) => [key, env[key]])),
+                })).digest("hex"),
             });
             // Reuse the live process when it is idle, unchanged, and is the session
             // the harness wants resumed. Anything else: close it and spawn fresh
@@ -1055,9 +1114,11 @@ export const ClaudeDriver = {
             if (live && !live.turn && !live.closing && live.child.exitCode === null && live.argsKey === argsKey && (!sessionId || sessionId === live.sessionId)) {
                 if (live.idleTimer)
                     clearTimeout(live.idleTimer);
-                live.turn = { turnId, settled: false, sawStreamDelta: false };
+                live.turn = { turnId, input: turn, retryAbort, settled: false, sawStreamDelta: false };
                 active.set(threadId, { stop: () => {
                         closeSession(threadId, "interrupted");
+                        retry.cancelled = true;
+                        retryAbort.abort();
                         stopSession(live);
                     }, turnId, broker: live.broker });
                 emit({ ...base(threadId, turnId), type: "turn.started" });
@@ -1125,7 +1186,7 @@ export const ClaudeDriver = {
                     // event can scope approvals to real desktop-control tools only
                     const askTools = new Map();
                     broker = await createPermissionBroker({
-                        socketPaths: brokerSocketCandidates(threadId),
+                        socketPaths: brokerSocketCandidates(threadId, botId),
                         isActive: () => Boolean(sessions.get(threadId)?.turn),
                         onAsk: (ask) => {
                             const eventTurnId = sessions.get(threadId)?.turn?.turnId ?? turnId;
@@ -1137,6 +1198,7 @@ export const ClaudeDriver = {
                             const nativeReview = permissionMode === "auto" && nativeMode !== null
                                 ? nativeMode === "auto" ? "active" : "inactive"
                                 : undefined;
+                            const questions = askQuestions(ask);
                             emit({
                                 ...base(threadId, eventTurnId),
                                 type: "request.opened",
@@ -1151,7 +1213,12 @@ export const ClaudeDriver = {
                                 approvalScope: typeof ask.tool === "string" && controlsHost && ask.tool.startsWith("mcp__computer")
                                     ? "local-computer"
                                     : undefined,
-                                choices: Array.isArray(ask.input?.choices) ? ask.input.choices.slice(0, 5) : undefined,
+                                questions: questions ?? undefined,
+                                // A structured ask still offers flat labels, for the phone
+                                // companions and any client that predates the question card.
+                                choices: questions
+                                    ? questionChoices(questions)
+                                    : Array.isArray(ask.input?.choices) ? ask.input.choices.slice(0, 5) : undefined,
                             });
                         },
                         onResolve: (resolved) => {
@@ -1180,6 +1247,9 @@ export const ClaudeDriver = {
                 if (mcpConfigPath) {
                     writeFileSync(mcpConfigPath, JSON.stringify({ mcpServers }), { mode: 0o600 });
                 }
+                if (authSettingsPath) {
+                    writeFileSync(authSettingsPath, JSON.stringify(authSettings), { mode: 0o600 });
+                }
                 if (sessionId)
                     args.push("--resume", sessionId);
                 else
@@ -1211,7 +1281,7 @@ export const ClaudeDriver = {
                 sessionId: sessionId ?? newSessionId,
                 sawInit: false,
                 nativePermissionMode: null,
-                turn: { turnId, settled: false, sawStreamDelta: false },
+                turn: { turnId, input: turn, retryAbort, settled: false, sawStreamDelta: false },
                 idleTimer: null,
                 closing: false,
                 stderr: "",
@@ -1415,6 +1485,10 @@ export const ClaudeDriver = {
                 // process that exited between turns (idle close, contract change)
                 // is just a session ending
                 if (session.turn && !session.turn.settled) {
+                    // A retained process may be running a later user turn. Its close
+                    // handler must retry that request, not the process's first prompt.
+                    const { turnId, input: turn, retryAbort } = session.turn;
+                    const retry = retryState.get(threadId) ?? { attempt: 0, cancelled: false };
                     const message = `claude exited ${code} before result${session.stderr ? `: ${session.stderr.trim().slice(-300)}` : ""}`;
                     const verdict = classifyError({ exitCode: code, stderr: message });
                     if (!retry.cancelled &&
@@ -1474,7 +1548,7 @@ export const ClaudeDriver = {
                             active.delete(threadId);
                             try {
                                 const cursor = session.sessionId ?? sessionId ?? undefined;
-                                await sendTurn({ ...turn, resumeCursor: cursor });
+                                await sendTurn({ ...turn, resumeCursor: cursor }, turnId);
                             }
                             catch (e) {
                                 retryState.delete(threadId);
@@ -1541,7 +1615,7 @@ export const ClaudeDriver = {
                         void (async () => {
                             try {
                                 // no cursor: a fresh session, carrying the rebuild
-                                await sendTurn({ ...turn, resumeCursor: undefined, recoveryText: undefined, text: recovery.text });
+                                await sendTurn({ ...turn, resumeCursor: undefined, recoveryText: undefined, text: recovery.text }, turnId);
                             }
                             catch (e) {
                                 retryState.delete(threadId);

package/dist-server/server/drivers/codex.js

@@ -524,6 +524,7 @@ export const CodexDriver = {
                 const earlyNotifications = [];
                 const state = {
                     settled: false,
+                    lastError: "",
                     lastText: "",
                     sawStreamDelta: false,
                     // codex reports token usage as a running THREAD total; the harness
@@ -878,7 +879,15 @@ export const CodexDriver = {
                         }
                         case "turn/completed": {
                             const t = p.turn ?? {};
-                            void settle(t.status === "completed", t.status === "completed" ? null : (t.error?.message ?? t.status ?? "failed"));
+                            const message = typeof t.error?.message === "string" ? t.error.message.slice(0, 400) : "";
+                            if (t.status !== "completed" && message && message !== state.lastError) {
+                                state.lastError = message;
+                                emit({ ...base(threadId, turnId), type: "runtime.error", message,
+                                    ...(classifyError({ text: message }).reason === "auth" ? { setup: true } : {}),
+                                });
+                            }
+                            void settle(t.status === "completed", t.status === "completed" ? null :
+                                (classifyError({ text: message || state.lastError }).reason === "provider_safety" ? "provider_safety" : (message || t.status || "failed")));
                             break;
                         }
                         case "error":
@@ -886,8 +895,10 @@ export const CodexDriver = {
                             // {error:{message}} — surface either (agentcal armor)
                             {
                                 const message = p.message ?? p.error?.message;
-                                if (message)
-                                    emit({ ...base(threadId, turnId), type: "runtime.error", message: String(message).slice(0, 400) });
+                                if (message) {
+                                    state.lastError = String(message).slice(0, 400);
+                                    emit({ ...base(threadId, turnId), type: "runtime.error", message: state.lastError });
+                                }
                             }
                             break;
                     }
@@ -1145,7 +1156,7 @@ export const CodexDriver = {
                             message,
                             ...(needsAuth ? { setup: true } : {}),
                         });
-                        await settle(false, needsAuth ? "auth_required" : "rpc_error");
+                        await settle(false, needsAuth ? "auth_required" : verdict.reason === "provider_safety" ? "provider_safety" : "rpc_error");
                     }
                 }
             };