openmausbot 0.1.74 → 0.1.76

package/dist-server/pair-cli.js

@@ -1113,6 +1113,21 @@ var require_main = __commonJS({
 // server/atomic.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { closeSync, fsyncSync, openSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function renameWithRetry(tmp, path3, rename2 = renameSync) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      rename2(tmp, path3);
+      return;
+    } catch (e) {
+      const code = e.code;
+      if (!code || !RETRYABLE_RENAME_CODES.has(code) || attempt >= RENAME_RETRY_DELAYS_MS.length) throw e;
+      sleepSync(RENAME_RETRY_DELAYS_MS[attempt]);
+    }
+  }
+}
 function writeFileAtomic(path3, data, options = {}) {
   const tmp = `${path3}.${process.pid}.${randomUUID3()}.tmp`;
   let fd = null;
@@ -1122,7 +1137,7 @@ function writeFileAtomic(path3, data, options = {}) {
     fsyncSync(fd);
     closeSync(fd);
     fd = null;
-    renameSync(tmp, path3);
+    renameWithRetry(tmp, path3);
   } catch (e) {
     if (fd !== null) {
       try {
@@ -1137,9 +1152,12 @@ function writeFileAtomic(path3, data, options = {}) {
     throw e;
   }
 }
+var RENAME_RETRY_DELAYS_MS, RETRYABLE_RENAME_CODES;
 var init_atomic = __esm({
   "server/atomic.ts"() {
     "use strict";
+    RENAME_RETRY_DELAYS_MS = [5, 10, 20, 40, 80];
+    RETRYABLE_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY"]);
   }
 });
 
@@ -9752,8 +9770,8 @@ var capitalizeFirstCharacter, error28;
 var init_lt = __esm({
   "node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/locales/lt.js"() {
     init_util();
-    capitalizeFirstCharacter = (text3) => {
-      return text3.charAt(0).toUpperCase() + text3.slice(1);
+    capitalizeFirstCharacter = (text4) => {
+      return text4.charAt(0).toUpperCase() + text4.slice(1);
     };
     error28 = () => {
       const Sizable = {
@@ -17585,8 +17603,8 @@ var init_mcp_registry = __esm({
 });
 
 // server/schema.ts
-function parseJson(text3) {
-  return JSON.parse(text3);
+function parseJson(text4) {
+  return JSON.parse(text4);
 }
 function schemaIssue(error51, fallback) {
   const issue2 = error51.issues[0];
@@ -18609,45 +18627,46 @@ function isFile(p) {
     return false;
   }
 }
-function whichWin(cli) {
-  const exts = (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+function whichWin(cli, env) {
+  const exts = ((env ?? process.env).PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
   const probe = (base2) => {
     const order = extname(base2) ? [base2, ...exts.map((e) => base2 + e)] : [...exts.map((e) => base2 + e), base2];
     return order.find(isFile) ?? null;
   };
   if (/[\\/]/.test(cli) || /^[a-zA-Z]:/.test(cli)) return probe(cli);
-  for (const dir of augmentedPath().split(delimiter3)) {
+  const path3 = env ? env.PATH ?? env.Path ?? "" : augmentedPath();
+  for (const dir of path3.split(delimiter3)) {
     if (!dir) continue;
     const hit = probe(join9(dir, cli));
     if (hit) return hit;
   }
   return null;
 }
-function nodeExe(near) {
+function nodeExe(near, env) {
   const local = join9(near, "node.exe");
   if (isFile(local)) return local;
-  const onPath2 = whichWin("node.exe");
+  const onPath2 = whichWin("node.exe", env);
   if (onPath2 && extname(onPath2).toLowerCase() === ".exe") return onPath2;
   return process.versions.electron ? null : process.execPath;
 }
-function parseCmdShim(shim) {
-  let text3;
+function parseCmdShim(shim, env) {
+  let text4;
   try {
-    text3 = readFileSync6(shim, "utf8");
+    text4 = readFileSync6(shim, "utf8");
   } catch {
     return null;
   }
   const dir = dirname4(shim);
-  const targets = [...text3.matchAll(/"%~?dp0%?\\?([^"]+)"/g)].map((m) => join9(dir, m[1])).filter((p) => isFile(p) && basename2(p).toLowerCase() !== "node.exe");
+  const targets = [...text4.matchAll(/"%~?dp0%?\\?([^"]+)"/g)].map((m) => join9(dir, m[1])).filter((p) => isFile(p) && basename2(p).toLowerCase() !== "node.exe");
   const script = targets.find((p) => /\.[cm]?js$/i.test(p));
   if (script) {
-    const node = nodeExe(dir);
+    const node = nodeExe(dir, env);
     if (node) return { command: node, args: [script] };
   }
   const exe = targets.find((p) => extname(p).toLowerCase() === ".exe");
   return exe ? { command: exe, args: [] } : null;
 }
-function parseNodeShebang(file2) {
+function parseNodeShebang(file2, env) {
   let head = "";
   let fd = null;
   try {
@@ -18666,32 +18685,32 @@ function parseNodeShebang(file2) {
     }
   }
   if (!/^#!.*\bnode(\.exe)?\b/.test(head)) return null;
-  const node = nodeExe(dirname4(file2));
+  const node = nodeExe(dirname4(file2), env);
   return node ? { command: node, args: [file2] } : null;
 }
-function resolveWord(cli, args) {
+function resolveWord(cli, args, env) {
   if (process.platform !== "win32") return { command: cli, args };
-  const file2 = whichWin(cli);
+  const file2 = whichWin(cli, env);
   if (!file2) return { command: cli, args };
   const ext = extname(file2).toLowerCase();
   if (ext === ".cmd" || ext === ".bat") {
-    const direct = parseCmdShim(file2);
+    const direct = parseCmdShim(file2, env);
     return direct ? { command: direct.command, args: [...direct.args, ...args] } : { command: file2, args };
   }
   if (ext === ".exe" || ext === ".com") return { command: file2, args };
-  const viaNode = parseNodeShebang(file2);
+  const viaNode = parseNodeShebang(file2, env);
   return viaNode ? { command: viaNode.command, args: [...viaNode.args, ...args] } : { command: file2, args };
 }
-function resolveCliSpawn(cli, args) {
+function resolveCliSpawn(cli, args, env) {
   const trimmed = cli.trim();
-  if (trimmed.includes(" ") && existsSync7(trimmed)) return resolveWord(trimmed, args);
+  if (trimmed.includes(" ") && existsSync7(trimmed)) return resolveWord(trimmed, args, env);
   const split = splitCliString(cli);
   if (split.length > 1 || split[0] !== trimmed) {
     const [head, ...fixed] = split;
     if (!head) return { command: cli, args };
-    return resolveWord(head, [...fixed, ...args]);
+    return resolveWord(head, [...fixed, ...args], env);
   }
-  return resolveWord(cli, args);
+  return resolveWord(cli, args, env);
 }
 var cached2, probed, loginShellPath, registeredDirs;
 var init_env_path = __esm({
@@ -18710,8 +18729,8 @@ import {
   execFile as execFile3
 } from "node:child_process";
 import { join as join10 } from "node:path";
-function resolveCli(cli, args = []) {
-  return resolveCliSpawn(cli, args);
+function resolveCli(cli, args = [], env) {
+  return resolveCliSpawn(cli, args, env);
 }
 function estimatedWindowsCommandLineChars(resolved) {
   return [resolved.command, ...resolved.args].reduce(
@@ -18825,9 +18844,13 @@ async function stopCliTree(child, pid, timeoutMs) {
   if (exited()) return true;
   return new Promise((resolve13) => {
     let timer;
+    let finished = false;
     const done = (stopped) => {
+      if (finished) return;
+      finished = true;
       clearTimeout(timer);
       child.off("close", closed);
+      child.off("exit", closed);
       resolve13(stopped);
     };
     const closed = () => done(true);
@@ -18835,7 +18858,12 @@ async function stopCliTree(child, pid, timeoutMs) {
     timer = setTimeout(() => done(false), timeoutMs);
     timer.unref?.();
     execFile3("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }, (err) => {
-      if (!err) return;
+      if (finished) return;
+      if (!err) {
+        if (exited()) done(true);
+        else child.once("exit", closed);
+        return;
+      }
       try {
         child.kill();
       } catch {
@@ -19583,9 +19611,9 @@ function isSecretName(name) {
   if (SECRET_KEY_PARTS.some((part) => lower.includes(part))) return true;
   return /(^|[_.-])keys?$/.test(lower);
 }
-function redactSecretsInText(text3) {
-  if (!text3 || text3.length < 8) return text3;
-  let out = text3;
+function redactSecretsInText(text4) {
+  if (!text4 || text4.length < 8) return text4;
+  let out = text4;
   out = out.replace(PEM_BLOCK, (_m, open2, body, close) => `${open2}
 ${mask(body.trim())}
 ${close}`);
@@ -19696,8 +19724,8 @@ function askInputSummary(input) {
   if (typeof fields.question === "string") return cut(fields.question, QUESTION_LIMIT);
   if (typeof fields.command === "string") return cut(fields.command, LIMIT);
   if (typeof fields.url === "string") return cut(fields.url, LIMIT);
-  const text3 = JSON.stringify(fields);
-  return text3 === "{}" ? void 0 : cut(text3, LIMIT);
+  const text4 = JSON.stringify(fields);
+  return text4 === "{}" ? void 0 : cut(text4, LIMIT);
 }
 var QUESTION_LIMIT, LIMIT, cut;
 var init_tool_summary = __esm({
@@ -19706,7 +19734,7 @@ var init_tool_summary = __esm({
     init_redact();
     QUESTION_LIMIT = 300;
     LIMIT = 200;
-    cut = (text3, limit) => redactSecretsInText(text3).trim().slice(0, limit);
+    cut = (text4, limit) => redactSecretsInText(text4).trim().slice(0, limit);
   }
 });
 
@@ -19729,11 +19757,11 @@ function sanitizeToolLogValue(value, budget, depth = 0) {
   if (typeof value === "string") {
     if (/^data:image\//iu.test(value) || budget.text <= 0) return void 0;
     const limit = Math.min(TOOL_LOG_TEXT_LIMIT, budget.text);
-    const text3 = value.length <= limit ? value : `[Earlier output truncated]
+    const text4 = value.length <= limit ? value : `[Earlier output truncated]
 
 ${value.slice(-limit)}`;
-    budget.text -= text3.length;
-    return text3;
+    budget.text -= text4.length;
+    return text4;
   }
   if (Array.isArray(value)) {
     return value.flatMap((entry) => {
@@ -20040,10 +20068,10 @@ function createAcpDriver(support11) {
           }
         };
         const flushAssistantText = () => {
-          const text3 = state.text;
+          const text4 = state.text;
           state.text = "";
-          if (!text3.trim()) return;
-          emit({ ...base2(threadId, turnId), type: "item.completed", itemType: "assistant_text", text: text3 });
+          if (!text4.trim()) return;
+          emit({ ...base2(threadId, turnId), type: "item.completed", itemType: "assistant_text", text: text4 });
         };
         const settle = (ok, stopReason) => {
           if (state.settled) return;
@@ -20299,7 +20327,7 @@ function createAcpDriver(support11) {
               }
             }
             const images = turn.images ?? [];
-            const runtimeAcceptsImages = init?.agentCapabilities?.promptCapabilities?.image === true;
+            const runtimeAcceptsImages = init?.agentCapabilities?.promptCapabilities?.image === true || support11.acceptsUnadvertisedImages?.(init) === true;
             if (images.length && support11.images === true && !runtimeAcceptsImages) {
               throw new Error(
                 `${support11.displayName} is configured for image attachments, but this installed runtime does not advertise ACP image input. Update the ${support11.displayName} CLI or send the message without an image.`
@@ -20372,13 +20400,13 @@ function createAcpDriver(support11) {
             }
             emitSessionStarted();
             state.promptSent = true;
-            const text3 = support11.buildPromptText ? support11.buildPromptText(turn) : turn.system ? `${turn.system}
+            const text4 = support11.buildPromptText ? support11.buildPromptText(turn) : turn.system ? `${turn.system}
 
 ${turn.text}` : turn.text;
             const imageBlocks = support11.images === true && runtimeAcceptsImages ? await readAcpImageBlocks(images) : [];
             const result = await request("session/prompt", {
               sessionId,
-              prompt: [{ type: "text", text: text3 }, ...imageBlocks]
+              prompt: [{ type: "text", text: text4 }, ...imageBlocks]
             });
             const usage = result?.usage ?? result?._meta ?? {};
             if (typeof usage.inputTokens === "number" || typeof usage.outputTokens === "number") {
@@ -21706,14 +21734,14 @@ var init_boxagent = __esm({
             let lastText = "";
             let pendingText = "";
             const flushAssistantText = () => {
-              const text3 = pendingText;
+              const text4 = pendingText;
               pendingText = "";
-              if (!text3.trim()) return;
-              emit({ ...base2(threadId, turnId), type: "item.completed", itemType: "assistant_text", text: text3 });
+              if (!text4.trim()) return;
+              emit({ ...base2(threadId, turnId), type: "item.completed", itemType: "assistant_text", text: text4 });
             };
-            const ingest = (text3) => {
-              const delta = text3.startsWith(lastText) ? text3.slice(lastText.length) : text3;
-              lastText = text3;
+            const ingest = (text4) => {
+              const delta = text4.startsWith(lastText) ? text4.slice(lastText.length) : text4;
+              lastText = text4;
               if (!delta) return;
               pendingText += delta;
               emit({ ...base2(threadId, turnId), type: "content.delta", streamKind: "assistant_text", delta });
@@ -21730,9 +21758,9 @@ var init_boxagent = __esm({
                   seen.add(id);
                   appendNative(threadId, { dir: "in", source: "box.events", msg: ev });
                   const kind = String(ev.type ?? ev.kind ?? "");
-                  const text3 = ev.text ?? ev.message ?? ev.data?.text ?? ev.data?.content ?? null;
-                  if (/assistant|message|output|response/i.test(kind) && typeof text3 === "string" && text3.trim()) {
-                    ingest(text3);
+                  const text4 = ev.text ?? ev.message ?? ev.data?.text ?? ev.data?.content ?? null;
+                  if (/assistant|message|output|response/i.test(kind) && typeof text4 === "string" && text4.trim()) {
+                    ingest(text4);
                   } else if (/tool|command|exec|browse/i.test(kind)) {
                     flushAssistantText();
                     emit({
@@ -22272,25 +22300,36 @@ var init_mcp_gate_config = __esm({
   }
 });
 
+// shared/provider-safety.ts
+function isProviderSafetyBlock(message2) {
+  return /\bblocked by (?:our|the provider['’]s) safety systems\b|\bsafety monitoring\b.{0,100}\b(?:paused|ended|blocked)\b|\b(?:safety_check_failed|safety_policy_violation)\b/i.test(message2);
+}
+var init_provider_safety = __esm({
+  "shared/provider-safety.ts"() {
+    "use strict";
+  }
+});
+
 // server/drivers/retry.ts
 function classifyError(err) {
-  const text3 = messageOf(err);
+  const text4 = messageOf(err);
+  if (isProviderSafetyBlock(text4)) return { transient: false, reason: "provider_safety" };
   if (err && "exitCode" in err) {
     const { exitCode: code } = err;
     if (code !== null && code < 0) return { transient: false, reason: "interrupted" };
     for (const { pattern, reason } of TRANSIENT_PATTERNS) {
-      if (pattern.test(text3)) return { transient: true, reason };
+      if (pattern.test(text4)) return { transient: true, reason };
     }
     for (const { pattern, reason } of TERMINAL_PATTERNS) {
-      if (pattern.test(text3)) return { transient: false, reason };
+      if (pattern.test(text4)) return { transient: false, reason };
     }
     return { transient: false, reason: "terminal_exit" };
   }
   for (const { pattern, reason } of TERMINAL_PATTERNS) {
-    if (pattern.test(text3)) return { transient: false, reason };
+    if (pattern.test(text4)) return { transient: false, reason };
   }
   for (const { pattern, reason } of TRANSIENT_PATTERNS) {
-    if (pattern.test(text3)) return { transient: true, reason };
+    if (pattern.test(text4)) return { transient: true, reason };
   }
   return { transient: false, reason: "unknown" };
 }
@@ -22321,6 +22360,7 @@ var RETRY_MAX_ATTEMPTS, BACKOFF_BASE_MS, TRANSIENT_PATTERNS, TERMINAL_PATTERNS,
 var init_retry = __esm({
   "server/drivers/retry.ts"() {
     "use strict";
+    init_provider_safety();
     RETRY_MAX_ATTEMPTS = 3;
     BACKOFF_BASE_MS = [1e3, 3e3, 8e3];
     TRANSIENT_PATTERNS = [
@@ -22355,6 +22395,82 @@ var init_retry = __esm({
   }
 });
 
+// shared/ask-question.ts
+function text3(value, limit) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed ? trimmed.slice(0, limit) : void 0;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseOption(value) {
+  if (typeof value === "string") {
+    const label2 = text3(value, MAX_LABEL);
+    return label2 ? { label: label2 } : null;
+  }
+  if (!isRecord(value)) return null;
+  const label = text3(value.label, MAX_LABEL);
+  if (!label) return null;
+  const description = text3(value.description, MAX_DESCRIPTION);
+  return description ? { label, description } : { label };
+}
+function parseQuestion(value) {
+  if (!isRecord(value)) return null;
+  const question = text3(value.question, MAX_QUESTION_TEXT);
+  if (!question) return null;
+  const options = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of Array.isArray(value.options) ? value.options : []) {
+    const option = parseOption(raw);
+    if (!option || seen.has(option.label)) continue;
+    seen.add(option.label);
+    options.push(option);
+    if (options.length === MAX_OPTIONS) break;
+  }
+  const header = text3(value.header, MAX_LABEL);
+  return {
+    question,
+    ...header ? { header } : {},
+    ...value.multiSelect === true ? { multiSelect: true } : {},
+    options
+  };
+}
+function parseAskQuestions(input) {
+  if (!isRecord(input) || !Array.isArray(input.questions)) return null;
+  const questions = [];
+  for (const raw of input.questions) {
+    const question = parseQuestion(raw);
+    if (!question) continue;
+    questions.push(question);
+    if (questions.length === MAX_QUESTIONS) break;
+  }
+  return questions.length ? questions : null;
+}
+function askQuestionSummary(questions) {
+  const first = questions[0]?.question ?? "";
+  const rest = questions.length - 1;
+  return rest > 0 ? `${first} (+${rest} more question${rest > 1 ? "s" : ""})` : first;
+}
+function questionChoices(questions) {
+  if (questions.length !== 1) return void 0;
+  const only = questions[0];
+  if (only.multiSelect || only.options.length < 2) return void 0;
+  return only.options.map((option) => option.label);
+}
+var ASK_USER_QUESTION_TOOL, MAX_QUESTIONS, MAX_OPTIONS, MAX_QUESTION_TEXT, MAX_LABEL, MAX_DESCRIPTION;
+var init_ask_question = __esm({
+  "shared/ask-question.ts"() {
+    "use strict";
+    ASK_USER_QUESTION_TOOL = "AskUserQuestion";
+    MAX_QUESTIONS = 6;
+    MAX_OPTIONS = 12;
+    MAX_QUESTION_TEXT = 400;
+    MAX_LABEL = 120;
+    MAX_DESCRIPTION = 400;
+  }
+});
+
 // server/drivers/claude.ts
 import { createHash as createHash5, randomBytes as randomBytes2 } from "node:crypto";
 import { chmodSync as chmodSync4, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, rmSync as rmSync4, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6 } from "node:fs";
@@ -22395,9 +22511,9 @@ function resolveClaudeConfigDir(configDir, env = process.env) {
   }
   return normalize(expanded);
 }
-function claudeAuthFailure(frame, text3) {
+function claudeAuthFailure(frame, text4) {
   if (frame.is_api_error_message !== true && typeof frame.error !== "string") return false;
-  return frame.error === "authentication_failed" || classifyError({ text: text3 }).reason === "auth";
+  return frame.error === "authentication_failed" || classifyError({ text: text4 }).reason === "auth";
 }
 function claudeEnvironment(model, source = process.env, configDir, instanceEnvironment = {}) {
   const env = { ...source, PATH: augmentedPath(), NPM_CONFIG_LOGLEVEL: "error" };
@@ -22421,6 +22537,24 @@ function claudeEnvironment(model, source = process.env, configDir, instanceEnvir
 function inheritsUserConfig(env) {
   return env.OMB_CLAUDE_INHERIT_USER_CONFIG === "1";
 }
+function readClaudeAuthSettings(env, instanceEnvironment = {}) {
+  if (CLAUDE_ACCOUNT_ENV_KEYS.some((key) => instanceEnvironment[key])) return {};
+  try {
+    const settings2 = JSON.parse(readFileSync8(join20(resolveClaudeConfigDir(void 0, env), "settings.json"), "utf8"));
+    const authEnv = {};
+    for (const key of CLAUDE_ACCOUNT_ENV_KEYS) {
+      if (!key.endsWith("_FILE_DESCRIPTOR") && typeof settings2?.env?.[key] === "string") {
+        authEnv[key] = settings2.env[key];
+      }
+    }
+    return {
+      ...Object.keys(authEnv).length ? { env: authEnv } : {},
+      ...typeof settings2?.apiKeyHelper === "string" && settings2.apiKeyHelper.trim() ? { apiKeyHelper: settings2.apiKeyHelper } : {}
+    };
+  } catch {
+    return {};
+  }
+}
 function projectMcpServers(cwd) {
   let parsed;
   try {
@@ -22525,18 +22659,24 @@ function removePrivateTempDir(filePath) {
 function systemEndedReply(kind) {
   return kind === "question" ? { behavior: "answer", message: "OpenMausBot: the turn is ending \u2014 wrap up." } : { behavior: "deny", message: "OpenMausBot: the turn ended" };
 }
+function askQuestions(ask) {
+  return ask.tool === ASK_USER_QUESTION_TOOL ? parseAskQuestions(ask.input) : null;
+}
 function askSummary(ask) {
+  const questions = askQuestions(ask);
+  if (questions) return askQuestionSummary(questions).slice(0, 300);
   return askInputSummary(ask.input) ?? ask.tool ?? "tool";
 }
-function permissionSocketPath(threadId) {
+function permissionSocketPath(threadId, botId) {
+  const key = botId ? `${botId}\0${threadId}` : threadId;
   const prefix = threadId.replace(/[^\w-]/g, "").slice(0, 4);
-  const digest2 = createHash5("sha256").update(threadId).digest("hex").slice(0, 4);
+  const digest2 = createHash5("sha256").update(key).digest("hex").slice(0, 4);
   return brokerSocketPath(DATA_DIR, `${prefix}${digest2}`);
 }
-function brokerSocketCandidates(threadId) {
-  const base2 = permissionSocketPath(threadId);
+function brokerSocketCandidates(threadId, botId) {
+  const base2 = permissionSocketPath(threadId, botId);
   if (process.platform !== "win32") {
-    const scope = createHash5("sha256").update(`${DATA_DIR}\0${process.pid}\0${threadId}`).digest("hex").slice(0, 16);
+    const scope = createHash5("sha256").update(`${DATA_DIR}\0${process.pid}\0${botId ?? ""}\0${threadId}`).digest("hex").slice(0, 16);
     return [base2, join20(tmpdir3(), `omb-perm-${scope}.sock`)];
   }
   return [
@@ -22596,7 +22736,9 @@ async function createPermissionBroker(opts) {
           if (!pending.delete(askId)) return;
           clearTimeout(timer);
           try {
-            conn.write(JSON.stringify({ t: "answer", id: askId, behavior, message: message2, ...always ? { always: true } : {} }) + "\n");
+            conn.write(
+              JSON.stringify({ t: "answer", id: askId, behavior, message: message2, source, ...always ? { always: true } : {} }) + "\n"
+            );
           } catch {
           }
           opts.onResolve({ ...ask, behavior, source });
@@ -22735,19 +22877,19 @@ function firstText(content) {
   }
   return "";
 }
-function withVolatileNote(text3, volatile) {
+function withVolatileNote(text4, volatile) {
   const body = volatile.trim() ? `This part of your instructions changed since this session started. It replaces the earlier copy:
 
 ${volatile.trim()}` : "The notes that were in your instructions when this session started have been cleared.";
   const note = `<system-reminder>
 ${body}
 </system-reminder>`;
-  return text3 ? `${note}
+  return text4 ? `${note}
 
-${text3}` : note;
+${text4}` : note;
 }
-function claudeUserMessage(text3, images) {
-  if (!images?.length) return { type: "user", message: { role: "user", content: text3 } };
+function claudeUserMessage(text4, images) {
+  if (!images?.length) return { type: "user", message: { role: "user", content: text4 } };
   const content = images.map((image) => ({
     type: "image",
     source: {
@@ -22756,7 +22898,7 @@ function claudeUserMessage(text3, images) {
       data: readFileSync8(image.path).toString("base64")
     }
   }));
-  if (text3) content.push({ type: "text", text: text3 });
+  if (text4) content.push({ type: "text", text: text4 });
   return { type: "user", message: { role: "user", content } };
 }
 function diagnosticClaudeUserMessage(message2) {
@@ -22794,6 +22936,7 @@ var init_claude = __esm({
     init_local_inject();
     init_native();
     init_proxy_paths();
+    init_ask_question();
     CLAUDE_ACCOUNT_ENV_KEYS = [
       "CLAUDE_CODE_OAUTH_TOKEN",
       "CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
@@ -22931,8 +23074,8 @@ var init_claude = __esm({
           createdAt: (/* @__PURE__ */ new Date()).toISOString()
         });
         const retryState = /* @__PURE__ */ new Map();
-        const sendTurn = async (turn) => {
-          const { threadId } = turn;
+        const sendTurn = async (turn, logicalTurnId) => {
+          const { threadId, botId } = turn;
           if (active.has(threadId)) throw new Error("a turn is already running on this thread");
           const permissionMode = turn.approvalMode === void 0 ? config2.permissionMode : turn.approvalMode === "full" ? "bypassPermissions" : turn.approvalMode === "auto" ? "auto" : turn.approvalMode === "edits" ? "acceptEdits" : "default";
           const controlsHost = turn.integrations?.localComputer?.scope === "local-computer";
@@ -22940,7 +23083,7 @@ var init_claude = __esm({
             throw new Error("local computer control requires the interactive approval broker");
           }
           const promptMsg = claudeUserMessage(turn.text, turn.images);
-          const turnId = newId();
+          const turnId = logicalTurnId ?? newId();
           const retryAbort = new AbortController();
           const retry = retryState.get(threadId) ?? { attempt: 0, cancelled: false };
           retry.cancelled = false;
@@ -23045,7 +23188,7 @@ var init_claude = __esm({
             if (gated) mcpServers[name] = gated;
           }
           let broker;
-          const socketPath = permissionSocketPath(threadId);
+          const socketPath = permissionSocketPath(threadId, botId);
           if (permissionMode !== "bypassPermissions") {
             args.push("--permission-prompt-tool", "mcp__ogb__approve");
           }
@@ -23058,9 +23201,12 @@ var init_claude = __esm({
             args.push("--allowedTools", allowed.join(","));
           }
           const env = environment(turnModel);
+          const authSettings = isolated && !injected.injected ? readClaudeAuthSettings(env, input.environment) : {};
+          const authSettingsPath = mcpConfigPath && Object.keys(authSettings).length ? join20(dirname9(mcpConfigPath), "auth-settings.json") : null;
+          if (authSettingsPath) args.push("--settings", authSettingsPath);
           env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS = "1";
           const cwd = turn.cwd ?? homedir9();
-          const privateFileFlags = /* @__PURE__ */ new Set(["--mcp-config"]);
+          const privateFileFlags = /* @__PURE__ */ new Set(["--mcp-config", "--settings"]);
           const keyArgs = args.filter((a2, i2) => !privateFileFlags.has(a2) && !privateFileFlags.has(args[i2 - 1] ?? ""));
           const argsKey = JSON.stringify({
             args: keyArgs,
@@ -23071,14 +23217,21 @@ var init_claude = __esm({
             cwd,
             model: injected.model ?? null,
             base: env.ANTHROPIC_BASE_URL ?? null,
-            configDir: env.CLAUDE_CONFIG_DIR ?? null
+            configDir: env.CLAUDE_CONFIG_DIR ?? null,
+            // Rotating an account's key/helper must not reuse the old process.
+            auth: createHash5("sha256").update(JSON.stringify({
+              settings: authSettings,
+              env: Object.fromEntries(CLAUDE_ACCOUNT_ENV_KEYS.map((key) => [key, env[key]]))
+            })).digest("hex")
           });
           const live = sessions.get(threadId);
           if (live && !live.turn && !live.closing && live.child.exitCode === null && live.argsKey === argsKey && (!sessionId || sessionId === live.sessionId)) {
             if (live.idleTimer) clearTimeout(live.idleTimer);
-            live.turn = { turnId, settled: false, sawStreamDelta: false };
+            live.turn = { turnId, input: turn, retryAbort, settled: false, sawStreamDelta: false };
             active.set(threadId, { stop: () => {
               closeSession(threadId, "interrupted");
+              retry.cancelled = true;
+              retryAbort.abort();
               stopSession(live);
             }, turnId, broker: live.broker });
             emit({ ...base2(threadId, turnId), type: "turn.started" });
@@ -23133,13 +23286,14 @@ var init_claude = __esm({
             if (socketPath) {
               const askTools = /* @__PURE__ */ new Map();
               broker = await createPermissionBroker({
-                socketPaths: brokerSocketCandidates(threadId),
+                socketPaths: brokerSocketCandidates(threadId, botId),
                 isActive: () => Boolean(sessions.get(threadId)?.turn),
                 onAsk: (ask) => {
                   const eventTurnId = sessions.get(threadId)?.turn?.turnId ?? turnId;
                   askTools.set(ask.id, typeof ask.tool === "string" ? ask.tool : void 0);
                   const nativeMode = sessions.get(threadId)?.nativePermissionMode ?? null;
                   const nativeReview = permissionMode === "auto" && nativeMode !== null ? nativeMode === "auto" ? "active" : "inactive" : void 0;
+                  const questions = askQuestions(ask);
                   emit({
                     ...base2(threadId, eventTurnId),
                     type: "request.opened",
@@ -23152,7 +23306,10 @@ var init_claude = __esm({
                     // host control stays one action at a time
                     allowSession: ask.kind === "permission" && !(controlsHost && typeof ask.tool === "string" && ask.tool.startsWith("mcp__computer")) ? true : void 0,
                     approvalScope: typeof ask.tool === "string" && controlsHost && ask.tool.startsWith("mcp__computer") ? "local-computer" : void 0,
-                    choices: Array.isArray(ask.input?.choices) ? ask.input.choices.slice(0, 5) : void 0
+                    questions: questions ?? void 0,
+                    // A structured ask still offers flat labels, for the phone
+                    // companions and any client that predates the question card.
+                    choices: questions ? questionChoices(questions) : Array.isArray(ask.input?.choices) ? ask.input.choices.slice(0, 5) : void 0
                   });
                 },
                 onResolve: (resolved) => {
@@ -23175,6 +23332,9 @@ var init_claude = __esm({
             if (mcpConfigPath) {
               writeFileSync6(mcpConfigPath, JSON.stringify({ mcpServers }), { mode: 384 });
             }
+            if (authSettingsPath) {
+              writeFileSync6(authSettingsPath, JSON.stringify(authSettings), { mode: 384 });
+            }
             if (sessionId) args.push("--resume", sessionId);
             else args.push("--session-id", newSessionId);
           } catch (error51) {
@@ -23202,7 +23362,7 @@ var init_claude = __esm({
             sessionId: sessionId ?? newSessionId,
             sawInit: false,
             nativePermissionMode: null,
-            turn: { turnId, settled: false, sawStreamDelta: false },
+            turn: { turnId, input: turn, retryAbort, settled: false, sawStreamDelta: false },
             idleTimer: null,
             closing: false,
             stderr: ""
@@ -23265,18 +23425,18 @@ var init_claude = __esm({
               }
               case "assistant": {
                 const msg = o.message ?? {};
-                const text3 = firstText(msg.content);
-                if (claudeAuthFailure(o, text3)) {
+                const text4 = firstText(msg.content);
+                if (claudeAuthFailure(o, text4)) {
                   if (session.turn) session.turn.authFailed = true;
-                  emit({ ...base2(threadId, currentTurnId()), type: "runtime.error", message: text3, setup: true });
+                  emit({ ...base2(threadId, currentTurnId()), type: "runtime.error", message: text4, setup: true });
                   break;
                 }
-                if (text3.trim()) {
+                if (text4.trim()) {
                   if (!session.turn?.sawStreamDelta) {
-                    emit({ ...base2(threadId, currentTurnId()), type: "content.delta", streamKind: "assistant_text", delta: text3 });
+                    emit({ ...base2(threadId, currentTurnId()), type: "content.delta", streamKind: "assistant_text", delta: text4 });
                   }
                   if (session.turn) session.turn.sawStreamDelta = false;
-                  emit({ ...base2(threadId, currentTurnId()), type: "item.completed", itemType: "assistant_text", text: text3 });
+                  emit({ ...base2(threadId, currentTurnId()), type: "item.completed", itemType: "assistant_text", text: text4 });
                 }
                 for (const b of Array.isArray(msg.content) ? msg.content : []) {
                   if (b.type === "tool_use") {
@@ -23354,9 +23514,11 @@ var init_claude = __esm({
             if (closeFinalized) return;
             closeFinalized = true;
             if (session.turn && !session.turn.settled) {
+              const { turnId: turnId2, input: turn2, retryAbort: retryAbort2 } = session.turn;
+              const retry2 = retryState.get(threadId) ?? { attempt: 0, cancelled: false };
               const message2 = `claude exited ${code} before result${session.stderr ? `: ${session.stderr.trim().slice(-300)}` : ""}`;
               const verdict = classifyError({ exitCode: code, stderr: message2 });
-              if (!retry.cancelled && code !== 0 && verdict.transient && !session.turn.sawStreamDelta && retry.attempt < RETRY_MAX_ATTEMPTS - 1) {
+              if (!retry2.cancelled && code !== 0 && verdict.transient && !session.turn.sawStreamDelta && retry2.attempt < RETRY_MAX_ATTEMPTS - 1) {
                 const failedBroker = session.broker;
                 session.broker = void 0;
                 failedBroker?.pause();
@@ -23374,23 +23536,23 @@ var init_claude = __esm({
                 }
                 sessions.delete(threadId);
                 session.turn = null;
-                retry.attempt++;
-                const delayMs = computeBackoff(retry.attempt - 1);
+                retry2.attempt++;
+                const delayMs = computeBackoff(retry2.attempt - 1);
                 emit({
-                  ...base2(threadId, turnId),
+                  ...base2(threadId, turnId2),
                   type: "turn.retrying",
-                  attempt: retry.attempt,
+                  attempt: retry2.attempt,
                   delayMs,
                   reason: verdict.reason
                 });
                 void (async () => {
-                  const wait2 = interruptibleDelay(delayMs * retryScale, retryAbort.signal);
+                  const wait2 = interruptibleDelay(delayMs * retryScale, retryAbort2.signal);
                   await wait2.promise;
-                  if (retry.cancelled) {
+                  if (retry2.cancelled) {
                     active.delete(threadId);
                     retryState.delete(threadId);
                     emit({
-                      ...base2(threadId, turnId),
+                      ...base2(threadId, turnId2),
                       type: "turn.completed",
                       ok: false,
                       stopReason: "interrupted",
@@ -23401,16 +23563,16 @@ var init_claude = __esm({
                   active.delete(threadId);
                   try {
                     const cursor3 = session.sessionId ?? sessionId ?? void 0;
-                    await sendTurn({ ...turn, resumeCursor: cursor3 });
+                    await sendTurn({ ...turn2, resumeCursor: cursor3 }, turnId2);
                   } catch (e) {
                     retryState.delete(threadId);
                     emit({
-                      ...base2(threadId, turnId),
+                      ...base2(threadId, turnId2),
                       type: "runtime.error",
                       message: e instanceof Error ? e.message : String(e)
                     });
                     emit({
-                      ...base2(threadId, turnId),
+                      ...base2(threadId, turnId2),
                       type: "turn.completed",
                       ok: false,
                       stopReason: "exit_before_result",
@@ -23426,10 +23588,10 @@ var init_claude = __esm({
                 promptSubmitted: session.sawInit,
                 producedOutput: session.turn.sawStreamDelta
               });
-              if (mayReplay(resumeFailure) && !retry.cancelled) {
+              if (mayReplay(resumeFailure) && !retry2.cancelled) {
                 const recovery = recoveryPromptFor({
-                  recoveryText: turn.recoveryText,
-                  currentText: turn.text,
+                  recoveryText: turn2.recoveryText,
+                  currentText: turn2.text,
                   failure: resumeFailure
                 });
                 session.broker?.close();
@@ -23449,23 +23611,23 @@ var init_claude = __esm({
                 session.turn = null;
                 active.delete(threadId);
                 emit({
-                  ...base2(threadId, turnId),
+                  ...base2(threadId, turnId2),
                   type: "turn.retrying",
-                  attempt: retry.attempt + 1,
+                  attempt: retry2.attempt + 1,
                   delayMs: 0,
                   reason: "resume_rejected"
                 });
                 void (async () => {
                   try {
-                    await sendTurn({ ...turn, resumeCursor: void 0, recoveryText: void 0, text: recovery.text });
+                    await sendTurn({ ...turn2, resumeCursor: void 0, recoveryText: void 0, text: recovery.text }, turnId2);
                   } catch (e) {
                     retryState.delete(threadId);
                     emit({
-                      ...base2(threadId, turnId),
+                      ...base2(threadId, turnId2),
                       type: "runtime.error",
                       message: e instanceof Error ? e.message : String(e)
                     });
-                    emit({ ...base2(threadId, turnId), type: "turn.completed", ok: false, stopReason: "exit_before_result", cost: null });
+                    emit({ ...base2(threadId, turnId2), type: "turn.completed", ok: false, stopReason: "exit_before_result", cost: null });
                   }
                 })();
                 return;
@@ -23507,10 +23669,10 @@ var init_claude = __esm({
           }
           return { turnId };
         };
-        const steer = async (threadId, text3) => {
+        const steer = async (threadId, text4) => {
           const s = sessions.get(threadId);
           if (!s || !s.turn || s.turn.settled || s.closing || s.child.exitCode !== null) return false;
-          return writeUser(s, threadId, claudeUserMessage(text3, void 0));
+          return writeUser(s, threadId, claudeUserMessage(text4, void 0));
         };
         const login = new ClaudeLoginController({ cli: config2.cli, environment, onAuthenticated: async () => {
           await refreshModels();
@@ -23788,7 +23950,7 @@ function unquote(raw) {
   }
   return value;
 }
-function parseCodexToml(text3) {
+function parseCodexToml(text4) {
   const result = { providers: [] };
   const byId = /* @__PURE__ */ new Map();
   let section = "root";
@@ -23801,7 +23963,7 @@ function parseCodexToml(text3) {
     }
     return provider;
   };
-  for (const line of text3.split(/\r?\n/)) {
+  for (const line of text4.split(/\r?\n/)) {
     const stripped = line.trim();
     if (!stripped || stripped.startsWith("#")) continue;
     if (stripped.startsWith("[") && stripped.endsWith("]")) {
@@ -24883,6 +25045,7 @@ var init_codex = __esm({
             const earlyNotifications = [];
             const state = {
               settled: false,
+              lastError: "",
               lastText: "",
               sawStreamDelta: false,
               // codex reports token usage as a running THREAD total; the harness
@@ -25144,13 +25307,26 @@ var init_codex = __esm({
                 }
                 case "turn/completed": {
                   const t2 = p.turn ?? {};
-                  void settle(t2.status === "completed", t2.status === "completed" ? null : t2.error?.message ?? t2.status ?? "failed");
+                  const message2 = typeof t2.error?.message === "string" ? t2.error.message.slice(0, 400) : "";
+                  if (t2.status !== "completed" && message2 && message2 !== state.lastError) {
+                    state.lastError = message2;
+                    emit({
+                      ...base2(threadId, turnId),
+                      type: "runtime.error",
+                      message: message2,
+                      ...classifyError({ text: message2 }).reason === "auth" ? { setup: true } : {}
+                    });
+                  }
+                  void settle(t2.status === "completed", t2.status === "completed" ? null : classifyError({ text: message2 || state.lastError }).reason === "provider_safety" ? "provider_safety" : message2 || t2.status || "failed");
                   break;
                 }
                 case "error":
                   {
                     const message2 = p.message ?? p.error?.message;
-                    if (message2) emit({ ...base2(threadId, turnId), type: "runtime.error", message: String(message2).slice(0, 400) });
+                    if (message2) {
+                      state.lastError = String(message2).slice(0, 400);
+                      emit({ ...base2(threadId, turnId), type: "runtime.error", message: state.lastError });
+                    }
                   }
                   break;
               }
@@ -25358,7 +25534,7 @@ var init_codex = __esm({
                   message: message2,
                   ...needsAuth ? { setup: true } : {}
                 });
-                await settle(false, needsAuth ? "auth_required" : "rpc_error");
+                await settle(false, needsAuth ? "auth_required" : verdict.reason === "provider_safety" ? "provider_safety" : "rpc_error");
               }
             }
           };
@@ -25472,72 +25648,89 @@ function createOpenAIChatRuntime(options) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   });
   const complete = async (messages, model, stream, signal, onDelta) => {
-    const timeout = AbortSignal.timeout(options.timeoutMs);
-    const response = await fetch(`${options.apiUrl}/chat/completions`, {
-      method: "POST",
-      headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
-      body: JSON.stringify(options.requestBody(model, messages, stream)),
-      signal: signal ? AbortSignal.any([signal, timeout]) : timeout
-    });
-    if (!response.ok) {
-      const body = await response.text().catch(() => "");
-      throw new Error(`${options.httpErrorLabel} HTTP ${response.status}${body ? `: ${body.slice(0, 200)}` : ""}`);
-    }
-    if (!stream) {
-      const json2 = await response.json();
-      const message2 = json2.choices?.[0]?.message;
-      return {
-        text: typeof message2?.content === "string" ? message2.content : "",
-        reasoning: options.reasoning && typeof message2?.reasoning_content === "string" ? message2.reasoning_content : "",
-        usage: usageFrom(json2.usage)
-      };
-    }
-    if (!response.body) {
-      throw new Error(options.noBodyError ?? `${options.httpErrorLabel} returned no response body`);
-    }
-    let text3 = "";
-    let reasoning = "";
-    let usage = null;
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = "";
+    const timeoutController = new AbortController();
+    let idleTimer = null;
+    const resetIdleTimer = () => {
+      if (idleTimer) clearTimeout(idleTimer);
+      idleTimer = setTimeout(() => {
+        timeoutController.abort(new DOMException("Streaming idle timeout elapsed", "AbortError"));
+      }, options.timeoutMs);
+    };
+    resetIdleTimer();
     try {
-      readLoop: for (; ; ) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        buffer += decoder.decode(value, { stream: true });
-        let newline;
-        while ((newline = buffer.indexOf("\n")) !== -1) {
-          const line = buffer.slice(0, newline).trim();
-          buffer = buffer.slice(newline + 1);
-          if (!line.startsWith("data:")) continue;
-          const data = line.slice(5).trim();
-          if (data === "[DONE]") break readLoop;
-          let chunk;
-          try {
-            chunk = JSON.parse(data);
-          } catch {
-            continue;
-          }
-          const delta = chunk.choices?.[0]?.delta;
-          const reasoningDelta = options.reasoning && typeof delta?.reasoning_content === "string" ? delta.reasoning_content : "";
-          const contentDelta = typeof delta?.content === "string" ? delta.content : "";
-          if (reasoningDelta) {
-            reasoning += reasoningDelta;
-            onDelta?.(reasoningDelta, "reasoning_text");
-          }
-          if (contentDelta) {
-            text3 += contentDelta;
-            onDelta?.(contentDelta, "assistant_text");
+      const activeSignal = signal ? AbortSignal.any([signal, timeoutController.signal]) : timeoutController.signal;
+      const response = await fetch(`${options.apiUrl}/chat/completions`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
+        body: JSON.stringify(options.requestBody(model, messages, stream)),
+        signal: activeSignal
+      });
+      if (!response.ok) {
+        const body = await response.text().catch(() => "");
+        throw new Error(`${options.httpErrorLabel} HTTP ${response.status}${body ? `: ${body.slice(0, 200)}` : ""}`);
+      }
+      if (!stream) {
+        const json2 = await response.json();
+        const message2 = json2.choices?.[0]?.message;
+        return {
+          text: typeof message2?.content === "string" ? message2.content : "",
+          reasoning: options.reasoning && typeof message2?.reasoning_content === "string" ? message2.reasoning_content : "",
+          usage: usageFrom(json2.usage)
+        };
+      }
+      if (!response.body) {
+        throw new Error(options.noBodyError ?? `${options.httpErrorLabel} returned no response body`);
+      }
+      let text4 = "";
+      let reasoning = "";
+      let usage = null;
+      const reader = response.body.getReader();
+      const decoder = new TextDecoder();
+      let buffer = "";
+      try {
+        readLoop: for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) {
+            if (buffer.trim() === "data: [DONE]") break;
+            throw new DOMException("Stream ended before completion", "AbortError");
+          }
+          resetIdleTimer();
+          buffer += decoder.decode(value, { stream: true });
+          let newline;
+          while ((newline = buffer.indexOf("\n")) !== -1) {
+            const line = buffer.slice(0, newline).trim();
+            buffer = buffer.slice(newline + 1);
+            if (!line.startsWith("data:")) continue;
+            const data = line.slice(5).trim();
+            if (data === "[DONE]") break readLoop;
+            let chunk;
+            try {
+              chunk = JSON.parse(data);
+            } catch {
+              continue;
+            }
+            const delta = chunk.choices?.[0]?.delta;
+            const reasoningDelta = options.reasoning && typeof delta?.reasoning_content === "string" ? delta.reasoning_content : "";
+            const contentDelta = typeof delta?.content === "string" ? delta.content : "";
+            if (reasoningDelta) {
+              reasoning += reasoningDelta;
+              onDelta?.(reasoningDelta, "reasoning_text");
+            }
+            if (contentDelta) {
+              text4 += contentDelta;
+              onDelta?.(contentDelta, "assistant_text");
+            }
+            if (chunk.usage) usage = usageFrom(chunk.usage);
           }
-          if (chunk.usage) usage = usageFrom(chunk.usage);
         }
+      } finally {
+        await reader.cancel().catch(() => {
+        });
       }
+      return { text: text4, reasoning, usage };
     } finally {
-      await reader.cancel().catch(() => {
-      });
+      if (idleTimer) clearTimeout(idleTimer);
     }
-    return { text: text3, reasoning, usage };
   };
   const messagesFor = (turn) => [
     ...turn.system ? [{ role: "system", content: turn.system }] : [],
@@ -25654,8 +25847,8 @@ function createOpenAIChatRuntime(options) {
     },
     generateText: async (prompt) => {
       const model = options.generateModel?.() ?? options.models().default;
-      const { text: text3, reasoning } = await complete([{ role: "user", content: prompt }], model, false);
-      return text3.trim() ? text3 : reasoning;
+      const { text: text4, reasoning } = await complete([{ role: "user", content: prompt }], model, false);
+      return text4.trim() ? text4 : reasoning;
     },
     dispose: async () => {
       for (const abort of active.values()) abort.abort();
@@ -25723,7 +25916,7 @@ var init_grok = __esm({
           nativeLog: {
             source: "xai.chat.completions",
             outgoing: (_turn, messages, model) => ({ model, messages }),
-            incoming: ({ text: text3, usage }) => ({ text: text3, usage })
+            incoming: ({ text: text4, usage }) => ({ text: text4, usage })
           }
         });
       }
@@ -25748,9 +25941,9 @@ function unquote2(raw) {
 }
 function readGrokModelCatalog(env = process.env) {
   const path3 = join25(grokHome(env), "config.toml");
-  let text3 = "";
+  let text4 = "";
   try {
-    text3 = readFileSync11(path3, "utf8");
+    text4 = readFileSync11(path3, "utf8");
   } catch {
     return STATIC_GROK_MODELS;
   }
@@ -25768,7 +25961,7 @@ function readGrokModelCatalog(env = process.env) {
     options.push({ id: current.slug, label: current.name || current.slug, custom: true });
     current = null;
   };
-  for (const line of text3.split(/\r?\n/)) {
+  for (const line of text4.split(/\r?\n/)) {
     const stripped = line.trim();
     if (stripped === "[models]") {
       flush();
@@ -25821,11 +26014,11 @@ function ensureGrokInjectSlug(modelId, env = process.env) {
   const host = localHost(inject.host);
   if (!host) return modelId;
   const path3 = join25(grokHome(env), "config.toml");
-  let text3 = "";
+  let text4 = "";
   try {
-    text3 = readFileSync11(path3, "utf8");
+    text4 = readFileSync11(path3, "utf8");
   } catch {
-    text3 = "";
+    text4 = "";
   }
   const taken = new Set(STATIC_GROK_MODELS.options.map((option) => option.id));
   let current = null;
@@ -25838,7 +26031,7 @@ function ensureGrokInjectSlug(modelId, env = process.env) {
     current = null;
   };
   let found = null;
-  for (const line of text3.split(/\r?\n/)) {
+  for (const line of text4.split(/\r?\n/)) {
     const stripped = line.trim();
     if (stripped.startsWith("[model.") && stripped.endsWith("]")) {
       flush();
@@ -25871,12 +26064,18 @@ function ensureGrokInjectSlug(modelId, env = process.env) {
     `api_key = ${quoteToml(hostApiKey(host, env))}`,
     ""
   ].join("\n");
-  const next = text3 && !text3.endsWith("\n") ? `${text3}
+  const next = text4 && !text4.endsWith("\n") ? `${text4}
 
-${block2}` : `${text3}${text3 ? "\n" : ""}${block2}`;
+${block2}` : `${text4}${text4 ? "\n" : ""}${block2}`;
   writeFileSync7(path3, next);
   return slug;
 }
+function grokAcceptsUnadvertisedImages(init) {
+  const meta3 = init?._meta;
+  if (meta3?.grokShell !== true || typeof meta3.agentVersion !== "string") return false;
+  const version2 = /^1\.0\.(\d+)$/.exec(meta3.agentVersion);
+  return Boolean(version2 && Number(version2[1]) >= 25);
+}
 var STATIC_GROK_MODELS, SLUG, support2, GrokAgentDriver;
 var init_grok2 = __esm({
   "server/drivers/acp/grok.ts"() {
@@ -25894,7 +26093,8 @@ var init_grok2 = __esm({
     support2 = {
       driverKind: "grokAgent",
       displayName: "Grok",
-      images: false,
+      images: true,
+      acceptsUnadvertisedImages: grokAcceptsUnadvertisedImages,
       models: STATIC_GROK_MODELS,
       resolveModels: (env) => mergeLocalInject(readGrokModelCatalog(env), env),
       // Grok's accepted levels vary by model and the CLI validates lazily — a
@@ -26068,18 +26268,18 @@ function stripTomlLineComment(line) {
   }
   return line;
 }
-function takeTomlBasicEscape(text3, i2) {
-  const code = text3[i2 + 1];
+function takeTomlBasicEscape(text4, i2) {
+  const code = text4[i2 + 1];
   if (code === void 0) return { ok: false };
   if (code === "u") {
-    const hex3 = text3.slice(i2 + 2, i2 + 6);
+    const hex3 = text4.slice(i2 + 2, i2 + 6);
     if (!/^[0-9a-fA-F]{4}$/.test(hex3)) return { ok: false };
     const point = parseInt(hex3, 16);
     if (point >= 55296 && point <= 57343) return { ok: false };
     return { ok: true, value: String.fromCharCode(point), next: i2 + 6 };
   }
   if (code === "U") {
-    const hex3 = text3.slice(i2 + 2, i2 + 10);
+    const hex3 = text4.slice(i2 + 2, i2 + 10);
     if (!/^[0-9a-fA-F]{8}$/.test(hex3)) return { ok: false };
     const point = parseInt(hex3, 16);
     if (point > 1114111 || point >= 55296 && point <= 57343) return { ok: false };
@@ -26151,14 +26351,14 @@ function tomlRowKey(row) {
   const eq = row.indexOf("=");
   return unquoteTomlKey(eq < 0 ? row : row.slice(0, eq));
 }
-function tomlTables(text3) {
+function tomlTables(text4) {
   const headings = [];
   let mode = "out";
   let i2 = 0;
-  const atLineStart = (idx) => idx === 0 || text3[idx - 1] === "\n";
-  while (i2 < text3.length) {
+  const atLineStart = (idx) => idx === 0 || text4[idx - 1] === "\n";
+  while (i2 < text4.length) {
     if (mode === "mlbasic") {
-      if (text3.startsWith('"""', i2)) {
+      if (text4.startsWith('"""', i2)) {
         mode = "out";
         i2 += 3;
         continue;
@@ -26167,7 +26367,7 @@ function tomlTables(text3) {
       continue;
     }
     if (mode === "mllit") {
-      if (text3.startsWith("'''", i2)) {
+      if (text4.startsWith("'''", i2)) {
         mode = "out";
         i2 += 3;
         continue;
@@ -26176,61 +26376,61 @@ function tomlTables(text3) {
       continue;
     }
     if (mode === "basic") {
-      if (text3[i2] === "\n") {
+      if (text4[i2] === "\n") {
         mode = "out";
         i2 += 1;
         continue;
       }
-      if (text3[i2] === "\\") {
+      if (text4[i2] === "\\") {
         i2 += 2;
         continue;
       }
-      if (text3[i2] === '"') mode = "out";
+      if (text4[i2] === '"') mode = "out";
       i2 += 1;
       continue;
     }
     if (mode === "literal") {
-      if (text3[i2] === "\n") {
+      if (text4[i2] === "\n") {
         mode = "out";
         i2 += 1;
         continue;
       }
-      if (text3[i2] === "'") mode = "out";
+      if (text4[i2] === "'") mode = "out";
       i2 += 1;
       continue;
     }
-    if (text3.startsWith('"""', i2)) {
+    if (text4.startsWith('"""', i2)) {
       mode = "mlbasic";
       i2 += 3;
       continue;
     }
-    if (text3.startsWith("'''", i2)) {
+    if (text4.startsWith("'''", i2)) {
       mode = "mllit";
       i2 += 3;
       continue;
     }
-    if (text3[i2] === '"') {
+    if (text4[i2] === '"') {
       mode = "basic";
       i2 += 1;
       continue;
     }
-    if (text3[i2] === "'") {
+    if (text4[i2] === "'") {
       mode = "literal";
       i2 += 1;
       continue;
     }
-    if (text3[i2] === "#") {
-      const nl = text3.indexOf("\n", i2);
-      i2 = nl < 0 ? text3.length : nl + 1;
+    if (text4[i2] === "#") {
+      const nl = text4.indexOf("\n", i2);
+      i2 = nl < 0 ? text4.length : nl + 1;
       continue;
     }
     if (atLineStart(i2)) {
       let j = i2;
-      while (j < text3.length && (text3[j] === " " || text3[j] === "	")) j += 1;
-      if (text3[j] === "[") {
-        const nl = text3.indexOf("\n", j);
-        const lineEnd = nl < 0 ? text3.length : nl;
-        const raw = text3.slice(j, lineEnd).replace(/\r$/, "");
+      while (j < text4.length && (text4[j] === " " || text4[j] === "	")) j += 1;
+      if (text4[j] === "[") {
+        const nl = text4.indexOf("\n", j);
+        const lineEnd = nl < 0 ? text4.length : nl;
+        const raw = text4.slice(j, lineEnd).replace(/\r$/, "");
         const stripped = stripTomlLineComment(raw).trim();
         const array2 = stripped.startsWith("[[");
         const name = array2 ? canonicalizeTomlHeading(`[${stripped.replace(/^\s*\[\[/, "").replace(/\]\]\s*$/, "")}]`) : canonicalizeTomlHeading(raw);
@@ -26243,11 +26443,11 @@ function tomlTables(text3) {
   }
   return headings.map((heading, index) => ({
     heading,
-    end: index + 1 < headings.length ? headings[index + 1].lineStart : text3.length
+    end: index + 1 < headings.length ? headings[index + 1].lineStart : text4.length
   })).filter((entry) => entry.heading.patchable && entry.heading.name).map((entry) => ({
     name: entry.heading.name,
     headingStart: entry.heading.lineStart,
-    bodyStart: entry.heading.lineEnd + (text3[entry.heading.lineEnd] === "\n" ? 1 : 0),
+    bodyStart: entry.heading.lineEnd + (text4[entry.heading.lineEnd] === "\n" ? 1 : 0),
     end: entry.end
   }));
 }
@@ -26303,22 +26503,22 @@ function tomlKeys(block2) {
   take(block2.length);
   return keys;
 }
-function hasTomlTable(text3, heading) {
+function hasTomlTable(text4, heading) {
   const name = canonicalizeTomlHeading(heading);
-  return name !== null && tomlTables(text3).some((table) => table.name === name);
+  return name !== null && tomlTables(text4).some((table) => table.name === name);
 }
-function patchTomlTable(text3, heading, rows) {
+function patchTomlTable(text4, heading, rows) {
   const name = canonicalizeTomlHeading(heading);
-  if (!name) return text3;
-  const table = tomlTables(text3).find((entry) => entry.name === name);
-  if (!table) return text3;
-  const keys = tomlKeys(text3.slice(table.bodyStart, table.end));
+  if (!name) return text4;
+  const table = tomlTables(text4).find((entry) => entry.name === name);
+  if (!table) return text4;
+  const keys = tomlKeys(text4.slice(table.bodyStart, table.end));
   const missing = rows.filter((row) => !keys.has(tomlRowKey(row)));
-  if (!missing.length) return text3;
+  if (!missing.length) return text4;
   let insertAt = table.end;
-  while (insertAt > table.bodyStart && (text3[insertAt - 1] === "\n" || text3[insertAt - 1] === "\r")) insertAt -= 1;
-  const before = text3.slice(0, insertAt);
-  const after = text3.slice(insertAt);
+  while (insertAt > table.bodyStart && (text4[insertAt - 1] === "\n" || text4[insertAt - 1] === "\r")) insertAt -= 1;
+  const before = text4.slice(0, insertAt);
+  const after = text4.slice(insertAt);
   const pad = before.endsWith("\n") || before.length === 0 ? "" : "\n";
   return `${before}${pad}${missing.join("\n")}${after.startsWith("\n") ? "" : "\n"}${after}`;
 }
@@ -26331,17 +26531,17 @@ function ensureKimiInjectAlias(modelId, env = process.env) {
   const dataRoot = kimiDataRoot(env);
   mkdirSync10(dataRoot, { recursive: true });
   const path3 = join27(dataRoot, "config.toml");
-  let text3 = "";
+  let text4 = "";
   try {
-    text3 = readFileSync13(path3, "utf8");
+    text4 = readFileSync13(path3, "utf8");
   } catch {
-    text3 = "";
+    text4 = "";
   }
-  const original = text3;
+  const original = text4;
   const providerHeading = `[providers.${inject.host}]`;
   const modelHeading = `[models.${quoteTomlKey(alias)}]`;
   const blocks = [];
-  if (!hasTomlTable(text3, providerHeading)) {
+  if (!hasTomlTable(text4, providerHeading)) {
     blocks.push(
       [
         providerHeading,
@@ -26352,8 +26552,8 @@ function ensureKimiInjectAlias(modelId, env = process.env) {
       ].join("\n")
     );
   }
-  if (hasTomlTable(text3, modelHeading)) {
-    text3 = patchTomlTable(text3, modelHeading, [`protocol = "openai"`, `max_context_size = 262144`]);
+  if (hasTomlTable(text4, modelHeading)) {
+    text4 = patchTomlTable(text4, modelHeading, [`protocol = "openai"`, `max_context_size = 262144`]);
   } else {
     blocks.push(
       [
@@ -26367,13 +26567,13 @@ function ensureKimiInjectAlias(modelId, env = process.env) {
     );
   }
   if (blocks.length) {
-    const prefix = text3 && !text3.endsWith("\n") ? `${text3}
+    const prefix = text4 && !text4.endsWith("\n") ? `${text4}
 
-` : text3 ? `${text3}
+` : text4 ? `${text4}
 ` : "";
     writeFileSync8(path3, `${prefix}${blocks.join("\n")}`);
-  } else if (text3 !== original) {
-    writeFileSync8(path3, text3);
+  } else if (text4 !== original) {
+    writeFileSync8(path3, text4);
   }
   return alias;
 }
@@ -26393,9 +26593,9 @@ function stripKimiModelEnv(env) {
 }
 function readKimiModelCatalog(env) {
   const dataRoot = kimiDataRoot(env);
-  let text3 = "";
+  let text4 = "";
   try {
-    text3 = readFileSync13(join27(dataRoot, "config.toml"), "utf8");
+    text4 = readFileSync13(join27(dataRoot, "config.toml"), "utf8");
   } catch {
     return STATIC_KIMI_MODELS;
   }
@@ -26411,7 +26611,7 @@ function readKimiModelCatalog(env) {
     options.push({ id: current.slug, label: current.name || current.slug, custom: true });
     current = null;
   };
-  for (const line of text3.split(/\r?\n/)) {
+  for (const line of text4.split(/\r?\n/)) {
     const stripped = line.trim();
     if ((stripped.startsWith("[model.") || stripped.startsWith("[models.")) && stripped.endsWith("]")) {
       flush();
@@ -26704,8 +26904,8 @@ function resolveCursorAcpModelId(available, wanted) {
   }
   return null;
 }
-function firstJsonValue(text3) {
-  const trimmed = text3.trim();
+function firstJsonValue(text4) {
+  const trimmed = text4.trim();
   if (!trimmed) return null;
   try {
     return JSON.parse(trimmed);
@@ -26779,12 +26979,12 @@ function stripModelMarkers(label) {
   }
   return { label: cleaned, isDefault, isCurrent };
 }
-function decodeCursorModelText(text3) {
+function decodeCursorModelText(text4) {
   const options = [];
   const seen = /* @__PURE__ */ new Set();
   let markedDefault;
   let markedCurrent;
-  for (const raw of text3.split(/\r?\n/)) {
+  for (const raw of text4.split(/\r?\n/)) {
     const line = raw.trim();
     if (!line || line.startsWith("#") || /^available\s+models?\b/i.test(line) || /^models?\b/i.test(line)) continue;
     const stripped = line.replace(/^[\s*•-]+\s*/, "");
@@ -26837,8 +27037,8 @@ function decodeCursorAuthStatus(payload) {
   }
   return null;
 }
-function decodeCursorAuthText(text3) {
-  const normalized = text3.trim().toLowerCase();
+function decodeCursorAuthText(text4) {
+  const normalized = text4.trim().toLowerCase();
   if (!normalized) return null;
   if (/not (?:logged|signed) in|not authenticated|unauthenticated|logged out/.test(normalized)) return false;
   if (/login successful|logged in|signed in|authenticated/.test(normalized)) return true;
@@ -27258,7 +27458,7 @@ function qwenHome(env) {
   const home = process.platform === "win32" ? env.USERPROFILE || env.HOME || homedir19() : env.HOME || env.USERPROFILE || homedir19();
   return join30(home, ".qwen");
 }
-function isRecord(value) {
+function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function qwenModelLabel(id, name) {
@@ -27272,15 +27472,15 @@ function readQwenRoutes(env) {
   } catch {
     return [];
   }
-  if (!isRecord(settings2) || !isRecord(settings2.modelProviders)) return [];
+  if (!isRecord2(settings2) || !isRecord2(settings2.modelProviders)) return [];
   const routes = [];
   const seen = /* @__PURE__ */ new Set();
-  const mappings = isRecord(settings2.providerProtocol) ? settings2.providerProtocol : {};
+  const mappings = isRecord2(settings2.providerProtocol) ? settings2.providerProtocol : {};
   for (const [provider, rows] of Object.entries(settings2.modelProviders)) {
     const protocol = Object.hasOwn(mappings, provider) ? mappings[provider] : provider;
     if (typeof protocol !== "string" || !PROTOCOLS.has(protocol) || !Array.isArray(rows)) continue;
     for (const row of rows) {
-      if (!isRecord(row) || typeof row.id !== "string") continue;
+      if (!isRecord2(row) || typeof row.id !== "string") continue;
       const model = row.id;
       if (!model.trim()) continue;
       if (row.baseUrl !== void 0 && typeof row.baseUrl !== "string") continue;
@@ -28426,14 +28626,14 @@ var init_stringifyComment = __esm({
 });
 
 // node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/browser/dist/stringify/foldFlowLines.js
-function foldFlowLines(text3, indent, mode = "flow", { indentAtStart, lineWidth = 80, minContentWidth = 20, onFold, onOverflow } = {}) {
+function foldFlowLines(text4, indent, mode = "flow", { indentAtStart, lineWidth = 80, minContentWidth = 20, onFold, onOverflow } = {}) {
   if (!lineWidth || lineWidth < 0)
-    return text3;
+    return text4;
   if (lineWidth < minContentWidth)
     minContentWidth = 0;
   const endStep = Math.max(1 + minContentWidth, 1 + lineWidth - indent.length);
-  if (text3.length <= endStep)
-    return text3;
+  if (text4.length <= endStep)
+    return text4;
   const folds = [];
   const escapedFolds = {};
   let end = lineWidth - indent.length;
@@ -28450,14 +28650,14 @@ function foldFlowLines(text3, indent, mode = "flow", { indentAtStart, lineWidth
   let escStart = -1;
   let escEnd = -1;
   if (mode === FOLD_BLOCK) {
-    i2 = consumeMoreIndentedLines(text3, i2, indent.length);
+    i2 = consumeMoreIndentedLines(text4, i2, indent.length);
     if (i2 !== -1)
       end = i2 + endStep;
   }
-  for (let ch; ch = text3[i2 += 1]; ) {
+  for (let ch; ch = text4[i2 += 1]; ) {
     if (mode === FOLD_QUOTED && ch === "\\") {
       escStart = i2;
-      switch (text3[i2 + 1]) {
+      switch (text4[i2 + 1]) {
         case "x":
           i2 += 3;
           break;
@@ -28474,12 +28674,12 @@ function foldFlowLines(text3, indent, mode = "flow", { indentAtStart, lineWidth
     }
     if (ch === "\n") {
       if (mode === FOLD_BLOCK)
-        i2 = consumeMoreIndentedLines(text3, i2, indent.length);
+        i2 = consumeMoreIndentedLines(text4, i2, indent.length);
       end = i2 + indent.length + endStep;
       split = void 0;
     } else {
       if (ch === " " && prev && prev !== " " && prev !== "\n" && prev !== "	") {
-        const next = text3[i2 + 1];
+        const next = text4[i2 + 1];
         if (next && next !== " " && next !== "\n" && next !== "	")
           split = i2;
       }
@@ -28491,12 +28691,12 @@ function foldFlowLines(text3, indent, mode = "flow", { indentAtStart, lineWidth
         } else if (mode === FOLD_QUOTED) {
           while (prev === " " || prev === "	") {
             prev = ch;
-            ch = text3[i2 += 1];
+            ch = text4[i2 += 1];
             overflow = true;
           }
           const j = i2 > escEnd + 1 ? i2 - 2 : escStart - 1;
           if (escapedFolds[j])
-            return text3;
+            return text4;
           folds.push(j);
           escapedFolds[j] = true;
           end = j + endStep;
@@ -28511,39 +28711,39 @@ function foldFlowLines(text3, indent, mode = "flow", { indentAtStart, lineWidth
   if (overflow && onOverflow)
     onOverflow();
   if (folds.length === 0)
-    return text3;
+    return text4;
   if (onFold)
     onFold();
-  let res = text3.slice(0, folds[0]);
+  let res = text4.slice(0, folds[0]);
   for (let i3 = 0; i3 < folds.length; ++i3) {
     const fold = folds[i3];
-    const end2 = folds[i3 + 1] || text3.length;
+    const end2 = folds[i3 + 1] || text4.length;
     if (fold === 0)
       res = `
-${indent}${text3.slice(0, end2)}`;
+${indent}${text4.slice(0, end2)}`;
     else {
       if (mode === FOLD_QUOTED && escapedFolds[fold])
-        res += `${text3[fold]}\\`;
+        res += `${text4[fold]}\\`;
       res += `
-${indent}${text3.slice(fold + 1, end2)}`;
+${indent}${text4.slice(fold + 1, end2)}`;
     }
   }
   return res;
 }
-function consumeMoreIndentedLines(text3, i2, indent) {
+function consumeMoreIndentedLines(text4, i2, indent) {
   let end = i2;
   let start = i2 + 1;
-  let ch = text3[start];
+  let ch = text4[start];
   while (ch === " " || ch === "	") {
     if (i2 < start + indent) {
-      ch = text3[++i2];
+      ch = text4[++i2];
     } else {
       do {
-        ch = text3[++i2];
+        ch = text4[++i2];
       } while (ch && ch !== "\n");
       end = i2;
       start = i2 + 1;
-      ch = text3[start];
+      ch = text4[start];
     }
   }
   return end;
@@ -34369,24 +34569,24 @@ function quoteYaml(value) {
   if (/^[\w./:+-]+$/.test(value)) return value;
   return JSON.stringify(value);
 }
-function upsertHermesProvider(text3, hostId, baseUrl, apiKey) {
+function upsertHermesProvider(text4, hostId, baseUrl, apiKey) {
   const block2 = [`  ${hostId}:`, `    base_url: ${quoteYaml(baseUrl)}`, `    api_key: ${quoteYaml(apiKey)}`, ""].join(
     "\n"
   );
-  if (/^providers:\s*$/m.test(text3)) {
-    const replaced = replaceHermesHostBlock(text3, hostId, block2);
+  if (/^providers:\s*$/m.test(text4)) {
+    const replaced = replaceHermesHostBlock(text4, hostId, block2);
     if (replaced !== null) return replaced;
-    return text3.replace(/^providers:\s*$/m, `providers:
+    return text4.replace(/^providers:\s*$/m, `providers:
 ${block2.trimEnd()}`);
   }
-  const prefix = text3 && !text3.endsWith("\n") ? `${text3}
-` : text3;
+  const prefix = text4 && !text4.endsWith("\n") ? `${text4}
+` : text4;
   return `${prefix}
 providers:
 ${block2}`;
 }
-function replaceHermesHostBlock(text3, hostId, block2) {
-  const lines = text3.split("\n");
+function replaceHermesHostBlock(text4, hostId, block2) {
+  const lines = text4.split("\n");
   const start = lines.findIndex((line) => line === `  ${hostId}:`);
   if (start < 0) return null;
   let end = start + 1;
@@ -34406,14 +34606,14 @@ function ensureHermesInjectProvider(modelId, env = process.env) {
   const dir = hermesHome(env);
   mkdirSync14(dir, { recursive: true });
   const path3 = join31(dir, "config.yaml");
-  let text3 = "";
+  let text4 = "";
   try {
-    text3 = readFileSync17(path3, "utf8");
+    text4 = readFileSync17(path3, "utf8");
   } catch {
-    text3 = "";
+    text4 = "";
   }
-  const next = upsertHermesProvider(text3, inject.host, host.baseUrl, hostApiKey(host, env));
-  if (next !== text3) writeFileSync12(path3, next);
+  const next = upsertHermesProvider(text4, inject.host, host.baseUrl, hostApiKey(host, env));
+  if (next !== text4) writeFileSync12(path3, next);
   return hermesAcpModelId(modelId) ?? modelId;
 }
 function hermesAcpModelId(modelId) {
@@ -34423,8 +34623,8 @@ function hermesAcpModelId(modelId) {
   if (native && !native.includes(INJECT_SEP) && /^[a-z0-9_-]+:[\w./:-]+$/i.test(native)) return native;
   return null;
 }
-function nonEmptyDotenvValue(text3, name) {
-  const match = new RegExp(`^[ \\t]*(?:export[ \\t]+)?${name}[ \\t]*=[ \\t]*([^\\r\\n]*)$`, "m").exec(text3);
+function nonEmptyDotenvValue(text4, name) {
+  const match = new RegExp(`^[ \\t]*(?:export[ \\t]+)?${name}[ \\t]*=[ \\t]*([^\\r\\n]*)$`, "m").exec(text4);
   if (!match) return null;
   const raw = match[1].trim();
   if (!raw || raw.startsWith("#")) return null;
@@ -34441,10 +34641,10 @@ function nonEmptyDotenvValue(text3, name) {
 function yamlString(value) {
   return typeof value === "string" ? value.trim() : "";
 }
-function hermesConfigDefault(text3) {
+function hermesConfigDefault(text4) {
   let raw;
   try {
-    raw = parse3(text3);
+    raw = parse3(text4);
   } catch {
     return null;
   }
@@ -34497,11 +34697,18 @@ function hermesConfiguredModel(env = process.env) {
     custom: true
   };
 }
+function hermesAcpModelsTimeoutMs(env) {
+  const raw = env[HERMES_ACP_MODELS_TIMEOUT_ENV];
+  if (raw === void 0) return HERMES_ACP_MODELS_DEFAULT_TIMEOUT_MS;
+  const parsed = Number(raw);
+  return Number.isInteger(parsed) && parsed > 0 && parsed <= 2147483647 ? parsed : HERMES_ACP_MODELS_DEFAULT_TIMEOUT_MS;
+}
 async function fetchHermesAcpModels(cli, env) {
   return await new Promise((resolve13) => {
     let child;
     try {
-      child = spawn6(cli, ["acp"], { stdio: ["pipe", "pipe", "ignore"], env });
+      const resolved = resolveCli(cli, ["acp"], env);
+      child = spawn6(resolved.command, resolved.args, { stdio: ["pipe", "pipe", "ignore"], env, windowsHide: true });
     } catch {
       return resolve13([]);
     }
@@ -34526,7 +34733,7 @@ async function fetchHermesAcpModels(cli, env) {
       }
       resolve13(out);
     };
-    timer = setTimeout(() => done([]), 5e3);
+    timer = setTimeout(() => done([]), hermesAcpModelsTimeoutMs(env));
     child.once("error", () => done([]));
     child.once("close", () => {
       if (hardKillTimer) clearTimeout(hardKillTimer);
@@ -34606,11 +34813,12 @@ async function applySetting2(request, method, params, what) {
     throw new Error(`Hermes rejected ${what} via ${method}: ${e.message}`);
   }
 }
-var EMPTY2, HERMES_OPENMAUS_SCREENSHOT_COMPAT, HERMES_OPENMAUS_SCREENSHOT_COMPAT_MODEL, HERMES_CONFIG_MODEL_ID, HERMES_HOSTED_PROVIDER_KEYS, HERMES_LOCAL_CONFIG_PROVIDERS, support10, HermesAgentDriver;
+var EMPTY2, HERMES_OPENMAUS_SCREENSHOT_COMPAT, HERMES_OPENMAUS_SCREENSHOT_COMPAT_MODEL, HERMES_CONFIG_MODEL_ID, HERMES_HOSTED_PROVIDER_KEYS, HERMES_LOCAL_CONFIG_PROVIDERS, HERMES_ACP_MODELS_TIMEOUT_ENV, HERMES_ACP_MODELS_DEFAULT_TIMEOUT_MS, support10, HermesAgentDriver;
 var init_hermes = __esm({
   "server/drivers/acp/hermes.ts"() {
     "use strict";
     init_browser();
+    init_procs();
     init_local_inject();
     init_core3();
     EMPTY2 = { default: "", options: [] };
@@ -34624,6 +34832,8 @@ var init_hermes = __esm({
       "Z_AI_API_KEY"
     ];
     HERMES_LOCAL_CONFIG_PROVIDERS = /* @__PURE__ */ new Set(["custom", "lmstudio", "ollama", "vllm", "llamacpp"]);
+    HERMES_ACP_MODELS_TIMEOUT_ENV = "HERMES_ACP_MODELS_TIMEOUT_MS";
+    HERMES_ACP_MODELS_DEFAULT_TIMEOUT_MS = 15e3;
     support10 = {
       driverKind: "hermesAgent",
       displayName: "Hermes",
@@ -34696,12 +34906,19 @@ function decodeConfig5(raw) {
     provider: typeof config2.provider === "string" ? config2.provider || void 0 : process.env.OPENAI_COMPAT_PROVIDER || void 0
   };
 }
-var DRIVER_KIND5, DEFAULT_MODELS, OpenAICompatDriver;
+var DRIVER_KIND5, DEFAULT_IDLE_TIMEOUT_MS, idleTimeoutMs, DEFAULT_MODELS, OpenAICompatDriver;
 var init_openai_compat = __esm({
   "server/drivers/openai-compat.ts"() {
     "use strict";
     init_openai_chat();
     DRIVER_KIND5 = "openai-compat";
+    DEFAULT_IDLE_TIMEOUT_MS = 18e4;
+    idleTimeoutMs = () => {
+      const raw = process.env.OPENMAUS_OPENAI_COMPAT_IDLE_TIMEOUT_MS;
+      if (!raw) return DEFAULT_IDLE_TIMEOUT_MS;
+      const value = Number(raw);
+      return Number.isSafeInteger(value) && value >= 1e3 && value <= 2147483647 ? value : DEFAULT_IDLE_TIMEOUT_MS;
+    };
     DEFAULT_MODELS = {
       default: "meta-llama/llama-3.3-70b-instruct",
       options: [
@@ -34782,15 +34999,15 @@ var init_openai_compat = __esm({
           httpErrorLabel: "upstream",
           missingKeyError: `no API key \u2014 set ${config2.apiKeyEnv} or add it to the instance config`,
           unavailableReason: `no API key \u2014 set ${config2.apiKeyEnv} or add it to the instance config`,
-          timeoutMs: 12e4,
+          timeoutMs: idleTimeoutMs(),
           reasoning: true,
           billing: "metered",
           includeUsageInCompleted: true,
           nativeLog: {
             source: "openai-compat.chat.completions",
             outgoing: (_turn, messages, model) => ({ model, messageCount: messages.length }),
-            incoming: ({ text: text3, reasoning, usage }) => ({
-              textLength: text3.length,
+            incoming: ({ text: text4, reasoning, usage }) => ({
+              textLength: text4.length,
               reasoningLength: reasoning.length,
               usage
             })
@@ -35026,6 +35243,16 @@ async function fetchPiModels(cli, env) {
     }
   });
 }
+async function updatePiModelCatalog(cli, env) {
+  return new Promise((resolve13) => {
+    execCli(
+      cli,
+      PI_MODEL_UPDATE_ARGS,
+      { env, timeout: 6e4, maxBuffer: 1024 * 1024 },
+      (error51) => resolve13(!error51)
+    );
+  });
+}
 function decodeConfig6(raw) {
   if (raw === null || raw === void 0) return { cli: "pi", fullAuto: false };
   if (typeof raw !== "object") throw new Error("pi config must be an object");
@@ -35043,7 +35270,7 @@ function piEnvironment(source) {
   for (const key of PROVIDER_CREDENTIAL_ENV) delete env[key];
   return env;
 }
-var DRIVER_KIND6, PI_ARGS, NODE_ENV_FLAG2, EMPTY3, PiDriver;
+var DRIVER_KIND6, PI_ARGS, PI_MODEL_UPDATE_ARGS, NODE_ENV_FLAG2, EMPTY3, PiDriver;
 var init_pi = __esm({
   "server/drivers/pi.ts"() {
     "use strict";
@@ -35057,6 +35284,7 @@ var init_pi = __esm({
     init_native();
     DRIVER_KIND6 = "piAgent";
     PI_ARGS = ["--mode", "rpc", "--no-session"];
+    PI_MODEL_UPDATE_ARGS = ["update", "--models", "--no-approve"];
     NODE_ENV_FLAG2 = { ELECTRON_RUN_AS_NODE: "1" };
     EMPTY3 = { default: "", options: [] };
     PiDriver = {
@@ -35078,7 +35306,7 @@ var init_pi = __esm({
         const { instanceId, config: config2 } = input;
         const catalogEnv = piEnvironment({ ...process.env, ...input.environment });
         let models = EMPTY3;
-        const refreshModels = async () => {
+        const readModels = async () => {
           let base3 = models;
           try {
             const resolved = await fetchPiModels(config2.cli, catalogEnv);
@@ -35092,7 +35320,11 @@ var init_pi = __esm({
             if (base3.options.length) models = base3;
           }
         };
-        await refreshModels();
+        const refreshModels = async () => {
+          await updatePiModelCatalog(config2.cli, catalogEnv);
+          await readModels();
+        };
+        await readModels();
         const listeners = /* @__PURE__ */ new Set();
         const active = /* @__PURE__ */ new Map();
         const emit = (event) => {
@@ -35181,10 +35413,10 @@ var init_pi = __esm({
             child.stdin.write(JSON.stringify(obj) + "\n");
           };
           const flushAssistantText = () => {
-            const text3 = assistantText;
+            const text4 = assistantText;
             assistantText = "";
-            if (!text3.trim()) return;
-            emit({ ...base2(threadId, turnId), type: "item.completed", itemType: "assistant_text", text: text3 });
+            if (!text4.trim()) return;
+            emit({ ...base2(threadId, turnId), type: "item.completed", itemType: "assistant_text", text: text4 });
           };
           const settle = (ok, stopReason, usage) => {
             if (settled) return;
@@ -35577,7 +35809,7 @@ var init_minimax = __esm({
           nativeLog: {
             source: "minimax.chat.completions",
             outgoing: (_turn, messages, model) => ({ model, messageCount: messages.length }),
-            incoming: ({ text: text3, usage }) => ({ textLength: text3.length, usage })
+            incoming: ({ text: text4, usage }) => ({ textLength: text4.length, usage })
           }
         });
       }
@@ -37244,10 +37476,10 @@ async function verifyHostedEndpoint(endpoint, { fetchImpl, timeoutSignal, timeou
     signal: cancellationSignal ? AbortSignal.any([requestSignal, cancellationSignal]) : requestSignal
   });
   if (!response.ok) return false;
-  const text3 = await response.text();
-  if (Buffer.byteLength(text3) > 4096) return false;
+  const text4 = await response.text();
+  if (Buffer.byteLength(text4) > 4096) return false;
   try {
-    return JSON.parse(text3)?.app === "openmausbot";
+    return JSON.parse(text4)?.app === "openmausbot";
   } catch {
     return false;
   }
@@ -38168,9 +38400,9 @@ async function startCaddy(options) {
   });
   let output = "";
   const receive = (chunk) => {
-    const text3 = chunk.toString("utf8");
-    if (output.length < 16384) output += text3;
-    for (const line of text3.split(/\r?\n/)) {
+    const text4 = chunk.toString("utf8");
+    if (output.length < 16384) output += text4;
+    for (const line of text4.split(/\r?\n/)) {
       if (!line.trim()) continue;
       if (/"level":"(warn|error)"/.test(line) || /^\S+\s+(WARN|ERROR)/.test(line) || !line.startsWith("{")) options.log?.(`caddy: ${line.slice(0, 400)}`);
     }
@@ -38437,8 +38669,8 @@ function agentUnit(spec) {
 function emptyRegistry(domain2) {
   return { version: 1, domain: domain2, nextPort: FLEET_FIRST_PORT, workspaces: {} };
 }
-function parseRegistry(text3) {
-  const value = JSON.parse(text3);
+function parseRegistry(text4) {
+  const value = JSON.parse(text4);
   const record3 = value && typeof value === "object" ? value : null;
   if (!record3 || record3.version !== 1 || typeof record3.domain !== "string" || typeof record3.nextPort !== "number" || !record3.workspaces || typeof record3.workspaces !== "object") {
     throw new Error("fleet.json is not a fleet registry this version understands");
@@ -38862,9 +39094,9 @@ function failed(io, what, output) {
   return 1;
 }
 function loadRegistry(layout, deps) {
-  const text3 = deps.readText(layout.registryFile);
-  if (text3 === null) throw new Error(`no fleet on this server yet: run \`openmausbot fleet init --domain your.domain\` first`);
-  return parseRegistry(text3);
+  const text4 = deps.readText(layout.registryFile);
+  if (text4 === null) throw new Error(`no fleet on this server yet: run \`openmausbot fleet init --domain your.domain\` first`);
+  return parseRegistry(text4);
 }
 function planFleetAction(input, deps) {
   const layout = fleetLayout(input.root ?? "/");
@@ -39011,13 +39243,13 @@ function readUsage(dataDir, range) {
   const from = range.from.getTime();
   const to = range.to.getTime();
   for (const key of monthsBetween(range.from, range.to)) {
-    let text3;
+    let text4;
     try {
-      text3 = readFileSync2(join4(dataDir, DIR, `${key}.jsonl`), "utf8");
+      text4 = readFileSync2(join4(dataDir, DIR, `${key}.jsonl`), "utf8");
     } catch {
       continue;
     }
-    for (const line of text3.split("\n")) {
+    for (const line of text4.split("\n")) {
       if (!line) continue;
       try {
         const value = JSON.parse(line);
@@ -39111,15 +39343,15 @@ function summarizeUsage(rows, groupBy, prices = null) {
 var MAX_BODY = 256 * 1024;
 function readBody(req) {
   return new Promise((resolve13, reject) => {
-    let text3 = "";
+    let text4 = "";
     req.on("data", (chunk) => {
-      text3 += chunk.toString("utf8");
-      if (text3.length > MAX_BODY) reject(Object.assign(new Error("request too large"), { status: 413 }));
+      text4 += chunk.toString("utf8");
+      if (text4.length > MAX_BODY) reject(Object.assign(new Error("request too large"), { status: 413 }));
     });
     req.on("end", () => {
-      if (!text3.trim()) return resolve13({});
+      if (!text4.trim()) return resolve13({});
       try {
-        const value = JSON.parse(text3);
+        const value = JSON.parse(text4);
         resolve13(value && typeof value === "object" && !Array.isArray(value) ? value : {});
       } catch {
         reject(Object.assign(new Error("body must be JSON"), { status: 400 }));
@@ -39290,8 +39522,8 @@ var tailscaleEnvironment = () => ({
 });
 
 // server/tailscale.ts
-function classifyTailscaleStderr(text3) {
-  const t2 = text3.toLowerCase();
+function classifyTailscaleStderr(text4) {
+  const t2 = text4.toLowerCase();
   if (/not logged in|logged out|needs login|please log in/.test(t2)) return "not-logged-in";
   if (/is tailscale running|tailscaled is not running|connection refused|failed to connect to local tailscaled/.test(t2)) return "not-running";
   if (/access denied|permission denied|operator|must be root|not permitted/.test(t2)) return "needs-operator";
@@ -40022,9 +40254,9 @@ function pairingBlock(input) {
   }
   return lines.join("\n");
 }
-function qrToString(text3) {
+function qrToString(text4) {
   let out = "";
-  import_qrcode_terminal.default.generate(text3, { small: true }, (rendered) => {
+  import_qrcode_terminal.default.generate(text4, { small: true }, (rendered) => {
     out = rendered;
   });
   return out;