openmausbot 0.1.77 → 0.1.79

package/dist-server/server/drivers/chat-mcp-tools.js

@@ -0,0 +1,368 @@
+// Per-turn MCP transport for the shared Chat Completions runtime. Approval is
+// owned by the caller; only registered, schema-validated calls reach this file.
+import { Ajv } from "ajv";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import formats from "ajv-formats";
+import { killCliTree, spawnCli } from "../procs.js";
+/** The transport cannot safely continue this turn. A dispatched operation may
+ * already have taken effect, so callers must not retry it through a new round. */
+export class ChatToolSessionError extends Error {
+}
+const STARTUP_MS = 8_000;
+const CALL_MS = 10 * 60_000;
+const FRAME_BYTES = 2 * 1024 * 1024;
+const OUTPUT_BYTES = 50 * 1024;
+const TOOL_COUNT = 128;
+const MAX_PAGES = 100;
+const SCHEMA_BYTES = 64 * 1024;
+const CATALOG_BYTES = 1024 * 1024;
+const MAX_FRAMES = 10_000;
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function aborted() { return new Error("MCP operation cancelled"); }
+class ChatMcpClient {
+    child;
+    buffer = "";
+    nextId = 1;
+    frames = 0;
+    closed = false;
+    closing;
+    pending = new Map();
+    constructor(server) {
+        try {
+            this.child = spawnCli(server.command, server.args, {
+                stdio: ["pipe", "pipe", "pipe"], env: { ...process.env, ...server.env },
+            });
+        }
+        catch {
+            throw new Error("MCP server could not start; check its command and installation");
+        }
+        this.child.stdout.setEncoding("utf8");
+        this.child.stdout.on("data", (chunk) => this.onData(chunk));
+        // Stderr may contain credentials; drain without recording or returning it.
+        this.child.stderr.on("data", () => { });
+        this.child.on("error", () => this.fail(new Error("MCP server could not start; check its command and installation")));
+        this.child.on("exit", () => this.fail(new Error("MCP server exited before the session closed")));
+        this.child.stdin.on("error", () => this.fail(new Error("MCP server input closed")));
+    }
+    fail(error) {
+        if (this.closed)
+            return;
+        this.closed = true;
+        for (const entry of this.pending.values())
+            entry.reject(error);
+        this.pending.clear();
+        // Capture rejection here; mount/execute finally await close and surface it.
+        void this.close().catch(() => { });
+    }
+    close() {
+        if (this.closing)
+            return this.closing;
+        this.closed = true;
+        for (const entry of this.pending.values())
+            entry.reject(new Error("MCP session closed"));
+        this.pending.clear();
+        this.buffer = "";
+        this.closing = killCliTree(this.child, 500).then((stopped) => {
+            if (!stopped)
+                throw new Error("MCP server shutdown could not be confirmed; execution outcome may be uncertain");
+        });
+        return this.closing;
+    }
+    write(frame) {
+        if (this.closed || !this.child.stdin.writable || this.child.stdin.destroyed)
+            throw new Error("MCP session closed");
+        const encoded = JSON.stringify(frame) + "\n";
+        if (Buffer.byteLength(encoded) > FRAME_BYTES)
+            throw new Error("MCP request exceeds the frame limit");
+        this.child.stdin.write(encoded);
+    }
+    onData(chunk) {
+        if (this.closed)
+            return;
+        this.buffer += chunk;
+        let newline;
+        while ((newline = this.buffer.indexOf("\n")) !== -1) {
+            const line = this.buffer.slice(0, newline);
+            this.buffer = this.buffer.slice(newline + 1);
+            if (++this.frames > MAX_FRAMES)
+                return this.fail(new Error("MCP session exceeded the response frame count limit"));
+            if (Buffer.byteLength(line) > FRAME_BYTES)
+                return this.fail(new Error("MCP response exceeds the frame limit"));
+            if (!line.trim())
+                continue;
+            let message;
+            try {
+                message = JSON.parse(line);
+            }
+            catch {
+                return this.fail(new Error("MCP server returned invalid JSON"));
+            }
+            if (!object(message) || message.jsonrpc !== "2.0")
+                return this.fail(new Error("MCP server returned an invalid RPC envelope"));
+            if (typeof message.method === "string") {
+                if (typeof message.id === "number" || typeof message.id === "string") {
+                    try {
+                        this.write({ jsonrpc: "2.0", id: message.id, error: { code: -32601, message: "Client method not supported" } });
+                    }
+                    catch {
+                        return this.fail(new Error("MCP server input closed"));
+                    }
+                }
+                continue;
+            }
+            if (typeof message.id !== "number")
+                return this.fail(new Error("MCP server returned an invalid response ID"));
+            const entry = this.pending.get(message.id);
+            if (!entry)
+                continue;
+            this.pending.delete(message.id);
+            if ("error" in message)
+                entry.reject(new Error("MCP request failed; inspect the configured integration"));
+            else if (!("result" in message))
+                entry.reject(new Error("MCP response has no result"));
+            else
+                entry.resolve(message.result);
+        }
+        if (Buffer.byteLength(this.buffer) > FRAME_BYTES)
+            this.fail(new Error("MCP response exceeds the frame limit"));
+    }
+    async call(method, params, signal, timeout) {
+        if (signal.aborted) {
+            await this.close();
+            throw aborted();
+        }
+        if (this.closed)
+            throw new Error("MCP session closed");
+        const id = this.nextId++;
+        try {
+            return await new Promise((resolve, reject) => {
+                const finish = (error, value) => {
+                    clearTimeout(timer);
+                    signal.removeEventListener("abort", cancel);
+                    this.pending.delete(id);
+                    if (error)
+                        reject(error);
+                    else
+                        resolve(value);
+                };
+                const cancel = () => {
+                    try {
+                        this.write({ jsonrpc: "2.0", method: "notifications/cancelled", params: { requestId: id, reason: "Cancelled" } });
+                    }
+                    catch { /* cleanup owns transport failure */ }
+                    finish(aborted());
+                };
+                const timer = setTimeout(() => finish(new Error("MCP request timed out; execution outcome may be uncertain")), timeout);
+                timer.unref();
+                signal.addEventListener("abort", cancel, { once: true });
+                this.pending.set(id, { resolve: (value) => finish(undefined, value), reject: (error) => finish(error) });
+                try {
+                    this.write({ jsonrpc: "2.0", id, method, params });
+                }
+                catch {
+                    finish(new Error("MCP request could not be sent"));
+                }
+            });
+        }
+        catch (error) {
+            await this.close();
+            throw error;
+        }
+    }
+    async tools(signal) {
+        const deadline = Date.now() + STARTUP_MS;
+        const remaining = () => {
+            if (Date.now() >= deadline)
+                throw new Error("MCP startup timed out");
+            return deadline - Date.now();
+        };
+        const initialized = await this.call("initialize", {
+            protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "openmausbot-chat", version: "1" },
+        }, signal, remaining());
+        if (!object(initialized))
+            throw new Error("MCP initialization returned an invalid result");
+        if (signal.aborted)
+            throw aborted();
+        this.write({ jsonrpc: "2.0", method: "notifications/initialized" });
+        const tools = [];
+        const cursors = new Set();
+        let cursor;
+        for (let page = 0; page < MAX_PAGES; page += 1) {
+            const result = await this.call("tools/list", cursor ? { cursor } : {}, signal, remaining());
+            if (!object(result) || !Array.isArray(result.tools))
+                throw new Error("MCP tools/list returned an invalid result");
+            tools.push(...result.tools);
+            if (tools.length > TOOL_COUNT)
+                throw new Error("MCP tool count exceeds the 128-tool limit");
+            if (result.nextCursor === undefined)
+                return tools;
+            if (typeof result.nextCursor !== "string" || !result.nextCursor || cursors.has(result.nextCursor))
+                throw new Error("MCP tools/list returned an invalid pagination cursor");
+            cursors.add(result.nextCursor);
+            cursor = result.nextCursor;
+        }
+        throw new Error("MCP tools/list exceeded the pagination limit");
+    }
+}
+// A schema is a contract, so conversion that drops constraints is not safe.
+// Ajv validates the same schema sent to the provider without coercing values,
+// applying defaults, removing fields, or fetching external references.
+const validatorOptions = {
+    strict: true, allErrors: false, coerceTypes: false, useDefaults: false,
+    removeAdditional: false, validateFormats: true, ownProperties: true, logger: false,
+    // These are style diagnostics, not unsupported validation keywords. Valid
+    // schemas may require undeclared names, use untyped composition branches,
+    // or describe an open tuple. Ajv still enforces every constraint.
+    strictRequired: false, strictTypes: false, strictTuples: false,
+};
+function compileSchema(schema) {
+    const dialect = schema.$schema;
+    if (dialect !== undefined && dialect !== "http://json-schema.org/draft-07/schema#" && dialect !== "https://json-schema.org/draft/2020-12/schema") {
+        throw new Error("MCP tool schema uses an unsupported dialect; use JSON Schema draft-07 or 2020-12");
+    }
+    // One compiler per schema also prevents external IDs from resolving against
+    // unrelated tools or retaining schemas after the turn has closed.
+    const compiler = dialect === "https://json-schema.org/draft/2020-12/schema"
+        ? new Ajv2020(validatorOptions) : new Ajv(validatorOptions);
+    // ajv-formats is CommonJS and exports the plugin as both module.exports
+    // and .default; the latter also matches its NodeNext declaration.
+    formats.default(compiler);
+    try {
+        return compiler.compile(schema);
+    }
+    catch {
+        throw new Error("MCP tool schema could not be validated; check its constraints, formats, and references");
+    }
+}
+function boundedText(value) {
+    const bytes = Buffer.from(value);
+    if (bytes.length <= OUTPUT_BYTES)
+        return value;
+    let end = OUTPUT_BYTES;
+    while ((bytes[end] & 0xc0) === 0x80)
+        end -= 1;
+    return `${bytes.subarray(0, end).toString()}\n[MCP result truncated at 50KB; request less output.]`;
+}
+export async function mountChatTools(integrations, signal) {
+    const servers = [];
+    if (integrations?.agents)
+        servers.push(["agents", integrations.agents]);
+    if (integrations?.composio)
+        servers.push(["composio", integrations.composio]);
+    servers.push(...Object.entries(integrations?.custom ?? {}));
+    if (servers.length > 32)
+        throw new Error("MCP server count exceeds the 32-server limit");
+    const clients = [];
+    let closed = false;
+    let closing;
+    const close = () => {
+        if (closing)
+            return closing;
+        closed = true;
+        signal.removeEventListener("abort", cancel);
+        closing = Promise.allSettled(clients.map((client) => client.close())).then((results) => {
+            if (results.some((result) => result.status === "rejected"))
+                throw new ChatToolSessionError("MCP server shutdown could not be confirmed; execution outcome may be uncertain");
+        });
+        return closing;
+    };
+    const cancel = () => { void close().catch(() => { }); };
+    signal.addEventListener("abort", cancel, { once: true });
+    const definitions = [];
+    const registered = new Map();
+    try {
+        if (signal.aborted)
+            throw aborted();
+        // Start independent servers concurrently; consume results in config order
+        // so names and collision suffixes remain stable across startup timings.
+        const mounts = await Promise.allSettled(servers.map(async ([name, descriptor]) => {
+            if (signal.aborted || closed)
+                throw aborted();
+            const client = new ChatMcpClient(descriptor);
+            clients.push(client);
+            return { name, client, tools: await client.tools(signal) };
+        }));
+        for (const mount of mounts) {
+            if (mount.status === "rejected")
+                throw mount.reason;
+            const { name: server, client, tools } = mount.value;
+            const originalNames = new Set();
+            for (const tool of tools) {
+                if (!object(tool) || typeof tool.name !== "string" || !tool.name.trim() || originalNames.has(tool.name))
+                    throw new Error("MCP server advertised an invalid or duplicate tool name");
+                originalNames.add(tool.name);
+                if (definitions.length >= TOOL_COUNT)
+                    throw new Error("MCP tool count exceeds the 128-tool limit");
+                if (!object(tool.inputSchema) || tool.inputSchema.type !== "object")
+                    throw new Error("MCP tools require an object input schema");
+                if (Buffer.byteLength(JSON.stringify(tool.inputSchema)) > SCHEMA_BYTES)
+                    throw new Error("MCP tool schema exceeds the 64KB limit");
+                const schema = compileSchema(tool.inputSchema);
+                const base = `${server}_${tool.name}`.toLowerCase().replace(/[^a-z0-9_]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 64) || "mcp_tool";
+                let name = base;
+                for (let index = 2; registered.has(name); index += 1) {
+                    const suffix = `_${index}`;
+                    name = base.slice(0, 64 - suffix.length) + suffix;
+                }
+                registered.set(name, { client, name: tool.name, schema });
+                definitions.push({ type: "function", function: { name, description: typeof tool.description === "string" ? tool.description : "Configured MCP tool", parameters: tool.inputSchema } });
+                if (Buffer.byteLength(JSON.stringify(definitions)) > CATALOG_BYTES)
+                    throw new Error("MCP tool catalog exceeds the 1MB limit");
+            }
+        }
+        if (signal.aborted || closed)
+            throw aborted();
+    }
+    catch (error) {
+        await close();
+        throw error;
+    }
+    const validate = (name, args) => {
+        if (closed || signal.aborted)
+            throw new ChatToolSessionError("MCP session closed");
+        const tool = registered.get(name);
+        if (!tool)
+            throw new Error("The requested tool was not advertised for this turn");
+        if (!object(args) || !tool.schema(args))
+            throw new Error("Tool arguments do not match the advertised input schema; use its required fields and types");
+    };
+    return {
+        definitions, validate, close,
+        async execute(name, args, callSignal) {
+            validate(name, args);
+            if (callSignal.aborted) {
+                await close();
+                throw aborted();
+            }
+            const tool = registered.get(name);
+            try {
+                const result = await tool.client.call("tools/call", { name: tool.name, arguments: args }, AbortSignal.any([signal, callSignal]), CALL_MS);
+                if (signal.aborted || callSignal.aborted)
+                    throw aborted();
+                if (!object(result) || !Array.isArray(result.content) || (result.isError !== undefined && typeof result.isError !== "boolean"))
+                    throw new Error("MCP tool returned an invalid result; execution outcome may be uncertain");
+                const parts = [];
+                let unsupported = 0;
+                for (const item of result.content) {
+                    if (!object(item) || typeof item.type !== "string" || (item.type === "text" && typeof item.text !== "string"))
+                        throw new Error("MCP tool returned invalid content; execution outcome may be uncertain");
+                    if (item.type === "text")
+                        parts.push(item.text);
+                    else
+                        unsupported += 1;
+                }
+                if (result.structuredContent !== undefined)
+                    parts.push(JSON.stringify(result.structuredContent));
+                if (unsupported)
+                    parts.unshift(`[${unsupported} unsupported MCP content item(s) omitted. The operation may have taken effect, but its full result cannot be represented; inspect its state before retrying.]`);
+                return { text: boundedText(parts.join("\n") || "(empty result)"), ok: result.isError !== true && unsupported === 0 };
+            }
+            catch (error) {
+                await close();
+                throw new ChatToolSessionError(error instanceof Error ? error.message : "MCP transport failed; execution outcome may be uncertain");
+            }
+        },
+    };
+}

package/dist-server/server/drivers/chat-tool-approval.js

@@ -0,0 +1,42 @@
+// Per-turn permission gate, adapted from the approval lifecycle in #780.
+// Register before publishing: a harness listener may answer synchronously.
+import { newId } from "../contracts.js";
+export function createChatToolApproval(options) {
+    const pending = new Map();
+    let closed = false;
+    return {
+        ask(tool, summary) {
+            if (closed || options.signal.aborted)
+                return Promise.resolve(false);
+            const ask = { id: newId(), tool, summary };
+            return new Promise((resolve) => {
+                const finish = (allowed, source) => {
+                    if (!pending.delete(ask.id))
+                        return;
+                    clearTimeout(timer);
+                    options.signal.removeEventListener("abort", abort);
+                    options.resolved(ask, allowed, source);
+                    resolve(allowed);
+                };
+                const abort = () => finish(false, "system");
+                const timer = setTimeout(() => finish(false, "timeout"), options.timeoutMs ?? 15 * 60_000);
+                timer.unref?.();
+                pending.set(ask.id, finish);
+                options.signal.addEventListener("abort", abort, { once: true });
+                options.open(ask);
+            });
+        },
+        answer(id, behavior) {
+            const finish = pending.get(id);
+            if (!finish || options.signal.aborted || behavior === "answer")
+                return "unavailable";
+            finish(behavior === "allow", "user");
+            return behavior === "allow" ? "allowed-once" : "rejected";
+        },
+        close() {
+            closed = true;
+            for (const finish of pending.values())
+                finish(false, "system");
+        },
+    };
+}

package/dist-server/server/drivers/claude.js

@@ -18,7 +18,6 @@ import { augmentedPath } from "../env-path.js";
 import { brokerSocketPath, describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
 import { ClaudeLoginController } from "./claude-login-auth.js";
-import { computerProxyEnv } from "../container-computer.js";
 import { gateServer, resultBudget } from "../mcp-gate-config.js";
 import { newEventId, newId } from "../contracts.js";
 import { askInputSummary, commandSummary, toolDetailPreview } from "../tool-summary.js";
@@ -26,7 +25,7 @@ import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS }
 import { applyClaudeInject, decodeInjectId, mergeLocalInject, probeLocalInjects, resolveInjectId, } from "./local-inject.js";
 import { appendNative } from "./native.js";
 import { SPAWNED_PROXIES } from "../proxy-paths.js";
-import { ASK_USER_QUESTION_TOOL, askQuestionSummary, parseAskQuestions, questionChoices, } from "../../shared/ask-question.js";
+import { ASK_USER_QUESTION_TOOL, askQuestionSummary, parseAskQuestions, parseChoices, questionChoices, } from "../../shared/ask-question.js";
 /** Whether `claude` has been signed in.
  *
  * Credential storage is deliberately not inspected here. Claude Code uses the
@@ -293,6 +292,30 @@ export function claudeCliUpdate(version, cli) {
         command: cli === "claude" ? "claude update" : `${cli} update`,
     };
 }
+/** Whether `claude --help` output lists `flag` as a supported option.
+ *
+ * A wrapper may print its own banner before the real options list, and the
+ * flag may appear only in an example or description rather than as an
+ * option. We scan for a line that begins with the flag (after optional
+ * leading whitespace), which is how the real CLI formats its `--help`.
+ */
+export function claudeCliHelpSupportsFlag(help, flag) {
+    if (!help)
+        return false;
+    const escaped = flag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`^\\s*${escaped}\\b`, "m").test(help);
+}
+/** Whether the installed CLI supports `--autocompact`.
+ *
+ * When `snapshot()` has already probed `claude --help`, use that. If the
+ * probe has not run or `--help` failed, fall back to the version floor so
+ * the pre-snapshot behavior is preserved.
+ */
+export function claudeAutoCompactSupported(version, help) {
+    if (help !== null)
+        return claudeCliHelpSupportsFlag(help, "--autocompact");
+    return claudeCliSupports(version, "--autocompact");
+}
 const DRIVER_KIND = "claudeAgent";
 // model catalog ported from upstream packages/contracts/src/model.ts
 export const STATIC_CLAUDE_MODELS = {
@@ -338,12 +361,15 @@ function extrasFromUnknown(value) {
  *  ANTHROPIC_API_KEY ("Not logged in · Please run /login"). Live injects
  *  come from mergeLocalInject. */
 export function readClaudeModelCatalog(env = process.env) {
+    // A missing or unreadable settings.json is not fatal: an instance whose
+    // environment sets ANTHROPIC_MODEL (a Claude Code install pointed at an
+    // Anthropic-compatible host) still lists that model as Custom.
     let settings = {};
     try {
         settings = JSON.parse(readFileSync(join(resolveClaudeConfigDir(undefined, env), "settings.json"), "utf8"));
     }
     catch {
-        return STATIC_CLAUDE_MODELS;
+        settings = {};
     }
     const extras = [
         ...extrasFromUnknown(settings.availableModels),
@@ -367,7 +393,6 @@ export function readClaudeModelCatalog(env = process.env) {
 // Resolved from the server root, never relative to this file: bundling inlines
 // this module into an entry one directory up, so a `".."` here would climb too
 // far. See server/proxy-paths.ts.
-const PROXY_PATH = SPAWNED_PROXIES.computer;
 const PERM_PROXY_PATH = SPAWNED_PROXIES.permission;
 const DWEB_PROXY_PATH = SPAWNED_PROXIES.dweb;
 // in the packaged app process.execPath is the Electron binary — this env
@@ -782,15 +807,16 @@ export const ClaudeDriver = {
             }
         };
         await refreshModels();
-        // The installed CLI's version as snapshot() last read it, so a flag the
-        // CLI does not know is never passed to it (CLAUDE_FLAG_FLOORS). The
-        // harness snapshots every instance whenever it describes them — app
-        // load, the Engines page, and right after `claude update`, which is
-        // exactly when the answer changes — so a turn normally finds it filled.
-        // A turn before any snapshot assumes a current CLI rather than paying a
-        // CLI start-up of its own: the flags are the default, the exception is
-        // the older install, and the next snapshot corrects it.
+        // The installed CLI's version and `--help` output as snapshot() last read
+        // them, so a flag the CLI does not know is never passed to it. The harness
+        // snapshots every instance whenever it describes them — app load, the
+        // Engines page, and right after `claude update` — which is exactly when
+        // the answer changes, so a turn normally finds it filled. A turn before
+        // any snapshot falls back to the version floor for the flags that are not
+        // known yet.
         let cliVersion = null;
+        let cliHelp = null;
+        let cliHelpVersion = null;
         const listeners = new Set();
         // one active turn per thread; a second send while busy is a caller bug
         const active = new Map();
@@ -876,7 +902,11 @@ export const ClaudeDriver = {
         const retryState = new Map();
         const sendTurn = async (turn, logicalTurnId) => {
             const { threadId, botId } = turn;
-            if (active.has(threadId))
+            // An internal relaunch (transient failure, rejected resume) keeps the
+            // logical turn's stop handle in `active` while it sets up, so Stop is
+            // never a silent no-op between two CLI processes of the same turn.
+            const relaunch = logicalTurnId !== undefined;
+            if (active.has(threadId) && !relaunch)
                 throw new Error("a turn is already running on this thread");
             // A bot-level mode is authoritative for this turn. In particular, an
             // old provider instance may still be configured with
@@ -901,7 +931,10 @@ export const ClaudeDriver = {
             const turnId = logicalTurnId ?? newId();
             const retryAbort = new AbortController();
             const retry = retryState.get(threadId) ?? { attempt: 0, cancelled: false };
-            retry.cancelled = false;
+            // A fresh user turn starts un-cancelled. A relaunch must keep a Stop
+            // that landed while it was being scheduled.
+            if (!relaunch)
+                retry.cancelled = false;
             retryState.set(threadId, retry);
             // a retry relaunches the whole CLI; the backoff is scaled down in tests
             // so a fake's transient failures don't stall real seconds
@@ -941,7 +974,7 @@ export const ClaudeDriver = {
                     args.push("--setting-sources", "project");
             }
             const compactWindow = autoCompactWindow(turnEnvironment);
-            if (compactWindow && claudeCliSupports(cliVersion, "--autocompact")) {
+            if (compactWindow && claudeAutoCompactSupported(cliVersion, cliHelp)) {
                 args.push("--autocompact", compactWindow);
             }
             const turnModel = await resolveClaudeTurnModel(turn.model, turnEnvironment);
@@ -964,15 +997,7 @@ export const ClaudeDriver = {
                 mcpServers.composio = { ...turn.integrations.composio };
                 allowed.push("mcp__composio");
             }
-            if (turn.integrations?.computer) {
-                mcpServers.computer = {
-                    command: process.execPath,
-                    args: [PROXY_PATH],
-                    env: { ...NODE_ENV_FLAG, ...computerProxyEnv(turn.integrations.computer) },
-                };
-                allowed.push("mcp__computer");
-            }
-            else if (turn.integrations?.localComputer) {
+            if (turn.integrations?.localComputer) {
                 const local = turn.integrations.localComputer;
                 mcpServers.computer = {
                     command: local.command,
@@ -1216,9 +1241,7 @@ export const ClaudeDriver = {
                                 questions: questions ?? undefined,
                                 // A structured ask still offers flat labels, for the phone
                                 // companions and any client that predates the question card.
-                                choices: questions
-                                    ? questionChoices(questions)
-                                    : Array.isArray(ask.input?.choices) ? ask.input.choices.slice(0, 5) : undefined,
+                                choices: questions ? questionChoices(questions) : parseChoices(ask.input?.choices),
                             });
                         },
                         onResolve: (resolved) => {
@@ -1259,6 +1282,16 @@ export const ClaudeDriver = {
                 cleanupUnownedLaunch();
                 throw error;
             }
+            // Stop reached the relaunch handle while this attempt was still setting
+            // up (model probe, broker). Settle the logical turn as interrupted
+            // instead of spawning a process nobody wants.
+            if (relaunch && retry.cancelled) {
+                cleanupUnownedLaunch();
+                if (active.get(threadId)?.turnId === turnId)
+                    active.delete(threadId);
+                emit({ ...base(threadId, turnId), type: "turn.completed", ok: false, stopReason: "interrupted", cost: null });
+                return { turnId };
+            }
             let child;
             try {
                 child = spawnCli(config.cli, args, {
@@ -1544,14 +1577,18 @@ export const ClaudeDriver = {
                                 });
                                 return;
                             }
-                            // hand the thread back before recursing — the relaunch's own
-                            // guard would otherwise reject it as "already running"
-                            active.delete(threadId);
+                            // Keep Stop reachable while the relaunch sets up: there is no
+                            // process yet, so this handle only records the cancellation and
+                            // the relaunched sendTurn honors it before spawning.
+                            retryState.set(threadId, retry);
+                            active.set(threadId, { stop: () => { retry.cancelled = true; retryAbort.abort(); }, turnId });
                             try {
                                 const cursor = session.sessionId ?? sessionId ?? undefined;
                                 await sendTurn({ ...turn, resumeCursor: cursor }, turnId);
                             }
                             catch (e) {
+                                if (active.get(threadId)?.turnId === turnId)
+                                    active.delete(threadId);
                                 retryState.delete(threadId);
                                 emit({
                                     ...base(threadId, turnId),
@@ -1605,7 +1642,9 @@ export const ClaudeDriver = {
                         }
                         sessions.delete(threadId);
                         session.turn = null;
-                        active.delete(threadId);
+                        // Same relaunch handle as the transient-retry path above.
+                        retryState.set(threadId, retry);
+                        active.set(threadId, { stop: () => { retry.cancelled = true; retryAbort.abort(); }, turnId });
                         emit({
                             ...base(threadId, turnId),
                             type: "turn.retrying",
@@ -1619,6 +1658,8 @@ export const ClaudeDriver = {
                                 await sendTurn({ ...turn, resumeCursor: undefined, recoveryText: undefined, text: recovery.text }, turnId);
                             }
                             catch (e) {
+                                if (active.get(threadId)?.turnId === turnId)
+                                    active.delete(threadId);
                                 retryState.delete(threadId);
                                 emit({
                                     ...base(threadId, turnId),
@@ -1693,12 +1734,26 @@ export const ClaudeDriver = {
             if (!version)
                 return { state: "unavailable", reason: `\`${config.cli}\` CLI not found` };
             cliVersion = parseClaudeCliVersion(version);
+            if (version !== cliHelpVersion) {
+                cliHelp = await new Promise((resolve) => {
+                    execCli(config.cli, ["--help"], { timeout: 8000, env }, (err, stdout) => resolve(err ? null : stdout));
+                });
+                cliHelpVersion = version;
+            }
+            const features = cliHelp !== null ? { autocompact: claudeCliHelpSupportsFlag(cliHelp, "--autocompact") } : undefined;
             const auth = await claudeAuthStatus(config.cli, env);
             // claudeEnvironment strips ANTHROPIC_API_KEY, so turns run on the
             // CLI's own login (Pro/Max): the cost it reports is what the call
             // WOULD bill, not a charge
             const update = claudeCliUpdate(version, config.cli);
-            return { state: "available", version, ...auth, ...(update ? { update } : {}), billing: "subscription" };
+            return {
+                state: "available",
+                version,
+                ...auth,
+                ...(update ? { update } : {}),
+                ...(features ? { features } : {}),
+                billing: "subscription",
+            };
         };
         /** One-shot Claude call with the prompt on stdin, never argv. Approval
          * summaries can contain paths, commands, or secrets, so the generic