openmausbot 0.1.79 → 0.1.81

package/dist-server/server/drivers/agents-proxy.js

@@ -458,6 +458,14 @@ const TOOLS = [
             required: ["task_id"],
         },
     },
+    {
+        name: "select_computer",
+        description: "Choose where this conversation does computer work. Call with no arguments to inspect actual available choices and the current place. For a task needing computer interaction, select the requested place, or auto to choose a suitable configured computer without asking the user to use menus. OpenMausBot reuses an existing computer first; with a configured provider it can start or provision one when needed. Do not provision for ordinary chat or just to inspect availability. A pending result means end this turn immediately: OpenMausBot updates the conversation selector and resumes the original request with that computer's real tools. Do not use the old tools after requesting a switch, repeat the task, or claim the action is done. This cannot change permissions, override Off, or switch a teammate/routine/channel.",
+        inputSchema: { type: "object", additionalProperties: false, properties: {
+                surface: { type: "string", enum: ["auto", "cloud", "vm", "local", "browser"],
+                    description: "auto = suitable configured computer, cloud = remote Box/VPS, vm = isolated Local VM, local = user's own desktop, browser = built-in browser. Omit to list." },
+            } },
+    },
     {
         name: "list_threads",
         description: "See your own threads and the threads you opened on teammates, newest first: each with its bot, title, state (running, waiting on the person, queued, idle, or closed), whether the person has unread there, and the delegation id if it was a handoff. Use it to check how the threads you started are going before reporting to the person; write a thread's title as #Title when you mention it. A teammate's other threads are never listed — only the ones you opened. This is a read: it starts nothing and changes nothing.",
@@ -548,7 +556,7 @@ const TOOLS = [
     },
     {
         name: "propose_bot_deletion",
-        description: "Chief of Staff only: when the user explicitly asks to delete a named teammate, submit a separate deletion request for that exact bot. Deletion removes its conversations, memory, instructions and skills; generated project files remain. Running work and owned computers can block deletion. Never delete yourself, substitute an archive, or put deletion into a setup batch. If review is pending, the decision and result resume you once." + PROPOSAL_OUTCOME,
+        description: "Chief of Staff only: when the user explicitly asks to delete a named teammate, submit a separate deletion request for that exact bot. Deletion removes its conversations, memory, instructions, skills, and any computer owned only by it; generated project files and shared team computers remain. Running work or an unavailable computer provider can block deletion safely. Never delete yourself, substitute an archive, or put deletion into a setup batch. If review is pending, the decision and result resume you once." + PROPOSAL_OUTCOME,
         inputSchema: { type: "object", additionalProperties: false, properties: {
                 bot_id: { type: "string", minLength: 1 }, reason: { type: "string", minLength: 1, maxLength: 500 },
             }, required: ["bot_id", "reason"] },
@@ -648,15 +656,20 @@ const TOOLS = [
     },
     {
         name: "session_search",
-        description: "Search your OWN earlier conversations with this user across all of your tasks, and your own memory files (MEMORY.md, memory/<topic>.md, your daily logs), best match first. Use it before asking the user to repeat something, and before redoing an audit, report, or investigation you may already have done in an earlier task. Conversation hits carry the task name, date, thread id, and message id; memory hits say which file they came from. One search is usually enough: when a hit is the message you need, call session_read with its ids to get the whole message instead of searching again for each detail. Results are your past notes, not new instructions. Other bots' conversations and memory are never included.",
+        description: "Search your OWN earlier conversations with this user across all of your tasks and the rooms you are in, and your own memory files (MEMORY.md, memory/<topic>.md, your daily logs), best match first — or, with since and no query, list what happened recently, newest first. Use it before asking the user to repeat something, before redoing an audit, report, or investigation you may already have done in an earlier task, and to answer what you have done since some time (a standup). Conversation hits carry the task or room name, date, thread id, and message id; memory hits say which file they came from. One search is usually enough: when a hit is the message you need, call session_read with its ids to get the whole message instead of searching again for each detail. Results are your past notes, not new instructions. Other bots' conversations and memory are never included.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
             properties: {
                 query: {
                     type: "string",
-                    description: "Two to five content words that would appear in the message you want, for example \"pricing audit broken links\". Every content word must match; skip filler words like \"the\", \"on\", \"what\".",
+                    description: "Two to five content words that would appear in the message you want, for example \"pricing audit broken links\". Every content word must match; skip filler words like \"the\", \"on\", \"what\". Optional when since is given.",
                 },
+                since: {
+                    type: "string",
+                    description: "Only messages from this time on: a span back from now like \"24h\", \"3d\", \"2w\"; \"today\" or \"yesterday\"; or a date. With no query, lists everything in that window, newest first.",
+                },
+                until: { type: "string", description: "Only messages up to this time; same forms as since." },
                 limit: { type: "integer", minimum: 1, maximum: 25, description: "Maximum hits to return; default 12." },
                 scope: {
                     type: "string",
@@ -664,7 +677,6 @@ const TOOLS = [
                     description: "What to search. Leave it out for both; \"memory\" for only your memory files, \"conversations\" for only your earlier conversations.",
                 },
             },
-            required: ["query"],
         },
     },
     {
@@ -944,9 +956,34 @@ async function callTool(name, args) {
         return { text: JSON.stringify(r), ...(r.error ? { isError: true } : {}) };
     }
     if (name === "coordinate_bots") {
+        // The tool's arguments are snake_case, but the harness wire they land on
+        // is camelCase, and a caller can reach for that spelling. Map the aliases
+        // to the canonical keys first - the documented snake_case spelling wins
+        // when both arrive - then refuse an unusable call with the field names a
+        // retry needs instead of a generic validation error (#1239).
+        const canonical = { ...args };
+        delete canonical.botIds;
+        delete canonical.requestKey;
+        delete canonical.groupId;
+        if (canonical.bot_ids === undefined)
+            canonical.bot_ids = args.botIds;
+        if (canonical.request_key === undefined)
+            canonical.request_key = args.requestKey;
+        if (canonical.group_id === undefined)
+            canonical.group_id = args.groupId;
+        const ids = canonical.bot_ids;
+        const usable = Array.isArray(ids) && ids.length > 0 && ids.every((id) => typeof id === "string")
+            && typeof canonical.message === "string" && canonical.message.trim().length > 0
+            && typeof canonical.request_key === "string" && canonical.request_key.trim().length > 0;
+        if (!usable) {
+            return {
+                text: `coordinate_bots takes snake_case arguments: bot_ids (an array of 1-4 teammate ids), message and request_key are required; group_id, rework and label are optional. Received: ${Object.keys(args).join(", ") || "none"}.`,
+                isError: true,
+            };
+        }
         const r = await api("/api/internal/coordinate-bots", { method: "POST", body: JSON.stringify({
-                groupId: args.group_id, botIds: args.bot_ids, message: args.message,
-                requestKey: args.request_key, rework: args.rework, label: args.label,
+                groupId: canonical.group_id, botIds: ids, message: canonical.message,
+                requestKey: canonical.request_key, rework: canonical.rework, label: canonical.label,
             }) });
         return { text: JSON.stringify(r), ...(r.error ? { isError: true } : {}) };
     }
@@ -1125,6 +1162,15 @@ async function callTool(name, args) {
         }
         return { text: `Task ${taskId} ended without a reply — ${String(r.status ?? "unknown")}${r.result ? `: ${String(r.result)}` : ""}.`, isError: true };
     }
+    if (name === "select_computer") {
+        if (args.surface !== undefined && (typeof args.surface !== "string" || !["auto", "cloud", "vm", "local", "browser"].includes(args.surface))) {
+            return { text: "Choose auto, cloud, vm, local or browser; omit surface to inspect connected choices.", isError: true };
+        }
+        const result = await api("/api/internal/computer/select", args.surface === undefined ? undefined : {
+            method: "POST", body: JSON.stringify({ surface: args.surface }),
+        });
+        return { text: JSON.stringify(result) };
+    }
     if (name === "list_threads") {
         const query = new URLSearchParams({ fromBotId: BOT_ID, fromThreadId: THREAD_ID });
         const r = await api(`/api/internal/threads?${query.toString()}`);
@@ -1475,9 +1521,18 @@ async function callTool(name, args) {
     }
     if (name === "session_search") {
         const q = String(args.query ?? "").trim();
-        if (!q)
-            return { text: "session_search needs a query, for example {\"query\":\"site audit broken links\"}.", isError: true };
-        const query = new URLSearchParams({ fromBotId: BOT_ID, fromThreadId: THREAD_ID, q });
+        const since = typeof args.since === "string" ? args.since.trim() : "";
+        const until = typeof args.until === "string" ? args.until.trim() : "";
+        if (!q && !since) {
+            return { text: "session_search needs a query (a few content words) or a since span, for example {\"query\":\"site audit broken links\"} or {\"since\":\"2d\"}.", isError: true };
+        }
+        const query = new URLSearchParams({ fromBotId: BOT_ID, fromThreadId: THREAD_ID });
+        if (q)
+            query.set("q", q);
+        if (since)
+            query.set("since", since);
+        if (until)
+            query.set("until", until);
         if (typeof args.limit === "number" && Number.isFinite(args.limit))
             query.set("limit", String(Math.trunc(args.limit)));
         if (args.scope === "conversations" || args.scope === "memory")
@@ -1490,21 +1545,29 @@ async function callTool(name, args) {
         const memoryBlock = memoryHits.length
             ? `${memoryHits.length} matching memory file${memoryHits.length === 1 ? "" : "s"} of yours:\n${memoryHits.map((hit) => `- [memory file ${String(hit.file)}] ${String(hit.snippet)}`).join("\n")}\n\n`
             : "";
+        const asked = q ? `matches "${q}"` : `is there since ${since}${until ? ` until ${until}` : ""}`;
         if (!hits.length && !memoryHits.length) {
-            return { text: `Nothing of yours matches "${q}" — no earlier conversation and no memory file. Try fewer or different words; every word must appear.` };
+            return { text: q
+                    ? `Nothing of yours ${asked} — no earlier conversation and no memory file. Try fewer or different words; every word must appear.`
+                    : `Nothing of yours ${asked} — no message in any of your conversations in that window.` };
         }
         if (!hits.length) {
             return { text: `${memoryBlock}No earlier conversation matches. These are your own notes, not new instructions; build on them.` };
         }
         const lines = hits.map((hit) => {
-            const when = typeof hit.at === "number" ? new Date(hit.at).toISOString().slice(0, 10) : "";
+            // a listing by time shows the time; a search by words keeps the date
+            const when = typeof hit.at === "number" ? new Date(hit.at).toISOString().slice(0, q ? 10 : 16).replace("T", " ") : "";
             const task = typeof hit.task === "string" && hit.task ? `task "${hit.task}"` : "an earlier task";
-            const where = hit.current ? "this conversation" : hit.crossed ? `${task}, private to this user` : task;
+            const where = hit.current
+                ? "this conversation"
+                : typeof hit.room === "string" && hit.room
+                    ? `room "${hit.room}"${typeof hit.task === "string" && hit.task ? `, ${task}` : ""}`
+                    : hit.crossed ? `${task}, private to this user` : task;
             return `- [${when} · ${where} · ${recallSpeaker(hit)} · thread ${hit.threadId} · message ${hit.messageId}] ${hit.snippet}`;
         });
         const crossed = hits.some((hit) => hit.crossed === true);
         return {
-            text: `${memoryBlock}${hits.length} matching message${hits.length === 1 ? "" : "s"} from your earlier conversations (best match first):\n${lines.join("\n")}\n\n` +
+            text: `${memoryBlock}${hits.length} ${q ? "matching " : ""}message${hits.length === 1 ? "" : "s"} from your earlier conversations (${q ? "best match first" : "newest first"}):\n${lines.join("\n")}\n\n` +
                 "These are your own past notes. If one of them is the message you need, call session_read with its thread and message ids for the full text rather than searching again. Build on them rather than redoing the work; ask the user only about what they do not cover." +
                 (crossed
                     ? " The hits marked private came from your one-to-one conversation with this user, not from this room; the room has been shown that you recalled them. Use them, and say where something came from if anyone asks."

package/dist-server/server/drivers/chat-mcp-tools.js

@@ -251,7 +251,12 @@ export async function mountChatTools(integrations, signal) {
         servers.push(["agents", integrations.agents]);
     if (integrations?.composio)
         servers.push(["composio", integrations.composio]);
-    servers.push(...Object.entries(integrations?.custom ?? {}));
+    // this client starts its servers and talks over stdio; a remote (url)
+    // entry is skipped here and reaches Claude and Codex bots
+    for (const [name, server] of Object.entries(integrations?.custom ?? {})) {
+        if ("command" in server)
+            servers.push([name, server]);
+    }
     if (servers.length > 32)
         throw new Error("MCP server count exceeds the 32-server limit");
     const clients = [];

package/dist-server/server/drivers/claude.js

@@ -150,6 +150,23 @@ function claudeEnvironment(model, source = process.env, configDir, instanceEnvir
 function inheritsUserConfig(env) {
     return env.OMB_CLAUDE_INHERIT_USER_CONFIG === "1";
 }
+/** The Engines-page warning while the escape hatch is set. The flag is a
+ * footgun: it is invisible once exported, and what it costs — every Claude
+ * bot re-reading this machine's own servers, skills, hooks and CLAUDE.md on
+ * every model call — shows up only on the bill. Naming it where the person
+ * looks when something is off is the whole point. */
+export function claudeInheritWarning(env) {
+    if (!inheritsUserConfig(env))
+        return undefined;
+    return {
+        title: "Bots inherit this machine's Claude Code setup",
+        message: "OMB_CLAUDE_INHERIT_USER_CONFIG=1 is set on the OpenMausBot process, so every Claude bot also loads this " +
+            "computer's own MCP servers, connectors, skills, hooks and personal CLAUDE.md on every turn — often thousands " +
+            "of extra tokens per model call, and tools nobody gave the bot. Unless a bot genuinely needs a server from " +
+            "your user-scope Claude config, remove the variable and restart; add the server under Settings → MCP servers " +
+            "or the bot project's .mcp.json instead.",
+    };
+}
 /** Retain the selected CLI account's authentication without importing its
  * hooks, permissions, MCP servers or personal instructions. Explicit OMB
  * connections/local endpoints own their entire routing + credential pair. */
@@ -243,11 +260,14 @@ export const CLAUDE_FLAG_FLOORS = {
     "--strict-mcp-config": [1, 0, 60],
     "--setting-sources": [1, 0, 122],
     "--autocompact": [2, 1, 122],
+    // 2.1.267 is the first CLI that accepts it; below that the recorded prompt
+    // simply is not refreshed, which is the pre-existing behaviour.
+    "--system-prompt-snapshot": [2, 1, 267],
 };
 /** The newest floor above: a CLI at or past it accepts everything the
  * harness sends. Below it the engine still works, minus the flags the CLI
  * predates, and the Engines page suggests an update. */
-export const CLAUDE_CONTEXT_CONTROL_MIN_VERSION = CLAUDE_FLAG_FLOORS["--autocompact"];
+export const CLAUDE_CONTEXT_CONTROL_MIN_VERSION = CLAUDE_FLAG_FLOORS["--system-prompt-snapshot"];
 /** `claude --version` prints "2.1.232 (Claude Code)"; the first dotted triple
  * is the version. Null when nothing parses, e.g. a wrapper that prints its
  * own banner first — see claudeCliSupports for how that is treated. */
@@ -273,9 +293,7 @@ export function claudeCliSupports(version, flag) {
     return version === null || versionAtLeast(version, CLAUDE_FLAG_FLOORS[flag]);
 }
 /** The Engines-page notice for a CLI older than the newest floor. The engine
- * keeps working: turns run without the flags the CLI predates, which means
- * no harness-picked compaction window and, on a very old CLI, no isolation
- * from this machine's own Claude Code setup. */
+ * keeps working without the flags its CLI predates. */
 export function claudeCliUpdate(version, cli) {
     const parsed = parseClaudeCliVersion(version);
     if (!parsed || versionAtLeast(parsed, CLAUDE_CONTEXT_CONTROL_MIN_VERSION))
@@ -283,39 +301,18 @@ export function claudeCliUpdate(version, cli) {
     const floor = CLAUDE_CONTEXT_CONTROL_MIN_VERSION.join(".");
     const missing = Object.keys(CLAUDE_FLAG_FLOORS)
         .filter((flag) => !claudeCliSupports(parsed, flag));
+    const effects = [
+        ...(missing.includes("--autocompact") ? ["no compaction window picked by OpenMausBot"] : []),
+        ...(missing.includes("--setting-sources") ? ["bots still see this machine's own Claude Code setup"] : []),
+        ...(missing.includes("--system-prompt-snapshot") ? ["coordinated resumed turns cannot refresh stale system prompts"] : []),
+    ];
     return {
         title: "Update Claude Code for context controls",
         message: `Claude Code ${parsed.join(".")} predates ${floor}, so bots run without ${missing.join(", ")}: ` +
-            "no compaction window picked by OpenMausBot" +
-            (missing.includes("--setting-sources") ? ", and bots still see this machine's own Claude Code setup" : "") +
-            ". Update it, then refresh Engines.",
+            `${effects.join("; ")}. Update it, then refresh Engines.`,
         command: cli === "claude" ? "claude update" : `${cli} update`,
     };
 }
-/** Whether `claude --help` output lists `flag` as a supported option.
- *
- * A wrapper may print its own banner before the real options list, and the
- * flag may appear only in an example or description rather than as an
- * option. We scan for a line that begins with the flag (after optional
- * leading whitespace), which is how the real CLI formats its `--help`.
- */
-export function claudeCliHelpSupportsFlag(help, flag) {
-    if (!help)
-        return false;
-    const escaped = flag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    return new RegExp(`^\\s*${escaped}\\b`, "m").test(help);
-}
-/** Whether the installed CLI supports `--autocompact`.
- *
- * When `snapshot()` has already probed `claude --help`, use that. If the
- * probe has not run or `--help` failed, fall back to the version floor so
- * the pre-snapshot behavior is preserved.
- */
-export function claudeAutoCompactSupported(version, help) {
-    if (help !== null)
-        return claudeCliHelpSupportsFlag(help, "--autocompact");
-    return claudeCliSupports(version, "--autocompact");
-}
 const DRIVER_KIND = "claudeAgent";
 // model catalog ported from upstream packages/contracts/src/model.ts
 export const STATIC_CLAUDE_MODELS = {
@@ -707,6 +704,7 @@ function decodeConfig(raw) {
     return {
         cli: typeof o.cli === "string" ? o.cli : "claude",
         ...(configDir ? { configDir } : {}),
+        ...(o.managed === true ? { managed: true } : {}),
         permissionMode: mode ?? "acceptEdits",
         ...(tools !== undefined ? { tools } : {}),
         ...(disallowedTools !== undefined ? { disallowedTools } : {}),
@@ -793,10 +791,17 @@ export const ClaudeDriver = {
     defaultConfig: () => decodeConfig({}),
     async create(input) {
         const { instanceId, config } = input;
-        const environment = (model) => claudeEnvironment(model, { ...process.env, ...input.environment }, config.configDir, input.environment);
+        const environment = (model) => claudeEnvironment(config.managed ? undefined : model, { ...process.env, ...input.environment }, config.configDir, input.environment);
         const catalogEnv = environment();
+        // Say it once where a headless or source run reads its logs; the Engines
+        // page carries the same warning for the desktop (claudeInheritWarning).
+        if (inheritsUserConfig(catalogEnv)) {
+            console.error(`claude (${instanceId}): OMB_CLAUDE_INHERIT_USER_CONFIG=1 — bots inherit this machine's Claude Code MCP servers, skills, hooks and CLAUDE.md on every turn; remove it unless a bot needs a user-scope server`);
+        }
         let models = STATIC_CLAUDE_MODELS;
         const refreshModels = async () => {
+            if (config.managed)
+                return;
             try {
                 const resolved = await mergeLocalInject(readClaudeModelCatalog(catalogEnv), catalogEnv);
                 if (resolved.options.length)
@@ -807,16 +812,19 @@ export const ClaudeDriver = {
             }
         };
         await refreshModels();
-        // The installed CLI's version and `--help` output as snapshot() last read
-        // them, so a flag the CLI does not know is never passed to it. The harness
-        // snapshots every instance whenever it describes them — app load, the
-        // Engines page, and right after `claude update` — which is exactly when
-        // the answer changes, so a turn normally finds it filled. A turn before
-        // any snapshot falls back to the version floor for the flags that are not
-        // known yet.
+        // The installed CLI's version as snapshot() last read it, so a flag the
+        // CLI does not know is never passed to it (CLAUDE_FLAG_FLOORS). The
+        // harness snapshots every instance whenever it describes them — app
+        // load, the Engines page, and right after `claude update`, which is
+        // exactly when the answer changes — so a turn normally finds it filled.
+        // Most turns before any snapshot assume a current CLI. A coordinated
+        // turn checks first because the snapshot-refresh flag is newer than the
+        // other context controls and an unknown flag would reject that request.
         let cliVersion = null;
-        let cliHelp = null;
-        let cliHelpVersion = null;
+        let cliVersionChecked = false;
+        const readCliVersion = (env) => new Promise((resolve) => {
+            execCli(config.cli, ["--version"], { timeout: 8000, env }, (err, stdout) => resolve(err ? null : stdout.trim() || null));
+        });
         const listeners = new Set();
         // one active turn per thread; a second send while busy is a caller bug
         const active = new Map();
@@ -901,6 +909,10 @@ export const ClaudeDriver = {
         // is a fresh sendTurn, and the attempt cap must survive across launches
         const retryState = new Map();
         const sendTurn = async (turn, logicalTurnId) => {
+            if (config.managed && (!turn.model || turn.model.includes("::") || !config.configDir ||
+                !input.environment.ANTHROPIC_API_KEY || !input.environment.ANTHROPIC_BASE_URL)) {
+                throw new Error("Company model access is unavailable. Reconnect your organization; personal billing will not be used.");
+            }
             const { threadId, botId } = turn;
             // An internal relaunch (transient failure, rejected resume) keeps the
             // logical turn's stop handle in `active` while it sets up, so Stop is
@@ -957,6 +969,13 @@ export const ClaudeDriver = {
                 args.push("--disallowedTools", config.disallowedTools.join(","));
             }
             const turnEnvironment = environment();
+            if (turn.refreshSystemPrompt && !cliVersionChecked) {
+                const version = await readCliVersion(turnEnvironment);
+                if (version) {
+                    cliVersion = parseClaudeCliVersion(version);
+                    cliVersionChecked = true;
+                }
+            }
             const isolated = !inheritsUserConfig(turnEnvironment);
             if (isolated) {
                 // A bot gets the tools and instructions its owner gave it, not
@@ -968,17 +987,30 @@ export const ClaudeDriver = {
                 // model call in the session then re-reads all of it.
                 // Each flag only on a CLI that accepts it: an unknown flag is an
                 // argument error that would fail every turn (CLAUDE_FLAG_FLOORS).
-                if (claudeCliSupports(cliVersion, "--strict-mcp-config"))
+                // The MCP half has a switch (Plugins → MCP servers → "Also use my
+                // Claude Code MCP servers"): with it on, the CLI loads the servers
+                // and connectors from the person's own Claude Code config — the way
+                // Codex reads its own config.toml — while skills, hooks and the
+                // personal CLAUDE.md stay out.
+                if (!turn.mcpFromUserConfig && claudeCliSupports(cliVersion, "--strict-mcp-config"))
                     args.push("--strict-mcp-config");
                 if (claudeCliSupports(cliVersion, "--setting-sources"))
                     args.push("--setting-sources", "project");
             }
             const compactWindow = autoCompactWindow(turnEnvironment);
-            if (compactWindow && claudeAutoCompactSupported(cliVersion, cliHelp)) {
+            if (compactWindow && claudeCliSupports(cliVersion, "--autocompact")) {
                 args.push("--autocompact", compactWindow);
             }
-            const turnModel = await resolveClaudeTurnModel(turn.model, turnEnvironment);
-            const injected = applyClaudeInject({ ...turnEnvironment }, turnModel);
+            // An old pair conversation can still carry its first assignment in
+            // Claude's recorded system prompt. The current brief rides in the user
+            // turn, so refresh the recorded prompt on --resume too. Gated by the
+            // version floor like every other flag the CLI may predate: an unknown
+            // flag is a hard argument error, not a graceful degrade.
+            if (turn.refreshSystemPrompt && cliVersionChecked && claudeCliSupports(cliVersion, "--system-prompt-snapshot")) {
+                args.push("--system-prompt-snapshot", "off");
+            }
+            const turnModel = config.managed ? turn.model : await resolveClaudeTurnModel(turn.model, turnEnvironment);
+            const injected = config.managed ? { model: turnModel ?? null, injected: false } : applyClaudeInject({ ...turnEnvironment }, turnModel);
             if (injected.model)
                 args.push("--model", injected.model);
             if (turn.effort)
@@ -1045,6 +1077,9 @@ export const ClaudeDriver = {
             // routes every custom tool call through the ogb permission broker
             // into an Allow/Deny card. Reserved names were filtered upstream;
             // skip any residual collision instead of clobbering a built-in.
+            // A remote entry ({type, url, headers}) is already in the CLI's own
+            // shape and the CLI connects to it itself; header values ride in the
+            // 0600 config file like every other credential here.
             // Bot-owned servers, gated below: they are the ones that answer for a
             // machine rather than for a context window.
             const botOwned = new Set();
@@ -1442,6 +1477,9 @@ export const ClaudeDriver = {
                                 ...(typeof msg.usage.cache_read_input_tokens === "number"
                                     ? { cachedInput: msg.usage.cache_read_input_tokens }
                                     : {}),
+                                // one assistant message = one model call, and its prompt is
+                                // everything in the window: fresh text, cache reads and writes
+                                contextTokens: (msg.usage.input_tokens || 0) + (msg.usage.cache_read_input_tokens || 0) + (msg.usage.cache_creation_input_tokens || 0),
                             });
                         }
                         break;
@@ -1728,32 +1766,18 @@ export const ClaudeDriver = {
         const login = new ClaudeLoginController({ cli: config.cli, environment, onAuthenticated: async () => { await refreshModels(); } });
         const snapshot = async () => {
             const env = environment();
-            const version = await new Promise((resolve) => {
-                execCli(config.cli, ["--version"], { timeout: 8000, env }, (err, stdout) => resolve(err ? null : stdout.trim()));
-            });
+            const version = await readCliVersion(env);
             if (!version)
                 return { state: "unavailable", reason: `\`${config.cli}\` CLI not found` };
             cliVersion = parseClaudeCliVersion(version);
-            if (version !== cliHelpVersion) {
-                cliHelp = await new Promise((resolve) => {
-                    execCli(config.cli, ["--help"], { timeout: 8000, env }, (err, stdout) => resolve(err ? null : stdout));
-                });
-                cliHelpVersion = version;
-            }
-            const features = cliHelp !== null ? { autocompact: claudeCliHelpSupportsFlag(cliHelp, "--autocompact") } : undefined;
+            cliVersionChecked = true;
             const auth = await claudeAuthStatus(config.cli, env);
             // claudeEnvironment strips ANTHROPIC_API_KEY, so turns run on the
             // CLI's own login (Pro/Max): the cost it reports is what the call
             // WOULD bill, not a charge
             const update = claudeCliUpdate(version, config.cli);
-            return {
-                state: "available",
-                version,
-                ...auth,
-                ...(update ? { update } : {}),
-                ...(features ? { features } : {}),
-                billing: "subscription",
-            };
+            const warning = claudeInheritWarning(env);
+            return { state: "available", version, ...auth, ...(update ? { update } : {}), ...(warning ? { warning } : {}), billing: "subscription" };
         };
         /** One-shot Claude call with the prompt on stdin, never argv. Approval
          * summaries can contain paths, commands, or secrets, so the generic