openmausbot 0.1.83 → 0.1.85

package/dist-server/server/drivers/agents-proxy.js

@@ -38,6 +38,7 @@ import { CREDENTIAL_TARGETS, isCredentialTargetId } from "../../shared/credentia
 import { normalizeCronSchedule } from "../../shared/routine-schedule.js";
 import { agentToolAnnotations } from "../agent-tool-policy.js";
 import { peerName } from "../peer-roster.js";
+import { boundedAgentResult } from "./agents-result.js";
 const HARNESS = process.env.OMB_HARNESS_URL ?? "http://127.0.0.1:8799";
 const BOT_ID = process.env.OMB_BOT_ID ?? "";
 const THREAD_ID = process.env.OMB_THREAD_ID ?? "";
@@ -349,8 +350,8 @@ const ROUTINE_FIELDS_SCHEMA = {
     schedule: ROUTINE_SCHEDULE_SCHEMA,
     run_on: {
         type: "string",
-        enum: ["maus", "cloud"],
-        description: "Where the routine runs. Defaults to maus (this OpenMausBot setup).",
+        enum: ["maus", "box"],
+        description: "Default maus keeps the bot's selected model and configured computer, INCLUDING a self-hosted VPS. Omit this field for normal schedules. box explicitly switches the agent to the Box-hosted runner; it requires Box setup and is not the generic cloud/VPS option. Legacy cloud values from list_routines mean box, not VPS.",
     },
     timeout_minutes: {
         type: "integer",
@@ -366,9 +367,26 @@ const ROUTINE_FIELDS_SCHEMA = {
         type: "boolean",
         description: "Opt in to using the latest completed run's bounded report as historical context. Defaults to false; set false in an update to start fresh again. Included in the applied result or pending confirmation.",
     },
+    overlap: {
+        type: "string",
+        enum: ["skip", "queue"],
+        description: "While this routine is still working, skip scheduled occurrences (default) or queue at most one run. Queue skips further occurrences until the pending run starts; it never builds an unlimited backlog. Manual and webhook requests are separate.",
+    },
 };
 const PROPOSAL_OUTCOME = " Read the result: granted Full Access may apply the change immediately. If applied, continue the requested work without another confirmation. Only a pending result requires ending the turn and waiting for the in-app decision. Never claim success from the permission mode alone; report failed or cancelled results honestly. This does not elevate another bot's execution permissions.";
 const TOOLS = [
+    {
+        name: "tool_result_read",
+        description: "Read a missing portion of an oversized agents-tool result using the saved id and next offset from its notice. Returns at most 16,000 characters, only from this bot in this conversation. Use only when the preview is insufficient; do not load every page by default. Results expire after one hour, on app restart, or under cache pressure. This never reruns the original action.",
+        inputSchema: {
+            type: "object", additionalProperties: false,
+            properties: {
+                id: { type: "string", description: "Saved result id copied from the truncation notice." },
+                offset: { type: "integer", minimum: 0, description: "Character offset copied from the previous result's notice. Defaults to 0." },
+            },
+            required: ["id"],
+        },
+    },
     {
         name: "list_shared_computers",
         description: "List online desktop computers explicitly shared with this workspace, and their allowed folders/capabilities. These are the user's computers, not this server. An offline or unshared computer cannot be accessed. Folder paths use opaque folder IDs and relative paths.",
@@ -412,7 +430,7 @@ const TOOLS = [
     },
     {
         name: "ask_bot",
-        description: "SYNCHRONOUS consultation: send a short question to another bot and stay blocked until its reply is returned inline. Use only when that reply is required to write your current response. Do not use for assigning work, background tasks, or potentially long work; use delegate_bot for those. Returns promptly with a note if that bot is busy.",
+        description: "Brief synchronous consultation: send a short question to another bot. Quick replies return inline; slow replies become asynchronous delegations and return automatically after you finish your turn. Use only when that reply is required to write your current response. Do not use for assigning work, background tasks, or potentially long work; use delegate_bot for those. Returns promptly with a note if that bot is busy.",
         inputSchema: {
             type: "object",
             properties: {
@@ -642,6 +660,20 @@ const TOOLS = [
             required: ["action"],
         },
     },
+    {
+        name: "retry_thread",
+        description: "Chief of Staff only. Resume a teammate's thread whose last run failed, stalled or could not start — the one an incident report named — exactly where it stopped, keeping its conversation and files. The teammate gets a line saying you asked for the retry and why. Use it when the cause looks transient (a crash, a timeout, a busy service). Use delegate_bot with a corrected brief instead when the request itself needs to change, and tell the person instead when only they can fix the cause (a sign-in, a missing credential, an unanswered question). Never retry the same thread more than twice.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                bot_id: { type: "string", description: "The teammate's id, from the incident report or list_bots." },
+                thread_id: { type: "string", description: "The failed thread's id, from the incident report." },
+                note: { type: "string", description: "Optional: one sentence for the teammate about what to watch for this time." },
+            },
+            required: ["bot_id", "thread_id"],
+        },
+    },
     {
         name: "memory_log",
         description: "Write one line to today's log file, memory/log/YYYY-MM-DD.md, stamped with the time and this conversation: what happened, not what is true. Use it for events worth a trace — a deploy went out, a person decided something, a check failed — that should not shape future sessions. Logs are never loaded into your prompt; the person can read them, and session_search finds them later. A fact that should hold in every session goes to memory_update instead.",
@@ -840,6 +872,8 @@ async function api(path, init) {
         throw new Error(String(body.error ?? `HTTP ${status}`));
     return body;
 }
+const capResult = (text) => boundedAgentResult(text, (retained, truncated) => api("/api/internal/tool-result", { method: "POST", signal: AbortSignal.timeout(3_000),
+    body: JSON.stringify({ text: retained, truncated }) }));
 /** Like api, but a refusal comes back as its body instead of an Error —
  * for the tools whose refusals carry more than a sentence. */
 async function apiResponse(path, init) {
@@ -870,16 +904,17 @@ function routineFields(args) {
     const fields = {};
     // list_routines returns the harness names. Accept those when a model
     // copies back a definition, as we already do for interval fields.
-    if (args.run_on != null && args.runOn != null && args.run_on !== args.runOn) {
+    const destination = (value) => value === "box" ? "cloud" : value;
+    if (args.run_on != null && args.runOn != null && destination(args.run_on) !== destination(args.runOn)) {
         return { fields, error: "Choose one run_on destination; run_on and runOn disagree." };
     }
     if (args.timeout_minutes != null && args.timeoutMinutes != null && args.timeout_minutes !== args.timeoutMinutes) {
         return { fields, error: "Choose one timeout_minutes limit; timeout_minutes and timeoutMinutes disagree." };
     }
-    const runOn = args.run_on ?? args.runOn;
+    const runOn = destination(args.run_on ?? args.runOn);
     const timeoutMinutes = args.timeout_minutes ?? args.timeoutMinutes;
     if (runOn != null && runOn !== "maus" && runOn !== "cloud") {
-        return { fields, error: 'run_on must be "maus" or "cloud".' };
+        return { fields, error: 'Use run_on="maus" for the bot’s current model and configured computer (including VPS), or run_on="box" only for the Box-hosted agent. Legacy "cloud" also means Box.' };
     }
     if (timeoutMinutes != null && (typeof timeoutMinutes !== "number" || !Number.isInteger(timeoutMinutes) || timeoutMinutes < 5 || timeoutMinutes > 240)) {
         return { fields, error: "timeout_minutes must be a whole number from 5 to 240. Use clear_timeout to remove a limit." };
@@ -887,6 +922,9 @@ function routineFields(args) {
     if (args.continuity != null && typeof args.continuity !== "boolean") {
         return { fields, error: "continuity must be true or false." };
     }
+    if (args.overlap !== undefined && args.overlap !== "skip" && args.overlap !== "queue") {
+        return { fields, error: "overlap must be skip or queue." };
+    }
     if (args.clear_timeout != null && typeof args.clear_timeout !== "boolean") {
         return { fields, error: "clear_timeout must be true or false." };
     }
@@ -911,6 +949,8 @@ function routineFields(args) {
         fields.timeoutMinutes = timeoutMinutes;
     if (typeof args.continuity === "boolean")
         fields.continuity = args.continuity;
+    if (args.overlap !== undefined)
+        fields.overlap = args.overlap;
     return { fields };
 }
 /** Full Access is decided by the harness, not inferred from a model claim or
@@ -951,6 +991,17 @@ function recallSpeaker(hit) {
     return hit.role === "user" ? "user" : "you";
 }
 async function callTool(name, args) {
+    if (name === "tool_result_read") {
+        if (typeof args.id !== "string" || !/^r-[0-9a-f-]{36}$/.test(args.id) ||
+            (args.offset !== undefined && (!Number.isSafeInteger(args.offset) || Number(args.offset) < 0))) {
+            return { text: "Use the saved result id and a non-negative integer offset from its notice.", isError: true };
+        }
+        const r = await api(`/api/internal/tool-result?id=${encodeURIComponent(args.id)}&offset=${args.offset ?? 0}`, { signal: AbortSignal.timeout(3_000) });
+        const text = String(r.text ?? "");
+        return { text: `${text}\n\n[${Number(r.nextOffset) < Number(r.length)
+                ? `Read more with tool_result_read id "${args.id}" and offset ${r.nextOffset}.`
+                : `End of retained result.${r.truncated ? " The original tail exceeded the storage limit and was omitted." : ""}`}]` };
+    }
     if (name === "list_room_targets") {
         const r = await api("/api/internal/room-targets");
         return { text: JSON.stringify(r), ...(r.error ? { isError: true } : {}) };
@@ -1067,9 +1118,11 @@ async function callTool(name, args) {
             const taskId = String(r.taskId ?? "").trim();
             if (taskId)
                 delegationTaskIdsThisTurn.add(taskId);
-            const waitedMinutes = Math.max(1, Math.round((Number(r.waitedMs) || 0) / 60_000));
+            const waitedSeconds = Math.max(1, Math.round((Number(r.waitedMs) || 0) / 1000));
+            const amount = waitedSeconds < 60 ? waitedSeconds : Math.round(waitedSeconds / 60);
+            const unit = waitedSeconds < 60 ? "second" : "minute";
             return {
-                text: `${r.toBotName ?? "That bot"} is still working after ${waitedMinutes} minute${waitedMinutes === 1 ? "" : "s"} — the ask was converted to a delegation so the reply is not lost. Task id: ${taskId}. Finish your turn now; the result will be delivered to this conversation automatically. Use check_delegation in a later turn only if the user asks for status.`,
+                text: `${r.toBotName ?? "That bot"} is still working after ${amount} ${unit}${amount === 1 ? "" : "s"} — the ask was converted to a delegation so the reply is not lost. Task id: ${taskId}. Finish your turn now; the result will be delivered to this conversation automatically. Use check_delegation in a later turn only if the user asks for status.`,
             };
         }
         if (r.busy) {
@@ -1507,6 +1560,20 @@ async function callTool(name, args) {
         const entry = typeof r.entry === "string" && r.entry ? ` Entry: ${r.entry}` : "";
         return { text: `Memory updated.${entry}${r.truncated ? " MEMORY.md exceeds the prompt load budget; keep it short and curated." : ""}` };
     }
+    if (name === "retry_thread") {
+        const botId = String(args.bot_id ?? "").trim();
+        const threadId = String(args.thread_id ?? "").trim();
+        const note = typeof args.note === "string" ? args.note.trim() : "";
+        if (!botId || !threadId)
+            return { text: "retry_thread needs bot_id and thread_id — both are in the incident report.", isError: true };
+        const r = await api("/api/internal/retry-thread", {
+            method: "POST",
+            body: JSON.stringify({ fromBotId: BOT_ID, fromThreadId: THREAD_ID, toBotId: botId, toThreadId: threadId, ...(note ? { note } : {}) }),
+        });
+        if (r.error)
+            return { text: `Couldn't retry that thread: ${String(r.error)}`, isError: true };
+        return { text: typeof r.message === "string" ? r.message : "The thread is running again. Its result stays in that thread; you are not woken for it — check it later with session_search or list_threads if you need to." };
+    }
     if (name === "memory_log") {
         if (typeof args.text !== "string" || !args.text.trim()) {
             return { text: "memory_log needs text: one line about what happened.", isError: true };
@@ -1706,7 +1773,7 @@ async function handle(msg) {
                     return;
                 }
                 if (name === "list_shared_computers") {
-                    textResult(id, JSON.stringify(await api("/api/internal/shared-computers")));
+                    textResult(id, await capResult(JSON.stringify(await api("/api/internal/shared-computers"))));
                     return;
                 }
                 if (name === "shared_computer") {
@@ -1715,14 +1782,14 @@ async function handle(msg) {
                     if (Array.isArray(result?.content))
                         ok(id, result);
                     else
-                        textResult(id, JSON.stringify(result));
+                        textResult(id, await capResult(JSON.stringify(result)));
                     return;
                 }
                 const { text, isError } = await callTool(name, (params.arguments ?? {}));
-                textResult(id, text, isError);
+                textResult(id, name === "tool_result_read" ? text : await capResult(text), isError);
             }
             catch (e) {
-                textResult(id, e.message, true);
+                textResult(id, await capResult(e.message), true);
             }
             return;
         }

package/dist-server/server/drivers/agents-result.js

@@ -0,0 +1,23 @@
+import { redactSecretsInText } from "../../shared/redact.js";
+import { TOOL_RESULT_MAX_CHARS, TOOL_RESULT_PREVIEW_CHARS, toolResultPrefix } from "../tool-results.js";
+/** The operation already happened. Saving overflow must never retry it or
+ * turn a successful operation into a failed MCP call. Only cache I/O is timed. */
+export async function boundedAgentResult(text, save) {
+    if (text.length <= 24_000)
+        return text;
+    const redacted = redactSecretsInText(text);
+    const prefix = toolResultPrefix(redacted, TOOL_RESULT_PREVIEW_CHARS);
+    const retained = toolResultPrefix(redacted, TOOL_RESULT_MAX_CHARS);
+    const truncated = retained.length < redacted.length;
+    try {
+        const saved = await save(retained, truncated);
+        if (!saved || typeof saved.id !== "string" || !/^r-[0-9a-f-]{36}$/.test(saved.id))
+            throw new Error("Invalid saved result");
+        return `${prefix}\n\n[Large tool result: showing the first ${prefix.length} characters. ${truncated || saved.truncated
+            ? "Only a bounded portion was retained; the remaining tail was omitted."
+            : "The remaining redacted result is temporarily saved."} If a missing detail is needed, call tool_result_read with id "${saved.id}" and offset ${prefix.length}. Saved results expire after one hour, on app restart, or under cache pressure. Do not repeat an action just to retrieve its output.]`;
+    }
+    catch {
+        return `${prefix}\n\n[Large tool result: showing the first ${prefix.length} characters. The remaining output could not be saved. The original operation was not retried. Do not repeat an action just to retrieve its output.]`;
+    }
+}

package/dist-server/server/drivers/claude.js

@@ -9,11 +9,12 @@
 //   - the bot's cloud computer (box.ascii.dev) via server/computer-proxy.ts
 //     — screenshot/exec/open_url, the CUA-on-the-box bridge
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { createServer as createNetServer } from "node:net";
 import { homedir, tmpdir } from "node:os";
 import { join, dirname, isAbsolute, normalize } from "node:path";
 import { DATA_DIR, stripWorkspaceCredentialEnv } from "../config.js";
+import { writeFileAtomic } from "../atomic.js";
 import { augmentedPath } from "../env-path.js";
 import { brokerSocketPath, describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
@@ -25,6 +26,7 @@ import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS }
 import { applyClaudeInject, decodeInjectId, mergeLocalInject, probeLocalInjects, resolveInjectId, } from "./local-inject.js";
 import { appendNative } from "./native.js";
 import { SPAWNED_PROXIES } from "../proxy-paths.js";
+import { extractMcpImages } from "../mcp-tool-images.js";
 import { ASK_USER_QUESTION_TOOL, askQuestionSummary, parseAskQuestions, parseChoices, questionChoices, } from "../../shared/ask-question.js";
 /** Whether `claude` has been signed in.
  *
@@ -392,6 +394,7 @@ export function readClaudeModelCatalog(env = process.env) {
 // far. See server/proxy-paths.ts.
 const PERM_PROXY_PATH = SPAWNED_PROXIES.permission;
 const DWEB_PROXY_PATH = SPAWNED_PROXIES.dweb;
+const HOOK_HELPER_PATH = SPAWNED_PROXIES.hook;
 // in the packaged app process.execPath is the Electron binary — this env
 // makes it behave as plain node for the spawned MCP proxies (harmless in dev)
 const NODE_ENV_FLAG = { ELECTRON_RUN_AS_NODE: "1" };
@@ -430,6 +433,26 @@ function askSummary(ask) {
         return askQuestionSummary(questions).slice(0, 300);
     return askInputSummary(ask.input) ?? ask.tool ?? "tool";
 }
+/** Where the hook helper reads this thread's current turn token. Stable per
+ * thread (so the CLI's environment can name it once) and private. */
+export function hookTokenFile(threadId, botId) {
+    const digest = createHash("sha256").update(`${botId ?? ""}\0${threadId}`).digest("hex").slice(0, 24);
+    return join(DATA_DIR, "hook-tokens", `${digest}.token`);
+}
+/** The `hooks` block for the private --settings file: one command for each
+ * event the harness observes. Claude Code runs it with the event JSON on
+ * stdin and applies any hookSpecificOutput it prints. The command string is
+ * a shell line, so both paths are quoted (this repo's own path has a space). */
+export function claudeHookSettings(helperPath) {
+    // JSON quoting is not shell quoting: $(), backticks and $names still
+    // expand inside double quotes on POSIX. Windows paths come through env
+    // variables so their backslashes are not JSON-escaped into the command.
+    const command = process.platform === "win32"
+        ? '"%OMB_HOOK_NODE%" "%OMB_HOOK_HELPER%"'
+        : [process.execPath, helperPath].map(path => `'${path.replace(/'/g, "'\\''")}'`).join(" ");
+    const entry = [{ matcher: "", hooks: [{ type: "command", command, timeout: 5 }] }];
+    return { PostToolUse: entry, PreCompact: entry, SessionStart: entry, Stop: entry };
+}
 export function permissionSocketPath(threadId, botId) {
     // A readable prefix alone is not unique: ids that agree on their first
     // characters ("t-perm-dup-1", "t-perm-dup-2") would share a socket. POSIX
@@ -945,13 +968,15 @@ export const ClaudeDriver = {
             const retry = retryState.get(threadId) ?? { attempt: 0, cancelled: false };
             // A fresh user turn starts un-cancelled. A relaunch must keep a Stop
             // that landed while it was being scheduled.
-            if (!relaunch)
+            if (!relaunch) {
                 retry.cancelled = false;
+                retry.rebuilt = false;
+            }
             retryState.set(threadId, retry);
             // a retry relaunches the whole CLI; the backoff is scaled down in tests
             // so a fake's transient failures don't stall real seconds
             const retryScale = Number(process.env.FAKE_CLAUDE_RETRY_SCALE ?? "1");
-            const sessionId = typeof turn.resumeCursor === "string" ? turn.resumeCursor : null;
+            const sessionId = !turn.sessionReset && typeof turn.resumeCursor === "string" ? turn.resumeCursor : null;
             const newSessionId = sessionId ? null : newId();
             const args = [
                 "-p",
@@ -1138,7 +1163,28 @@ export const ClaudeDriver = {
             const env = environment(turnModel);
             const authSettings = isolated && !injected.injected
                 ? readClaudeAuthSettings(env, input.environment) : {};
-            const authSettingsPath = mcpConfigPath && Object.keys(authSettings).length
+            // Harness hooks (item 0.2): one helper command for the events the
+            // harness observes. The helper reads its bearer from a per-thread file
+            // the harness rewrites every turn, so a long-lived CLI process never
+            // presents a stale token. Registered through the same private
+            // --settings file as the auth override; both are 0600 and per launch.
+            const hooks = turn.integrations?.hooks;
+            const hookTokenPath = hooks ? hookTokenFile(threadId, botId) : null;
+            if (hooks && hookTokenPath) {
+                mkdirSync(dirname(hookTokenPath), { recursive: true, mode: 0o700 });
+                writeFileAtomic(hookTokenPath, hooks.token, { mode: 0o600 });
+                env.OMB_HOOK_URL = hooks.url;
+                env.OMB_HOOK_TOKEN_FILE = hookTokenPath;
+                env.OMB_HOOK_NODE = process.execPath;
+                env.OMB_HOOK_HELPER = HOOK_HELPER_PATH;
+                // in the packaged app process.execPath is Electron — run the helper as node
+                if (process.versions.electron)
+                    env.ELECTRON_RUN_AS_NODE = "1";
+            }
+            const settings = { ...authSettings };
+            if (hooks)
+                settings.hooks = claudeHookSettings(HOOK_HELPER_PATH);
+            const authSettingsPath = mcpConfigPath && Object.keys(settings).length
                 ? join(dirname(mcpConfigPath), "auth-settings.json") : null;
             if (authSettingsPath)
                 args.push("--settings", authSettingsPath);
@@ -1161,6 +1207,8 @@ export const ClaudeDriver = {
                 model: injected.model ?? null,
                 base: env.ANTHROPIC_BASE_URL ?? null,
                 configDir: env.CLAUDE_CONFIG_DIR ?? null,
+                // hooks on/off changes the settings file the process was launched with
+                hooks: Boolean(hooks),
                 // Rotating an account's key/helper must not reuse the old process.
                 auth: createHash("sha256").update(JSON.stringify({
                     settings: authSettings,
@@ -1168,10 +1216,10 @@ export const ClaudeDriver = {
                 })).digest("hex"),
             });
             // Reuse the live process when it is idle, unchanged, and is the session
-            // the harness wants resumed. Anything else: close it and spawn fresh
-            // (with --resume, so the conversation continues in the new process).
+            // the harness wants resumed. Clearing a cursor alone does not opt out
+            // of legacy reuse: an explicit rebuild must discard the idle context.
             const live = sessions.get(threadId);
-            if (live && !live.turn && !live.closing && live.child.exitCode === null && live.argsKey === argsKey && (!sessionId || sessionId === live.sessionId)) {
+            if (!turn.sessionReset && live && !live.turn && !live.closing && live.child.exitCode === null && live.argsKey === argsKey && (!sessionId || sessionId === live.sessionId)) {
                 if (live.idleTimer)
                     clearTimeout(live.idleTimer);
                 live.turn = { turnId, input: turn, retryAbort, settled: false, sawStreamDelta: false };
@@ -1211,7 +1259,7 @@ export const ClaudeDriver = {
                 return { turnId };
             }
             if (live)
-                closeSession(threadId, "spawn contract changed");
+                closeSession(threadId, turn.sessionReset ? "context reset" : "spawn contract changed");
             // Until sessions.set() below, this turn owns every launch resource.
             // Any bind, private-config or synchronous spawn failure must release
             // them here rather than leave a live listener or credential temp file.
@@ -1306,7 +1354,7 @@ export const ClaudeDriver = {
                     writeFileSync(mcpConfigPath, JSON.stringify({ mcpServers }), { mode: 0o600 });
                 }
                 if (authSettingsPath) {
-                    writeFileSync(authSettingsPath, JSON.stringify(authSettings), { mode: 0o600 });
+                    writeFileSync(authSettingsPath, JSON.stringify(settings), { mode: 0o600 });
                 }
                 if (sessionId)
                     args.push("--resume", sessionId);
@@ -1407,7 +1455,7 @@ export const ClaudeDriver = {
                             session.nativePermissionMode = typeof o.permissionMode === "string" ? o.permissionMode : null;
                             if (typeof o.session_id === "string")
                                 session.sessionId = o.session_id;
-                            emit({ ...base(threadId, currentTurnId()), type: "session.started", sessionId: o.session_id, model: o.model });
+                            emit({ ...base(threadId, currentTurnId()), type: "session.started", sessionId: o.session_id, model: o.model, ...(retry.rebuilt ? { rebuilt: true } : {}) });
                         }
                         else if (o.subtype === "thinking_tokens") {
                             emit({ ...base(threadId, currentTurnId()), type: "item.updated", itemType: "reasoning", tokens: o.estimated_tokens });
@@ -1447,13 +1495,16 @@ export const ClaudeDriver = {
                             break;
                         }
                         if (text.trim()) {
+                            // The CLI's own report of any other API error is still shown,
+                            // but marked: the model never produced it.
+                            const synthetic = o.is_api_error_message === true || typeof o.error === "string" ? { synthetic: true } : {};
                             // fallback delta for CLIs/paths that never streamed the block
                             if (!session.turn?.sawStreamDelta) {
-                                emit({ ...base(threadId, currentTurnId()), type: "content.delta", streamKind: "assistant_text", delta: text });
+                                emit({ ...base(threadId, currentTurnId()), ...synthetic, type: "content.delta", streamKind: "assistant_text", delta: text });
                             }
                             if (session.turn)
                                 session.turn.sawStreamDelta = false;
-                            emit({ ...base(threadId, currentTurnId()), type: "item.completed", itemType: "assistant_text", text });
+                            emit({ ...base(threadId, currentTurnId()), ...synthetic, type: "item.completed", itemType: "assistant_text", text });
                         }
                         for (const b of Array.isArray(msg.content) ? msg.content : []) {
                             if (b.type === "tool_use") {
@@ -1488,6 +1539,9 @@ export const ClaudeDriver = {
                         for (const b of Array.isArray(o.message?.content) ? o.message.content : []) {
                             if (b.type === "tool_result") {
                                 emit({ ...base(threadId, currentTurnId()), type: "item.completed", itemType: "tool", itemId: b.tool_use_id, ok: !b.is_error, output: toolDetailPreview(b.content) });
+                                for (const img of extractMcpImages(b.content)) {
+                                    emit({ ...base(threadId, currentTurnId()), type: "item.completed", itemType: "assistant_image", data: img.data });
+                                }
                             }
                         }
                         break;
@@ -1622,7 +1676,9 @@ export const ClaudeDriver = {
                             active.set(threadId, { stop: () => { retry.cancelled = true; retryAbort.abort(); }, turnId });
                             try {
                                 const cursor = session.sessionId ?? sessionId ?? undefined;
-                                await sendTurn({ ...turn, resumeCursor: cursor }, turnId);
+                                // The reset was consumed by the initial launch. Retry the
+                                // new session, never the context that launch replaced.
+                                await sendTurn({ ...turn, sessionReset: false, resumeCursor: cursor }, turnId);
                             }
                             catch (e) {
                                 if (active.get(threadId)?.turnId === turnId)
@@ -1680,7 +1736,10 @@ export const ClaudeDriver = {
                         }
                         sessions.delete(threadId);
                         session.turn = null;
-                        // Same relaunch handle as the transient-retry path above.
+                        // Same relaunch handle as the transient-retry path above. The new
+                        // session is announced as rebuilt only when it is actually given
+                        // the replay: with nothing to replay it gets the turn text alone.
+                        retry.rebuilt = recovery.replayed;
                         retryState.set(threadId, retry);
                         active.set(threadId, { stop: () => { retry.cancelled = true; retryAbort.abort(); }, turnId });
                         emit({
@@ -1867,9 +1926,19 @@ export const ClaudeDriver = {
                     nativeImageInput: true,
                     effortLevels: ["low", "medium", "high", "xhigh", "max"],
                     queueing: true,
+                    // Only while this CLI can be told to refresh a resumed session's
+                    // recorded system prompt (--system-prompt-snapshot). Keeping a
+                    // session across an update from outside it means the harness keeps
+                    // its prompt too; an older CLI would answer a delegated return with
+                    // the instructions of the turn that started the session, where a
+                    // fresh session rebuilt them. Unknown version: not yet.
+                    get strictResume() {
+                        return cliVersionChecked && cliVersion !== null && claudeCliSupports(cliVersion, "--system-prompt-snapshot");
+                    },
                     // Harness turns reassert a per-bot mode and restore the broker even
                     // when an old instance was configured with bypassPermissions.
                     localComputerMcp: true,
+                    hooks: true,
                 },
                 sendTurn,
                 steer,
@@ -1897,7 +1966,7 @@ export const ClaudeDriver = {
                     return () => listeners.delete(listener);
                 },
             },
-            generateText: (prompt) => generateReview(prompt),
+            generateText: (prompt, options) => generateReview(prompt, options?.signal),
             reviewPermission: generateReview,
             dispose: async () => {
                 try {

package/dist-server/server/drivers/codex.js

@@ -25,6 +25,7 @@ import { codexDeveloperInstructions, syncCodexInstructions } from "./codex-instr
 import { CodexDeviceAuthController } from "./codex-device-auth.js";
 import { codexAccountEmail } from "./codex-identity.js";
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
+import { extractMcpImages } from "../mcp-tool-images.js";
 export { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 const DRIVER_KIND = "codex";
 const ASTRA_MODEL_ID = "gpt-6-astra";
@@ -1039,6 +1040,11 @@ export const CodexDriver = {
                                     ok: item.status !== "failed" && item.status !== "declined",
                                     output: toolDetailPreview(item.type === "commandExecution" ? { output: item.aggregatedOutput, exitCode: item.exitCode } : item.type === "mcpToolCall" ? item.error ?? item.result : item.type === "fileChange" ? item.changes : item.action),
                                 });
+                                if (item.type === "mcpToolCall") {
+                                    for (const img of extractMcpImages(item.result)) {
+                                        emit({ ...base(threadId, turnId), type: "item.completed", itemType: "assistant_image", data: img.data });
+                                    }
+                                }
                             }
                             else if (item.type === "reasoning") {
                                 emit({ ...base(threadId, turnId), type: "item.updated", itemType: "reasoning", tokens: null });
@@ -1309,6 +1315,7 @@ export const CodexDriver = {
                     const cursor = typeof turn.resumeCursor === "string" ? turn.resumeCursor : null;
                     let startedModel = null;
                     let resumedNativeThread = false;
+                    let rebuiltFromReplay = false;
                     let promptText = turn.text;
                     if (cursor) {
                         const resumeThread = () => request("thread/resume", {
@@ -1339,13 +1346,19 @@ export const CodexDriver = {
                                 promptSubmitted,
                                 producedOutput: state.sawStreamDelta,
                             });
-                            if (!config.managed || recoveredMissingSession || stopRequested || state.settled ||
+                            if ((!config.managed && !turn.recoveryIsReplay) || recoveredMissingSession || stopRequested || state.settled ||
                                 !turn.recoveryText?.trim() || !missingNativeCodexThread(error, cursor) || !mayReplay(failure))
                                 throw error;
-                            // The prompt has never been submitted. Rebuild only missing Company
-                            // histories, once, through the same approved model/provider below.
+                            // The prompt has never been submitted. Rebuild missing Company
+                            // histories, and a personal thread only for a turn whose recovery
+                            // text is the replay it would have had anyway; once, through the
+                            // same approved model/provider below.
                             recoveredMissingSession = true;
-                            promptText = recoveryPromptFor({ recoveryText: turn.recoveryText, currentText: turn.text, failure }).text;
+                            const rebuild = recoveryPromptFor({ recoveryText: turn.recoveryText, currentText: turn.text, failure });
+                            // Announced as rebuilt only when the replacement really carries the
+                            // replay; otherwise it holds no more than the turn text.
+                            rebuiltFromReplay = rebuild.replayed;
+                            promptText = rebuild.text;
                         }
                     }
                     if (!codexThreadId) {
@@ -1374,7 +1387,7 @@ export const CodexDriver = {
                     if (!codexThreadId)
                         throw new Error("Codex did not return a native thread id");
                     await syncCodexInstructions(threadId, codexThreadId, developerInstructions, resumedNativeThread, request);
-                    emit({ ...base(threadId, turnId), type: "session.started", sessionId: codexThreadId, model: startedModel ?? turn.model ?? null });
+                    emit({ ...base(threadId, turnId), type: "session.started", sessionId: codexThreadId, model: startedModel ?? turn.model ?? null, ...(rebuiltFromReplay ? { rebuilt: true } : {}) });
                     const turnInput = [
                         ...(promptText ? [{ type: "text", text: promptText }] : []),
                         ...(turn.images ?? []).map((image) => ({ type: "localImage", path: image.path })),
@@ -1512,6 +1525,7 @@ export const CodexDriver = {
                     images: true,
                     nativeImageInput: true,
                     effortLevels: ["low", "medium", "high", "xhigh", "max"],
+                    strictResume: true,
                 },
                 sendTurn,
                 interruptTurn: async (threadId) => {