openmausbot 0.1.84 → 0.1.85

package/dist-server/server/drivers/agents-proxy.js

@@ -38,6 +38,7 @@ import { CREDENTIAL_TARGETS, isCredentialTargetId } from "../../shared/credentia
 import { normalizeCronSchedule } from "../../shared/routine-schedule.js";
 import { agentToolAnnotations } from "../agent-tool-policy.js";
 import { peerName } from "../peer-roster.js";
+import { boundedAgentResult } from "./agents-result.js";
 const HARNESS = process.env.OMB_HARNESS_URL ?? "http://127.0.0.1:8799";
 const BOT_ID = process.env.OMB_BOT_ID ?? "";
 const THREAD_ID = process.env.OMB_THREAD_ID ?? "";
@@ -349,8 +350,8 @@ const ROUTINE_FIELDS_SCHEMA = {
     schedule: ROUTINE_SCHEDULE_SCHEMA,
     run_on: {
         type: "string",
-        enum: ["maus", "cloud"],
-        description: "Where the routine runs. Defaults to maus (this OpenMausBot setup).",
+        enum: ["maus", "box"],
+        description: "Default maus keeps the bot's selected model and configured computer, INCLUDING a self-hosted VPS. Omit this field for normal schedules. box explicitly switches the agent to the Box-hosted runner; it requires Box setup and is not the generic cloud/VPS option. Legacy cloud values from list_routines mean box, not VPS.",
     },
     timeout_minutes: {
         type: "integer",
@@ -366,9 +367,26 @@ const ROUTINE_FIELDS_SCHEMA = {
         type: "boolean",
         description: "Opt in to using the latest completed run's bounded report as historical context. Defaults to false; set false in an update to start fresh again. Included in the applied result or pending confirmation.",
     },
+    overlap: {
+        type: "string",
+        enum: ["skip", "queue"],
+        description: "While this routine is still working, skip scheduled occurrences (default) or queue at most one run. Queue skips further occurrences until the pending run starts; it never builds an unlimited backlog. Manual and webhook requests are separate.",
+    },
 };
 const PROPOSAL_OUTCOME = " Read the result: granted Full Access may apply the change immediately. If applied, continue the requested work without another confirmation. Only a pending result requires ending the turn and waiting for the in-app decision. Never claim success from the permission mode alone; report failed or cancelled results honestly. This does not elevate another bot's execution permissions.";
 const TOOLS = [
+    {
+        name: "tool_result_read",
+        description: "Read a missing portion of an oversized agents-tool result using the saved id and next offset from its notice. Returns at most 16,000 characters, only from this bot in this conversation. Use only when the preview is insufficient; do not load every page by default. Results expire after one hour, on app restart, or under cache pressure. This never reruns the original action.",
+        inputSchema: {
+            type: "object", additionalProperties: false,
+            properties: {
+                id: { type: "string", description: "Saved result id copied from the truncation notice." },
+                offset: { type: "integer", minimum: 0, description: "Character offset copied from the previous result's notice. Defaults to 0." },
+            },
+            required: ["id"],
+        },
+    },
     {
         name: "list_shared_computers",
         description: "List online desktop computers explicitly shared with this workspace, and their allowed folders/capabilities. These are the user's computers, not this server. An offline or unshared computer cannot be accessed. Folder paths use opaque folder IDs and relative paths.",
@@ -412,7 +430,7 @@ const TOOLS = [
     },
     {
         name: "ask_bot",
-        description: "SYNCHRONOUS consultation: send a short question to another bot and stay blocked until its reply is returned inline. Use only when that reply is required to write your current response. Do not use for assigning work, background tasks, or potentially long work; use delegate_bot for those. Returns promptly with a note if that bot is busy.",
+        description: "Brief synchronous consultation: send a short question to another bot. Quick replies return inline; slow replies become asynchronous delegations and return automatically after you finish your turn. Use only when that reply is required to write your current response. Do not use for assigning work, background tasks, or potentially long work; use delegate_bot for those. Returns promptly with a note if that bot is busy.",
         inputSchema: {
             type: "object",
             properties: {
@@ -854,6 +872,8 @@ async function api(path, init) {
         throw new Error(String(body.error ?? `HTTP ${status}`));
     return body;
 }
+const capResult = (text) => boundedAgentResult(text, (retained, truncated) => api("/api/internal/tool-result", { method: "POST", signal: AbortSignal.timeout(3_000),
+    body: JSON.stringify({ text: retained, truncated }) }));
 /** Like api, but a refusal comes back as its body instead of an Error —
  * for the tools whose refusals carry more than a sentence. */
 async function apiResponse(path, init) {
@@ -884,16 +904,17 @@ function routineFields(args) {
     const fields = {};
     // list_routines returns the harness names. Accept those when a model
     // copies back a definition, as we already do for interval fields.
-    if (args.run_on != null && args.runOn != null && args.run_on !== args.runOn) {
+    const destination = (value) => value === "box" ? "cloud" : value;
+    if (args.run_on != null && args.runOn != null && destination(args.run_on) !== destination(args.runOn)) {
         return { fields, error: "Choose one run_on destination; run_on and runOn disagree." };
     }
     if (args.timeout_minutes != null && args.timeoutMinutes != null && args.timeout_minutes !== args.timeoutMinutes) {
         return { fields, error: "Choose one timeout_minutes limit; timeout_minutes and timeoutMinutes disagree." };
     }
-    const runOn = args.run_on ?? args.runOn;
+    const runOn = destination(args.run_on ?? args.runOn);
     const timeoutMinutes = args.timeout_minutes ?? args.timeoutMinutes;
     if (runOn != null && runOn !== "maus" && runOn !== "cloud") {
-        return { fields, error: 'run_on must be "maus" or "cloud".' };
+        return { fields, error: 'Use run_on="maus" for the bot’s current model and configured computer (including VPS), or run_on="box" only for the Box-hosted agent. Legacy "cloud" also means Box.' };
     }
     if (timeoutMinutes != null && (typeof timeoutMinutes !== "number" || !Number.isInteger(timeoutMinutes) || timeoutMinutes < 5 || timeoutMinutes > 240)) {
         return { fields, error: "timeout_minutes must be a whole number from 5 to 240. Use clear_timeout to remove a limit." };
@@ -901,6 +922,9 @@ function routineFields(args) {
     if (args.continuity != null && typeof args.continuity !== "boolean") {
         return { fields, error: "continuity must be true or false." };
     }
+    if (args.overlap !== undefined && args.overlap !== "skip" && args.overlap !== "queue") {
+        return { fields, error: "overlap must be skip or queue." };
+    }
     if (args.clear_timeout != null && typeof args.clear_timeout !== "boolean") {
         return { fields, error: "clear_timeout must be true or false." };
     }
@@ -925,6 +949,8 @@ function routineFields(args) {
         fields.timeoutMinutes = timeoutMinutes;
     if (typeof args.continuity === "boolean")
         fields.continuity = args.continuity;
+    if (args.overlap !== undefined)
+        fields.overlap = args.overlap;
     return { fields };
 }
 /** Full Access is decided by the harness, not inferred from a model claim or
@@ -965,6 +991,17 @@ function recallSpeaker(hit) {
     return hit.role === "user" ? "user" : "you";
 }
 async function callTool(name, args) {
+    if (name === "tool_result_read") {
+        if (typeof args.id !== "string" || !/^r-[0-9a-f-]{36}$/.test(args.id) ||
+            (args.offset !== undefined && (!Number.isSafeInteger(args.offset) || Number(args.offset) < 0))) {
+            return { text: "Use the saved result id and a non-negative integer offset from its notice.", isError: true };
+        }
+        const r = await api(`/api/internal/tool-result?id=${encodeURIComponent(args.id)}&offset=${args.offset ?? 0}`, { signal: AbortSignal.timeout(3_000) });
+        const text = String(r.text ?? "");
+        return { text: `${text}\n\n[${Number(r.nextOffset) < Number(r.length)
+                ? `Read more with tool_result_read id "${args.id}" and offset ${r.nextOffset}.`
+                : `End of retained result.${r.truncated ? " The original tail exceeded the storage limit and was omitted." : ""}`}]` };
+    }
     if (name === "list_room_targets") {
         const r = await api("/api/internal/room-targets");
         return { text: JSON.stringify(r), ...(r.error ? { isError: true } : {}) };
@@ -1081,9 +1118,11 @@ async function callTool(name, args) {
             const taskId = String(r.taskId ?? "").trim();
             if (taskId)
                 delegationTaskIdsThisTurn.add(taskId);
-            const waitedMinutes = Math.max(1, Math.round((Number(r.waitedMs) || 0) / 60_000));
+            const waitedSeconds = Math.max(1, Math.round((Number(r.waitedMs) || 0) / 1000));
+            const amount = waitedSeconds < 60 ? waitedSeconds : Math.round(waitedSeconds / 60);
+            const unit = waitedSeconds < 60 ? "second" : "minute";
             return {
-                text: `${r.toBotName ?? "That bot"} is still working after ${waitedMinutes} minute${waitedMinutes === 1 ? "" : "s"} — the ask was converted to a delegation so the reply is not lost. Task id: ${taskId}. Finish your turn now; the result will be delivered to this conversation automatically. Use check_delegation in a later turn only if the user asks for status.`,
+                text: `${r.toBotName ?? "That bot"} is still working after ${amount} ${unit}${amount === 1 ? "" : "s"} — the ask was converted to a delegation so the reply is not lost. Task id: ${taskId}. Finish your turn now; the result will be delivered to this conversation automatically. Use check_delegation in a later turn only if the user asks for status.`,
             };
         }
         if (r.busy) {
@@ -1734,7 +1773,7 @@ async function handle(msg) {
                     return;
                 }
                 if (name === "list_shared_computers") {
-                    textResult(id, JSON.stringify(await api("/api/internal/shared-computers")));
+                    textResult(id, await capResult(JSON.stringify(await api("/api/internal/shared-computers"))));
                     return;
                 }
                 if (name === "shared_computer") {
@@ -1743,14 +1782,14 @@ async function handle(msg) {
                     if (Array.isArray(result?.content))
                         ok(id, result);
                     else
-                        textResult(id, JSON.stringify(result));
+                        textResult(id, await capResult(JSON.stringify(result)));
                     return;
                 }
                 const { text, isError } = await callTool(name, (params.arguments ?? {}));
-                textResult(id, text, isError);
+                textResult(id, name === "tool_result_read" ? text : await capResult(text), isError);
             }
             catch (e) {
-                textResult(id, e.message, true);
+                textResult(id, await capResult(e.message), true);
             }
             return;
         }

package/dist-server/server/drivers/agents-result.js

@@ -0,0 +1,23 @@
+import { redactSecretsInText } from "../../shared/redact.js";
+import { TOOL_RESULT_MAX_CHARS, TOOL_RESULT_PREVIEW_CHARS, toolResultPrefix } from "../tool-results.js";
+/** The operation already happened. Saving overflow must never retry it or
+ * turn a successful operation into a failed MCP call. Only cache I/O is timed. */
+export async function boundedAgentResult(text, save) {
+    if (text.length <= 24_000)
+        return text;
+    const redacted = redactSecretsInText(text);
+    const prefix = toolResultPrefix(redacted, TOOL_RESULT_PREVIEW_CHARS);
+    const retained = toolResultPrefix(redacted, TOOL_RESULT_MAX_CHARS);
+    const truncated = retained.length < redacted.length;
+    try {
+        const saved = await save(retained, truncated);
+        if (!saved || typeof saved.id !== "string" || !/^r-[0-9a-f-]{36}$/.test(saved.id))
+            throw new Error("Invalid saved result");
+        return `${prefix}\n\n[Large tool result: showing the first ${prefix.length} characters. ${truncated || saved.truncated
+            ? "Only a bounded portion was retained; the remaining tail was omitted."
+            : "The remaining redacted result is temporarily saved."} If a missing detail is needed, call tool_result_read with id "${saved.id}" and offset ${prefix.length}. Saved results expire after one hour, on app restart, or under cache pressure. Do not repeat an action just to retrieve its output.]`;
+    }
+    catch {
+        return `${prefix}\n\n[Large tool result: showing the first ${prefix.length} characters. The remaining output could not be saved. The original operation was not retried. Do not repeat an action just to retrieve its output.]`;
+    }
+}

package/dist-server/server/drivers/claude.js

@@ -9,11 +9,12 @@
 //   - the bot's cloud computer (box.ascii.dev) via server/computer-proxy.ts
 //     — screenshot/exec/open_url, the CUA-on-the-box bridge
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { createServer as createNetServer } from "node:net";
 import { homedir, tmpdir } from "node:os";
 import { join, dirname, isAbsolute, normalize } from "node:path";
 import { DATA_DIR, stripWorkspaceCredentialEnv } from "../config.js";
+import { writeFileAtomic } from "../atomic.js";
 import { augmentedPath } from "../env-path.js";
 import { brokerSocketPath, describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
@@ -25,6 +26,7 @@ import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS }
 import { applyClaudeInject, decodeInjectId, mergeLocalInject, probeLocalInjects, resolveInjectId, } from "./local-inject.js";
 import { appendNative } from "./native.js";
 import { SPAWNED_PROXIES } from "../proxy-paths.js";
+import { extractMcpImages } from "../mcp-tool-images.js";
 import { ASK_USER_QUESTION_TOOL, askQuestionSummary, parseAskQuestions, parseChoices, questionChoices, } from "../../shared/ask-question.js";
 /** Whether `claude` has been signed in.
  *
@@ -392,6 +394,7 @@ export function readClaudeModelCatalog(env = process.env) {
 // far. See server/proxy-paths.ts.
 const PERM_PROXY_PATH = SPAWNED_PROXIES.permission;
 const DWEB_PROXY_PATH = SPAWNED_PROXIES.dweb;
+const HOOK_HELPER_PATH = SPAWNED_PROXIES.hook;
 // in the packaged app process.execPath is the Electron binary — this env
 // makes it behave as plain node for the spawned MCP proxies (harmless in dev)
 const NODE_ENV_FLAG = { ELECTRON_RUN_AS_NODE: "1" };
@@ -430,6 +433,26 @@ function askSummary(ask) {
         return askQuestionSummary(questions).slice(0, 300);
     return askInputSummary(ask.input) ?? ask.tool ?? "tool";
 }
+/** Where the hook helper reads this thread's current turn token. Stable per
+ * thread (so the CLI's environment can name it once) and private. */
+export function hookTokenFile(threadId, botId) {
+    const digest = createHash("sha256").update(`${botId ?? ""}\0${threadId}`).digest("hex").slice(0, 24);
+    return join(DATA_DIR, "hook-tokens", `${digest}.token`);
+}
+/** The `hooks` block for the private --settings file: one command for each
+ * event the harness observes. Claude Code runs it with the event JSON on
+ * stdin and applies any hookSpecificOutput it prints. The command string is
+ * a shell line, so both paths are quoted (this repo's own path has a space). */
+export function claudeHookSettings(helperPath) {
+    // JSON quoting is not shell quoting: $(), backticks and $names still
+    // expand inside double quotes on POSIX. Windows paths come through env
+    // variables so their backslashes are not JSON-escaped into the command.
+    const command = process.platform === "win32"
+        ? '"%OMB_HOOK_NODE%" "%OMB_HOOK_HELPER%"'
+        : [process.execPath, helperPath].map(path => `'${path.replace(/'/g, "'\\''")}'`).join(" ");
+    const entry = [{ matcher: "", hooks: [{ type: "command", command, timeout: 5 }] }];
+    return { PostToolUse: entry, PreCompact: entry, SessionStart: entry, Stop: entry };
+}
 export function permissionSocketPath(threadId, botId) {
     // A readable prefix alone is not unique: ids that agree on their first
     // characters ("t-perm-dup-1", "t-perm-dup-2") would share a socket. POSIX
@@ -953,7 +976,7 @@ export const ClaudeDriver = {
             // a retry relaunches the whole CLI; the backoff is scaled down in tests
             // so a fake's transient failures don't stall real seconds
             const retryScale = Number(process.env.FAKE_CLAUDE_RETRY_SCALE ?? "1");
-            const sessionId = typeof turn.resumeCursor === "string" ? turn.resumeCursor : null;
+            const sessionId = !turn.sessionReset && typeof turn.resumeCursor === "string" ? turn.resumeCursor : null;
             const newSessionId = sessionId ? null : newId();
             const args = [
                 "-p",
@@ -1140,7 +1163,28 @@ export const ClaudeDriver = {
             const env = environment(turnModel);
             const authSettings = isolated && !injected.injected
                 ? readClaudeAuthSettings(env, input.environment) : {};
-            const authSettingsPath = mcpConfigPath && Object.keys(authSettings).length
+            // Harness hooks (item 0.2): one helper command for the events the
+            // harness observes. The helper reads its bearer from a per-thread file
+            // the harness rewrites every turn, so a long-lived CLI process never
+            // presents a stale token. Registered through the same private
+            // --settings file as the auth override; both are 0600 and per launch.
+            const hooks = turn.integrations?.hooks;
+            const hookTokenPath = hooks ? hookTokenFile(threadId, botId) : null;
+            if (hooks && hookTokenPath) {
+                mkdirSync(dirname(hookTokenPath), { recursive: true, mode: 0o700 });
+                writeFileAtomic(hookTokenPath, hooks.token, { mode: 0o600 });
+                env.OMB_HOOK_URL = hooks.url;
+                env.OMB_HOOK_TOKEN_FILE = hookTokenPath;
+                env.OMB_HOOK_NODE = process.execPath;
+                env.OMB_HOOK_HELPER = HOOK_HELPER_PATH;
+                // in the packaged app process.execPath is Electron — run the helper as node
+                if (process.versions.electron)
+                    env.ELECTRON_RUN_AS_NODE = "1";
+            }
+            const settings = { ...authSettings };
+            if (hooks)
+                settings.hooks = claudeHookSettings(HOOK_HELPER_PATH);
+            const authSettingsPath = mcpConfigPath && Object.keys(settings).length
                 ? join(dirname(mcpConfigPath), "auth-settings.json") : null;
             if (authSettingsPath)
                 args.push("--settings", authSettingsPath);
@@ -1163,6 +1207,8 @@ export const ClaudeDriver = {
                 model: injected.model ?? null,
                 base: env.ANTHROPIC_BASE_URL ?? null,
                 configDir: env.CLAUDE_CONFIG_DIR ?? null,
+                // hooks on/off changes the settings file the process was launched with
+                hooks: Boolean(hooks),
                 // Rotating an account's key/helper must not reuse the old process.
                 auth: createHash("sha256").update(JSON.stringify({
                     settings: authSettings,
@@ -1170,10 +1216,10 @@ export const ClaudeDriver = {
                 })).digest("hex"),
             });
             // Reuse the live process when it is idle, unchanged, and is the session
-            // the harness wants resumed. Anything else: close it and spawn fresh
-            // (with --resume, so the conversation continues in the new process).
+            // the harness wants resumed. Clearing a cursor alone does not opt out
+            // of legacy reuse: an explicit rebuild must discard the idle context.
             const live = sessions.get(threadId);
-            if (live && !live.turn && !live.closing && live.child.exitCode === null && live.argsKey === argsKey && (!sessionId || sessionId === live.sessionId)) {
+            if (!turn.sessionReset && live && !live.turn && !live.closing && live.child.exitCode === null && live.argsKey === argsKey && (!sessionId || sessionId === live.sessionId)) {
                 if (live.idleTimer)
                     clearTimeout(live.idleTimer);
                 live.turn = { turnId, input: turn, retryAbort, settled: false, sawStreamDelta: false };
@@ -1213,7 +1259,7 @@ export const ClaudeDriver = {
                 return { turnId };
             }
             if (live)
-                closeSession(threadId, "spawn contract changed");
+                closeSession(threadId, turn.sessionReset ? "context reset" : "spawn contract changed");
             // Until sessions.set() below, this turn owns every launch resource.
             // Any bind, private-config or synchronous spawn failure must release
             // them here rather than leave a live listener or credential temp file.
@@ -1308,7 +1354,7 @@ export const ClaudeDriver = {
                     writeFileSync(mcpConfigPath, JSON.stringify({ mcpServers }), { mode: 0o600 });
                 }
                 if (authSettingsPath) {
-                    writeFileSync(authSettingsPath, JSON.stringify(authSettings), { mode: 0o600 });
+                    writeFileSync(authSettingsPath, JSON.stringify(settings), { mode: 0o600 });
                 }
                 if (sessionId)
                     args.push("--resume", sessionId);
@@ -1493,6 +1539,9 @@ export const ClaudeDriver = {
                         for (const b of Array.isArray(o.message?.content) ? o.message.content : []) {
                             if (b.type === "tool_result") {
                                 emit({ ...base(threadId, currentTurnId()), type: "item.completed", itemType: "tool", itemId: b.tool_use_id, ok: !b.is_error, output: toolDetailPreview(b.content) });
+                                for (const img of extractMcpImages(b.content)) {
+                                    emit({ ...base(threadId, currentTurnId()), type: "item.completed", itemType: "assistant_image", data: img.data });
+                                }
                             }
                         }
                         break;
@@ -1627,7 +1676,9 @@ export const ClaudeDriver = {
                             active.set(threadId, { stop: () => { retry.cancelled = true; retryAbort.abort(); }, turnId });
                             try {
                                 const cursor = session.sessionId ?? sessionId ?? undefined;
-                                await sendTurn({ ...turn, resumeCursor: cursor }, turnId);
+                                // The reset was consumed by the initial launch. Retry the
+                                // new session, never the context that launch replaced.
+                                await sendTurn({ ...turn, sessionReset: false, resumeCursor: cursor }, turnId);
                             }
                             catch (e) {
                                 if (active.get(threadId)?.turnId === turnId)
@@ -1887,6 +1938,7 @@ export const ClaudeDriver = {
                     // Harness turns reassert a per-bot mode and restore the broker even
                     // when an old instance was configured with bypassPermissions.
                     localComputerMcp: true,
+                    hooks: true,
                 },
                 sendTurn,
                 steer,
@@ -1914,7 +1966,7 @@ export const ClaudeDriver = {
                     return () => listeners.delete(listener);
                 },
             },
-            generateText: (prompt) => generateReview(prompt),
+            generateText: (prompt, options) => generateReview(prompt, options?.signal),
             reviewPermission: generateReview,
             dispose: async () => {
                 try {

package/dist-server/server/drivers/codex.js

@@ -25,6 +25,7 @@ import { codexDeveloperInstructions, syncCodexInstructions } from "./codex-instr
 import { CodexDeviceAuthController } from "./codex-device-auth.js";
 import { codexAccountEmail } from "./codex-identity.js";
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
+import { extractMcpImages } from "../mcp-tool-images.js";
 export { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 const DRIVER_KIND = "codex";
 const ASTRA_MODEL_ID = "gpt-6-astra";
@@ -1039,6 +1040,11 @@ export const CodexDriver = {
                                     ok: item.status !== "failed" && item.status !== "declined",
                                     output: toolDetailPreview(item.type === "commandExecution" ? { output: item.aggregatedOutput, exitCode: item.exitCode } : item.type === "mcpToolCall" ? item.error ?? item.result : item.type === "fileChange" ? item.changes : item.action),
                                 });
+                                if (item.type === "mcpToolCall") {
+                                    for (const img of extractMcpImages(item.result)) {
+                                        emit({ ...base(threadId, turnId), type: "item.completed", itemType: "assistant_image", data: img.data });
+                                    }
+                                }
                             }
                             else if (item.type === "reasoning") {
                                 emit({ ...base(threadId, turnId), type: "item.updated", itemType: "reasoning", tokens: null });

package/dist-server/server/drivers/openai-chat.js

@@ -115,11 +115,67 @@ export function createOpenAIChatRuntime(options) {
             const reader = response.body.getReader();
             const decoder = new TextDecoder();
             let buffer = "";
+            const consumeDataLine = (line, atEof = false) => {
+                if (!line.startsWith("data:"))
+                    return false;
+                const data = line.slice(5).trim();
+                if (data === "[DONE]")
+                    return true;
+                let chunk;
+                try {
+                    chunk = JSON.parse(data);
+                }
+                catch {
+                    // A tail left in the buffer when the socket closed is an INCOMPLETE
+                    // frame, not a bad one: a stop, an abort or a dropped connection all
+                    // end mid-frame. Only a properly newline-terminated frame that will
+                    // not parse means the provider actually sent something malformed.
+                    // Counting the tail here turned a stopped turn into a hard,
+                    // non-retryable failure (`calls.finish(finishReason, malformedFrame)`).
+                    if (!atEof)
+                        malformedFrame = true;
+                    return false;
+                }
+                const chunkError = providerError(chunk);
+                if (chunkError)
+                    throw new ChatProtocolError(`provider returned a streaming completion error: ${chunkError.slice(0, 200)}`);
+                const choice = chunk.choices?.find((row) => row.index === undefined || row.index === 0);
+                const delta = choice?.delta;
+                if (object(delta))
+                    sawChoice = true;
+                if (delta?.function_call)
+                    throw new ChatProtocolError("legacy function_call is unsupported; use structured tool_calls");
+                calls.add(delta?.tool_calls, true);
+                details.add(delta?.reasoning_details);
+                if (choice?.finish_reason)
+                    finishReason = choice.finish_reason;
+                const reasoningPart = delta?.reasoning_content ?? delta?.reasoning;
+                if (typeof reasoningPart === "string")
+                    protocolReasoning += reasoningPart;
+                const reasoningDelta = options.reasoning && typeof reasoningPart === "string"
+                    ? reasoningPart
+                    : "";
+                const contentDelta = typeof delta?.content === "string" ? delta.content : "";
+                if (reasoningDelta) {
+                    reasoning += reasoningDelta;
+                    onDelta?.(reasoningDelta, "reasoning_text");
+                }
+                if (contentDelta) {
+                    text += contentDelta;
+                    onDelta?.(contentDelta, "assistant_text");
+                }
+                if (chunk.usage)
+                    usage = usageFrom(chunk.usage);
+                return false;
+            };
             try {
                 readLoop: for (;;) {
                     const { done, value } = await reader.read();
                     if (done) {
                         buffer += decoder.decode();
+                        const line = buffer.trim();
+                        if (line && line !== "data: [DONE]")
+                            consumeDataLine(line, true);
                         // MiniMax's api.minimax.io/v1 closes the connection after the
                         // finish_reason chunk and never sends `[DONE]`.
                         if (buffer.trim() === "data: [DONE]" || finishReason)
@@ -146,49 +202,8 @@ export function createOpenAIChatRuntime(options) {
                     while ((newline = buffer.indexOf("\n")) !== -1) {
                         const line = buffer.slice(0, newline).trim();
                         buffer = buffer.slice(newline + 1);
-                        if (!line.startsWith("data:"))
-                            continue;
-                        const data = line.slice(5).trim();
-                        if (data === "[DONE]")
+                        if (consumeDataLine(line))
                             break readLoop;
-                        let chunk;
-                        try {
-                            chunk = JSON.parse(data);
-                        }
-                        catch {
-                            malformedFrame = true;
-                            continue;
-                        }
-                        const chunkError = providerError(chunk);
-                        if (chunkError)
-                            throw new ChatProtocolError(`provider returned a streaming completion error: ${chunkError.slice(0, 200)}`);
-                        const choice = chunk.choices?.find((row) => row.index === undefined || row.index === 0);
-                        const delta = choice?.delta;
-                        if (object(delta))
-                            sawChoice = true;
-                        if (delta?.function_call)
-                            throw new ChatProtocolError("legacy function_call is unsupported; use structured tool_calls");
-                        calls.add(delta?.tool_calls, true);
-                        details.add(delta?.reasoning_details);
-                        if (choice?.finish_reason)
-                            finishReason = choice.finish_reason;
-                        const reasoningPart = delta?.reasoning_content ?? delta?.reasoning;
-                        if (typeof reasoningPart === "string")
-                            protocolReasoning += reasoningPart;
-                        const reasoningDelta = options.reasoning && typeof reasoningPart === "string"
-                            ? reasoningPart
-                            : "";
-                        const contentDelta = typeof delta?.content === "string" ? delta.content : "";
-                        if (reasoningDelta) {
-                            reasoning += reasoningDelta;
-                            onDelta?.(reasoningDelta, "reasoning_text");
-                        }
-                        if (contentDelta) {
-                            text += contentDelta;
-                            onDelta?.(contentDelta, "assistant_text");
-                        }
-                        if (chunk.usage)
-                            usage = usageFrom(chunk.usage);
                     }
                 }
             }
@@ -383,7 +398,13 @@ export function createOpenAIChatRuntime(options) {
                                 throw new ChatProtocolError("tool arguments must be a JSON object");
                             tools.validate(call.function.name, args);
                             const inputPreview = preview(args);
-                            const allowed = await approval.ask(call.function.name, inputPreview ?? "This tool has no arguments.");
+                            // Full access is the person's explicit grant to answer every
+                            // prompt. This runtime has no provider reviewer to hand it to,
+                            // so it is honoured here: without it every single tool call on
+                            // an OpenAI-compatible engine stops for a card, and a Chief's
+                            // delegated Full access cannot help either.
+                            const allowed = turn.approvalMode === "full"
+                                || await approval.ask(call.function.name, inputPreview ?? "This tool has no arguments.");
                             abort.signal.throwIfAborted();
                             emit({ ...base(turn.threadId, turnId), type: "item.started", itemType: "tool", itemId: call.id,
                                 title: call.function.name, ...(inputPreview ? { input: inputPreview } : {}),
@@ -489,9 +510,9 @@ export function createOpenAIChatRuntime(options) {
                 return () => listeners.delete(listener);
             },
         },
-        generateText: async (prompt) => {
+        generateText: async (prompt, { signal } = {}) => {
             const model = options.generateModel?.() ?? options.models().default;
-            const { text, reasoning, toolCalls } = await complete([{ role: "user", content: prompt }], model, false);
+            const { text, reasoning, toolCalls } = await complete([{ role: "user", content: prompt }], model, false, signal);
             if (toolCalls.length)
                 throw new ChatProtocolError("provider returned tool calls to a text-only helper");
             return text.trim() ? text : reasoning;

package/dist-server/server/drivers/openai-compat.js

@@ -132,6 +132,7 @@ export const OpenAICompatDriver = {
                 model,
                 messages,
                 stream,
+                stream_options: stream ? { include_usage: true } : undefined,
                 ...(config.provider && isOpenRouterUrl(config.url)
                     ? { provider: { order: [config.provider], allow_fallbacks: false } }
                     : {}),

package/dist-server/server/hooks/omb-hook.js

@@ -0,0 +1,103 @@
+// omb-hook — the one command OpenMausBot registers for Claude Code hooks
+// (PostToolUse, PreCompact, SessionStart, Stop). Claude Code runs it with the
+// hook's JSON on stdin and waits for it, so it obeys three rules learned
+// the hard way by other harnesses:
+//
+//   1. It ALWAYS exits 0. A hook that fails or times out can block the
+//      agent's next step; the harness observing is never worth that.
+//   2. It has a hard budget (OMB_HOOK_TIMEOUT_MS, default 4000) below Claude
+//      Code's own per-hook timeout, and speaks only to the loopback harness.
+//   3. It is dependency-free and does no work itself: it forwards the event
+//      to POST /api/internal/hook with the turn's capability token (read
+//      from OMB_HOOK_TOKEN_FILE at run time — the token rotates per turn
+//      while the CLI process, and its environment, live on) and prints the
+//      harness's `hookSpecificOutput`, if any, for Claude Code to apply.
+//
+// stdout is the hook channel — never console.log anything else here.
+import { readFileSync } from "node:fs";
+const CONTEXT_EVENTS = new Set(["SessionStart", "UserPromptSubmit"]);
+const requestedBudget = Number(process.env.OMB_HOOK_TIMEOUT_MS);
+const budgetMs = Number.isFinite(requestedBudget) && requestedBudget > 0 ? Math.min(requestedBudget, 4_000) : 4_000;
+const MAX_INPUT_BYTES = 1024 * 1024;
+const url = process.env.OMB_HOOK_URL ?? "";
+const tokenFile = process.env.OMB_HOOK_TOKEN_FILE ?? "";
+const done = (out) => {
+    if (out === undefined)
+        process.exit(0);
+    process.stdout.write(out, () => process.exit(0));
+};
+process.stdout.on("error", () => process.exit(0));
+// the outer fuse: whatever is still pending when this fires, we leave
+const fuse = setTimeout(() => done(), budgetMs);
+fuse.unref();
+function readStdin() {
+    return new Promise((resolve) => {
+        let data = "";
+        let bytes = 0;
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => {
+            bytes += Buffer.byteLength(chunk);
+            if (bytes > MAX_INPUT_BYTES)
+                return done();
+            data += chunk;
+        });
+        process.stdin.on("end", () => resolve(data));
+        process.stdin.on("error", () => resolve(data));
+    });
+}
+async function main() {
+    const raw = await readStdin();
+    let payload;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return done();
+        payload = parsed;
+    }
+    catch {
+        return done();
+    }
+    const event = typeof payload.hook_event_name === "string" ? payload.hook_event_name : "";
+    if (!event || !/^https?:\/\/127\.0\.0\.1(:\d+)?$/.test(url) || !tokenFile)
+        return done();
+    let token = "";
+    try {
+        token = readFileSync(tokenFile, "utf8").trim();
+    }
+    catch {
+        return done();
+    }
+    if (!token)
+        return done();
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), Math.max(200, budgetMs - 300));
+    try {
+        const response = await fetch(`${url}/api/internal/hook`, {
+            method: "POST",
+            headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+            body: JSON.stringify({ event, payload }),
+            redirect: "error",
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return done();
+        const body = (await response.json().catch(() => null));
+        if (body && typeof body === "object" && body.hookSpecificOutput && typeof body.hookSpecificOutput === "object") {
+            return done(JSON.stringify({ hookSpecificOutput: body.hookSpecificOutput }));
+        }
+        // On SessionStart (and UserPromptSubmit) Claude Code reads plain-text
+        // stdout as context the model sees; on every other event stdout is
+        // only a debug line, so a context body is printed nowhere else.
+        if (body && typeof body === "object" && typeof body.context === "string" && body.context && CONTEXT_EVENTS.has(event)) {
+            return done(body.context);
+        }
+        return done();
+    }
+    catch {
+        return done();
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+void main();