openmausbot 0.1.84 → 0.1.86

package/dist-server/server/drivers/agents-result.js

@@ -0,0 +1,23 @@
+import { redactSecretsInText } from "../../shared/redact.js";
+import { TOOL_RESULT_MAX_CHARS, TOOL_RESULT_PREVIEW_CHARS, toolResultPrefix } from "../tool-results.js";
+/** The operation already happened. Saving overflow must never retry it or
+ * turn a successful operation into a failed MCP call. Only cache I/O is timed. */
+export async function boundedAgentResult(text, save) {
+    if (text.length <= 24_000)
+        return text;
+    const redacted = redactSecretsInText(text);
+    const prefix = toolResultPrefix(redacted, TOOL_RESULT_PREVIEW_CHARS);
+    const retained = toolResultPrefix(redacted, TOOL_RESULT_MAX_CHARS);
+    const truncated = retained.length < redacted.length;
+    try {
+        const saved = await save(retained, truncated);
+        if (!saved || typeof saved.id !== "string" || !/^r-[0-9a-f-]{36}$/.test(saved.id))
+            throw new Error("Invalid saved result");
+        return `${prefix}\n\n[Large tool result: showing the first ${prefix.length} characters. ${truncated || saved.truncated
+            ? "Only a bounded portion was retained; the remaining tail was omitted."
+            : "The remaining redacted result is temporarily saved."} If a missing detail is needed, call tool_result_read with id "${saved.id}" and offset ${prefix.length}. Saved results expire after one hour, on app restart, or under cache pressure. Do not repeat an action just to retrieve its output.]`;
+    }
+    catch {
+        return `${prefix}\n\n[Large tool result: showing the first ${prefix.length} characters. The remaining output could not be saved. The original operation was not retried. Do not repeat an action just to retrieve its output.]`;
+    }
+}

package/dist-server/server/drivers/chat-mcp-tools.js

@@ -3,6 +3,8 @@
 import { Ajv } from "ajv";
 import { Ajv2020 } from "ajv/dist/2020.js";
 import formats from "ajv-formats";
+import { stripControlPlaneEnv } from "../config.js";
+import { augmentedPath } from "../env-path.js";
 import { killCliTree, spawnCli } from "../procs.js";
 /** The transport cannot safely continue this turn. A dispatched operation may
  * already have taken effect, so callers must not retry it through a new round. */
@@ -21,6 +23,14 @@ function object(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function aborted() { return new Error("MCP operation cancelled"); }
+/** These servers are a chat-runtime bot's tools, the counterpart of an engine
+ * CLI's children: the operator's control-plane secrets never ride along. What
+ * the server entry itself names is a deliberate grant and is applied last. */
+export function chatMcpEnvironment(serverEnv, source = process.env) {
+    const env = { ...source, PATH: augmentedPath() };
+    stripControlPlaneEnv(env);
+    return { ...env, ...serverEnv };
+}
 class ChatMcpClient {
     child;
     buffer = "";
@@ -31,8 +41,11 @@ class ChatMcpClient {
     pending = new Map();
     constructor(server) {
         try {
+            // The desktop shell inherits Finder's bare PATH, where `npx`-style
+            // servers cannot find `node` and exit at once. Widen it the way the
+            // Claude and Codex drivers do; a PATH the user set on the server wins.
             this.child = spawnCli(server.command, server.args, {
-                stdio: ["pipe", "pipe", "pipe"], env: { ...process.env, ...server.env },
+                stdio: ["pipe", "pipe", "pipe"], env: chatMcpEnvironment(server.env),
             });
         }
         catch {
@@ -64,7 +77,9 @@ class ChatMcpClient {
             entry.reject(new Error("MCP session closed"));
         this.pending.clear();
         this.buffer = "";
-        this.closing = killCliTree(this.child, 500).then((stopped) => {
+        // Confirm within the codebase-default grace: Windows reaps the tree via
+        // taskkill /T, which can exceed shorter budgets on a loaded machine.
+        this.closing = killCliTree(this.child, 5_000).then((stopped) => {
             if (!stopped)
                 throw new Error("MCP server shutdown could not be confirmed; execution outcome may be uncertain");
         });

package/dist-server/server/drivers/claude.js

@@ -9,11 +9,12 @@
 //   - the bot's cloud computer (box.ascii.dev) via server/computer-proxy.ts
 //     — screenshot/exec/open_url, the CUA-on-the-box bridge
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { createServer as createNetServer } from "node:net";
 import { homedir, tmpdir } from "node:os";
 import { join, dirname, isAbsolute, normalize } from "node:path";
 import { DATA_DIR, stripWorkspaceCredentialEnv } from "../config.js";
+import { writeFileAtomic } from "../atomic.js";
 import { augmentedPath } from "../env-path.js";
 import { brokerSocketPath, describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
@@ -25,6 +26,7 @@ import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS }
 import { applyClaudeInject, decodeInjectId, mergeLocalInject, probeLocalInjects, resolveInjectId, } from "./local-inject.js";
 import { appendNative } from "./native.js";
 import { SPAWNED_PROXIES } from "../proxy-paths.js";
+import { extractMcpImages } from "../mcp-tool-images.js";
 import { ASK_USER_QUESTION_TOOL, askQuestionSummary, parseAskQuestions, parseChoices, questionChoices, } from "../../shared/ask-question.js";
 /** Whether `claude` has been signed in.
  *
@@ -320,6 +322,7 @@ export const STATIC_CLAUDE_MODELS = {
     options: [
         { id: "claude-fable-5-1", label: "Claude Fable 5.1" },
         { id: "claude-fable-5", label: "Claude Fable 5" },
+        { id: "claude-opus-5-5", label: "Claude Opus 5.5", contextWindow: 1_000_000 },
         { id: "claude-opus-5", label: "Claude Opus 5" },
         { id: "claude-sonnet-5", label: "Claude Sonnet 5" },
         { id: "claude-haiku-4-5", label: "Claude Haiku 4.5" },
@@ -392,6 +395,7 @@ export function readClaudeModelCatalog(env = process.env) {
 // far. See server/proxy-paths.ts.
 const PERM_PROXY_PATH = SPAWNED_PROXIES.permission;
 const DWEB_PROXY_PATH = SPAWNED_PROXIES.dweb;
+const HOOK_HELPER_PATH = SPAWNED_PROXIES.hook;
 // in the packaged app process.execPath is the Electron binary — this env
 // makes it behave as plain node for the spawned MCP proxies (harmless in dev)
 const NODE_ENV_FLAG = { ELECTRON_RUN_AS_NODE: "1" };
@@ -430,6 +434,26 @@ function askSummary(ask) {
         return askQuestionSummary(questions).slice(0, 300);
     return askInputSummary(ask.input) ?? ask.tool ?? "tool";
 }
+/** Where the hook helper reads this thread's current turn token. Stable per
+ * thread (so the CLI's environment can name it once) and private. */
+export function hookTokenFile(threadId, botId) {
+    const digest = createHash("sha256").update(`${botId ?? ""}\0${threadId}`).digest("hex").slice(0, 24);
+    return join(DATA_DIR, "hook-tokens", `${digest}.token`);
+}
+/** The `hooks` block for the private --settings file: one command for each
+ * event the harness observes. Claude Code runs it with the event JSON on
+ * stdin and applies any hookSpecificOutput it prints. The command string is
+ * a shell line, so both paths are quoted (this repo's own path has a space). */
+export function claudeHookSettings(helperPath) {
+    // JSON quoting is not shell quoting: $(), backticks and $names still
+    // expand inside double quotes on POSIX. Windows paths come through env
+    // variables so their backslashes are not JSON-escaped into the command.
+    const command = process.platform === "win32"
+        ? '"%OMB_HOOK_NODE%" "%OMB_HOOK_HELPER%"'
+        : [process.execPath, helperPath].map(path => `'${path.replace(/'/g, "'\\''")}'`).join(" ");
+    const entry = [{ matcher: "", hooks: [{ type: "command", command, timeout: 5 }] }];
+    return { PostToolUse: entry, PreCompact: entry, SessionStart: entry, Stop: entry };
+}
 export function permissionSocketPath(threadId, botId) {
     // A readable prefix alone is not unique: ids that agree on their first
     // characters ("t-perm-dup-1", "t-perm-dup-2") would share a socket. POSIX
@@ -701,10 +725,13 @@ function decodeConfig(raw) {
     const configDir = typeof o.configDir === "string" ? o.configDir.trim() : undefined;
     if (configDir)
         resolveClaudeConfigDir(configDir);
+    if (o.managedModels !== undefined && (o.managed !== true || !Array.isArray(o.managedModels) || !o.managedModels.length || o.managedModels.some(model => typeof model !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/.test(model))))
+        throw new Error("Invalid hosted Claude models.");
     return {
         cli: typeof o.cli === "string" ? o.cli : "claude",
         ...(configDir ? { configDir } : {}),
         ...(o.managed === true ? { managed: true } : {}),
+        ...(o.managedModels ? { managedModels: o.managedModels } : {}),
         permissionMode: mode ?? "acceptEdits",
         ...(tools !== undefined ? { tools } : {}),
         ...(disallowedTools !== undefined ? { disallowedTools } : {}),
@@ -798,7 +825,7 @@ export const ClaudeDriver = {
         if (inheritsUserConfig(catalogEnv)) {
             console.error(`claude (${instanceId}): OMB_CLAUDE_INHERIT_USER_CONFIG=1 — bots inherit this machine's Claude Code MCP servers, skills, hooks and CLAUDE.md on every turn; remove it unless a bot needs a user-scope server`);
         }
-        let models = STATIC_CLAUDE_MODELS;
+        let models = config.managedModels ? { default: config.managedModels[0], options: config.managedModels.map(id => ({ id, label: id })) } : STATIC_CLAUDE_MODELS;
         const refreshModels = async () => {
             if (config.managed)
                 return;
@@ -909,6 +936,8 @@ export const ClaudeDriver = {
         // is a fresh sendTurn, and the attempt cap must survive across launches
         const retryState = new Map();
         const sendTurn = async (turn, logicalTurnId) => {
+            if (config.managedModels && (!turn.model || !config.managedModels.includes(turn.model)))
+                throw new Error("This model is not assigned to this workspace.");
             if (config.managed && (!turn.model || turn.model.includes("::") || !config.configDir ||
                 !input.environment.ANTHROPIC_API_KEY || !input.environment.ANTHROPIC_BASE_URL)) {
                 throw new Error("Company model access is unavailable. Reconnect your organization; personal billing will not be used.");
@@ -953,7 +982,7 @@ export const ClaudeDriver = {
             // a retry relaunches the whole CLI; the backoff is scaled down in tests
             // so a fake's transient failures don't stall real seconds
             const retryScale = Number(process.env.FAKE_CLAUDE_RETRY_SCALE ?? "1");
-            const sessionId = typeof turn.resumeCursor === "string" ? turn.resumeCursor : null;
+            const sessionId = !turn.sessionReset && typeof turn.resumeCursor === "string" ? turn.resumeCursor : null;
             const newSessionId = sessionId ? null : newId();
             const args = [
                 "-p",
@@ -1140,7 +1169,28 @@ export const ClaudeDriver = {
             const env = environment(turnModel);
             const authSettings = isolated && !injected.injected
                 ? readClaudeAuthSettings(env, input.environment) : {};
-            const authSettingsPath = mcpConfigPath && Object.keys(authSettings).length
+            // Harness hooks (item 0.2): one helper command for the events the
+            // harness observes. The helper reads its bearer from a per-thread file
+            // the harness rewrites every turn, so a long-lived CLI process never
+            // presents a stale token. Registered through the same private
+            // --settings file as the auth override; both are 0600 and per launch.
+            const hooks = turn.integrations?.hooks;
+            const hookTokenPath = hooks ? hookTokenFile(threadId, botId) : null;
+            if (hooks && hookTokenPath) {
+                mkdirSync(dirname(hookTokenPath), { recursive: true, mode: 0o700 });
+                writeFileAtomic(hookTokenPath, hooks.token, { mode: 0o600 });
+                env.OMB_HOOK_URL = hooks.url;
+                env.OMB_HOOK_TOKEN_FILE = hookTokenPath;
+                env.OMB_HOOK_NODE = process.execPath;
+                env.OMB_HOOK_HELPER = HOOK_HELPER_PATH;
+                // in the packaged app process.execPath is Electron — run the helper as node
+                if (process.versions.electron)
+                    env.ELECTRON_RUN_AS_NODE = "1";
+            }
+            const settings = { ...authSettings };
+            if (hooks)
+                settings.hooks = claudeHookSettings(HOOK_HELPER_PATH);
+            const authSettingsPath = mcpConfigPath && Object.keys(settings).length
                 ? join(dirname(mcpConfigPath), "auth-settings.json") : null;
             if (authSettingsPath)
                 args.push("--settings", authSettingsPath);
@@ -1163,6 +1213,8 @@ export const ClaudeDriver = {
                 model: injected.model ?? null,
                 base: env.ANTHROPIC_BASE_URL ?? null,
                 configDir: env.CLAUDE_CONFIG_DIR ?? null,
+                // hooks on/off changes the settings file the process was launched with
+                hooks: Boolean(hooks),
                 // Rotating an account's key/helper must not reuse the old process.
                 auth: createHash("sha256").update(JSON.stringify({
                     settings: authSettings,
@@ -1170,14 +1222,16 @@ export const ClaudeDriver = {
                 })).digest("hex"),
             });
             // Reuse the live process when it is idle, unchanged, and is the session
-            // the harness wants resumed. Anything else: close it and spawn fresh
-            // (with --resume, so the conversation continues in the new process).
+            // the harness wants resumed. Clearing a cursor alone does not opt out
+            // of legacy reuse: an explicit rebuild must discard the idle context.
             const live = sessions.get(threadId);
-            if (live && !live.turn && !live.closing && live.child.exitCode === null && live.argsKey === argsKey && (!sessionId || sessionId === live.sessionId)) {
+            if (!turn.sessionReset && live && !live.turn && !live.closing && live.child.exitCode === null && live.argsKey === argsKey && (!sessionId || sessionId === live.sessionId)) {
                 if (live.idleTimer)
                     clearTimeout(live.idleTimer);
                 live.turn = { turnId, input: turn, retryAbort, settled: false, sawStreamDelta: false };
                 active.set(threadId, { stop: () => {
+                        if (live.turn)
+                            live.turn.stopRequested = true;
                         closeSession(threadId, "interrupted");
                         retry.cancelled = true;
                         retryAbort.abort();
@@ -1189,8 +1243,9 @@ export const ClaudeDriver = {
                     ? promptMsg
                     : claudeUserMessage(withVolatileNote(turn.text, volatile), turn.images);
                 live.volatile = volatile;
+                const running = live.turn;
                 const written = await writeUser(live, threadId, message);
-                if (!written) {
+                if (!written && !running?.stopRequested) {
                     active.delete(threadId);
                     live.turn = null;
                     closeSession(threadId, "stdin write failed");
@@ -1213,7 +1268,7 @@ export const ClaudeDriver = {
                 return { turnId };
             }
             if (live)
-                closeSession(threadId, "spawn contract changed");
+                closeSession(threadId, turn.sessionReset ? "context reset" : "spawn contract changed");
             // Until sessions.set() below, this turn owns every launch resource.
             // Any bind, private-config or synchronous spawn failure must release
             // them here rather than leave a live listener or credential temp file.
@@ -1308,7 +1363,7 @@ export const ClaudeDriver = {
                     writeFileSync(mcpConfigPath, JSON.stringify({ mcpServers }), { mode: 0o600 });
                 }
                 if (authSettingsPath) {
-                    writeFileSync(authSettingsPath, JSON.stringify(authSettings), { mode: 0o600 });
+                    writeFileSync(authSettingsPath, JSON.stringify(settings), { mode: 0o600 });
                 }
                 if (sessionId)
                     args.push("--resume", sessionId);
@@ -1493,6 +1548,9 @@ export const ClaudeDriver = {
                         for (const b of Array.isArray(o.message?.content) ? o.message.content : []) {
                             if (b.type === "tool_result") {
                                 emit({ ...base(threadId, currentTurnId()), type: "item.completed", itemType: "tool", itemId: b.tool_use_id, ok: !b.is_error, output: toolDetailPreview(b.content) });
+                                for (const img of extractMcpImages(b.content)) {
+                                    emit({ ...base(threadId, currentTurnId()), type: "item.completed", itemType: "assistant_image", data: img.data });
+                                }
                             }
                         }
                         break;
@@ -1561,7 +1619,10 @@ export const ClaudeDriver = {
                 // a turn still running when the process died is a failed turn; a
                 // process that exited between turns (idle close, contract change)
                 // is just a session ending
-                if (session.turn && !session.turn.settled) {
+                if (session.turn?.stopRequested && !session.turn.settled) {
+                    settle(false, "interrupted");
+                }
+                else if (session.turn && !session.turn.settled) {
                     // A retained process may be running a later user turn. Its close
                     // handler must retry that request, not the process's first prompt.
                     const { turnId, input: turn, retryAbort } = session.turn;
@@ -1627,7 +1688,9 @@ export const ClaudeDriver = {
                             active.set(threadId, { stop: () => { retry.cancelled = true; retryAbort.abort(); }, turnId });
                             try {
                                 const cursor = session.sessionId ?? sessionId ?? undefined;
-                                await sendTurn({ ...turn, resumeCursor: cursor }, turnId);
+                                // The reset was consumed by the initial launch. Retry the
+                                // new session, never the context that launch replaced.
+                                await sendTurn({ ...turn, sessionReset: false, resumeCursor: cursor }, turnId);
                             }
                             catch (e) {
                                 if (active.get(threadId)?.turnId === turnId)
@@ -1743,6 +1806,8 @@ export const ClaudeDriver = {
                 void session.finishClose();
             });
             const stop = () => {
+                if (session.turn)
+                    session.turn.stopRequested = true;
                 // taskkill is asynchronous on Windows. Retire steering and approvals
                 // now, before a still-connected child can submit more work.
                 closeSession(threadId, "interrupted");
@@ -1756,7 +1821,8 @@ export const ClaudeDriver = {
             // stdin stays OPEN: that is what keeps the session alive for a
             // mid-turn steer or the next turn; closeSession() ends it.
             if (!(await writeUser(session, threadId, promptMsg))) {
-                settle(false, "stdin_write_failed");
+                if (!session.turn?.stopRequested)
+                    settle(false, "stdin_write_failed");
                 closeSession(threadId, "stdin write failed");
             }
             return { turnId };
@@ -1793,9 +1859,9 @@ export const ClaudeDriver = {
          * `claude -p "prompt"` shape is not safe for review. No tools or MCP
          * servers are mounted in this isolated process. */
         const generateReview = (prompt, signal) => new Promise((resolve, reject) => {
-            const child = spawnCli(config.cli, ["-p", "--model", "claude-haiku-4-5", "--output-format", "text"], {
+            const child = spawnCli(config.cli, ["-p", "--model", config.managedModels?.[0] ?? "claude-haiku-4-5", "--output-format", "text"], {
                 stdio: ["pipe", "pipe", "pipe"],
-                env: environment("claude-haiku-4-5"),
+                env: environment(config.managedModels?.[0] ?? "claude-haiku-4-5"),
             });
             let stdout = "";
             let stderr = "";
@@ -1887,6 +1953,7 @@ export const ClaudeDriver = {
                     // Harness turns reassert a per-bot mode and restore the broker even
                     // when an old instance was configured with bypassPermissions.
                     localComputerMcp: true,
+                    hooks: true,
                 },
                 sendTurn,
                 steer,
@@ -1914,7 +1981,7 @@ export const ClaudeDriver = {
                     return () => listeners.delete(listener);
                 },
             },
-            generateText: (prompt) => generateReview(prompt),
+            generateText: (prompt, options) => generateReview(prompt, options?.signal),
             reviewPermission: generateReview,
             dispose: async () => {
                 try {

package/dist-server/server/drivers/codex-mcp-names.js

@@ -0,0 +1,44 @@
+// MCP server names the user already declared in their own Codex config.
+//
+// Custom MCP servers reach codex as `-c mcp_servers.<name>.…` overrides, and
+// codex merges an override into any same-named table in config.toml. A stdio
+// command laid over a remote `url` entry is "invalid configuration": codex
+// falls back to defaults, config/read fails, and the whole turn dies before
+// the model is even asked. Mounting a colliding server under a name of its
+// own keeps both definitions usable.
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const HEADER = /^[ \t]*\[[ \t]*mcp_servers[ \t]*\.[ \t]*(?:"((?:[^"\\]|\\.)*)"|'([^']*)'|([A-Za-z0-9_-]+))[ \t]*[.\]]/gm;
+/** Names declared as `[mcp_servers.<name>]` (or a sub-table of one). Inline
+ * tables are not scanned; a collision there still surfaces as codex's own
+ * configuration error. */
+export function mcpServerNamesInToml(toml) {
+    const names = new Set();
+    for (const match of toml.matchAll(HEADER)) {
+        const name = match[1] !== undefined ? match[1].replace(/\\(.)/g, "$1") : match[2] ?? match[3];
+        if (name)
+            names.add(name);
+    }
+    return names;
+}
+/** Server names in the config.toml of the Codex home this child will use. */
+export function codexConfigMcpServerNames(env) {
+    const codexHome = env.CODEX_HOME || join(env.HOME || env.USERPROFILE || homedir(), ".codex");
+    try {
+        return mcpServerNamesInToml(readFileSync(join(codexHome, "config.toml"), "utf8"));
+    }
+    catch {
+        return new Set();
+    }
+}
+/** The name to mount a custom server under: its own, unless the user's Codex
+ * config already has a server by that name. */
+export function mountedMcpServerName(name, taken) {
+    if (!taken.has(name))
+        return name;
+    let candidate = `${name}_openmausbot`;
+    for (let i = 2; taken.has(candidate); i++)
+        candidate = `${name}_openmausbot${i}`;
+    return candidate;
+}

package/dist-server/server/drivers/codex.js

@@ -11,6 +11,7 @@
 // and preserves that history or reports a failed resume.
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
+import { codexConfigMcpServerNames, mountedMcpServerName } from "./codex-mcp-names.js";
 import { stripWorkspaceCredentialEnv } from "../config.js";
 import { describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
 import { isHarnessOwnedMcpEnvName } from "../mcp-registry.js";
@@ -25,6 +26,7 @@ import { codexDeveloperInstructions, syncCodexInstructions } from "./codex-instr
 import { CodexDeviceAuthController } from "./codex-device-auth.js";
 import { codexAccountEmail } from "./codex-identity.js";
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
+import { extractMcpImages } from "../mcp-tool-images.js";
 export { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 const DRIVER_KIND = "codex";
 const ASTRA_MODEL_ID = "gpt-6-astra";
@@ -127,6 +129,14 @@ export function managedCodexArgs(config) {
 const QUESTION_TIMEOUT_NOTE = "No answer was given — use your best judgment.";
 const DENY_TIMEOUT_NOTE = "OpenMausBot: nobody answered this permission request in time. Skip this action and finish what you can without it.";
 const skippedSseServers = new Set();
+const renamedMcpServers = new Set();
+/** Logged once per name: the rename is deliberate, not a lost server. */
+function noteRenamedMcpServer(name, mountName) {
+    if (renamedMcpServers.has(name))
+        return;
+    renamedMcpServers.add(name);
+    console.error(`codex: MCP server ${JSON.stringify(name)} is also declared in Codex's own config.toml — mounted as ${JSON.stringify(mountName)} for this bot so the two do not merge`);
+}
 function noteSkippedSseServer(name) {
     if (skippedSseServers.has(name))
         return;
@@ -592,6 +602,11 @@ export const CodexDriver = {
                 if (turn.integrations?.browser) {
                     mountMcpServer(appServerArgs, env, "browser", turn.integrations.browser);
                 }
+                // A custom server named like one in the user's own config.toml would
+                // be merged with it by the `-c` override — a stdio command over a
+                // remote url is "invalid configuration" and kills the turn before the
+                // model is asked. Such a server mounts under a name of its own.
+                const declaredInCodexConfig = codexConfigMcpServerNames(env);
                 for (const [name, server] of Object.entries(turn.integrations?.custom ?? {})) {
                     // codex speaks streamable HTTP to a remote server, not the older
                     // SSE transport: such an entry still reaches Claude bots, and is
@@ -600,7 +615,10 @@ export const CodexDriver = {
                         noteSkippedSseServer(name);
                         continue;
                     }
-                    mountMcpServer(appServerArgs, env, name, server, false);
+                    const mountName = mountedMcpServerName(name, declaredInCodexConfig);
+                    if (mountName !== name)
+                        noteRenamedMcpServer(name, mountName);
+                    mountMcpServer(appServerArgs, env, mountName, server, false);
                 }
                 if (turn.integrations?.phone) {
                     const bridge = turn.integrations.phone;
@@ -1039,6 +1057,11 @@ export const CodexDriver = {
                                     ok: item.status !== "failed" && item.status !== "declined",
                                     output: toolDetailPreview(item.type === "commandExecution" ? { output: item.aggregatedOutput, exitCode: item.exitCode } : item.type === "mcpToolCall" ? item.error ?? item.result : item.type === "fileChange" ? item.changes : item.action),
                                 });
+                                if (item.type === "mcpToolCall") {
+                                    for (const img of extractMcpImages(item.result)) {
+                                        emit({ ...base(threadId, turnId), type: "item.completed", itemType: "assistant_image", data: img.data });
+                                    }
+                                }
                             }
                             else if (item.type === "reasoning") {
                                 emit({ ...base(threadId, turnId), type: "item.updated", itemType: "reasoning", tokens: null });
@@ -1282,10 +1305,15 @@ export const CodexDriver = {
                         });
                         effectiveConfig = configured?.config;
                     }
-                    catch {
+                    catch (error) {
                         // Do not expose a possibly secret-bearing native config error or
-                        // overwrite unknown instructions with an empty fallback.
-                        throw new Error("Could not read Codex configuration; cannot safely update bot instructions. Retry after checking Codex.");
+                        // overwrite unknown instructions with an empty fallback. A config
+                        // codex itself rejected is the one case worth naming: the person
+                        // can act on it, and the message carries no credential.
+                        const invalid = error instanceof CodexRpcError && /^invalid configuration\b/i.test(error.message);
+                        throw new Error(invalid
+                            ? "Codex rejected its configuration as invalid. Check ~/.codex/config.toml (or CODEX_HOME) for a broken entry, then retry."
+                            : "Could not read Codex configuration; cannot safely update bot instructions. Retry after checking Codex.");
                     }
                     const developerInstructions = codexDeveloperInstructions(effectiveConfig, turn.system ?? "");
                     let approvalParams;

package/dist-server/server/drivers/grok.js

@@ -2,8 +2,9 @@ import { createOpenAIChatRuntime } from "./openai-chat.js";
 const DRIVER_KIND = "grok";
 const DEFAULT_URL = "https://api.x.ai/v1";
 const MODELS = {
-    default: "grok-4",
+    default: "grok-4.7",
     options: [
+        { id: "grok-4.7", label: "Grok 4.7", contextWindow: 500_000 },
         { id: "grok-4", label: "Grok 4" },
         { id: "grok-4-fast", label: "Grok 4 Fast" },
         { id: "grok-3-mini", label: "Grok 3 Mini" },

package/dist-server/server/drivers/openai-chat.js

@@ -115,11 +115,67 @@ export function createOpenAIChatRuntime(options) {
             const reader = response.body.getReader();
             const decoder = new TextDecoder();
             let buffer = "";
+            const consumeDataLine = (line, atEof = false) => {
+                if (!line.startsWith("data:"))
+                    return false;
+                const data = line.slice(5).trim();
+                if (data === "[DONE]")
+                    return true;
+                let chunk;
+                try {
+                    chunk = JSON.parse(data);
+                }
+                catch {
+                    // A tail left in the buffer when the socket closed is an INCOMPLETE
+                    // frame, not a bad one: a stop, an abort or a dropped connection all
+                    // end mid-frame. Only a properly newline-terminated frame that will
+                    // not parse means the provider actually sent something malformed.
+                    // Counting the tail here turned a stopped turn into a hard,
+                    // non-retryable failure (`calls.finish(finishReason, malformedFrame)`).
+                    if (!atEof)
+                        malformedFrame = true;
+                    return false;
+                }
+                const chunkError = providerError(chunk);
+                if (chunkError)
+                    throw new ChatProtocolError(`provider returned a streaming completion error: ${chunkError.slice(0, 200)}`);
+                const choice = chunk.choices?.find((row) => row.index === undefined || row.index === 0);
+                const delta = choice?.delta;
+                if (object(delta))
+                    sawChoice = true;
+                if (delta?.function_call)
+                    throw new ChatProtocolError("legacy function_call is unsupported; use structured tool_calls");
+                calls.add(delta?.tool_calls, true);
+                details.add(delta?.reasoning_details);
+                if (choice?.finish_reason)
+                    finishReason = choice.finish_reason;
+                const reasoningPart = delta?.reasoning_content ?? delta?.reasoning;
+                if (typeof reasoningPart === "string")
+                    protocolReasoning += reasoningPart;
+                const reasoningDelta = options.reasoning && typeof reasoningPart === "string"
+                    ? reasoningPart
+                    : "";
+                const contentDelta = typeof delta?.content === "string" ? delta.content : "";
+                if (reasoningDelta) {
+                    reasoning += reasoningDelta;
+                    onDelta?.(reasoningDelta, "reasoning_text");
+                }
+                if (contentDelta) {
+                    text += contentDelta;
+                    onDelta?.(contentDelta, "assistant_text");
+                }
+                if (chunk.usage)
+                    usage = usageFrom(chunk.usage);
+                return false;
+            };
             try {
                 readLoop: for (;;) {
                     const { done, value } = await reader.read();
                     if (done) {
                         buffer += decoder.decode();
+                        const line = buffer.trim();
+                        if (line && line !== "data: [DONE]")
+                            consumeDataLine(line, true);
                         // MiniMax's api.minimax.io/v1 closes the connection after the
                         // finish_reason chunk and never sends `[DONE]`.
                         if (buffer.trim() === "data: [DONE]" || finishReason)
@@ -146,49 +202,8 @@ export function createOpenAIChatRuntime(options) {
                     while ((newline = buffer.indexOf("\n")) !== -1) {
                         const line = buffer.slice(0, newline).trim();
                         buffer = buffer.slice(newline + 1);
-                        if (!line.startsWith("data:"))
-                            continue;
-                        const data = line.slice(5).trim();
-                        if (data === "[DONE]")
+                        if (consumeDataLine(line))
                             break readLoop;
-                        let chunk;
-                        try {
-                            chunk = JSON.parse(data);
-                        }
-                        catch {
-                            malformedFrame = true;
-                            continue;
-                        }
-                        const chunkError = providerError(chunk);
-                        if (chunkError)
-                            throw new ChatProtocolError(`provider returned a streaming completion error: ${chunkError.slice(0, 200)}`);
-                        const choice = chunk.choices?.find((row) => row.index === undefined || row.index === 0);
-                        const delta = choice?.delta;
-                        if (object(delta))
-                            sawChoice = true;
-                        if (delta?.function_call)
-                            throw new ChatProtocolError("legacy function_call is unsupported; use structured tool_calls");
-                        calls.add(delta?.tool_calls, true);
-                        details.add(delta?.reasoning_details);
-                        if (choice?.finish_reason)
-                            finishReason = choice.finish_reason;
-                        const reasoningPart = delta?.reasoning_content ?? delta?.reasoning;
-                        if (typeof reasoningPart === "string")
-                            protocolReasoning += reasoningPart;
-                        const reasoningDelta = options.reasoning && typeof reasoningPart === "string"
-                            ? reasoningPart
-                            : "";
-                        const contentDelta = typeof delta?.content === "string" ? delta.content : "";
-                        if (reasoningDelta) {
-                            reasoning += reasoningDelta;
-                            onDelta?.(reasoningDelta, "reasoning_text");
-                        }
-                        if (contentDelta) {
-                            text += contentDelta;
-                            onDelta?.(contentDelta, "assistant_text");
-                        }
-                        if (chunk.usage)
-                            usage = usageFrom(chunk.usage);
                     }
                 }
             }
@@ -383,7 +398,13 @@ export function createOpenAIChatRuntime(options) {
                                 throw new ChatProtocolError("tool arguments must be a JSON object");
                             tools.validate(call.function.name, args);
                             const inputPreview = preview(args);
-                            const allowed = await approval.ask(call.function.name, inputPreview ?? "This tool has no arguments.");
+                            // Full access is the person's explicit grant to answer every
+                            // prompt. This runtime has no provider reviewer to hand it to,
+                            // so it is honoured here: without it every single tool call on
+                            // an OpenAI-compatible engine stops for a card, and a Chief's
+                            // delegated Full access cannot help either.
+                            const allowed = turn.approvalMode === "full"
+                                || await approval.ask(call.function.name, inputPreview ?? "This tool has no arguments.");
                             abort.signal.throwIfAborted();
                             emit({ ...base(turn.threadId, turnId), type: "item.started", itemType: "tool", itemId: call.id,
                                 title: call.function.name, ...(inputPreview ? { input: inputPreview } : {}),
@@ -489,9 +510,9 @@ export function createOpenAIChatRuntime(options) {
                 return () => listeners.delete(listener);
             },
         },
-        generateText: async (prompt) => {
+        generateText: async (prompt, { signal } = {}) => {
             const model = options.generateModel?.() ?? options.models().default;
-            const { text, reasoning, toolCalls } = await complete([{ role: "user", content: prompt }], model, false);
+            const { text, reasoning, toolCalls } = await complete([{ role: "user", content: prompt }], model, false, signal);
             if (toolCalls.length)
                 throw new ChatProtocolError("provider returned tool calls to a text-only helper");
             return text.trim() ? text : reasoning;