openmausbot 0.1.86 → 0.1.87

package/dist-server/server/drivers/chat-tool-approval.js

@@ -1,4 +1,4 @@
-// Per-turn permission gate, adapted from the approval lifecycle in #780.
+// Per-turn ask gate, adapted from the approval lifecycle in #780.
 // Register before publishing: a harness listener may answer synchronously.
 import { newId } from "../contracts.js";
 export function createChatToolApproval(options) {
@@ -10,33 +10,85 @@ export function createChatToolApproval(options) {
                 return Promise.resolve(false);
             const ask = { id: newId(), tool, summary };
             return new Promise((resolve) => {
-                const finish = (allowed, source) => {
-                    if (!pending.delete(ask.id))
-                        return;
-                    clearTimeout(timer);
-                    options.signal.removeEventListener("abort", abort);
-                    options.resolved(ask, allowed, source);
-                    resolve(allowed);
+                let timer;
+                const card = {
+                    kind: "permission",
+                    ask,
+                    finish(source, decision) {
+                        if (!pending.delete(ask.id))
+                            return;
+                        clearTimeout(timer);
+                        options.signal.removeEventListener("abort", abort);
+                        const allowed = decision?.allowed === true;
+                        options.resolved(ask, allowed, source);
+                        resolve(allowed);
+                    },
                 };
-                const abort = () => finish(false, "system");
-                const timer = setTimeout(() => finish(false, "timeout"), options.timeoutMs ?? 15 * 60_000);
+                const abort = () => card.finish("system");
+                timer = setTimeout(() => card.finish("timeout"), options.timeoutMs ?? 15 * 60_000);
                 timer.unref?.();
-                pending.set(ask.id, finish);
+                pending.set(ask.id, card);
                 options.signal.addEventListener("abort", abort, { once: true });
                 options.open(ask);
             });
         },
-        answer(id, behavior) {
-            const finish = pending.get(id);
-            if (!finish || options.signal.aborted || behavior === "answer")
+        question(tool, summary, questions) {
+            if (closed || options.signal.aborted)
+                return Promise.resolve(null);
+            const ask = { id: newId(), tool, summary };
+            return new Promise((resolve) => {
+                let timer;
+                const card = {
+                    kind: "question",
+                    ask,
+                    finish(source, decision) {
+                        if (!pending.delete(ask.id))
+                            return;
+                        clearTimeout(timer);
+                        options.signal.removeEventListener("abort", abort);
+                        // Only the person's reply resolves a question; a timeout or
+                        // abort resolves null so no system note can occupy the answer
+                        // slot the model reads as the person's words.
+                        const reply = typeof decision?.message === "string" && decision.message.length > 0 ? decision.message : null;
+                        options.resolvedQuestion(ask, reply !== null, source);
+                        resolve(reply);
+                    },
+                };
+                const abort = () => card.finish("system");
+                timer = setTimeout(() => card.finish("timeout"), options.timeoutMs ?? 15 * 60_000);
+                timer.unref?.();
+                pending.set(ask.id, card);
+                options.signal.addEventListener("abort", abort, { once: true });
+                options.openQuestion(ask, questions);
+            });
+        },
+        answer(id, behavior, message) {
+            const card = pending.get(id);
+            if (!card || options.signal.aborted)
                 return "unavailable";
-            finish(behavior === "allow", "user");
-            return behavior === "allow" ? "allowed-once" : "rejected";
+            if (behavior === "deny") {
+                card.finish("user");
+                return "rejected";
+            }
+            if (card.kind === "permission") {
+                // An answer is not a permission: only allow or deny settles it.
+                if (behavior !== "allow")
+                    return "unavailable";
+                card.finish("user", { allowed: true });
+                return "allowed-once";
+            }
+            // And an allow is not an answer: a question settles only on a real
+            // reply, never a blank the model would have to interpret.
+            if (behavior === "answer" && typeof message === "string" && message.trim()) {
+                card.finish("user", { message });
+                return "answered";
+            }
+            return "unavailable";
         },
         close() {
             closed = true;
-            for (const finish of pending.values())
-                finish(false, "system");
+            for (const card of pending.values())
+                card.finish("system");
         },
     };
 }

package/dist-server/server/drivers/claude.js

@@ -6,7 +6,7 @@
 //
 // Integrations become MCP servers on the CLI:
 //   - Composio Sessions (connected apps → tools) over streamable HTTP
-//   - the bot's cloud computer (box.ascii.dev) via server/computer-proxy.ts
+//   - the bot's cloud computer (boat.dev) via server/computer-proxy.ts
 //     — screenshot/exec/open_url, the CUA-on-the-box bridge
 import { createHash, randomBytes } from "node:crypto";
 import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -25,6 +25,7 @@ import { askInputSummary, commandSummary, toolDetailPreview } from "../tool-summ
 import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS } from "./retry.js";
 import { applyClaudeInject, decodeInjectId, mergeLocalInject, probeLocalInjects, resolveInjectId, } from "./local-inject.js";
 import { appendNative } from "./native.js";
+import { permissionCommand, permissionLaunchCwd } from "./permission-command.js";
 import { SPAWNED_PROXIES } from "../proxy-paths.js";
 import { extractMcpImages } from "../mcp-tool-images.js";
 import { ASK_USER_QUESTION_TOOL, askQuestionSummary, parseAskQuestions, parseChoices, questionChoices, } from "../../shared/ask-question.js";
@@ -1199,6 +1200,7 @@ export const ClaudeDriver = {
             // parallel bot work must use the harness's durable delegate_bot path.
             env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS = "1";
             const cwd = turn.cwd ?? homedir();
+            const commandCwd = permissionLaunchCwd(cwd);
             // Everything that shapes the process, minus session/turn-specific temp
             // paths. Their contents are represented directly in the key instead.
             const privateFileFlags = new Set(["--mcp-config", "--settings"]);
@@ -1239,7 +1241,7 @@ export const ClaudeDriver = {
                     }, turnId, broker: live.broker });
                 emit({ ...base(threadId, turnId), type: "turn.started" });
                 const volatile = turn.systemVolatile ?? "";
-                const message = volatile === live.volatile
+                const message = volatile === live.volatile && !turn.mentionTurn
                     ? promptMsg
                     : claudeUserMessage(withVolatileNote(turn.text, volatile), turn.images);
                 live.volatile = volatile;
@@ -1323,6 +1325,9 @@ export const ClaudeDriver = {
                                 requestType: ask.kind,
                                 tool: ask.tool,
                                 summary: askSummary(ask),
+                                command: ask.kind === "permission" && ask.tool === "Bash"
+                                    ? permissionCommand(ask.input.command, commandCwd) : undefined,
+                                requiresExplicitApproval: ask.kind === "permission" && ask.tool === "Bash" && ask.input.dangerouslyDisableSandbox === true || undefined,
                                 nativeReview,
                                 // the proxy hands Claude its own suggested rules on `always`;
                                 // host control stays one action at a time

package/dist-server/server/drivers/codex-instructions.js

@@ -1,10 +1,35 @@
-// Codex owns history; this receipt only remembers which bot rules it accepted.
+// Codex owns history; this receipt only remembers which bot rules and which
+// volatile context digest the native thread last carried.
 import { createHash } from "node:crypto";
 import { mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { DATA_DIR } from "../config.js";
 import { writeFileAtomic } from "../atomic.js";
 const digest = (value) => createHash("sha256").update(value).digest("hex");
+const isFingerprint = (value) => /^[0-9a-f]{64}$/.test(value);
+function parseReceipt(raw) {
+    if (!raw)
+        return null;
+    const trimmed = raw.trim();
+    if (isFingerprint(trimmed))
+        return { instructions: trimmed };
+    try {
+        const parsed = JSON.parse(trimmed);
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            const record = parsed;
+            if (typeof record.instructions === "string" && isFingerprint(record.instructions)) {
+                return {
+                    instructions: record.instructions,
+                    ...(typeof record.volatile === "string" && isFingerprint(record.volatile) ? { volatile: record.volatile } : {}),
+                };
+            }
+        }
+    }
+    catch {
+        /* a corrupt receipt is simply unknown */
+    }
+    return null;
+}
 /** Preserve native configured rules when overriding Codex's developer slot. */
 export function codexDeveloperInstructions(config, botInstructions) {
     if (!config || typeof config !== "object" || Array.isArray(config)) {
@@ -20,19 +45,21 @@ export function codexDeveloperInstructions(config, botInstructions) {
         ? `${botInstructions || "No OpenMausBot bot-specific instructions remain."}\n\n${configured}`
         : botInstructions;
 }
-export async function syncCodexInstructions(key, nativeThreadId, instructions, resumed, request) {
+export async function syncCodexInstructions(key, nativeThreadId, instructions, volatile, resumed, request, mentionTurn = false) {
     const directory = join(DATA_DIR, "codex-instructions");
     const path = join(directory, `${digest(JSON.stringify([key, nativeThreadId]))}.sha256`);
     const fingerprint = digest(instructions);
+    const volatileFingerprint = digest(volatile);
     let previous;
     try {
-        previous = readFileSync(path, "utf8");
+        previous = parseReceipt(readFileSync(path, "utf8"));
     }
     catch (error) {
         if (error.code !== "ENOENT")
             throw error;
+        previous = null;
     }
-    if (resumed && previous !== fingerprint) {
+    if (resumed && previous?.instructions !== fingerprint) {
         // thread/resume config overrides are used after compaction, but Codex
         // 0.153.4 keeps the old initial developer message until then. Append a
         // developer update ONLY on change (or first adoption of an old session).
@@ -59,8 +86,23 @@ export async function syncCodexInstructions(key, nativeThreadId, instructions, r
             throw error;
         }
     }
-    if (!resumed || previous !== fingerprint) {
+    // A mention describes the turn it rides: deliver it on every tagged turn,
+    // even when the volatile text is byte-identical to the previous turn's.
+    const deliverVolatile = !resumed || previous?.volatile !== volatileFingerprint || mentionTurn;
+    const hadVolatile = typeof previous?.volatile === "string" && previous.volatile !== digest("");
+    if (!resumed || previous?.instructions !== fingerprint) {
+        // Instructions-only, and only after inject_items acknowledged: the
+        // volatile digest stays pending until the driver commits it after the
+        // provider accepts the turn, so a submission the provider rejected
+        // redelivers its context on the next attempt.
         mkdirSync(directory, { recursive: true });
-        writeFileAtomic(path, fingerprint, { mode: 0o600 });
+        writeFileAtomic(path, JSON.stringify({ instructions: fingerprint }), { mode: 0o600 });
     }
+    const commitVolatile = previous?.instructions === fingerprint && previous?.volatile === volatileFingerprint
+        ? null
+        : () => {
+            mkdirSync(directory, { recursive: true });
+            writeFileAtomic(path, JSON.stringify({ instructions: fingerprint, volatile: volatileFingerprint }), { mode: 0o600 });
+        };
+    return { deliverVolatile, hadVolatile, commitVolatile };
 }

package/dist-server/server/drivers/codex-tool-surface.js

@@ -0,0 +1,20 @@
+// OpenMausBot owns computer selection and mounts its scoped MCP servers.
+// Keep the standalone Codex installation untouched: these overrides apply
+// only to the child process, including resumed conversations and retries.
+// The desktop-app browser is not available in Codex CLI. Enabling its tool
+// without a desktop connection exposes an unusable route; native search is
+// independent and must remain governed by the user's/provider's config.
+// https://developers.openai.com/codex/browser
+export function codexToolSurfaceArgs() {
+    return [
+        "-c", "features.browser_use=false",
+        "-c", "features.browser_use_external=false",
+        "-c", "features.computer_use=false",
+        // Disable the matching instructions as well as the native tool. Use an
+        // inline table: quoted dotted keys are interpreted literally by some CLIs.
+        "-c", 'plugins={ "browser@openai-bundled" = { enabled = false }, "computer-use@openai-bundled" = { enabled = false }, "unified-computer-use@openai-bundled" = { enabled = false } }',
+        // Native web search does not require the desktop browser connection.
+        // Preserve the user's/provider's search mode instead of disabling it for
+        // every OpenMausBot process after a failure in one search route.
+    ];
+}

package/dist-server/server/drivers/codex.js

@@ -1,3 +1,4 @@
+import { codexToolSurfaceArgs } from "./codex-tool-surface.js";
 // Codex driver — upstream CodexDriver skeleton over agentcal's
 // drivers/codex.js runtime: the official `codex` CLI headless over its
 // app-server JSON-RPC protocol (newline-delimited JSON on stdio).
@@ -21,12 +22,15 @@ import { codexLocalProviderArgs } from "./local-inject.js";
 import { augmentedPath, splitCliString } from "../env-path.js";
 import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS } from "./retry.js";
 import { appendNative } from "./native.js";
+import { permissionCommand, permissionLaunchCwd } from "./permission-command.js";
 import { commandSummary, toolDetailPreview } from "../tool-summary.js";
 import { codexDeveloperInstructions, syncCodexInstructions } from "./codex-instructions.js";
+import { volatileContextNote, withContextNote } from "./prompt-split.js";
 import { CodexDeviceAuthController } from "./codex-device-auth.js";
 import { codexAccountEmail } from "./codex-identity.js";
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
 import { extractMcpImages } from "../mcp-tool-images.js";
+import { parseProtocolAskQuestions, questionAnswersById, questionChoices } from "../../shared/ask-question.js";
 export { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 const DRIVER_KIND = "codex";
 const ASTRA_MODEL_ID = "gpt-6-astra";
@@ -126,7 +130,6 @@ export function managedCodexArgs(config) {
         "-c", "shell_environment_policy.ignore_default_excludes=false",
     ];
 }
-const QUESTION_TIMEOUT_NOTE = "No answer was given — use your best judgment.";
 const DENY_TIMEOUT_NOTE = "OpenMausBot: nobody answered this permission request in time. Skip this action and finish what you can without it.";
 const skippedSseServers = new Set();
 const renamedMcpServers = new Set();
@@ -275,6 +278,21 @@ function namedApprovalParams(mode) {
         },
     };
 }
+/** Keep the turn on the complete sandbox resolved by native start/resume. */
+function withResolvedSandbox(params, session) {
+    const requested = plainRecord(params.turn.sandboxPolicy);
+    // Named permission profiles own their policy; do not mix both selectors.
+    if (!requested)
+        return params;
+    const sandbox = plainRecord(plainRecord(session)?.sandbox);
+    if (!sandbox || typeof sandbox.type !== "string") {
+        throw new Error("Codex did not return its resolved sandbox policy. Update Codex, then retry; the turn was not started because its permissions could not be verified.");
+    }
+    if (sandbox.type !== requested.type) {
+        throw new Error("Codex did not apply the requested sandbox mode; cannot safely start the turn.");
+    }
+    return { ...params, turn: { ...params.turn, sandboxPolicy: sandbox } };
+}
 function effectiveApprovalPolicy(value) {
     if (value === "untrusted" || value === "on-request" || value === "never")
         return value;
@@ -587,7 +605,7 @@ export const CodexDriver = {
             const retryScale = Number(process.env.FAKE_CODEX_RETRY_SCALE ?? "1");
             const launchAttempt = async (attempt) => {
                 const env = childEnv();
-                const appServerArgs = ["app-server", ...(config.managed ? managedCodexArgs(config.managed) : codexLocalProviderArgs(env, turn.model))];
+                const appServerArgs = ["app-server", ...(config.managed ? managedCodexArgs(config.managed) : codexLocalProviderArgs(env, turn.model)), ...codexToolSurfaceArgs()];
                 if (turn.integrations?.composio) {
                     mountMcpServer(appServerArgs, env, "openmausbot_connectors", turn.integrations.composio);
                 }
@@ -626,6 +644,7 @@ export const CodexDriver = {
                     const prefix = "mcp_servers.openmausbot_phone";
                     appServerArgs.push("-c", `${prefix}.command=${JSON.stringify(bridge.command)}`, "-c", `${prefix}.args=${JSON.stringify(bridge.args)}`, "-c", `${prefix}.env_vars=${JSON.stringify(Object.keys(bridge.env))}`, "-c", `${prefix}.default_tools_approval_mode="auto"`);
                 }
+                const commandCwd = permissionLaunchCwd(turn.cwd ?? homedir());
                 const child = spawnCli(config.cli, appServerArgs, {
                     cwd: turn.cwd ?? homedir(),
                     env,
@@ -838,23 +857,22 @@ export const CodexDriver = {
                         }
                         return;
                     }
-                    // One ask card carries one question honestly: its choices would come
-                    // from the first question alone and its one reply (including the
-                    // timeout note) would be copied into every question id (#1237).
-                    // Refuse the bundled call with a teaching error instead of
-                    // fabricating per-question answers.
-                    if (isQuestion && (!Array.isArray(params.questions) || params.questions.length !== 1)) {
-                        const bundled = Array.isArray(params.questions) && params.questions.length > 1;
+                    // The whole set rides one card, answered per id: the protocol pairs
+                    // each question with its own id, and the card's single reply is
+                    // mapped back block by block (or as the flat single-question
+                    // fallback). The only refusal left is an ask with nothing answerable
+                    // — #1237 is closed: a bundle no longer copies one answer into
+                    // every id.
+                    const protocolQuestions = isQuestion ? parseProtocolAskQuestions(params.questions) : null;
+                    if (isQuestion && !protocolQuestions) {
                         send({
                             jsonrpc: "2.0",
                             id: msg.id,
                             error: {
                                 code: -32602,
-                                message: bundled
-                                    ? `ask supports one question per call; this request bundled ${params.questions.length}. Split it into separate asks, one question each.`
-                                    : Array.isArray(params.questions)
-                                        ? "ask supports one question per call; this request sent none."
-                                        : "ask supports one question per call; params.questions must be an array with exactly one question.",
+                                message: Array.isArray(params.questions)
+                                    ? "ask needs at least one answerable question — a string id and question text each; this request sent none."
+                                    : "ask needs params.questions to be an array of questions, each with a string id and question text.",
                             },
                         });
                         return;
@@ -894,23 +912,36 @@ export const CodexDriver = {
                             ? (mcpAppApproval?.summary ?? (typeof params.message === "string" ? params.message : "MCP access requested"))
                             : typeof params.command === "string"
                                 ? params.command
-                                : Array.isArray(params.questions)
-                                    ? params.questions.map((q) => q.question ?? q.header).filter(Boolean).join(" · ")
-                                    : typeof params.reason === "string"
-                                        ? params.reason
-                                        : tool;
-                    const choices = isQuestion
-                        ? (params.questions?.[0]?.options ?? []).map((o) => o.label).slice(0, 5)
-                        : undefined;
+                                : protocolQuestions
+                                    ? protocolQuestions.map(({ question }) => question.question).join(" · ")
+                                    : Array.isArray(params.questions)
+                                        ? params.questions.map((q) => q.question ?? q.header).filter(Boolean).join(" · ")
+                                        : typeof params.reason === "string"
+                                            ? params.reason
+                                            : tool;
+                    // Flat choices only when one non-multiselect question can actually
+                    // be answered by a bare reply; a bundle's first-question buttons
+                    // would be an unusable lie for flat clients.
+                    const choices = isQuestion && protocolQuestions ? questionChoices(protocolQuestions.map(({ question }) => question)) : undefined;
                     const finish = (behavior, message, source = "user") => {
                         if (!asks.delete(requestId))
                             return;
                         clearTimeout(timer);
                         if (isQuestion) {
-                            const answers = {};
-                            for (const q of Array.isArray(params.questions) ? params.questions : []) {
-                                answers[q.id] = { answers: [message || QUESTION_TIMEOUT_NOTE] };
-                            }
+                            // Only the person's reply is filed: Q:/A: blocks mapped to the
+                            // id that asked them, or the flat fallback for a single
+                            // question. Timeout and turn teardown send empty answers so
+                            // every id reads unanswered — system notes never occupy the
+                            // slot the model reads as the person's words (the rule
+                            // permission-proxy already follows).
+                            const mapped = behavior === "answer" && source === "user" && typeof message === "string"
+                                ? questionAnswersById(message, protocolQuestions ?? [])
+                                : {};
+                            // Null prototype so an opaque id like __proto__ becomes a real
+                            // answer key instead of hitting the inherited setter.
+                            const answers = Object.create(null);
+                            for (const [id, answer] of Object.entries(mapped))
+                                answers[id] = { answers: [answer] };
                             send({ jsonrpc: "2.0", id: msg.id, result: { answers } });
                         }
                         else {
@@ -922,7 +953,11 @@ export const CodexDriver = {
                         }
                         emit({ ...base(threadId, turnId), type: "request.resolved", requestId, behavior, source });
                     };
-                    const timer = setTimeout(() => (isQuestion ? finish("answer", QUESTION_TIMEOUT_NOTE, "timeout") : finish("deny", DENY_TIMEOUT_NOTE, "timeout")), 15 * 60_000);
+                    const timer = setTimeout(
+                    // A timed-out question resolves as denied, not answered: the card
+                    // closes with no reply (answers stay empty either way), and the
+                    // resolve event must not claim an answer that never happened.
+                    () => finish("deny", isQuestion ? undefined : DENY_TIMEOUT_NOTE, "timeout"), 15 * 60_000);
                     timer.unref?.();
                     asks.set(requestId, finish);
                     emit({
@@ -932,9 +967,15 @@ export const CodexDriver = {
                         requestType: isQuestion ? "question" : "permission",
                         tool,
                         summary,
+                        command: method === "execCommandApproval" || method === "item/commandExecution/requestApproval"
+                            ? permissionCommand(params.command, params.cwd ?? (
+                            // Helpers may have a different workspace from their parent.
+                            !params.threadId || params.threadId === codexThreadId ? commandCwd : undefined)) : undefined,
                         choices,
+                        ...(protocolQuestions ? { questions: protocolQuestions.map((pair) => pair.question) } : {}),
                         approvalScope: controlsHost ? "local-computer" : undefined,
-                        requiresExplicitApproval: isAdditionalPermission || undefined,
+                        requiresExplicitApproval: isAdditionalPermission || ((method === "execCommandApproval" || method === "item/commandExecution/requestApproval") &&
+                            (params.additionalPermissions != null || params.networkApprovalContext != null)) || undefined,
                     });
                 };
                 const handleNotification = (msg) => {
@@ -1315,7 +1356,18 @@ export const CodexDriver = {
                             ? "Codex rejected its configuration as invalid. Check ~/.codex/config.toml (or CODEX_HOME) for a broken entry, then retry."
                             : "Could not read Codex configuration; cannot safely update bot instructions. Retry after checking Codex.");
                     }
-                    const developerInstructions = codexDeveloperInstructions(effectiveConfig, turn.system ?? "");
+                    // Only the stable half of the prompt belongs in the developer slot:
+                    // it is the part that must survive compaction unchanged, and any
+                    // change to it invalidates the provider's cached prefix. The volatile
+                    // half (memory, mentions, outstanding teammate work) is delivered
+                    // inside the turn that changed it, after the cached prefix, the same
+                    // contract SendTurnInput.systemStable documents. Without the split
+                    // the driver keeps the previous single-block behaviour.
+                    const stableInstructions = typeof turn.systemStable === "string" && typeof turn.systemVolatile === "string"
+                        ? turn.systemStable
+                        : null;
+                    const promptSplit = stableInstructions !== null;
+                    const developerInstructions = codexDeveloperInstructions(effectiveConfig, stableInstructions ?? turn.system ?? "");
                     let approvalParams;
                     if (approvalMode === "custom") {
                         // config/read returns the effective global + project config for this
@@ -1358,6 +1410,7 @@ export const CodexDriver = {
                                 approvalParams = approvalParams.fallback;
                                 resumed = await resumeThread();
                             }
+                            approvalParams = withResolvedSandbox(approvalParams, resumed);
                             codexThreadId = resumed?.thread?.id ?? cursor;
                             resumedNativeThread = true;
                         }
@@ -1403,12 +1456,20 @@ export const CodexDriver = {
                             approvalParams = approvalParams.fallback;
                             started = await startThread();
                         }
+                        approvalParams = withResolvedSandbox(approvalParams, started);
                         codexThreadId = started?.thread?.id ?? null;
                         startedModel = started?.model ?? null;
                     }
                     if (!codexThreadId)
                         throw new Error("Codex did not return a native thread id");
-                    await syncCodexInstructions(threadId, codexThreadId, developerInstructions, resumedNativeThread, request);
+                    const { deliverVolatile, hadVolatile, commitVolatile } = await syncCodexInstructions(threadId, codexThreadId, developerInstructions, promptSplit ? turn.systemVolatile ?? "" : "", resumedNativeThread, request, Boolean(turn.mentionTurn));
+                    // A changed volatile half rides the next user input as a labelled
+                    // context block. It never touches the developer slot, so an
+                    // ordinary memory write or roster change neither appends a second
+                    // copy of the prompt to history nor re-uploads the conversation.
+                    if (deliverVolatile) {
+                        promptText = withContextNote(volatileContextNote(promptSplit ? turn.systemVolatile ?? "" : "", hadVolatile), promptText);
+                    }
                     emit({ ...base(threadId, turnId), type: "session.started", sessionId: codexThreadId, model: startedModel ?? turn.model ?? null, ...(rebuiltFromReplay ? { rebuilt: true } : {}) });
                     const turnInput = [
                         ...(promptText ? [{ type: "text", text: promptText }] : []),
@@ -1442,6 +1503,10 @@ export const CodexDriver = {
                         approvalParams = approvalParams.fallback;
                         await startTurn();
                     }
+                    // turn/start accepted the input: only now may the receipt claim the
+                    // volatile half was delivered, so a rejected turn redelivers on retry.
+                    if (commitVolatile)
+                        commitVolatile();
                 }
                 catch (e) {
                     const failure = e instanceof Error ? e : { text: String(e) };

package/dist-server/server/drivers/mistral.js

@@ -0,0 +1,115 @@
+import { z } from "zod";
+import { createOpenAIChatRuntime } from "./openai-chat.js";
+const DEFAULT_URL = "https://api.mistral.ai/v1";
+const DEFAULT_MODELS = {
+    default: "mistral-large-latest",
+    options: [
+        { id: "mistral-large-latest", label: "Mistral Large (latest)" },
+        { id: "mistral-small-latest", label: "Mistral Small (latest)" },
+    ],
+};
+const configSchema = z.object({
+    url: z.string().trim().url().default(DEFAULT_URL),
+    model: z.string().trim().min(1).optional(),
+    tools: z.boolean().optional(),
+});
+function decodeConfig(raw) {
+    const config = configSchema.parse(raw ?? {});
+    config.url = config.url.replace(/\/+$/, "");
+    const url = new URL(config.url);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" &&
+        ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) {
+        throw new Error("Mistral requires HTTPS, except for a local test endpoint.");
+    }
+    return config;
+}
+const modelCard = z.object({
+    id: z.string().min(1),
+    name: z.string().nullable().optional(),
+    aliases: z.array(z.string()).optional(),
+    archived: z.boolean().optional(),
+    capabilities: z.object({ completion_chat: z.boolean().optional() }).optional(),
+    max_context_length: z.number().int().positive().optional(),
+});
+/** Mistral can return plain text or a list of typed content chunks. */
+function contentText(content) {
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    return content.map((chunk) => chunk?.type === "text" && typeof chunk.text === "string" ? chunk.text : "").join("");
+}
+export const MistralDriver = {
+    driverKind: "mistral",
+    metadata: { displayName: "Mistral (API)", supportsMultipleInstances: true, access: "api" },
+    models: DEFAULT_MODELS,
+    install: {
+        docsUrl: "https://console.mistral.ai/api-keys",
+        signInCommand: "Save a Mistral API key in Settings → Connections, or set MISTRAL_API_KEY on the server.",
+    },
+    decodeConfig,
+    defaultConfig: () => decodeConfig({}),
+    async create(input) {
+        const { config } = input;
+        const apiKey = (input.environment.MISTRAL_API_KEY ?? process.env.MISTRAL_API_KEY ?? "").trim();
+        const withConfiguredModel = (options) => {
+            const preferred = config.model ?? DEFAULT_MODELS.default;
+            if (config.model && !options.some((option) => option.id === config.model)) {
+                options = [{ id: config.model, label: config.model }, ...options];
+            }
+            return { default: options.some((option) => option.id === preferred) ? preferred : options[0].id, options };
+        };
+        let catalog = withConfiguredModel(DEFAULT_MODELS.options);
+        const refreshModels = async () => {
+            if (!apiKey)
+                return;
+            try {
+                const response = await fetch(`${config.url}/models`, {
+                    headers: { authorization: `Bearer ${apiKey}` },
+                    redirect: "error",
+                    signal: AbortSignal.timeout(8_000),
+                });
+                if (!response.ok)
+                    return;
+                const json = await response.json();
+                const rows = Array.isArray(json) ? json : z.object({ data: z.array(z.unknown()) }).parse(json).data;
+                const options = [];
+                const seen = new Set();
+                for (const row of rows) {
+                    const parsed = modelCard.safeParse(row);
+                    if (!parsed.success || parsed.data.archived || parsed.data.capabilities?.completion_chat === false)
+                        continue;
+                    const card = parsed.data;
+                    for (const id of [card.id, ...(card.aliases ?? [])]) {
+                        if (!id.trim() || seen.has(id))
+                            continue;
+                        seen.add(id);
+                        options.push({ id, label: id === card.id ? card.name?.trim() || id : id,
+                            ...(card.max_context_length ? { contextWindow: card.max_context_length } : {}) });
+                    }
+                }
+                if (options.length)
+                    catalog = withConfiguredModel(options);
+            }
+            catch {
+                // A failed refresh keeps the last usable catalog, including custom models.
+            }
+        };
+        if (apiKey)
+            void refreshModels();
+        return createOpenAIChatRuntime({
+            input, driverKind: "mistral", apiKey, apiUrl: config.url,
+            tools: config.tools, models: () => catalog, refreshModels, contentText,
+            requestBody: (model, messages, stream) => ({ model, messages, stream }),
+            httpErrorLabel: "Mistral",
+            missingKeyError: "Save a Mistral API key in Settings → Connections, or set MISTRAL_API_KEY.",
+            unavailableReason: "No Mistral API key — open Settings → Connections.",
+            timeoutMs: 180_000, billing: "metered", includeUsageInCompleted: true,
+            nativeLog: {
+                source: "mistral.chat.completions",
+                outgoing: (_turn, messages, model) => ({ model, messageCount: messages.length }),
+                incoming: ({ text, usage }) => ({ textLength: text.length, usage }),
+            },
+        });
+    },
+};