openmausbot 0.1.86 → 0.1.88

package/dist-server/server/drivers/chat-box-tools.js

@@ -0,0 +1,90 @@
+import { isolatedRemoteCommand, runCommand, screenshotBox } from "../box.js";
+import { createControlClient, CONTROL_REFUSAL_PLAIN } from "../control-client.js";
+const coordinate = { type: "integer", minimum: 0, maximum: 32767 };
+const tool = (name, description, properties = {}, required = []) => ({ name, description, inputSchema: { type: "object", properties, required, additionalProperties: false } });
+const TOOLS = [
+    tool("screenshot", "See the assigned cloud desktop at native pixel resolution."),
+    tool("get_screen_size", "Get the cloud desktop width and height."),
+    tool("click", "Click a point on the cloud desktop.", { x: coordinate, y: coordinate, button: { type: "string", enum: ["left", "middle", "right"] }, count: { type: "integer", minimum: 1, maximum: 3 } }, ["x", "y"]),
+    tool("move", "Move the cloud mouse pointer.", { x: coordinate, y: coordinate }, ["x", "y"]),
+    tool("drag", "Drag on the cloud desktop.", { x: coordinate, y: coordinate, to_x: coordinate, to_y: coordinate }, ["x", "y", "to_x", "to_y"]),
+    tool("type_text", "Type Unicode text into the focused cloud application.", { text: { type: "string", maxLength: 4000 } }, ["text"]),
+    tool("key_press", "Press an X11 key or shortcut.", { key: { type: "string", pattern: "^[A-Za-z0-9_+]+$", minLength: 1, maxLength: 100 } }, ["key"]),
+    tool("scroll", "Scroll at a point on the cloud desktop.", { x: coordinate, y: coordinate, direction: { type: "string", enum: ["up", "down", "left", "right"] }, amount: { type: "integer", minimum: 1, maximum: 30 } }, ["x", "y", "direction"]),
+    tool("open_url", "Request opening an HTTP or HTTPS URL in the cloud desktop browser; inspect the screen to confirm it loaded.", { url: { type: "string", pattern: "^https?://", maxLength: 2000 } }, ["url"]),
+    tool("exec", "Run a shell command on the assigned cloud computer.", { command: { type: "string", minLength: 1, maxLength: 4000 } }, ["command"]),
+];
+const quote = (value) => "'" + value.replace(/'/g, "'\\''") + "'";
+const buttons = { left: 1, middle: 2, right: 3 };
+const scrollButtons = { up: 4, down: 5, left: 6, right: 7 };
+/** Uses only the leased descriptor supplied by the harness. Schema validation
+ * and user approval happen in the shared chat tool executor before this call. */
+export class ChatBoxClient {
+    closed = false;
+    control;
+    descriptor;
+    constructor(descriptor) {
+        this.descriptor = descriptor;
+        if (!descriptor.control?.url || !descriptor.control.token)
+            throw new Error("Cloud computer control gate missing");
+        this.control = createControlClient(descriptor.control);
+    }
+    async tools() { return TOOLS; }
+    async close() { this.closed = true; }
+    async call(_method, params, signal) {
+        signal.throwIfAborted();
+        if (this.closed)
+            throw new Error("Cloud computer session closed");
+        const state = await this.control.state(true);
+        signal.throwIfAborted();
+        if (this.closed)
+            throw new Error("Cloud computer session closed");
+        if (state.held || state.blockedReason)
+            return { isError: true, content: [{ type: "text", text: state.blockedReason || CONTROL_REFUSAL_PLAIN }] };
+        const { name, arguments: a } = params;
+        const config = { box: { token: this.descriptor.token } };
+        const id = this.descriptor.boxId;
+        if (name === "screenshot") {
+            const shot = await screenshotBox(config, "", id, { signal, nativeSize: true });
+            signal.throwIfAborted();
+            return { content: [{ type: "image", mimeType: "image/jpeg", data: shot.png }] };
+        }
+        const mouse = `xdotool mousemove --sync ${a.x} ${a.y}`;
+        let command;
+        switch (name) {
+            case "get_screen_size":
+                command = "xdotool getdisplaygeometry";
+                break;
+            case "click":
+                command = `${mouse} click --repeat ${a.count ?? 1} --delay 100 ${buttons[String(a.button ?? "left")]}`;
+                break;
+            case "move":
+                command = mouse;
+                break;
+            case "drag":
+                command = `${mouse} mousedown 1 mousemove --sync ${a.to_x} ${a.to_y} mouseup 1`;
+                break;
+            case "type_text":
+                command = `printf %s ${quote(Buffer.from(String(a.text)).toString("base64"))} | base64 -d | xclip -selection clipboard && xdotool key --clearmodifiers ctrl+v`;
+                break;
+            case "key_press":
+                command = `xdotool key --clearmodifiers ${quote(String(a.key))}`;
+                break;
+            case "scroll":
+                command = `${mouse} click --repeat ${a.amount ?? 3} --delay 80 ${scrollButtons[String(a.direction)]}`;
+                break;
+            case "open_url":
+                command = `nohup xdg-open ${quote(String(a.url))} >/dev/null 2>&1 </dev/null &`;
+                break;
+            case "exec":
+                command = String(a.command);
+                break;
+            default: throw new Error("Unknown cloud computer tool");
+        }
+        const result = await runCommand(config, id, isolatedRemoteCommand(command), { signal });
+        signal.throwIfAborted();
+        if (name === "open_url" && result.ok)
+            return { content: [{ type: "text", text: "Browser launch requested. Page loading is not confirmed; inspect the screen before continuing." }] };
+        return { isError: !result.ok, content: [{ type: "text", text: JSON.stringify(result) }] };
+    }
+}

package/dist-server/server/drivers/chat-images.js

@@ -0,0 +1,54 @@
+import { readFileSync, statSync } from "node:fs";
+const IMAGE_BYTES = 20 * 1024 * 1024;
+const MIME = new Set(["image/png", "image/jpeg", "image/webp", "image/gif"]);
+export const CHAT_IMAGE_BUDGET = 32 * 1024 * 1024;
+/** Bound retained base64 before JSON serialization or another model call. */
+export function chatImageBudget() {
+    let used = 0;
+    return (parts) => {
+        if (!Array.isArray(parts))
+            return;
+        const added = parts.reduce((total, part) => total + (part.type === "image_url" ? part.image_url.url.length : 0), 0);
+        if (used + added > CHAT_IMAGE_BUDGET)
+            throw new Error("Turn image budget exceeded (32 MiB encoded); screenshot cannot be retained. An operation may already have taken effect; inspect its state before retrying.");
+        used += added;
+    };
+}
+export function assertImageTransport(url) {
+    const endpoint = new URL(url);
+    const loopback = endpoint.hostname === "localhost" || endpoint.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(endpoint.hostname);
+    if (endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && loopback)) {
+        throw new Error("Images and computer tools require HTTPS for remote API endpoints; HTTP is supported only on loopback.");
+    }
+}
+export function chatImage(item) {
+    const { mimeType, data } = item;
+    if (typeof mimeType !== "string" || !MIME.has(mimeType) || typeof data !== "string" ||
+        !data.length || data.length > Math.ceil(IMAGE_BYTES / 3) * 4 || data.length % 4 ||
+        !/^[A-Za-z0-9+/]*={0,2}$/.test(data)) {
+        throw new Error("Invalid or oversized MCP image");
+    }
+    const bytes = Buffer.from(data, "base64");
+    const matches = mimeType === "image/png" ? bytes.length >= 33 && bytes.subarray(0, 8).equals(Buffer.from("89504e470d0a1a0a", "hex")) && bytes.toString("ascii", 12, 16) === "IHDR"
+        : mimeType === "image/jpeg" ? bytes.length >= 4 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff
+            : mimeType === "image/gif" ? bytes.length >= 13 && ["GIF87a", "GIF89a"].includes(bytes.toString("ascii", 0, 6))
+                : bytes.length >= 16 && bytes.toString("ascii", 0, 4) === "RIFF" && bytes.toString("ascii", 8, 12) === "WEBP";
+    if (bytes.length > IMAGE_BYTES || bytes.toString("base64") !== data || !matches)
+        throw new Error("Image bytes do not match the declared MIME type");
+    return { type: "image_url", image_url: { url: `data:${mimeType};base64,${data}` } };
+}
+export function chatUserContent(turn) {
+    if (!turn.images?.length)
+        return turn.text;
+    const budget = chatImageBudget();
+    return [{ type: "text", text: turn.text }, ...turn.images.map(image => {
+            if (statSync(image.path).size > IMAGE_BYTES)
+                throw new Error("Image exceeds 20 MB");
+            const part = chatImage({ mimeType: image.mime, data: readFileSync(image.path).toString("base64") });
+            budget([part]);
+            return part;
+        })];
+}
+export function chatToolImages(callId, images) {
+    return images?.length ? [{ type: "text", text: `Screenshot result from tool call ${callId}:` }, ...images] : [];
+}

package/dist-server/server/drivers/chat-mcp-tools.js

@@ -6,6 +6,8 @@ import formats from "ajv-formats";
 import { stripControlPlaneEnv } from "../config.js";
 import { augmentedPath } from "../env-path.js";
 import { killCliTree, spawnCli } from "../procs.js";
+import { chatImage } from "./chat-images.js";
+import { ChatBoxClient } from "./chat-box-tools.js";
 /** The transport cannot safely continue this turn. A dispatched operation may
  * already have taken effect, so callers must not retry it through a new round. */
 export class ChatToolSessionError extends Error {
@@ -32,6 +34,7 @@ export function chatMcpEnvironment(serverEnv, source = process.env) {
     return { ...env, ...serverEnv };
 }
 class ChatMcpClient {
+    frameBytes;
     child;
     buffer = "";
     nextId = 1;
@@ -39,7 +42,8 @@ class ChatMcpClient {
     closed = false;
     closing;
     pending = new Map();
-    constructor(server) {
+    constructor(server, computerUse = false) {
+        this.frameBytes = computerUse ? 32 * 1024 * 1024 : FRAME_BYTES;
         try {
             // The desktop shell inherits Finder's bare PATH, where `npx`-style
             // servers cannot find `node` and exit at once. Widen it the way the
@@ -89,7 +93,7 @@ class ChatMcpClient {
         if (this.closed || !this.child.stdin.writable || this.child.stdin.destroyed)
             throw new Error("MCP session closed");
         const encoded = JSON.stringify(frame) + "\n";
-        if (Buffer.byteLength(encoded) > FRAME_BYTES)
+        if (Buffer.byteLength(encoded) > this.frameBytes)
             throw new Error("MCP request exceeds the frame limit");
         this.child.stdin.write(encoded);
     }
@@ -103,7 +107,7 @@ class ChatMcpClient {
             this.buffer = this.buffer.slice(newline + 1);
             if (++this.frames > MAX_FRAMES)
                 return this.fail(new Error("MCP session exceeded the response frame count limit"));
-            if (Buffer.byteLength(line) > FRAME_BYTES)
+            if (Buffer.byteLength(line) > this.frameBytes)
                 return this.fail(new Error("MCP response exceeds the frame limit"));
             if (!line.trim())
                 continue;
@@ -140,7 +144,7 @@ class ChatMcpClient {
             else
                 entry.resolve(message.result);
         }
-        if (Buffer.byteLength(this.buffer) > FRAME_BYTES)
+        if (Buffer.byteLength(this.buffer) > this.frameBytes)
             this.fail(new Error("MCP response exceeds the frame limit"));
     }
     async call(method, params, signal, timeout) {
@@ -244,6 +248,8 @@ function compileSchema(schema) {
     // ajv-formats is CommonJS and exports the plugin as both module.exports
     // and .default; the latter also matches its NodeNext declaration.
     formats.default(compiler);
+    compiler.addFormat("uint32", { type: "number", validate: value => Number.isInteger(value) && value >= 0 && value <= 4294967295 });
+    compiler.addFormat("uint64", { type: "number", validate: value => Number.isSafeInteger(value) && value >= 0 });
     try {
         return compiler.compile(schema);
     }
@@ -260,8 +266,14 @@ function boundedText(value) {
         end -= 1;
     return `${bytes.subarray(0, end).toString()}\n[MCP result truncated at 50KB; request less output.]`;
 }
-export async function mountChatTools(integrations, signal) {
+export async function mountChatTools(integrations, signal, computerUse = false) {
     const servers = [];
+    if (computerUse && integrations?.computer)
+        servers.push(["computer", integrations.computer]);
+    if (computerUse && integrations?.localComputer)
+        servers.push(["computer", integrations.localComputer]);
+    if (computerUse && integrations?.browser)
+        servers.push(["browser", integrations.browser]);
     if (integrations?.agents)
         servers.push(["agents", integrations.agents]);
     if (integrations?.composio)
@@ -300,7 +312,9 @@ export async function mountChatTools(integrations, signal) {
         const mounts = await Promise.allSettled(servers.map(async ([name, descriptor]) => {
             if (signal.aborted || closed)
                 throw aborted();
-            const client = new ChatMcpClient(descriptor);
+            // Every mounted MCP server can return images when the caller enables
+            // image delivery, including custom servers. Text stays bounded below.
+            const client = "boxId" in descriptor ? new ChatBoxClient(descriptor) : new ChatMcpClient(descriptor, computerUse);
             clients.push(client);
             return { name, client, tools: await client.tools(signal) };
         }));
@@ -320,6 +334,18 @@ export async function mountChatTools(integrations, signal) {
                 if (Buffer.byteLength(JSON.stringify(tool.inputSchema)) > SCHEMA_BYTES)
                     throw new Error("MCP tool schema exceeds the 64KB limit");
                 const schema = compileSchema(tool.inputSchema);
+                const parameters = { ...tool.inputSchema };
+                const constraints = {};
+                if (computerUse) {
+                    for (const key of ["anyOf", "oneOf", "allOf", "not"]) {
+                        if (key in parameters) {
+                            constraints[key] = parameters[key];
+                            delete parameters[key];
+                        }
+                    }
+                }
+                const description = (typeof tool.description === "string" ? tool.description : "Configured MCP tool") +
+                    (Object.keys(constraints).length ? " Additional argument constraints (validated before execution): " + JSON.stringify(constraints) : "");
                 const base = `${server}_${tool.name}`.toLowerCase().replace(/[^a-z0-9_]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 64) || "mcp_tool";
                 let name = base;
                 for (let index = 2; registered.has(name); index += 1) {
@@ -327,7 +353,7 @@ export async function mountChatTools(integrations, signal) {
                     name = base.slice(0, 64 - suffix.length) + suffix;
                 }
                 registered.set(name, { client, name: tool.name, schema });
-                definitions.push({ type: "function", function: { name, description: typeof tool.description === "string" ? tool.description : "Configured MCP tool", parameters: tool.inputSchema } });
+                definitions.push({ type: "function", function: { name, description, parameters } });
                 if (Buffer.byteLength(JSON.stringify(definitions)) > CATALOG_BYTES)
                     throw new Error("MCP tool catalog exceeds the 1MB limit");
             }
@@ -364,12 +390,15 @@ export async function mountChatTools(integrations, signal) {
                 if (!object(result) || !Array.isArray(result.content) || (result.isError !== undefined && typeof result.isError !== "boolean"))
                     throw new Error("MCP tool returned an invalid result; execution outcome may be uncertain");
                 const parts = [];
+                const images = [];
                 let unsupported = 0;
                 for (const item of result.content) {
                     if (!object(item) || typeof item.type !== "string" || (item.type === "text" && typeof item.text !== "string"))
                         throw new Error("MCP tool returned invalid content; execution outcome may be uncertain");
                     if (item.type === "text")
                         parts.push(item.text);
+                    else if (computerUse && item.type === "image")
+                        images.push(chatImage(item));
                     else
                         unsupported += 1;
                 }
@@ -377,7 +406,8 @@ export async function mountChatTools(integrations, signal) {
                     parts.push(JSON.stringify(result.structuredContent));
                 if (unsupported)
                     parts.unshift(`[${unsupported} unsupported MCP content item(s) omitted. The operation may have taken effect, but its full result cannot be represented; inspect its state before retrying.]`);
-                return { text: boundedText(parts.join("\n") || "(empty result)"), ok: result.isError !== true && unsupported === 0 };
+                return { text: boundedText(parts.join("\n") || (images.length ? "Screenshot captured." : "(empty result)")), ok: result.isError !== true && unsupported === 0,
+                    ...(images.length ? { images } : {}) };
             }
             catch (error) {
                 await close();

package/dist-server/server/drivers/chat-tool-approval.js

@@ -1,4 +1,4 @@
-// Per-turn permission gate, adapted from the approval lifecycle in #780.
+// Per-turn ask gate, adapted from the approval lifecycle in #780.
 // Register before publishing: a harness listener may answer synchronously.
 import { newId } from "../contracts.js";
 export function createChatToolApproval(options) {
@@ -10,33 +10,85 @@ export function createChatToolApproval(options) {
                 return Promise.resolve(false);
             const ask = { id: newId(), tool, summary };
             return new Promise((resolve) => {
-                const finish = (allowed, source) => {
-                    if (!pending.delete(ask.id))
-                        return;
-                    clearTimeout(timer);
-                    options.signal.removeEventListener("abort", abort);
-                    options.resolved(ask, allowed, source);
-                    resolve(allowed);
+                let timer;
+                const card = {
+                    kind: "permission",
+                    ask,
+                    finish(source, decision) {
+                        if (!pending.delete(ask.id))
+                            return;
+                        clearTimeout(timer);
+                        options.signal.removeEventListener("abort", abort);
+                        const allowed = decision?.allowed === true;
+                        options.resolved(ask, allowed, source);
+                        resolve(allowed);
+                    },
                 };
-                const abort = () => finish(false, "system");
-                const timer = setTimeout(() => finish(false, "timeout"), options.timeoutMs ?? 15 * 60_000);
+                const abort = () => card.finish("system");
+                timer = setTimeout(() => card.finish("timeout"), options.timeoutMs ?? 15 * 60_000);
                 timer.unref?.();
-                pending.set(ask.id, finish);
+                pending.set(ask.id, card);
                 options.signal.addEventListener("abort", abort, { once: true });
                 options.open(ask);
             });
         },
-        answer(id, behavior) {
-            const finish = pending.get(id);
-            if (!finish || options.signal.aborted || behavior === "answer")
+        question(tool, summary, questions) {
+            if (closed || options.signal.aborted)
+                return Promise.resolve(null);
+            const ask = { id: newId(), tool, summary };
+            return new Promise((resolve) => {
+                let timer;
+                const card = {
+                    kind: "question",
+                    ask,
+                    finish(source, decision) {
+                        if (!pending.delete(ask.id))
+                            return;
+                        clearTimeout(timer);
+                        options.signal.removeEventListener("abort", abort);
+                        // Only the person's reply resolves a question; a timeout or
+                        // abort resolves null so no system note can occupy the answer
+                        // slot the model reads as the person's words.
+                        const reply = typeof decision?.message === "string" && decision.message.length > 0 ? decision.message : null;
+                        options.resolvedQuestion(ask, reply !== null, source);
+                        resolve(reply);
+                    },
+                };
+                const abort = () => card.finish("system");
+                timer = setTimeout(() => card.finish("timeout"), options.timeoutMs ?? 15 * 60_000);
+                timer.unref?.();
+                pending.set(ask.id, card);
+                options.signal.addEventListener("abort", abort, { once: true });
+                options.openQuestion(ask, questions);
+            });
+        },
+        answer(id, behavior, message) {
+            const card = pending.get(id);
+            if (!card || options.signal.aborted)
                 return "unavailable";
-            finish(behavior === "allow", "user");
-            return behavior === "allow" ? "allowed-once" : "rejected";
+            if (behavior === "deny") {
+                card.finish("user");
+                return "rejected";
+            }
+            if (card.kind === "permission") {
+                // An answer is not a permission: only allow or deny settles it.
+                if (behavior !== "allow")
+                    return "unavailable";
+                card.finish("user", { allowed: true });
+                return "allowed-once";
+            }
+            // And an allow is not an answer: a question settles only on a real
+            // reply, never a blank the model would have to interpret.
+            if (behavior === "answer" && typeof message === "string" && message.trim()) {
+                card.finish("user", { message });
+                return "answered";
+            }
+            return "unavailable";
         },
         close() {
             closed = true;
-            for (const finish of pending.values())
-                finish(false, "system");
+            for (const card of pending.values())
+                card.finish("system");
         },
     };
 }

package/dist-server/server/drivers/claude.js

@@ -6,7 +6,7 @@
 //
 // Integrations become MCP servers on the CLI:
 //   - Composio Sessions (connected apps → tools) over streamable HTTP
-//   - the bot's cloud computer (box.ascii.dev) via server/computer-proxy.ts
+//   - the bot's cloud computer (boat.dev) via server/computer-proxy.ts
 //     — screenshot/exec/open_url, the CUA-on-the-box bridge
 import { createHash, randomBytes } from "node:crypto";
 import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -23,8 +23,11 @@ import { gateServer, resultBudget } from "../mcp-gate-config.js";
 import { newEventId, newId } from "../contracts.js";
 import { askInputSummary, commandSummary, toolDetailPreview } from "../tool-summary.js";
 import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS } from "./retry.js";
+import { sessionIdlePolicy } from "./session-idle.js";
+import { parseVersionTriple, versionAtLeast } from "./acp/core.js";
 import { applyClaudeInject, decodeInjectId, mergeLocalInject, probeLocalInjects, resolveInjectId, } from "./local-inject.js";
 import { appendNative } from "./native.js";
+import { permissionCommand, permissionLaunchCwd } from "./permission-command.js";
 import { SPAWNED_PROXIES } from "../proxy-paths.js";
 import { extractMcpImages } from "../mcp-tool-images.js";
 import { ASK_USER_QUESTION_TOOL, askQuestionSummary, parseAskQuestions, parseChoices, questionChoices, } from "../../shared/ask-question.js";
@@ -108,6 +111,17 @@ export function claudeAuthFailure(frame, text) {
         return false;
     return frame.error === "authentication_failed" || classifyError({ text }).reason === "auth";
 }
+/** A model newer than the installed Claude Code: the API refuses it and the
+ * CLI relays that as an api-error frame ("Claude Code 2.1.268 does not
+ * support this model; version 2.1.280 or newer is required. Run 'claude
+ * update'…"). It names no model, so it covers every model it happens for.
+ * Like a signed-out turn, it is fixed by changing the install, not by a
+ * retry, so the UI offers to run the update. */
+export function claudeVersionTooOld(frame, text) {
+    if (frame.is_api_error_message !== true && typeof frame.error !== "string")
+        return false;
+    return /\bClaude Code v?\d+(?:\.\d+)+ does not support this model\b/i.test(text);
+}
 /** The CLI environment shared by auth probes and real turns.
  *
  * Subscription users can be billed pay-as-you-go if an inherited API key
@@ -274,17 +288,7 @@ export const CLAUDE_CONTEXT_CONTROL_MIN_VERSION = CLAUDE_FLAG_FLOORS["--system-p
  * is the version. Null when nothing parses, e.g. a wrapper that prints its
  * own banner first — see claudeCliSupports for how that is treated. */
 export function parseClaudeCliVersion(stdout) {
-    const match = /(\d+)\.(\d+)\.(\d+)/.exec(stdout ?? "");
-    if (!match)
-        return null;
-    return [Number(match[1]), Number(match[2]), Number(match[3])];
-}
-function versionAtLeast(installed, floor) {
-    for (let i = 0; i < 3; i += 1) {
-        if (installed[i] !== floor[i])
-            return installed[i] > floor[i];
-    }
-    return true;
+    return parseVersionTriple(stdout ?? "");
 }
 /** Whether a CLI reporting `version` accepts `flag`. A version that could
  * not be parsed counts as current: every CLI that predates a floor prints a
@@ -856,11 +860,7 @@ export const ClaudeDriver = {
         // one active turn per thread; a second send while busy is a caller bug
         const active = new Map();
         const sessions = new Map();
-        const configuredIdleMinimum = Number(process.env.OMB_CLAUDE_SESSION_IDLE_MIN_MS);
-        const sessionIdleMinimum = Number.isFinite(configuredIdleMinimum) && configuredIdleMinimum > 0
-            ? configuredIdleMinimum
-            : 10_000;
-        const SESSION_IDLE_MS = Math.max(sessionIdleMinimum, Number(process.env.OMB_CLAUDE_SESSION_IDLE_MS) || 10 * 60_000);
+        const { idleMs: SESSION_IDLE_MS } = sessionIdlePolicy("CLAUDE");
         const stopSession = (session) => {
             void killCliTree(session.child).then((stopped) => {
                 if (stopped)
@@ -1199,6 +1199,7 @@ export const ClaudeDriver = {
             // parallel bot work must use the harness's durable delegate_bot path.
             env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS = "1";
             const cwd = turn.cwd ?? homedir();
+            const commandCwd = permissionLaunchCwd(cwd);
             // Everything that shapes the process, minus session/turn-specific temp
             // paths. Their contents are represented directly in the key instead.
             const privateFileFlags = new Set(["--mcp-config", "--settings"]);
@@ -1239,7 +1240,7 @@ export const ClaudeDriver = {
                     }, turnId, broker: live.broker });
                 emit({ ...base(threadId, turnId), type: "turn.started" });
                 const volatile = turn.systemVolatile ?? "";
-                const message = volatile === live.volatile
+                const message = volatile === live.volatile && !turn.mentionTurn
                     ? promptMsg
                     : claudeUserMessage(withVolatileNote(turn.text, volatile), turn.images);
                 live.volatile = volatile;
@@ -1323,6 +1324,9 @@ export const ClaudeDriver = {
                                 requestType: ask.kind,
                                 tool: ask.tool,
                                 summary: askSummary(ask),
+                                command: ask.kind === "permission" && ask.tool === "Bash"
+                                    ? permissionCommand(ask.input.command, commandCwd) : undefined,
+                                requiresExplicitApproval: ask.kind === "permission" && ask.tool === "Bash" && ask.input.dangerouslyDisableSandbox === true || undefined,
                                 nativeReview,
                                 // the proxy hands Claude its own suggested rules on `always`;
                                 // host control stays one action at a time
@@ -1441,6 +1445,11 @@ export const ClaudeDriver = {
                 // A settled turn owns no retry budget. Retained CLI sessions may run
                 // many later turns on this thread, and each must start fresh.
                 retryState.delete(threadId);
+                // Updating the executable cannot update code already loaded by this
+                // pooled child. Retire it before announcing completion so an explicit
+                // retry resumes on a fresh process; healthy sibling sessions stay warm.
+                if (stopReason === "update_required")
+                    closeSession(threadId, "update required");
                 emit({ ...base(threadId, t.turnId), type: "turn.completed", ok, stopReason, cost, ...(usage ? { usage } : {}) });
                 if (session.child.exitCode === null && !session.closing)
                     armIdle(threadId);
@@ -1503,6 +1512,12 @@ export const ClaudeDriver = {
                             emit({ ...base(threadId, currentTurnId()), type: "runtime.error", message: text, setup: true });
                             break;
                         }
+                        if (claudeVersionTooOld(o, text)) {
+                            if (session.turn)
+                                session.turn.updateRequired = true;
+                            emit({ ...base(threadId, currentTurnId()), type: "runtime.error", message: text, setup: true, claudeUpdate: true });
+                            break;
+                        }
                         if (text.trim()) {
                             // The CLI's own report of any other API error is still shown,
                             // but marked: the model never produced it.
@@ -1565,7 +1580,11 @@ export const ClaudeDriver = {
                         // are billed (at the cache rate) and they fill the window — but
                         // they are reported separately too, so the UI can show how much
                         // of the figure was context re-read rather than new text.
-                        settle(o.is_error !== true, session.turn?.authFailed ? "auth_required" : o.stop_reason ?? o.terminal_reason ?? null, o.total_cost_usd ?? null, o.usage
+                        settle(o.is_error !== true, session.turn?.authFailed
+                            ? "auth_required"
+                            : session.turn?.updateRequired
+                                ? "update_required"
+                                : o.stop_reason ?? o.terminal_reason ?? null, o.total_cost_usd ?? null, o.usage
                             ? {
                                 input: (o.usage.input_tokens || 0) + (o.usage.cache_read_input_tokens || 0) + (o.usage.cache_creation_input_tokens || 0),
                                 output: o.usage.output_tokens || 0,

package/dist-server/server/drivers/codex-catalog.js

@@ -6,11 +6,17 @@
 import { readdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, join } from "node:path";
+import { qualifiedModelLabel } from "../contracts.js";
 import { killCliTree, spawnCli } from "../procs.js";
+import { codexHome } from "./codex-identity.js";
 import { mergeLocalInject } from "./local-inject.js";
 export const STATIC_CODEX_MODELS = {
     default: "gpt-5.6-sol",
     options: [
+        // Only used when live discovery fails; these rows do not establish account access.
+        { id: "gpt-6-astra", label: "GPT-6 Astra (availability unverified)" },
+        { id: "gpt-6-sol", label: "GPT-6 Sol (availability unverified)" },
+        { id: "gpt-6-luna", label: "GPT-6 Luna (availability unverified)" },
         { id: "gpt-5.6-sol", label: "GPT-5.6 Sol" },
         { id: "gpt-5.6-terra", label: "GPT-5.6 Terra" },
         { id: "gpt-5.6-luna", label: "GPT-5.6 Luna" },
@@ -154,11 +160,6 @@ export function readCodexAppServerModelCatalog(cli, env, timeoutMs = 8_000) {
         request("initialize", { clientInfo: { name: "openmausbot", version: "1" } }, "initialize");
     });
 }
-export function codexHome(env) {
-    if (env.CODEX_HOME)
-        return env.CODEX_HOME;
-    return join(env.HOME || env.USERPROFILE || homedir(), ".codex");
-}
 function unquote(raw) {
     let value = raw.trim();
     const hash = value.indexOf(" #");
@@ -253,7 +254,10 @@ function niceLabel(model, provider, known, named) {
     if (named.has(encoded))
         return named.get(encoded);
     const host = providerName(provider, known);
-    return host === provider ? model : `${model} (${host})`;
+    return qualifiedModelLabel(model, host, {
+        redundantWhen: () => host === provider,
+        decorate: (facet) => ` (${facet})`,
+    });
 }
 function collectCatalogNames(home) {
     const named = new Map();
@@ -338,7 +342,11 @@ async function probeProviderModels(provider, env, fetchImpl) {
 /** Local slugs Codex already knows, plus the three official cloud rows. */
 export async function readCodexModelCatalog(env = process.env, fetchImpl = fetch, cli) {
     const official = (cli ? await readCodexAppServerModelCatalog(cli, env) : null) ?? STATIC_CODEX_MODELS;
+    // Match the identity boundary: an explicitly relative CODEX_HOME or user
+    // home must not load a catalog from a different directory.
     const home = codexHome(env);
+    if (!home)
+        return mergeLocalInject(official, env, fetchImpl);
     const mainText = readText(join(home, "config.toml"));
     if (!mainText)
         return mergeLocalInject(official, env, fetchImpl);

package/dist-server/server/drivers/codex-identity.js

@@ -3,6 +3,7 @@
 // old file's email. Only the protocol's display email leaves this helper.
 import { homedir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
+import { userHome } from "../env-path.js";
 import { killCliTree, spawnCli } from "../procs.js";
 const MAX_OUTPUT = 16_384;
 const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
@@ -11,7 +12,7 @@ const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 export function codexHome(env) {
     if (env.CODEX_HOME)
         return isAbsolute(env.CODEX_HOME) ? resolve(env.CODEX_HOME) : null;
-    const home = env.HOME || env.USERPROFILE || homedir();
+    const home = userHome(env);
     return isAbsolute(home) ? join(home, ".codex") : null;
 }
 /** Read-only account metadata. Unsupported CLIs and uncertain responses stay