Carry a question in the event model, not in one provider's JSON

A question is now fully described by the event that reports it: the tag
it was asked under, each option's label, what it means, and the sample of
what picking it would produce, plus whether several may be picked at
once. The app renders from that alone.

It had been reading Claude Code's tool input to find the parts the event
dropped -- that dialect's schema, written out a second time in Kotlin,
where no other provider could reach it and where it would drift the
first time the schema moved. Echo could not describe an option at all,
and llama never will.

Answers travel as a list for the same reason. A question that takes one
answer sends a list of one rather than being a different shape, and the
one place that flattens it is where the CLI is spoken to: its answers
map holds a string, so several choices are joined there. That join was
in the phone.

Also here because it is the same rule: the permission ask reuses the
question body rather than owning a second one, so Allow/Deny renders and
resolves through exactly the code an AskUserQuestion does.

Verified against both, since a refactor that only satisfies the case it
was written for has been tried on the half that cannot fail: a two
question `/ask` answered from the phone, one option and then two, and a
real sonnet session's `rm -f` permission asked, allowed, and run.

server/src/session/driver.rs

@@ -15,6 +15,35 @@ use tokio::sync::mpsc;
 /// directions use the one id so the transcript renders them identically.
 pub type ImageRef = String;
 
+/// One choice offered in answer to a [`Event::Question`].
+///
+/// More than a label because the reader is deciding, not confirming: what
+/// an option means, and what picking it would produce, are the things that
+/// decide it. Both are optional -- a permission's Allow and Deny mean
+/// exactly what they say.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct QuestionOption {
+    pub label: String,
+    /// A sentence about what this option means.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// A block to show as written -- a mockup, a diff, a config file.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub preview: Option<String>,
+}
+
+impl QuestionOption {
+    /// An option that is only its label, which is most of them.
+    pub fn plain(label: impl Into<String>) -> Self {
+        Self {
+            label: label.into(),
+            description: None,
+            preview: None,
+        }
+    }
+}
+
 /// Everything a session can tell the outside world. Every event is
 /// appended to the session's transcript with a sequence number, then fanned
 /// out to SSE subscribers; the phone renders purely from this stream, so
@@ -93,7 +122,22 @@ pub enum Event {
     Question {
         id: String,
         prompt: String,
-        options: Vec<String>,
+        /// A few words naming what the question is about, when the asker
+        /// offered one -- a tag beside the question rather than part of
+        /// it. `None` for a permission, which is about the call above it.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        header: Option<String>,
+        options: Vec<QuestionOption>,
+        /// Whether several options may be chosen at once.
+        ///
+        /// Here rather than left for a phone to work out from the dialect
+        /// underneath: how many answers a question takes is a fact about
+        /// the question, and the alternative was the app parsing Claude
+        /// Code's tool input to find out -- one dialect's schema, written
+        /// out a second time in Kotlin, where no other dialect could
+        /// reach it.
+        #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+        multi_select: bool,
         /// The tool call this is permission for, when it is one.
         ///
         /// The CLI's `can_use_tool` request carries the `tool_use_id` of
@@ -120,9 +164,15 @@ pub enum Event {
     /// The manager's record of a question being answered, so a rendered
     /// question card resolves on every device, not just the one that
     /// answered it.
+    ///
+    /// A list because a question can take several answers, and one that
+    /// took one is the list of length one rather than a different shape.
+    /// What a dialect makes of that -- Claude Code's answers map holds a
+    /// string, so several become one line -- is that dialect's business
+    /// and is done where it talks to it.
     Answered {
         id: String,
-        answer: String,
+        answers: Vec<String>,
     },
     Status {
         state: SessionStatus,
@@ -217,7 +267,10 @@ pub trait Driver: Send + Sync {
     /// message in the transcript, so a driver that never sends it drops
     /// the message from the conversation entirely.
     fn send_user_message(&self, text: String, images: Vec<ImageRef>);
-    fn answer_question(&self, id: &str, answer: &str);
+    /// Answers one question with everything that was chosen, in the order
+    /// it was offered. One answer is a list of one; a driver whose dialect
+    /// takes a single value joins them where it writes it.
+    fn answer_question(&self, id: &str, answers: &[String]);
     /// Stop mid-run; the session survives.
     fn interrupt(&self);
     fn set_model(&self, model: &str);