@ai-devkit/agent-manager 0.32.0 → 0.33.0

package/src/__tests__/print/ClaudeCliProbe.test.ts

@@ -1,28 +1,34 @@
-import { describe, expect, it, vi } from 'vitest';
-import { ClaudeCliProbe } from '../../providers/claude/durable/ClaudeCliProbe.js';
+import { describe, expect, it, vi } from "vitest";
+import { ClaudeCliProbe } from "../../providers/claude/durable/ClaudeCliProbe.js";
 
-describe('ClaudeCliProbe', () => {
-    it('validates only version/help and requires the print session flags', async () => {
-        const exec = vi.fn()
-            .mockResolvedValueOnce({ stdout: '2.1.220\n', stderr: '' })
-            .mockResolvedValueOnce({
-                stdout: '--print --session-id --resume --output-format stream-json', stderr: '',
-            });
+describe("ClaudeCliProbe", () => {
+  it("validates only version/help and requires the print session flags", async () => {
+    const exec = vi
+      .fn()
+      .mockResolvedValueOnce({ stdout: "2.1.220\n", stderr: "" })
+      .mockResolvedValueOnce({
+        stdout: "--print --session-id --resume --output-format stream-json",
+        stderr: "",
+      });
 
-        await expect(new ClaudeCliProbe({ exec }).validate()).resolves.toEqual({
-            executable: 'claude', version: '2.1.220',
-        });
-        expect(exec.mock.calls).toEqual([
-            ['claude', ['--version']],
-            ['claude', ['--help']],
-        ]);
+    await expect(new ClaudeCliProbe({ exec }).validate()).resolves.toEqual({
+      executable: "claude",
+      version: "2.1.220",
     });
+    expect(exec.mock.calls).toEqual([
+      ["claude", ["--version"]],
+      ["claude", ["--help"]],
+    ]);
+  });
 
-    it('rejects a CLI missing a required capability', async () => {
-        const exec = vi.fn()
-            .mockResolvedValueOnce({ stdout: 'old', stderr: '' })
-            .mockResolvedValueOnce({ stdout: '--print only', stderr: '' });
+  it("rejects a CLI missing a required capability", async () => {
+    const exec = vi
+      .fn()
+      .mockResolvedValueOnce({ stdout: "old", stderr: "" })
+      .mockResolvedValueOnce({ stdout: "--print only", stderr: "" });
 
-        await expect(new ClaudeCliProbe({ exec }).validate()).rejects.toMatchObject({ code: 'CLAUDE_CLI_UNSUPPORTED' });
+    await expect(new ClaudeCliProbe({ exec }).validate()).rejects.toMatchObject({
+      code: "CLAUDE_CLI_UNSUPPORTED",
     });
+  });
 });

package/src/__tests__/print/ClaudePrintAgent.integration.test.ts

@@ -1,53 +1,61 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { afterEach, describe, expect, it, vi } from 'vitest';
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import {
-    ClaudePrintAgentService,
-    DurableAgentRepository,
-    type ProcessInspector,
-} from '../../index.js';
+  ClaudePrintAgentService,
+  DurableAgentRepository,
+  type ProcessInspector,
+} from "../../index.js";
 
 const roots: string[] = [];
 
 afterEach(() => {
-    for (const root of roots.splice(0)) fs.rmSync(root, { recursive: true, force: true });
+  for (const root of roots.splice(0)) fs.rmSync(root, { recursive: true, force: true });
 });
 
-describe('Claude durable-agent fake-provider journey', () => {
-    it('creates without invocation, then starts and resumes the same session through stdin', async () => {
-        const root = fs.mkdtempSync(path.join(os.tmpdir(), 'durable-agent-integration-'));
-        roots.push(root);
-        const cwd = path.join(root, 'project');
-        fs.mkdirSync(cwd);
-        const processInspector: ProcessInspector = {
-            getIdentity: (pid) => ({ pid, startedAt: `process-${pid}` }),
-        };
-        const repository = new DurableAgentRepository({
-            dbPath: path.join(root, 'state', 'agents.db'),
-            processInspector,
-        });
-        const runner = {
-            run: vi.fn().mockImplementation(async (request) => {
-                await request.onSpawn({ pid: 42, startedAt: 'process-42' });
-                return { sessionId: request.agent.providerSessionId, result: `answer:${request.prompt}`, exitCode: 0 };
-            }),
+describe("Claude durable-agent fake-provider journey", () => {
+  it("creates without invocation, then starts and resumes the same session through stdin", async () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "durable-agent-integration-"));
+    roots.push(root);
+    const cwd = path.join(root, "project");
+    fs.mkdirSync(cwd);
+    const processInspector: ProcessInspector = {
+      getIdentity: (pid) => ({ pid, startedAt: `process-${pid}` }),
+    };
+    const repository = new DurableAgentRepository({
+      dbPath: path.join(root, "state", "agents.db"),
+      processInspector,
+    });
+    const runner = {
+      run: vi.fn().mockImplementation(async (request) => {
+        await request.onSpawn({ pid: 42, startedAt: "process-42" });
+        return {
+          sessionId: request.agent.providerSessionId,
+          result: `answer:${request.prompt}`,
+          exitCode: 0,
         };
-        const service = new ClaudePrintAgentService({
-            repository,
-            probe: { validate: vi.fn() },
-            runner,
-        });
+      }),
+    };
+    const service = new ClaudePrintAgentService({
+      repository,
+      probe: { validate: vi.fn() },
+      runner,
+    });
 
-        const created = await service.create({ name: 'reviewer', cwd });
+    const created = await service.create({ name: "reviewer", cwd });
 
-        await expect(service.send(created.id, 'first secret')).resolves.toMatchObject({ result: 'answer:first secret' });
-        await expect(service.send(created.id, 'follow up')).resolves.toMatchObject({ result: 'answer:follow up' });
+    await expect(service.send(created.id, "first secret")).resolves.toMatchObject({
+      result: "answer:first secret",
+    });
+    await expect(service.send(created.id, "follow up")).resolves.toMatchObject({
+      result: "answer:follow up",
+    });
 
-        expect(runner.run.mock.calls[0][0]).toMatchObject({ firstRun: true, prompt: 'first secret' });
-        expect(runner.run.mock.calls[1][0]).toMatchObject({ firstRun: false, prompt: 'follow up' });
+    expect(runner.run.mock.calls[0][0]).toMatchObject({ firstRun: true, prompt: "first secret" });
+    expect(runner.run.mock.calls[1][0]).toMatchObject({ firstRun: false, prompt: "follow up" });
 
-        const persisted = await repository.getById(created.id);
-        expect(persisted).toMatchObject({ state: 'ready', sessionHealth: 'healthy' });
-    });
+    const persisted = await repository.getById(created.id);
+    expect(persisted).toMatchObject({ state: "ready", sessionHealth: "healthy" });
+  });
 });

package/src/__tests__/print/ClaudePrintAgentService.test.ts

@@ -1,78 +1,129 @@
-import { describe, expect, it, vi } from 'vitest';
+import { describe, expect, it, vi } from "vitest";
 
-describe('ClaudePrintAgentService', () => {
-    it('validates before create and does not run Claude', async () => {
-        const api = await import('../../index.js') as Record<string, unknown>;
-        expect(api).toHaveProperty('ClaudePrintAgentService');
-        const probe = { validate: vi.fn().mockResolvedValue({ executable: 'claude', version: '2.1.220' }) };
-        const repository = { create: vi.fn().mockResolvedValue({ id: 'agent-id', name: 'reviewer' }) };
-        const runner = { run: vi.fn() };
-        const Service = api.ClaudePrintAgentService as new (options: unknown) => any;
+describe("ClaudePrintAgentService", () => {
+  it("validates before create and does not run Claude", async () => {
+    const api = (await import("../../index.js")) as Record<string, unknown>;
+    expect(api).toHaveProperty("ClaudePrintAgentService");
+    const probe = {
+      validate: vi.fn().mockResolvedValue({ executable: "claude", version: "2.1.220" }),
+    };
+    const repository = { create: vi.fn().mockResolvedValue({ id: "agent-id", name: "reviewer" }) };
+    const runner = { run: vi.fn() };
+    const Service = api.ClaudePrintAgentService as new (options: unknown) => any;
 
-        await expect(new Service({ repository, probe, runner }).create({ name: 'reviewer', cwd: '/project' }))
-            .resolves.toMatchObject({ id: 'agent-id' });
-        expect(probe.validate).toHaveBeenCalledOnce();
-        expect(repository.create).toHaveBeenCalledWith({ name: 'reviewer', cwd: '/project' });
-        expect(runner.run).not.toHaveBeenCalled();
-    });
+    await expect(
+      new Service({ repository, probe, runner }).create({ name: "reviewer", cwd: "/project" }),
+    ).resolves.toMatchObject({ id: "agent-id" });
+    expect(probe.validate).toHaveBeenCalledOnce();
+    expect(repository.create).toHaveBeenCalledWith({ name: "reviewer", cwd: "/project" });
+    expect(runner.run).not.toHaveBeenCalled();
+  });
 
-    it('runs first and resumed sends and records provider identity/results', async () => {
-        const api = await import('../../index.js') as Record<string, unknown>;
-        const base = { id: 'id', name: 'reviewer', provider: 'claude', providerSessionId: 'session', sessionHealth: 'uninitialized' };
-        const repository = {
-            resolve: vi.fn().mockResolvedValue(base),
-            acquireRun: vi.fn()
-                .mockResolvedValueOnce({ agent: base, token: 'one' })
-                .mockResolvedValueOnce({ agent: { ...base, sessionHealth: 'healthy' }, token: 'two' }),
-            recordProviderProcess: vi.fn(), completeRun: vi.fn().mockResolvedValue({}),
-        };
-        const runner = { run: vi.fn().mockImplementation(async (request) => {
-            await request.onSpawn({ pid: 42, startedAt: 'start' });
-            return { sessionId: 'session', result: 'answer', exitCode: 0 };
-        }) };
-        const Service = api.ClaudePrintAgentService as new (options: unknown) => any;
-        const service = new Service({ repository, probe: { validate: vi.fn() }, runner, executable: 'fake-claude' });
+  it("runs first and resumed sends and records provider identity/results", async () => {
+    const api = (await import("../../index.js")) as Record<string, unknown>;
+    const base = {
+      id: "id",
+      name: "reviewer",
+      provider: "claude",
+      providerSessionId: "session",
+      sessionHealth: "uninitialized",
+    };
+    const repository = {
+      resolve: vi.fn().mockResolvedValue(base),
+      acquireRun: vi
+        .fn()
+        .mockResolvedValueOnce({ agent: base, token: "one" })
+        .mockResolvedValueOnce({ agent: { ...base, sessionHealth: "healthy" }, token: "two" }),
+      recordProviderProcess: vi.fn(),
+      completeRun: vi.fn().mockResolvedValue({}),
+    };
+    const runner = {
+      run: vi.fn().mockImplementation(async (request) => {
+        await request.onSpawn({ pid: 42, startedAt: "start" });
+        return { sessionId: "session", result: "answer", exitCode: 0 };
+      }),
+    };
+    const Service = api.ClaudePrintAgentService as new (options: unknown) => any;
+    const service = new Service({
+      repository,
+      probe: { validate: vi.fn() },
+      runner,
+      executable: "fake-claude",
+    });
 
-        await service.send('reviewer', 'first');
-        await service.send('id', 'later');
+    await service.send("reviewer", "first");
+    await service.send("id", "later");
 
-        expect(runner.run.mock.calls[0][0]).toMatchObject({ prompt: 'first', firstRun: true, executable: 'fake-claude' });
-        expect(runner.run.mock.calls[1][0]).toMatchObject({ prompt: 'later', firstRun: false, executable: 'fake-claude' });
-        expect(repository.recordProviderProcess).toHaveBeenCalledWith('id', 'one', { pid: 42, startedAt: 'start' });
-        expect(repository.completeRun).toHaveBeenCalledWith('id', 'one', expect.objectContaining({
-            status: 'succeeded', exitCode: 0, sessionHealth: 'healthy',
-        }));
+    expect(runner.run.mock.calls[0][0]).toMatchObject({
+      prompt: "first",
+      firstRun: true,
+      executable: "fake-claude",
+    });
+    expect(runner.run.mock.calls[1][0]).toMatchObject({
+      prompt: "later",
+      firstRun: false,
+      executable: "fake-claude",
     });
+    expect(repository.recordProviderProcess).toHaveBeenCalledWith("id", "one", {
+      pid: 42,
+      startedAt: "start",
+    });
+    expect(repository.completeRun).toHaveBeenCalledWith(
+      "id",
+      "one",
+      expect.objectContaining({
+        status: "succeeded",
+        exitCode: 0,
+        sessionHealth: "healthy",
+      }),
+    );
+  });
 
-    it('rejects a non-Claude target without acquiring or mutating it', async () => {
-        const api = await import('../../index.js') as Record<string, unknown>;
-        const Service = api.ClaudePrintAgentService as new (options: unknown) => any;
-        const target = { id: 'id', name: 'reviewer', provider: 'pi' };
-        const repository = {
-            resolve: vi.fn().mockResolvedValue(target),
-            acquireRun: vi.fn(), recordProviderProcess: vi.fn(), completeRun: vi.fn(),
-        };
+  it("rejects a non-Claude target without acquiring or mutating it", async () => {
+    const api = (await import("../../index.js")) as Record<string, unknown>;
+    const Service = api.ClaudePrintAgentService as new (options: unknown) => any;
+    const target = { id: "id", name: "reviewer", provider: "pi" };
+    const repository = {
+      resolve: vi.fn().mockResolvedValue(target),
+      acquireRun: vi.fn(),
+      recordProviderProcess: vi.fn(),
+      completeRun: vi.fn(),
+    };
 
-        await expect(new Service({ repository, probe: { validate: vi.fn() }, runner: { run: vi.fn() } })
-            .send('reviewer', 'x')).rejects.toMatchObject({ code: 'CLAUDE_PRINT_UNSUPPORTED' });
-        expect(repository.acquireRun).not.toHaveBeenCalled();
-        expect(repository.completeRun).not.toHaveBeenCalled();
-    });
+    await expect(
+      new Service({ repository, probe: { validate: vi.fn() }, runner: { run: vi.fn() } }).send(
+        "reviewer",
+        "x",
+      ),
+    ).rejects.toMatchObject({ code: "CLAUDE_PRINT_UNSUPPORTED" });
+    expect(repository.acquireRun).not.toHaveBeenCalled();
+    expect(repository.completeRun).not.toHaveBeenCalled();
+  });
 
-    it('does not turn a successful completion write failure into a second completion', async () => {
-        const api = await import('../../index.js') as Record<string, unknown>;
-        const Service = api.ClaudePrintAgentService as new (options: unknown) => any;
-        const target = { id: 'id', name: 'reviewer', provider: 'claude', providerSessionId: 'session', sessionHealth: 'healthy' };
-        const completionFailure = new Error('completion failed');
-        const repository = {
-            resolve: vi.fn().mockResolvedValue(target),
-            acquireRun: vi.fn().mockResolvedValue({ agent: target, token: 'one' }),
-            recordProviderProcess: vi.fn(), completeRun: vi.fn().mockRejectedValue(completionFailure),
-        };
-        const runner = { run: vi.fn().mockResolvedValue({ sessionId: 'session', result: 'answer', exitCode: 0 }) };
+  it("does not turn a successful completion write failure into a second completion", async () => {
+    const api = (await import("../../index.js")) as Record<string, unknown>;
+    const Service = api.ClaudePrintAgentService as new (options: unknown) => any;
+    const target = {
+      id: "id",
+      name: "reviewer",
+      provider: "claude",
+      providerSessionId: "session",
+      sessionHealth: "healthy",
+    };
+    const completionFailure = new Error("completion failed");
+    const repository = {
+      resolve: vi.fn().mockResolvedValue(target),
+      acquireRun: vi.fn().mockResolvedValue({ agent: target, token: "one" }),
+      recordProviderProcess: vi.fn(),
+      completeRun: vi.fn().mockRejectedValue(completionFailure),
+    };
+    const runner = {
+      run: vi.fn().mockResolvedValue({ sessionId: "session", result: "answer", exitCode: 0 }),
+    };
 
-        await expect(new Service({ repository, probe: { validate: vi.fn() }, runner })
-            .send('reviewer', 'x')).rejects.toBe(completionFailure);
-        expect(repository.completeRun).toHaveBeenCalledOnce();
-    });
+    await expect(
+      new Service({ repository, probe: { validate: vi.fn() }, runner }).send("reviewer", "x"),
+    ).rejects.toBe(completionFailure);
+    expect(repository.completeRun).toHaveBeenCalledOnce();
+  });
 });

package/src/__tests__/print/ClaudePrintRunner.test.ts

@@ -1,99 +1,152 @@
-import { EventEmitter } from 'node:events';
-import { PassThrough, Writable } from 'node:stream';
-import { describe, expect, it, vi } from 'vitest';
-import type { DurableAgent } from '../../index.js';
-import { ClaudePrintRunner } from '../../providers/claude/durable/ClaudePrintRunner.js';
+import { EventEmitter } from "node:events";
+import { PassThrough, Writable } from "node:stream";
+import { describe, expect, it, vi } from "vitest";
+import type { DurableAgent } from "../../index.js";
+import { ClaudePrintRunner } from "../../providers/claude/durable/ClaudePrintRunner.js";
 
 function agent(): DurableAgent {
-    return {
-        id: '11111111-1111-4111-8111-111111111111', name: 'reviewer', provider: 'claude', mode: 'durable',
-        cwd: '/project', providerSessionId: '22222222-2222-4222-8222-222222222222', state: 'running',
-        sessionHealth: 'uninitialized', createdAt: '', updatedAt: '', lastActiveAt: null, lastResult: null,
-        activeRun: null,
-    };
+  return {
+    id: "11111111-1111-4111-8111-111111111111",
+    name: "reviewer",
+    provider: "claude",
+    mode: "durable",
+    cwd: "/project",
+    providerSessionId: "22222222-2222-4222-8222-222222222222",
+    state: "running",
+    sessionHealth: "uninitialized",
+    createdAt: "",
+    updatedAt: "",
+    lastActiveAt: null,
+    lastResult: null,
+    activeRun: null,
+  };
 }
 
 function fakeSpawn(events: object[], exitCode = 0) {
-    const calls: unknown[][] = [];
-    const promptChunks: Buffer[] = [];
-    const child = new EventEmitter() as any;
-    child.pid = 4242;
-    child.stdout = new PassThrough();
-    child.stderr = new PassThrough();
-    child.stdin = new Writable({
-        write(chunk, _encoding, callback) { promptChunks.push(Buffer.from(chunk)); callback(); },
-        final(callback) {
-            for (const event of events) child.stdout.write(`${JSON.stringify(event)}\n`);
-            child.stdout.end();
-            queueMicrotask(() => child.emit('close', exitCode, null));
-            callback();
-        },
-    });
-    const spawn = vi.fn((...args: unknown[]) => { calls.push(args); return child; });
-    return { spawn, calls, promptChunks };
+  const calls: unknown[][] = [];
+  const promptChunks: Buffer[] = [];
+  const child = new EventEmitter() as any;
+  child.pid = 4242;
+  child.stdout = new PassThrough();
+  child.stderr = new PassThrough();
+  child.stdin = new Writable({
+    write(chunk, _encoding, callback) {
+      promptChunks.push(Buffer.from(chunk));
+      callback();
+    },
+    final(callback) {
+      for (const event of events) child.stdout.write(`${JSON.stringify(event)}\n`);
+      child.stdout.end();
+      queueMicrotask(() => child.emit("close", exitCode, null));
+      callback();
+    },
+  });
+  const spawn = vi.fn((...args: unknown[]) => {
+    calls.push(args);
+    return child;
+  });
+  return { spawn, calls, promptChunks };
 }
 
-describe('ClaudePrintRunner', () => {
-    it('starts a caller-assigned session and persists provider identity before stdin', async () => {
-        const fixture = fakeSpawn([
-            { type: 'system', subtype: 'init', session_id: agent().providerSessionId },
-            { type: 'result', session_id: agent().providerSessionId, result: 'done' },
-        ]);
-        let persisted = false;
-        const runner = new ClaudePrintRunner({ spawn: fixture.spawn, processInspector: {
-            getIdentity: () => ({ pid: 4242, startedAt: 'provider-start' }),
-        } });
-
-        const result = await runner.run({
-            agent: agent(), prompt: 'secret prompt', executable: 'claude-test', firstRun: true,
-            onSpawn: async () => { expect(fixture.promptChunks).toHaveLength(0); persisted = true; },
-        });
+describe("ClaudePrintRunner", () => {
+  it("starts a caller-assigned session and persists provider identity before stdin", async () => {
+    const fixture = fakeSpawn([
+      { type: "system", subtype: "init", session_id: agent().providerSessionId },
+      { type: "result", session_id: agent().providerSessionId, result: "done" },
+    ]);
+    let persisted = false;
+    const runner = new ClaudePrintRunner({
+      spawn: fixture.spawn,
+      processInspector: {
+        getIdentity: () => ({ pid: 4242, startedAt: "provider-start" }),
+      },
+    });
 
-        expect(persisted).toBe(true);
-        expect(fixture.calls[0]).toEqual([
-            'claude-test',
-            ['-p', '--session-id', agent().providerSessionId, '--output-format', 'stream-json', '--verbose'],
-            expect.objectContaining({ cwd: '/project', shell: false, stdio: ['pipe', 'pipe', 'pipe'] }),
-        ]);
-        expect(JSON.stringify(fixture.calls)).not.toContain('secret prompt');
-        expect(Buffer.concat(fixture.promptChunks).toString()).toBe('secret prompt');
-        expect(result).toEqual({ sessionId: agent().providerSessionId, result: 'done', exitCode: 0 });
+    const result = await runner.run({
+      agent: agent(),
+      prompt: "secret prompt",
+      executable: "claude-test",
+      firstRun: true,
+      onSpawn: async () => {
+        expect(fixture.promptChunks).toHaveLength(0);
+        persisted = true;
+      },
     });
 
-    it('uses exact resume and rejects a mismatched result session', async () => {
-        const fixture = fakeSpawn([{ type: 'result', session_id: 'wrong', result: 'nope' }]);
-        const runner = new ClaudePrintRunner({ spawn: fixture.spawn, processInspector: {
-            getIdentity: () => ({ pid: 4242, startedAt: 'provider-start' }),
-        } });
+    expect(persisted).toBe(true);
+    expect(fixture.calls[0]).toEqual([
+      "claude-test",
+      [
+        "-p",
+        "--session-id",
+        agent().providerSessionId,
+        "--output-format",
+        "stream-json",
+        "--verbose",
+      ],
+      expect.objectContaining({ cwd: "/project", shell: false, stdio: ["pipe", "pipe", "pipe"] }),
+    ]);
+    expect(JSON.stringify(fixture.calls)).not.toContain("secret prompt");
+    expect(Buffer.concat(fixture.promptChunks).toString()).toBe("secret prompt");
+    expect(result).toEqual({ sessionId: agent().providerSessionId, result: "done", exitCode: 0 });
+  });
 
-        await expect(runner.run({
-            agent: agent(), prompt: 'followup', executable: 'claude', firstRun: false, onSpawn: vi.fn(),
-        })).rejects.toMatchObject({ code: 'CLAUDE_SESSION_MISMATCH' });
-        expect(fixture.calls[0]![1]).toEqual([
-            '-p', '--resume', agent().providerSessionId, '--output-format', 'stream-json', '--verbose',
-        ]);
+  it("uses exact resume and rejects a mismatched result session", async () => {
+    const fixture = fakeSpawn([{ type: "result", session_id: "wrong", result: "nope" }]);
+    const runner = new ClaudePrintRunner({
+      spawn: fixture.spawn,
+      processInspector: {
+        getIdentity: () => ({ pid: 4242, startedAt: "provider-start" }),
+      },
     });
 
-    it('does not disclose provider stderr in a failed-run error', async () => {
-        const fixture = fakeSpawn([], 1);
-        const runner = new ClaudePrintRunner({ spawn: fixture.spawn, processInspector: {
-            getIdentity: () => ({ pid: 4242, startedAt: 'provider-start' }),
-        } });
-        fixture.spawn.mockImplementationOnce((...args: unknown[]) => {
-            const child = (fakeSpawn([], 1).spawn as any)(...args);
-            child.stdin = new Writable({
-                final(callback) {
-                    child.stderr.write('secret prompt echoed by provider');
-                    child.stderr.end();
-                    queueMicrotask(() => child.emit('close', 1, null));
-                    callback();
-                },
-            });
-            return child;
-        });
+    await expect(
+      runner.run({
+        agent: agent(),
+        prompt: "followup",
+        executable: "claude",
+        firstRun: false,
+        onSpawn: vi.fn(),
+      }),
+    ).rejects.toMatchObject({ code: "CLAUDE_SESSION_MISMATCH" });
+    expect(fixture.calls[0]![1]).toEqual([
+      "-p",
+      "--resume",
+      agent().providerSessionId,
+      "--output-format",
+      "stream-json",
+      "--verbose",
+    ]);
+  });
 
-        await expect(runner.run({
-            agent: agent(), prompt: 'secret prompt', firstRun: true, onSpawn: vi.fn(),
-        })).rejects.not.toThrow(/secret prompt/);
+  it("does not disclose provider stderr in a failed-run error", async () => {
+    const fixture = fakeSpawn([], 1);
+    const runner = new ClaudePrintRunner({
+      spawn: fixture.spawn,
+      processInspector: {
+        getIdentity: () => ({ pid: 4242, startedAt: "provider-start" }),
+      },
     });
+    fixture.spawn.mockImplementationOnce((...args: unknown[]) => {
+      const child = (fakeSpawn([], 1).spawn as any)(...args);
+      child.stdin = new Writable({
+        final(callback) {
+          child.stderr.write("secret prompt echoed by provider");
+          child.stderr.end();
+          queueMicrotask(() => child.emit("close", 1, null));
+          callback();
+        },
+      });
+      return child;
+    });
+
+    await expect(
+      runner.run({
+        agent: agent(),
+        prompt: "secret prompt",
+        firstRun: true,
+        onSpawn: vi.fn(),
+      }),
+    ).rejects.not.toThrow(/secret prompt/);
+  });
 });