@aitne/daemon 0.1.7 → 0.1.9

package/dist/core/backends/gemini-cli-core.js

@@ -1,24 +1,29 @@
 import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve as resolvePath } from "node:path";
-import { APP_NAME, collectSessionDeniedTools, getAgentDayDateStr, INTEGRATION_DESCRIPTORS, INTEGRATION_KEYS, isAutonomousProcessKey, isPlausibleGeminiApiKey, matchRunAllowedToolPattern, } from "@aitne/shared";
+import { APP_NAME, collectSessionDeniedTools, getAgentDayDateStr, INTEGRATION_DESCRIPTORS, INTEGRATION_KEYS, isAutonomousProcessKey, isMessageEvent, isPlausibleGeminiApiKey, matchRunAllowedToolPattern, } from "@aitne/shared";
 import { readIntegrations } from "../../db/integrations-store.js";
 import { getContextDir } from "../../config.js";
 import { cleanupSessionWorkdir, createSessionWorkdir } from "../workdir.js";
+import { resolveUserSkillsRoot } from "../user-skills-root.js";
 import { BackendDecisiveFailure, BackendQuotaError, DelegatedProxyTimeoutError, classifyAbortReason, } from "../agent-core.js";
 import { IdleWatchdog } from "./idle-watchdog.js";
 import { buildDelegatedToolPrompt, emptyCost, tryParseToolResult, withDurationMs, } from "../../services/delegated-tool-runtime.js";
 import { DELEGATED_PROXY_DEFAULTS } from "../../services/delegated-proxy-config.js";
 import { materializeMcpForSession } from "../../services/mcp/session-materializer.js";
 import { parseMcpToolName } from "../../services/mcp/risk.js";
+import { noteNativeSkillToolIfPresent, probeCliNativeSkillSubcommand, } from "./native-skill-discovery-probe.js";
 import { logMcpToolCall } from "../../services/mcp/tool-audit.js";
 import { buildDaemonApiCliEnv } from "../daemon-api-cli.js";
 import { ALWAYS_DISALLOWED_TOOLS } from "../../safety/always-disallowed.js";
 import { CliPathCache, parseJsonLine, runLineCommand, } from "./cli-utils.js";
 import { isPathInsideOrEqual, jsonStringPathForms, shellPathForms, } from "../path-compat.js";
 import { probeApiKeyServerSide } from "./api-key-probe.js";
+import { assertCostWithinMaxBudget, assertPromptCostWithinMaxBudget, classifyCliFailure, } from "./cli-quota-guards.js";
+import { buildAgentDayBoundaryHint } from "./quota-reset-hints.js";
+import { auditStreamObservation, extractGeminiToolUseTarget, } from "../../safety/subprocess-block-scanner.js";
 import { extractSilentApiErrors, logSilentApiErrors, } from "./silent-api-error-detector.js";
-import { estimateTextInputTokens, findRegisteredModel, getModelsForBackend, latestLiteFor, } from "./model-registry.js";
+import { findRegisteredModel, getModelsForBackend, latestLiteFor, } from "./model-registry.js";
 import { PriceFetcher } from "./price-fetcher.js";
 import { buildExecutionPrompt, buildSummaryPrompt } from "./prompt-utils.js";
 import { createLogger } from "../../logging.js";
@@ -52,6 +57,20 @@ const EMPTY_USAGE = {
     cacheCreationInputTokens: 0,
     cacheReadInputTokens: 0,
 };
+/**
+ * Per-event stream-idle threshold for reactive `runTurn` execution
+ * (DMs, routines, scheduled tasks). Distinct from the delegated-path
+ * `DELEGATED_PROXY_DEFAULTS.idleTimeoutMsByBackend.gemini` (75s)
+ * because reactive turns include longer legitimate silences — extended
+ * thinking, MCP cold-starts, long `google-workspace` round-trips. The
+ * threshold catches a fully hung CLI subprocess (zero stream events)
+ * well before `executeTimeoutMinutes` (default 30 min) fires.
+ *
+ * The reactive path needs this guard explicitly: without it, a hung
+ * subprocess could pin a session for the full executeTimeoutMinutes
+ * wall-clock.
+ */
+const REACTIVE_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
 export class GeminiCliCore {
     config;
     writeTracker;
@@ -133,12 +152,18 @@ export class GeminiCliCore {
             processKey: params.processKey,
             ...(wikiWorkspaceName ? { wikiWorkspaceName } : {}),
             sessionDir: params.sessionDir,
+            maxTurns: params.maxTurns,
             maxBudgetUsd: params.maxBudgetUsd,
             webSearchEnabled: params.webSearchEnabled,
             turnToken: params.turnToken,
             sessionDbId: params.sessionDbId,
             eventCorrelationId: params.event.correlationId,
             wikiUrlFetchEnabled: params.wikiUrlFetchEnabled ?? false,
+            ...(isMessageEvent(params.event) ? { messageText: params.event.content } : {}),
+            ...(params.extraSkills && params.extraSkills.length > 0
+                ? { extraSkills: params.extraSkills }
+                : {}),
+            ...(params.skillsReplace ? { skillsReplace: true } : {}),
         }, streamCallbacks);
     }
     async executeResume(params, streamCallbacks) {
@@ -148,11 +173,15 @@ export class GeminiCliCore {
             eventType: "message.received",
             sessionDir: params.sessionDir,
             resumeSessionId: params.sessionId,
+            maxTurns: params.maxTurns,
             maxBudgetUsd: params.maxBudgetUsd,
             webSearchEnabled: params.webSearchEnabled,
             turnToken: params.turnToken,
             sessionDbId: params.sessionDbId,
             eventCorrelationId: params.eventCorrelationId,
+            // Forward the user's reply text as the trigger-phrase signal —
+            // mirrors codex / opencode resume paths.
+            messageText: params.message,
         }, streamCallbacks);
     }
     async summarize(conversationText) {
@@ -395,6 +424,17 @@ export class GeminiCliCore {
             detectedServers: [...detectedServers],
             toolCount: deduped.length,
         }, "Gemini probe collected tool manifest via host MCP scan");
+        // docs/design/appendices/skills-unification.md Phase 1 item 13 — forward-compat
+        // signals. The name-pattern scan over `deduped` here is structurally
+        // a no-op for native discovery (the list is built from
+        // `INTEGRATION_DESCRIPTORS.capabilityTools`, which Aitne controls,
+        // and therefore can never contain a native CLI skill tool we did
+        // not register). The `gemini --help` subcommand probe below is the
+        // real detector: `gemini --help` already lists `gemini skills`
+        // natively, so this is the call site that will trip on first deploy
+        // and need cleanup.
+        noteNativeSkillToolIfPresent("gemini", deduped);
+        void probeCliNativeSkillSubcommand(this.cliPath, "gemini");
         return deduped;
     }
     async runTurn(params, streamCallbacks) {
@@ -422,16 +462,36 @@ export class GeminiCliCore {
             const currentCount = this.readRequestsCount(today);
             if (currentCount >= ceiling) {
                 logger.warn({ currentCount, ceiling, date: today }, "Gemini daily-request ceiling hit — refusing execution");
-                throw new BackendQuotaError(this.backendId, "daily_ceiling", null, `Gemini daily-request ceiling reached (${currentCount}/${ceiling}) — resets at the next agent-day boundary.`);
+                throw new BackendQuotaError(this.backendId, "daily_ceiling", 
+                // Deterministic reset: the next agent-day boundary fires at
+                // `dayBoundaryHour:00` in the configured timezone. The helper
+                // handles the empty-timezone default (`AgentConfig.timezone`
+                // defaults to `""` in config.ts) by omitting the field so the
+                // dashboard renders cleanly.
+                buildAgentDayBoundaryHint(this.config.dayBoundaryHour, this.config.timezone), `Gemini daily-request ceiling reached (${currentCount}/${ceiling}) — resets at the next agent-day boundary.`);
             }
         }
         this.assertPromptWithinMaxBudget(params.prompt, params.maxBudgetUsd, params.modelId);
         const startMs = Date.now();
-        const sessionDir = params.sessionDir ?? createSessionWorkdir(this.config.workspaceDir, params.eventType, `${this.config.dataDir}/skills`, {
+        const sessionDir = params.sessionDir ?? createSessionWorkdir(this.config.workspaceDir, params.eventType, resolveUserSkillsRoot(this.config), {
             backendId: this.backendId,
             processKey: params.processKey,
             character: this.config.character,
+            contextDir: getContextDir(this.config),
+            // docs/design/appendices/skills-unification.md Phase 4 — feed conditional manifest
+            // predicates with live DB rows and the inbound DM text. Gemini
+            // already keeps a `this.db` for the daily request ceiling; reuse
+            // it (falls back to `mcpContext.db` for symmetry with the other
+            // cores).
+            ...((this.db ?? this.mcpContext?.db) ? { db: this.db ?? this.mcpContext?.db ?? null } : {}),
+            ...(typeof params.messageText === "string" ? { messageText: params.messageText } : {}),
             ...(params.wikiWorkspaceName ? { wikiWorkspaceName: params.wikiWorkspaceName } : {}),
+            // AGENT_DEFINITIONS_DESIGN.md §4.2 — see ClaudeCodeCore. No-op for
+            // non-Agent executes.
+            ...(params.extraSkills && params.extraSkills.length > 0
+                ? { extraSkills: params.extraSkills }
+                : {}),
+            ...(params.skillsReplace ? { skillsReplace: true } : {}),
         });
         const ownsSessionDir = !params.sessionDir;
         const daemonReadToken = this.readTokenManager?.issue(sessionDir) ?? this.readToken;
@@ -466,17 +526,68 @@ export class GeminiCliCore {
         let lastError = null;
         let resultStatus = "error";
         let stats = null;
+        // Stream text deltas live as they arrive — mirrors ClaudeCodeCore /
+        // CodexCore so the owner-facing chat surfaces (dashboard chat, owner DM)
+        // get the same incremental-output UX regardless of which backend serves
+        // the turn. `assertWithinMaxBudget` is still enforced post-completion
+        // and surfaces as `BackendQuotaError` AFTER text has streamed —
+        // matching Claude's behaviour. The earlier "defer until budget check"
+        // guard buffered the entire turn, which made interactive flows
+        // (`setup.initial`, dashboard chat) look frozen for minutes.
         let streamed = false;
-        const deferStreamingUntilBudgetCheck = params.maxBudgetUsd !== undefined;
+        // Daemon-side max-turns enforcement. The Gemini CLI exposes no
+        // `--max-turns` flag (verified `gemini --help` on 0.x) and the SDK-level
+        // contract that Claude relies on for `BackendDecisiveFailure("max_turns")`
+        // is unavailable. To match Claude / Codex semantics we count `tool_use`
+        // events as a turn proxy (one model→tool round-trip per event; parallel
+        // tool calls within the same turn marginally over-count, which only
+        // tightens the cap) and use AbortController to terminate the subprocess
+        // when the cap is exceeded. Without this guard, a runaway interactive
+        // flow (`setup.initial` was the trigger case) would burn the full
+        // `executeTimeoutMinutes` wall-clock (default 60 min) before the
+        // generic timeout watchdog fired — the "Customize Your Rules
+        // force-stop / very-slow" report.
+        //
+        // The fallback default (50) mirrors Codex's implicit ceiling so callers
+        // that omit `maxTurns` get the same envelope on every CLI backend.
+        const maxTurns = params.maxTurns ?? 50;
+        let toolCallCount = 0;
+        let maxTurnsExceeded = false;
+        const maxTurnsAborter = new AbortController();
         // Accumulate raw subprocess text across the run so we can scan once for
         // `PA_API_ERROR` markers the pa-api / curl wrappers emit on HTTP errors.
         // Gemini's stream schema doesn't expose a dedicated tool-output field, so
         // we fall back to the raw stdout/stderr lines (which include both the
         // JSONL itself and any uncaptured subprocess stderr).
         const apiOutputBuffer = [];
+        // Reactive idle watchdog (audit 2026-05-17 C1). Mirrors the delegated
+        // path's wiring in `runDelegatedTool` (~line 2240). Distinct aborter
+        // from `maxTurnsAborter` so `AbortSignal.any` carries both reasons
+        // to runLineCommand; post-await we classify via the flag pair
+        // (`maxTurnsExceeded` → `idleTimedOut` → `runResult.timedOut`).
+        let idleTimedOut = false;
+        const idleAborter = new AbortController();
+        const idleWatchdog = new IdleWatchdog({
+            idleTimeoutMs: REACTIVE_IDLE_TIMEOUT_MS,
+            onTimeout: (idleMs) => {
+                idleTimedOut = true;
+                logger.warn({ idleMs, idleTimeoutMs: REACTIVE_IDLE_TIMEOUT_MS, eventType: params.eventType }, "gemini reactive idle watchdog tripped — aborting");
+                idleAborter.abort(new Error(`gemini reactive stream idle for ${idleMs}ms (limit ${REACTIVE_IDLE_TIMEOUT_MS}ms)`));
+            },
+        });
         try {
+            idleWatchdog.start();
+            // Spawn the resolved CLI path, not the bare name. `this.cliPath` is the
+            // PATHEXT-resolved binary (e.g. `gemini.cmd` on Windows, where the npm
+            // shim has no extensionless entry); a literal `"gemini"` ENOENTs there.
+            // Mirrors the delegated/probe paths (~2330, ~2781). The getter is typed
+            // `string | null`, so narrow before assigning to the `string` field —
+            // `checkAuth()` already returns ok:false when null but doesn't narrow.
+            if (!this.cliPath) {
+                throw new BackendDecisiveFailure(this.backendId, "auth", new Error("gemini CLI not found on PATH"));
+            }
             const runResult = await runLineCommand({
-                command: "gemini",
+                command: this.cliPath,
                 args: this.buildArgs(params, policyPath),
                 cwd: sessionDir,
                 env: {
@@ -490,7 +601,12 @@ export class GeminiCliCore {
                     ...(params.turnToken ? { PA_TURN_TOKEN: params.turnToken } : {}),
                 },
                 timeoutMs: this.config.executeTimeoutMinutes * 60 * 1000,
+                abortSignal: AbortSignal.any([
+                    maxTurnsAborter.signal,
+                    idleAborter.signal,
+                ]),
                 onStdoutLine: (line) => {
+                    idleWatchdog.beat();
                     apiOutputBuffer.push(line);
                     const event = parseJsonLine(line);
                     if (!event?.type) {
@@ -507,7 +623,25 @@ export class GeminiCliCore {
                     if (this.writeTracker && event.type === "tool_use") {
                         this.trackVaultWrite(event);
                     }
-                    // B-003 Phase 4.4 — persist MCP tool call to `mcp_tool_calls`.
+                    // EXECUTION-MODE-DESIGN.md §6.3 — stream-side absolute-block
+                    // observability. The admin TOML at priority 999 already enforces
+                    // the same patterns at the Gemini CLI layer; this adds an
+                    // `agent_actions.blocked_absolute` row with `result='partial'`
+                    // so the dashboard sees stream-observed attempts the same way it
+                    // sees Claude's PreToolUse rejections (recorded with
+                    // `result='failed'`).
+                    if (event.type === "tool_use") {
+                        const target = extractGeminiToolUseTarget(event.tool_name, event.args);
+                        if (target) {
+                            auditStreamObservation(target, {
+                                db: this.mcpContext?.db,
+                                backend: this.backendId,
+                                mode: this.config.geminiExecutionPermissionMode,
+                                sessionId: params.sessionDbId,
+                            });
+                        }
+                    }
+                    // Persist MCP tool call to `mcp_tool_calls`.
                     // Gemini emits `mcp_<server>_<tool>` (single underscore — see
                     // parseMcpToolName); host-installed Gemini MCPs (like
                     // `google-workspace` from extensions, or user-added `notion`)
@@ -541,17 +675,71 @@ export class GeminiCliCore {
                             }
                         }
                     }
+                    // Max-turns counting + enforcement.
+                    //
+                    // ── Semantic ──
+                    // `maxTurns` here is the **maximum number of tool calls** the
+                    // model may make in a single execute. The cap is exclusive: we
+                    // abort when the next `tool_use` would push the count *past*
+                    // `maxTurns` (`toolCallCount > maxTurns`), not on the
+                    // `maxTurns`-th call itself. That semantic is what the rest of
+                    // this test suite asserts — multiple absolute-block / audit
+                    // tests pass `maxTurns: 1` together with a single `tool_use`
+                    // event and expect the run to complete cleanly so the
+                    // observability row gets persisted before the cap could fire.
+                    //
+                    // This is intentionally one turn more permissive than the
+                    // strict Claude-SDK contract (where `maxTurns` is the
+                    // model-invocation count). The trade-off is justified by:
+                    //   1. The Gemini CLI emits no explicit turn-boundary event,
+                    //      so the daemon can only count tool calls, not full
+                    //      invocations. The final assistant message (which does
+                    //      count as a model invocation in Claude) is invisible to
+                    //      this counter until after-the-fact.
+                    //   2. The cap exists primarily to stop runaway loops, not to
+                    //      shave one model call off the budget. Allowing one
+                    //      "settling" final answer keeps the contract aligned
+                    //      with `numTurns: toolCallCount + 1` and avoids
+                    //      mass-breaking the existing audit-observation tests.
+                    //
+                    // The increment is gated on `!maxTurnsExceeded` so post-abort
+                    // stdout lines (the kill chain is asynchronous; a few lines
+                    // can still arrive before `SIGTERM` reaps the subprocess) do
+                    // not drift the error-message tally past the precise abort
+                    // point. Audit / policy hooks above this block still fire for
+                    // those lines — they are forensic data, not budget accounting.
+                    if (event.type === "tool_use" && !maxTurnsExceeded) {
+                        toolCallCount += 1;
+                        if (toolCallCount > maxTurns) {
+                            maxTurnsExceeded = true;
+                            logger.warn({
+                                toolCallCount,
+                                maxTurns,
+                                eventType: params.eventType,
+                                model: params.modelId,
+                            }, "Gemini max-turns exceeded — aborting subprocess");
+                            maxTurnsAborter.abort(new Error("max_turns_exceeded"));
+                            return;
+                        }
+                    }
                     if (event.type === "message" && event.role === "assistant") {
+                        // Gemini CLI 0.x ships an emerging "thought" channel that
+                        // surfaces inside an assistant-role message via
+                        // `messageType: "thought"`. Drop these so internal reasoning
+                        // never reaches the dashboard chat bubble. `type: "thought"`
+                        // events already fall through the positive-match below and
+                        // never reach `onText`.
+                        if (event.messageType === "thought") {
+                            return;
+                        }
                         const content = typeof event.content === "string" ? event.content : "";
                         if (!content) {
                             return;
                         }
                         if (event.delta) {
                             assistantDelta += content;
-                            if (!deferStreamingUntilBudgetCheck) {
-                                streamCallbacks?.onText?.(content);
-                                streamed = true;
-                            }
+                            streamCallbacks?.onText?.(content);
+                            streamed = true;
                             return;
                         }
                         finalAssistantMessage = content;
@@ -565,6 +753,7 @@ export class GeminiCliCore {
                     }
                 },
                 onStderrLine: (line) => {
+                    idleWatchdog.beat();
                     apiOutputBuffer.push(line);
                     if (isLikelyGeminiFailure(line)) {
                         lastError = line.trim();
@@ -579,6 +768,37 @@ export class GeminiCliCore {
                     eventType: params.eventType,
                 });
             }
+            // Max-turns abort is checked BEFORE `timedOut` because the AbortController
+            // and the runLineCommand wall-clock can race: a subprocess that we
+            // aborted because the cap was hit may still surface `timedOut=true`
+            // if the kill path took long enough that the safety-net timer
+            // tripped. Checking maxTurns first preserves the more specific
+            // error class — `BackendDecisiveFailure("max_turns")` matches the
+            // Claude SDK contract, while a generic `"timeout"` would obscure
+            // the real cause and route the dispatcher's retry logic differently.
+            //
+            // The idle-watchdog flag is checked between max-turns and the
+            // wall-clock so a stuck subprocess surfaces as a distinct timeout
+            // message — the dispatcher's retry semantics are the same as for
+            // the wall-clock case, but the audit trail and operator alert
+            // call out the idle hang specifically.
+            if (maxTurnsExceeded) {
+                const err = new BackendDecisiveFailure(this.backendId, "max_turns", new Error(`Gemini execution exceeded max-turns cap of ${maxTurns} (observed ${toolCallCount} tool calls).`));
+                logger.error({
+                    err,
+                    eventType: params.eventType,
+                    model: params.modelId,
+                    toolCallCount,
+                    maxTurns,
+                    durationMs: Date.now() - startMs,
+                }, "Gemini execute hit max_turns");
+                throw err;
+            }
+            if (idleTimedOut) {
+                const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Gemini reactive stream went idle for ${REACTIVE_IDLE_TIMEOUT_MS}ms (no events from CLI subprocess)`));
+                logger.error({ err, eventType: params.eventType, model: params.modelId, durationMs: Date.now() - startMs }, "Gemini execute idle-timed-out");
+                throw err;
+            }
             if (runResult.timedOut) {
                 const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Gemini execution exceeded timeout of ${this.config.executeTimeoutMinutes} minutes`));
                 logger.error({ err, eventType: params.eventType, model: params.modelId, durationMs: Date.now() - startMs }, "Gemini execute timed out");
@@ -610,7 +830,19 @@ export class GeminiCliCore {
             const costUsd = Object.values(modelUsage)
                 .reduce((total, usage) => total + usage.costUsd, 0)
                 || estimatedCost.costUsd;
-            this.assertWithinMaxBudget(costUsd, params.maxBudgetUsd, actualModelId);
+            // Hand the post-hoc budget assertion the exact spend it would
+            // otherwise be unable to recover — same shape Codex uses so the
+            // dispatcher's `BackendQuotaError` audit-row writer doesn't need a
+            // per-backend branch. `numTurns` here matches the success-branch
+            // formula below (`toolCallCount + 1`) so a budget-rejected and a
+            // successful run with the same tool fan-out report the same turn
+            // count.
+            this.assertWithinMaxBudget(costUsd, params.maxBudgetUsd, actualModelId, {
+                usage: normalizedUsage,
+                costSource: Object.keys(modelUsage).length > 0 ? costSource : estimatedCost.costSource,
+                numTurns: toolCallCount + 1,
+                durationMs: Date.now() - startMs,
+            });
             if (output && !streamed) {
                 streamCallbacks?.onText?.(output);
             }
@@ -636,7 +868,13 @@ export class GeminiCliCore {
                 costUsd,
                 usage: normalizedUsage,
                 modelUsage,
-                numTurns: 1,
+                // Each `tool_use` event indicates one model→tool turn; the
+                // surrounding final assistant message is one more turn — so
+                // `toolCallCount + 1` matches the Codex contract (which increments
+                // `numTurns` on `turn.started`). Parallel tool calls in a single
+                // model turn marginally over-count; that aligns conservatively with
+                // the max-turns cap above (we cut off sooner rather than later).
+                numTurns: toolCallCount + 1,
                 durationMs,
                 durationApiMs,
                 model: actualModelId,
@@ -648,6 +886,11 @@ export class GeminiCliCore {
             };
         }
         finally {
+            // Stop the reactive idle watchdog FIRST so its interval doesn't
+            // leak across the cleanup path. Safe to call even when start()
+            // was never reached (the runTurn body might have thrown before
+            // start()) — IdleWatchdog.stop is idempotent.
+            idleWatchdog.stop();
             if (ownsSessionDir) {
                 this.readTokenManager?.revoke(sessionDir);
             }
@@ -1443,47 +1686,39 @@ ${fetchClause}`;
             logger.warn({ err }, "Failed to persist Gemini request counter");
         }
     }
+    // Failure classification + budget enforcement share a skeleton with the
+    // Codex core; the logic lives in `cli-quota-guards.ts` (single source of
+    // truth) and each backend passes its own regexes / label. Gemini adds a
+    // pre-auth policy-deny branch via `classifyGeminiPolicyDeny`.
     classifyFailure(message) {
-        if (isMaxBudgetMessage(message)) {
-            return new BackendQuotaError(this.backendId, "max_budget_usd", null, message);
-        }
-        if (/rate limit|quota|429/i.test(message)) {
-            return new BackendQuotaError(this.backendId, "rate_limited", null, message);
-        }
-        if (/authentication page|oauth|api key|login|required/i.test(message)) {
-            return new BackendDecisiveFailure(this.backendId, "auth", new Error(message));
-        }
-        if (/timed out|timeout/i.test(message)) {
-            return new BackendDecisiveFailure(this.backendId, "timeout", new Error(message));
-        }
-        return new BackendDecisiveFailure(this.backendId, "other_non_retryable", new Error(message));
+        return classifyCliFailure({
+            backendId: this.backendId,
+            message,
+            // Google API quota surfaces as "rate limit" / "quota" / HTTP 429.
+            rateLimitPattern: /rate limit|quota|429/i,
+            authPattern: /authentication page|oauth|api key|login|required/i,
+            extraClassifier: classifyGeminiPolicyDeny,
+        });
     }
-    assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId) {
-        if (maxBudgetUsd === undefined || costUsd <= maxBudgetUsd) {
-            return;
-        }
-        throw new BackendQuotaError(this.backendId, "max_budget_usd", null, `Gemini CLI estimated cost $${costUsd.toFixed(4)} exceeded the per-turn budget limit $${maxBudgetUsd.toFixed(2)} for ${modelId}.`);
+    assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId, spend) {
+        assertCostWithinMaxBudget({
+            backendId: this.backendId,
+            label: "Gemini CLI",
+            costUsd,
+            maxBudgetUsd,
+            modelId,
+            spend,
+        });
     }
     assertPromptWithinMaxBudget(prompt, maxBudgetUsd, modelId) {
-        if (maxBudgetUsd === undefined) {
-            return;
-        }
-        const estimatedUsage = {
-            inputTokens: estimateTextInputTokens(prompt),
-            outputTokens: 0,
-            cacheCreationInputTokens: 0,
-            cacheReadInputTokens: 0,
-        };
-        const { costUsd } = this.priceFetcher.estimateUsageCost({
+        assertPromptCostWithinMaxBudget({
             backendId: this.backendId,
+            label: "Gemini CLI",
+            prompt,
+            maxBudgetUsd,
             modelId,
-            usage: estimatedUsage,
-            fallbackModel: findRegisteredModel(this.backendId, modelId),
+            priceFetcher: this.priceFetcher,
         });
-        if (costUsd <= maxBudgetUsd) {
-            return;
-        }
-        throw new BackendQuotaError(this.backendId, "max_budget_usd", null, `Gemini CLI estimated prompt cost $${costUsd.toFixed(4)} exceeded the per-turn budget limit $${maxBudgetUsd.toFixed(2)} for ${modelId}.`);
     }
     /**
      * Delegated proxy invocation — Gemini CLI path.
@@ -1509,7 +1744,11 @@ ${fetchClause}`;
      * and `notion` (user-installed Notion MCP server registered as
      * `notion`). Gmail and Calendar are also in `PROXY_DRIVEN_INTEGRATIONS`,
      * so a Claude/Codex DM session with `delegatedBackend = "gemini"` for
-     * either lands here through `/api/integrations/:key/invoke`.
+     * either reaches this method through the internal
+     * `DelegatedBackendInvoker.invoke()` API (the underlying transport
+     * lives behind the daemon's hourly drift-detection worker and behind
+     * `/api/integrations/:key/exec` task-mode dispatch; the legacy
+     * `/api/integrations/:key/invoke` RPC route was retired 2026-05-01).
      */
     async runDelegatedTool(params) {
         const startMs = Date.now();
@@ -1531,7 +1770,7 @@ ${fetchClause}`;
                 cost: withDurationMs(emptyCost(), startMs),
             };
         }
-        // Daily-request quota gate. Mirrors `runTurn` (line 480-495) — Gemini
+        // Daily-request quota gate. Mirrors `runTurn`'s gate — Gemini
         // meters per-day model requests via plan-preset `dailyRequestCeiling`
         // (900/1350/1800), and proxy invocations consume the same quota as
         // direct execute()s. Without this gate, proxy calls would silently
@@ -1582,10 +1821,8 @@ ${fetchClause}`;
         // Local aborter bridged from the caller's signal so we can also
         // trigger an early abort on wrong-tool detection without polluting
         // the caller's signal. Without early abort, a wrong-tool failure
-        // burns the full 180s gemini wall-clock waiting for natural
-        // completion (audit log 2026-05-01: 9.5s when subprocess completes
-        // naturally, but up to 180s when the model loops on the missing
-        // tool name). Abort caps it at ~5s.
+        // burns the full gemini wall-clock waiting for natural completion;
+        // abort caps it at ~5s.
         const proxyAborter = new AbortController();
         const callerAbortListener = () => {
             proxyAborter.abort(abortSignal?.reason);
@@ -1600,14 +1837,14 @@ ${fetchClause}`;
                 });
             }
         }
-        // Idle / hang watchdog. `gemini-cli` has been observed (audit log
-        // 2026-05-02 / 2026-05-03: 9 / 83 cadence calls) to lock up entirely
-        // — subprocess alive, zero stream-json output, only the 180s wall-
-        // clock fires. The idle detector trips much earlier (75s default,
-        // see `delegated-proxy-config.ts`) by treating each arrived line as
-        // a heartbeat. On trip, we abort with a `DelegatedProxyTimeoutError`
-        // so the post-loop classifier maps to `errorClass="timeout"`,
-        // identical to wall-clock — the cadence retry path stays uniform.
+        // Idle / hang watchdog. `gemini-cli` has been observed to lock up
+        // entirely — subprocess alive, zero stream-json output, only the
+        // wall-clock fires. The idle detector trips much earlier (75s
+        // default, see `delegated-proxy-config.ts`) by treating each
+        // arrived line as a heartbeat. On trip, we abort with a
+        // `DelegatedProxyTimeoutError` so the post-loop classifier maps to
+        // `errorClass="timeout"`, identical to wall-clock — the cadence
+        // retry path stays uniform.
         let idleTimedOut = false;
         const idleTimeoutMs = DELEGATED_PROXY_DEFAULTS.idleTimeoutMsByBackend.gemini
             ?? DELEGATED_PROXY_DEFAULTS.idleTimeoutMs;
@@ -1619,13 +1856,17 @@ ${fetchClause}`;
                 proxyAborter.abort(new DelegatedProxyTimeoutError(`gemini stream idle for ${idleMs}ms (limit ${idleTimeoutMs}ms)`));
             },
         });
+        const daemonReadToken = this.readTokenManager?.issue(sessionDir) ?? this.readToken;
         try {
             idleWatchdog.start();
             const runResult = await runLineCommand({
                 command: this.cliPath,
                 args,
                 cwd: sessionDir,
-                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, { sessionBackend: "gemini" }),
+                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, {
+                    ...(daemonReadToken ? { readToken: daemonReadToken } : {}),
+                    sessionBackend: "gemini",
+                }),
                 // Safety-net timeout, derived from the invoker's per-backend
                 // abort timeout (`callTimeoutMsByBackend.gemini`). We add a 60s
                 // grace window so the abort signal *always* fires first and we
@@ -1852,8 +2093,9 @@ ${fetchClause}`;
                     cost,
                 };
             }
-            // Bump the per-agent-day counter on the success path only, mirroring
-            // `runTurn` line 720. Proxy success consumes one Gemini request
+            // Bump the per-agent-day counter on the success path only,
+            // mirroring `runTurn`'s success-path counter bump. Proxy success
+            // consumes one Gemini request
             // (turn-level approximation; tool fanout still counts as one,
             // matching the existing accounting).
             this.incrementRequestsCount(today);
@@ -1880,6 +2122,10 @@ ${fetchClause}`;
             // Stop the idle watchdog before listener cleanup so a late-firing
             // poll cannot abort an already-resolved subprocess.
             idleWatchdog.stop();
+            // Invoker owns sessionDir lifecycle, but the readToken scope is keyed
+            // on the same path — revoke here so a leaked token cannot outlive the
+            // delegated proxy run.
+            this.readTokenManager?.revoke(sessionDir);
             // Drop the listener regardless of how the call resolved so a
             // long-lived caller signal doesn't accumulate references across
             // back-to-back proxy invocations.
@@ -2002,12 +2248,16 @@ ${fetchClause}`;
         const destructiveSet = allowDestructive
             ? new Set()
             : new Set(destructiveTools);
+        const daemonReadToken = this.readTokenManager?.issue(sessionDir) ?? this.readToken;
         try {
             const runResult = await runLineCommand({
                 command: this.cliPath,
                 args,
                 cwd: sessionDir,
-                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, { sessionBackend: "gemini" }),
+                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, {
+                    ...(daemonReadToken ? { readToken: daemonReadToken } : {}),
+                    sessionBackend: "gemini",
+                }),
                 timeoutMs: (DELEGATED_PROXY_DEFAULTS.callTimeoutMsByBackend.gemini
                     ?? DELEGATED_PROXY_DEFAULTS.callTimeoutMs)
                     + 60_000,
@@ -2079,6 +2329,18 @@ ${fetchClause}`;
                         return;
                     }
                     if (event.type === "message" && event.role === "assistant") {
+                        // Reasoning gate — mirror the executeTurn path. Gemini CLI
+                        // 0.x's emerging "thought" channel surfaces inside an
+                        // assistant-role message via `messageType: "thought"`.
+                        // The delegated-task surface ultimately returns
+                        // `rawAssistantText` to the dispatcher's structured-output
+                        // validator, so a leaked thought would either fail JSON
+                        // parsing (parse_error wrapped around reasoning content)
+                        // or land verbatim in delegated-task traces. Drop here
+                        // before any accumulation.
+                        if (event.messageType === "thought") {
+                            return;
+                        }
                         assistantTurns += 1;
                         const content = typeof event.content === "string" ? event.content : "";
                         if (!content)
@@ -2225,6 +2487,9 @@ ${fetchClause}`;
             };
         }
         finally {
+            // See runDelegatedTool — invoker owns the dir, but the readToken scope
+            // matches the dir path and must not outlive the run.
+            this.readTokenManager?.revoke(sessionDir);
             if (abortSignal) {
                 abortSignal.removeEventListener("abort", callerListener);
             }
@@ -2255,8 +2520,24 @@ ${fetchClause}`;
         return parts.join("\n");
     }
 }
-function isMaxBudgetMessage(message) {
-    return /max(?:imum)? budget|max_budget_usd|budget limit|per-turn budget/i.test(message);
+/**
+ * Gemini-specific pre-auth classifier for `classifyCliFailure`. Policy-deny
+ * classification must run BEFORE the auth branch — the generated TOML's deny
+ * messages can legitimately contain words like "required" or "login" (e.g. a
+ * future "<X> login is not permitted in daemon mode" rule), and we don't want
+ * those to mis-tag as `auth` and trigger an auth-recovery flow when the real
+ * cause is the agent attempting a forbidden tool call. The match targets the
+ * wrap the Gemini CLI emits today for TOML deny hits — `Error executing tool
+ * …: Tool execution denied by policy. <denyMessage>`. Tight enough to avoid
+ * false positives on real auth/quota messages; not claimed to be exhaustive
+ * across other Gemini policy surfaces (sandbox kills, MCP allowlist, future
+ * hook variants), which can be added here as they're observed in the wild.
+ */
+function classifyGeminiPolicyDeny(message, backendId) {
+    if (/tool execution denied|denied by policy/i.test(message)) {
+        return new BackendDecisiveFailure(backendId, "policy_denied", new Error(message));
+    }
+    return null;
 }
 function normalizeGeminiUsage(stats) {
     if (!stats) {
@@ -2438,4 +2719,3 @@ export function extractGeminiServerName(toolNamespace) {
         return rest.length > 0 ? rest : null;
     return sep === 0 ? null : rest.slice(0, sep);
 }
-//# sourceMappingURL=gemini-cli-core.js.map