@aitne/daemon 0.1.8 → 0.1.9

package/dist/core/backends/backend-router.js

@@ -1,4 +1,4 @@
-import { backendHasIntegrationConnector, delegatedIntegrationsForProcessKey, getDefaultTierForProcessKey, isCustomRoutineKey, isMessageEvent, isProcessKey, nativeIntegrationsForProcessKey, resolveProcessKey, TIER_LOCKED_PROCESS_KEYS, } from "@aitne/shared";
+import { backendHasIntegrationConnector, delegatedIntegrationsForProcessKey, getBrowserHistorySafetyFloor, getDefaultTierForProcessKey, isCustomRoutineKey, isMessageEvent, isProcessKey, nativeIntegrationsForProcessKey, resolveProcessKey, TIER_LOCKED_PROCESS_KEYS, } from "@aitne/shared";
 import { readIntegrations } from "../../db/integrations-store.js";
 import { createLogger } from "../../logging.js";
 import { BackendDecisiveFailure, BackendQuotaError, } from "../agent-core.js";
@@ -81,6 +81,21 @@ export class BackendRouter {
             ...(params.requestedBackendId ? { requestedBackendId: params.requestedBackendId } : {}),
             ...(params.requestedModelId ? { requestedModelId: params.requestedModelId } : {}),
         });
+        // BROWSER_HISTORY_INTEGRATION_PLAN §10.3 — backend safety floor.
+        // High-sensitivity integrations declare a per-process-key allowlist
+        // of eligible backends + a forbidden-modes list. When the resolved
+        // binding violates the floor, the router refuses to execute, logs
+        // an `agent_actions(action_type='backend_floor_refused')` row, and
+        // surfaces a one-time owner DM directing the operator at
+        // /settings/models. No graceful degradation — the threat model
+        // assumes the enforcement surface holds.
+        const floorViolation = this.checkSafetyFloor(binding);
+        if (floorViolation) {
+            this.logSafetyFloorRefusal(binding, floorViolation);
+            await this.dmSafetyFloorOnce(binding, floorViolation, params.event);
+            const failure = new BackendDecisiveFailure(binding.main.backendId, "policy_denied", floorViolation.reason);
+            throw new BackendRouterHandledError(`Backend safety floor refused: ${floorViolation.reason}`, failure, failure);
+        }
         // Phase 3.3 — pre-flight auth cache check. When the main backend's
         // cached auth status is recently confirmed bad, skip straight to the
         // fallback to avoid a doomed subprocess. Only applies when a fallback
@@ -125,6 +140,10 @@ export class BackendRouter {
                 ...(params.wikiUrlFetchEnabled
                     ? { wikiUrlFetchEnabled: true }
                     : {}),
+                ...(params.extraSkills && params.extraSkills.length > 0
+                    ? { extraSkills: params.extraSkills }
+                    : {}),
+                ...(params.skillsReplace ? { skillsReplace: true } : {}),
             }, streamCallbacks);
             // Reactive self-heal: a successful execute is authoritative proof the
             // CLI held valid credentials. Bump auth_last_success_at (so the 60-day
@@ -307,6 +326,10 @@ export class BackendRouter {
                 ...(params.wikiUrlFetchEnabled
                     ? { wikiUrlFetchEnabled: true }
                     : {}),
+                ...(params.extraSkills && params.extraSkills.length > 0
+                    ? { extraSkills: params.extraSkills }
+                    : {}),
+                ...(params.skillsReplace ? { skillsReplace: true } : {}),
             }, streamCallbacks);
             recordReactiveAuthSuccess(this.db, fallback.backendId, this.authTelemetry);
             await this.notifyFallbackSuccess(params.event, binding.processKey, binding.main, mainFailure, fallback);
@@ -799,6 +822,116 @@ export class BackendRouter {
             .get(name);
         return !!row;
     }
+    /**
+     * BROWSER_HISTORY_INTEGRATION_PLAN §10.3 — backend safety floor check.
+     * Returns null when the resolved binding satisfies the floor (or no
+     * floor applies to the process key); returns a violation otherwise.
+     *
+     * The floor is consulted via `getBrowserHistorySafetyFloor`, a
+     * static map keyed by process key. When a new high-sensitivity
+     * integration ships, it registers its own floor map and routes
+     * through a similar lookup; this helper is the single chokepoint.
+     *
+     * Validates BOTH `binding.main` and `binding.fallback`. The earlier
+     * implementation only checked main, which left a security gap: for
+     * `routine.research_dispatch` (Claude-only — non-negotiable per the
+     * design), a main=Claude / fallback=Codex configuration would pass
+     * the gate, but a decisive failure on Claude would then run the
+     * routine on Codex through `executeFallbackCore`, violating the
+     * floor silently. §10.3 is explicit: "There is no fallback to
+     * 'best effort with prose deny' — the design's threat model assumes
+     * the enforcement surface holds; running without it is not a
+     * graceful degradation, it is a security regression."
+     */
+    checkSafetyFloor(binding) {
+        const floor = getBrowserHistorySafetyFloor(binding.processKey);
+        if (!floor)
+            return null;
+        const mainViolation = this.evaluateSafetyFloorForBackend(binding.processKey, binding.main.backendId, floor, "main");
+        if (mainViolation)
+            return mainViolation;
+        if (binding.fallback) {
+            const fallbackViolation = this.evaluateSafetyFloorForBackend(binding.processKey, binding.fallback.backendId, floor, "fallback");
+            if (fallbackViolation)
+                return fallbackViolation;
+        }
+        return null;
+    }
+    evaluateSafetyFloorForBackend(processKey, backendId, floor, side) {
+        if (!floor.eligible.includes(backendId)) {
+            return {
+                reason: `Process ${processKey} requires one of [${floor.eligible.join(", ")}] but the ${side} binding is ${backendId}. ${floor.rationale}`,
+                backendId,
+                side,
+            };
+        }
+        if (floor.forbiddenModes) {
+            const mode = this.executionModeFor(backendId);
+            const forbidden = floor.forbiddenModes.find((entry) => entry.backend === backendId && entry.mode === mode);
+            if (forbidden) {
+                return {
+                    reason: `Process ${processKey} cannot run on ${backendId} in ${mode} mode (${side} binding). ${floor.rationale}`,
+                    backendId,
+                    side,
+                };
+            }
+        }
+        return null;
+    }
+    executionModeFor(backendId) {
+        switch (backendId) {
+            case "claude":
+                return this.config.claudeExecutionPermissionMode;
+            case "codex":
+                return this.config.codexExecutionPermissionMode;
+            case "gemini":
+                return this.config.geminiExecutionPermissionMode;
+            case "opencode":
+                return this.config.opencodeExecutionPermissionMode;
+        }
+    }
+    logSafetyFloorRefusal(binding, violation) {
+        try {
+            this.db
+                .prepare(`INSERT INTO agent_actions
+             (action_type, result, error, detail)
+           VALUES (?, ?, ?, ?)`)
+                .run("backend_floor_refused", "failed", violation.reason, JSON.stringify({
+                processKey: binding.processKey,
+                backendId: violation.backendId,
+                side: violation.side,
+                executionMode: this.executionModeFor(violation.backendId),
+                reason: violation.reason,
+            }));
+        }
+        catch (err) {
+            // Defensive: an unexpected schema mismatch (e.g. agent_actions
+            // missing columns in a stale test fixture) must not block the
+            // refusal itself. The throw above still surfaces the policy.
+            logger.warn({ err, processKey: binding.processKey }, "Failed to persist backend_floor_refused audit row");
+        }
+    }
+    // BROWSER_HISTORY_INTEGRATION_PLAN §10.3 mandates a one-time DM on
+    // floor refusal so the operator notices the binding is misconfigured.
+    // Without the DM the routine silently stops running and the
+    // `agent_actions` row is only visible through the dashboard activity
+    // panel — easy to miss for a routine that runs nightly. We thread
+    // the originating event through so notifier.send can route the
+    // message on the configured owner channel.
+    async dmSafetyFloorOnce(binding, violation, event) {
+        if (!this.notifier)
+            return;
+        const dedupeKey = `backend-floor:${binding.processKey}:${violation.side}:${violation.backendId}`;
+        const message = `Browser-history routine \`${binding.processKey}\` is paused: `
+            + `your configured ${violation.side} backend (${violation.backendId}) is not in the safety floor. `
+            + `Adjust the binding in /settings/models and re-run.`;
+        logger.warn({
+            processKey: binding.processKey,
+            backendId: violation.backendId,
+            reason: violation.reason,
+        }, message);
+        await this.notifyConfiguredChannel(message, event, dedupeKey, "high");
+    }
     async handleNoFallbackFailure(event, processKey, main, failure) {
         await this.maybeSendUserFacingFailure(event, processKey, failure);
         await this.notifyConfiguredChannel(this.buildNoFallbackMessage(processKey, main, failure), event, `no-fallback:${processKey}:${main.backendId}:${this.describeFailureKind(failure)}`, "normal");
@@ -905,4 +1038,3 @@ export class BackendRouter {
             && failure.originalCode === "max_budget_usd";
     }
 }
-//# sourceMappingURL=backend-router.js.map

package/dist/core/backends/claude-auth.d.ts

@@ -67,4 +67,3 @@ export declare function checkAuth(deps: ClaudeAuthDeps): Promise<{
  *    refresh would race and corrupt state).
  */
 export declare function checkAuthDetailed(deps: ClaudeAuthDeps): Promise<AuthCheckResult>;
-//# sourceMappingURL=claude-auth.d.ts.map

package/dist/core/backends/claude-auth.js

@@ -195,4 +195,3 @@ export async function checkAuthDetailed(deps) {
     }
     return { ok: true, status: "ok", method: "oauth" };
 }
-//# sourceMappingURL=claude-auth.js.map

package/dist/core/backends/claude-code-core.d.ts

@@ -53,6 +53,7 @@ export declare class ClaudeCodeCore implements IAgentCore {
     readonly backendId: "claude";
     private static readonly RETRY_DELAY_MS;
     private static readonly MAX_RETRIES;
+    private static readonly NETWORK_ERROR_MESSAGE_PATTERN;
     private readonly cliPathCache;
     /** Legacy shared read token injected into the Claude subprocess env. */
     private readToken;
@@ -221,7 +222,7 @@ export declare class ClaudeCodeCore implements IAgentCore {
      * `delegatedTools` is UNION'd onto the returned list — even when
      * `allowedToolsOverride` is set. This is a deliberate deviation from the
      * override's otherwise-absolute "replace everything" contract (see
-     * `CRITICAL_OVERRIDE_TOOLS` at line 293, which warns but does not union).
+     * `CRITICAL_OVERRIDE_TOOLS`, which warns but does not union).
      * Rationale: delegated mode is a runtime-configurable axis orthogonal to
      * the dashboard's tool-customization override. If a user set the override
      * before flipping an integration to delegated, silently dropping the
@@ -275,4 +276,3 @@ export declare class ClaudeCodeCore implements IAgentCore {
      */
     runDelegatedTask(params: DelegatedTaskInvokeParams): Promise<DelegatedTaskResultRaw>;
 }
-//# sourceMappingURL=claude-code-core.d.ts.map

package/dist/core/backends/claude-code-core.js

@@ -10,6 +10,7 @@ import { BackendQuotaError, BackendDecisiveFailure, } from "../agent-core.js";
 import { flattenToolResultContent } from "../../services/delegated-tool-runtime.js";
 import { runDelegatedTool as runDelegatedToolFn, runDelegatedTask as runDelegatedTaskFn, } from "./claude-delegated.js";
 import { createSessionWorkdir, cleanupSessionWorkdir } from "../workdir.js";
+import { resolveUserSkillsRoot } from "../user-skills-root.js";
 import { buildDaemonApiCliEnv } from "../daemon-api-cli.js";
 import { createLogger } from "../../logging.js";
 import { DEFAULT_CLAUDE_HIGH_MODEL, DEFAULT_CLAUDE_MEDIUM_MODEL, findRegisteredModel, getModelsForBackend, } from "./model-registry.js";
@@ -43,18 +44,35 @@ const logger = createLogger("claude-code-core");
  * in the session, the pre-pass produces no JSON, and the parent routine
  * collapses to a heartbeat-only shadow run.
  *
- * Opting in to `['user']` brings Claude in line with Codex and Gemini,
- * both of which load `~/.codex/config.toml` / `~/.gemini/settings.json`
- * by default at CLI spawn (they have no `--setting-sources=` equivalent
- * to suppress). This is the parity surface for native mode.
+ * `'project'` is also required: the SDK's `on1` skills loader bails out
+ * in bare mode unless `pJ("projectSettings")` is true (verified in the
+ * shipped `cli.js`), meaning the per-session `<sessionDir>/.claude/skills/`
+ * tree the SkillsCompiler materialises would not be auto-discovered.
+ * `sdk.d.ts` is explicit: "Must include 'project' to load CLAUDE.md
+ * files." Without it the daemon's `<sessionDir>/CLAUDE.md` (the entire
+ * agent profile + safety + skill-reference block) is also silently
+ * dropped, and `excludeDynamicSections: true` has nothing to strip /
+ * re-inject. Symptom: the agent lists user-scope skills (e.g.
+ * `webapp-testing` from `~/.claude/skills/`) but reports daemon-side
+ * project skills like `browser-task` as "not available".
+ *
+ * Opting in to `['user', 'project']` brings Claude in line with Codex
+ * and Gemini, both of which load `~/.codex/config.toml` /
+ * `~/.gemini/settings.json` AND per-session instruction files by
+ * default at CLI spawn (they have no `--setting-sources=` equivalent
+ * to suppress).
  *
  * Trade-off — user-scoped file hooks (e.g. notify.sh entries under
  * `~/.claude/settings.json` → `hooks.{Notification,Stop,PermissionRequest}`)
- * are also loaded. Programmatic hooks passed via `query({ hooks })`
- * layer on top rather than suppress them. Users with noisy file hooks
- * should scope them with matchers; the daemon does not strip them.
+ * are also loaded, plus any `<sessionDir>/.claude/settings.json` the
+ * daemon may add in the future. The SkillsCompiler does not currently
+ * write a per-session settings.json, so the project surface adds only
+ * the intended `<sessionDir>/.claude/skills/` + CLAUDE.md auto-discovery.
+ * Programmatic hooks passed via `query({ hooks })` layer on top rather
+ * than suppress them. Users with noisy file hooks should scope them
+ * with matchers; the daemon does not strip them.
  */
-const CLAUDE_SDK_SETTING_SOURCES = ["user"];
+const CLAUDE_SDK_SETTING_SOURCES = ["user", "project"];
 /**
  * `routine.fetch_window` is a short, lite-tier pre-pass with high
  * per-session prompt-cache write cost (docs/design/appendices/fetch-window-cost-reduction.md
@@ -117,6 +135,18 @@ export class ClaudeCodeCore {
     backendId = "claude";
     static RETRY_DELAY_MS = 5 * 60 * 1000;
     static MAX_RETRIES = 1;
+    // Network-connectivity failures reach us two ways: as a Node error carrying
+    // a `.code` (ENOTFOUND, ECONNREFUSED, …) OR — when the Claude Agent SDK's
+    // transport hits the failure mid-stream — as a thrown `Error` whose *message*
+    // embeds the cause, e.g. `Claude Code returned an error result: API Error:
+    // Unable to connect to API (ENOTFOUND)`. The message form has no `.code`, so
+    // shape-matching the text is the only signal. Both are transient: a momentary
+    // offline blip (wifi reconnect, DNS hiccup) should recover on the next
+    // attempt rather than fail decisively as `other_non_retryable` (no retry, no
+    // fallback, and a user-notification cascade we can't even deliver while
+    // offline). Keep this aligned with the `.code` allowlist in
+    // `isRetryableExecutionError`.
+    static NETWORK_ERROR_MESSAGE_PATTERN = /network error|fetch failed|socket hang up|connection reset|connection refused|network is unreachable|unable to connect to api|getaddrinfo|timed out|\b(?:ENOTFOUND|ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENETUNREACH|EAI_AGAIN|EPIPE|ECONNABORTED)\b/i;
     // Lazily re-resolved with a 60 s TTL so CLI install/uninstall is
     // detected without a daemon restart (roadmap §9.4). Constructor does an
     // eager PATH scan so the first checkAuth() call has no extra latency.
@@ -384,7 +414,7 @@ export class ClaudeCodeCore {
         // The disposable path also receives user skills so agent DMs that don't
         // take the persistent-workdir path can still discover user-authored skills.
         const wikiWorkspaceName = typeof event.data?.workspace === "string" ? event.data.workspace : undefined;
-        const useSessionDir = sessionDir ?? createSessionWorkdir(this.config.workspaceDir, event.type, `${this.config.dataDir}/skills`, {
+        const useSessionDir = sessionDir ?? createSessionWorkdir(this.config.workspaceDir, event.type, resolveUserSkillsRoot(this.config), {
             backendId: this.backendId,
             processKey: params.processKey,
             character: this.config.character,
@@ -398,6 +428,13 @@ export class ClaudeCodeCore {
             ...(this.mcpContext?.db ? { db: this.mcpContext.db } : {}),
             ...(isMessageEvent(event) ? { messageText: event.content } : {}),
             ...(wikiWorkspaceName ? { wikiWorkspaceName } : {}),
+            // AGENT_DEFINITIONS_DESIGN.md §4.2 — fold the firing Agent's
+            // `tools.skills` onto the process-key bundle. No-op for non-Agent
+            // executes (the dispatcher leaves these unset).
+            ...(params.extraSkills && params.extraSkills.length > 0
+                ? { extraSkills: params.extraSkills }
+                : {}),
+            ...(params.skillsReplace ? { skillsReplace: true } : {}),
         });
         const isOwnedTempDir = !sessionDir;
         const daemonReadToken = this.readTokenManager?.issue(useSessionDir) ?? this.readToken;
@@ -423,7 +460,19 @@ export class ClaudeCodeCore {
             // of the operator's per-backend Execution Mode setting. We swap
             // back to strict `dontAsk` + the explicit allowedTools list. The
             // ALWAYS_DISALLOWED_TOOLS layer still applies.
-            const optimizerClampActive = Array.isArray(params.allowedToolsOverride) && params.allowedToolsOverride.length > 0;
+            //
+            // An EMPTY array (`[]`) is a deliberate "no tools" clamp — used by
+            // `routine.hourly_check.triage` (JSON-only triage spawn) and Stage B
+            // of the morning-routine pipeline (daily-journal-daemon-write.md §3
+            // corollary). A pre-2026-05-24 version of this gate required
+            // `length > 0`, which silently fell through to the default `dontAsk`
+            // branch — leaving those callers with the full
+            // `CLAUDE_DEFAULT_ALLOWED_TOOLS` set (Read / Write / Edit /
+            // Bash(curl *)) despite their explicit `[]` request. The fix:
+            // any caller-supplied array (including `[]`) activates the clamp.
+            // Callers who want the default surface MUST pass `undefined` or
+            // omit the field; passing `[]` now means "no tools, strictly."
+            const optimizerClampActive = Array.isArray(params.allowedToolsOverride);
             const stream = query({
                 prompt: fullPrompt,
                 options: {
@@ -649,7 +698,7 @@ export class ClaudeCodeCore {
             ["ECONNRESET", "ECONNREFUSED", "ETIMEDOUT", "EPIPE", "ECONNABORTED", "ENOTFOUND"].includes(code)) {
             return true;
         }
-        return /network error|fetch failed|socket hang up|connection reset|timed out/i.test(this.getErrorMessage(error));
+        return ClaudeCodeCore.NETWORK_ERROR_MESSAGE_PATTERN.test(this.getErrorMessage(error));
     }
     /** Visible for testing. */
     classifyExecutionError(error) {
@@ -903,12 +952,14 @@ export class ClaudeCodeCore {
                     logger.debug({ sessionId, model: sysMsg.model }, "Session initialized");
                 }
                 else if (message.type === "stream_event") {
-                    // Forward streaming text deltas to the caller (e.g., dashboard SSE)
-                    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- SDK stream_event lacks typed .event
+                    // Forward streaming text deltas to the caller (e.g., dashboard SSE).
+                    // The SDK union doesn't surface `.event` on the stream_event variant,
+                    // so narrow with a local shape that mirrors what the runtime emits.
                     const event = message.event;
-                    if (event?.type === "content_block_delta" && event?.delta?.type === "text_delta") {
-                        streamedOutput += event.delta.text;
-                        streamCallbacks?.onText?.(event.delta.text);
+                    if (event?.type === "content_block_delta" && event.delta?.type === "text_delta") {
+                        const text = event.delta.text ?? "";
+                        streamedOutput += text;
+                        streamCallbacks?.onText?.(text);
                     }
                 }
                 else if (message.type === "assistant") {
@@ -1178,7 +1229,7 @@ export class ClaudeCodeCore {
      * `delegatedTools` is UNION'd onto the returned list — even when
      * `allowedToolsOverride` is set. This is a deliberate deviation from the
      * override's otherwise-absolute "replace everything" contract (see
-     * `CRITICAL_OVERRIDE_TOOLS` at line 293, which warns but does not union).
+     * `CRITICAL_OVERRIDE_TOOLS`, which warns but does not union).
      * Rationale: delegated mode is a runtime-configurable axis orthogonal to
      * the dashboard's tool-customization override. If a user set the override
      * before flipping an integration to delegated, silently dropping the
@@ -1266,4 +1317,3 @@ export class ClaudeCodeCore {
         return runDelegatedTaskFn(this.delegatedDeps(), params);
     }
 }
-//# sourceMappingURL=claude-code-core.js.map

package/dist/core/backends/claude-credentials-store.d.ts

@@ -80,4 +80,3 @@ export declare function getClaudeKeychainAccounts(username: string): string[];
  */
 export declare function readClaudeCredentials(options?: ReadClaudeCredentialsOptions): Promise<ClaudeCredentialsBundle | null>;
 export {};
-//# sourceMappingURL=claude-credentials-store.d.ts.map

package/dist/core/backends/claude-credentials-store.js

@@ -240,4 +240,3 @@ function readFromPlaintext(path, readPlaintext, telemetry) {
         return null;
     }
 }
-//# sourceMappingURL=claude-credentials-store.js.map

package/dist/core/backends/claude-delegated.d.ts

@@ -83,4 +83,3 @@ export declare function runDelegatedTool(deps: ClaudeDelegatedDeps, params: Dele
  * any destructive tool ran during the task.
  */
 export declare function runDelegatedTask(deps: ClaudeDelegatedDeps, params: DelegatedTaskInvokeParams): Promise<DelegatedTaskResultRaw>;
-//# sourceMappingURL=claude-delegated.d.ts.map

package/dist/core/backends/claude-delegated.js

@@ -144,11 +144,11 @@ export async function runDelegatedTool(deps, params) {
                 // Canva, Hugging Face, …) the CLI ships only a working set of
                 // tool schemas and defers the rest. To call a deferred tool, the
                 // model must first call ToolSearch to load its schema. Without
-                // ToolSearch allowed, the proxy's first turn was wasted on a
-                // denied ToolSearch call (audit log 2026-04-29: 1 Notion failure
-                // logged as `wrong_tool=ToolSearch`, 5 logged as
-                // `subprocess_crashed: Reached maximum number of turns (2)` —
-                // the model retried other approaches and exhausted the budget).
+                // ToolSearch allowed, the proxy's first turn is wasted on a
+                // denied ToolSearch call — the model then retries other
+                // approaches and exhausts the budget (logged as
+                // `wrong_tool=ToolSearch` or `subprocess_crashed: Reached
+                // maximum number of turns`).
                 //
                 // Allowing ToolSearch is safe: allowedTools enforcement still
                 // gates which tools can be CALLED, and ToolSearch only loads
@@ -157,12 +157,12 @@ export async function runDelegatedTool(deps, params) {
                 // partial-result trace classifies as `no_tool_call` rather than
                 // misleading `wrong_tool=ToolSearch`.
                 //
-                // TODO(future): a cleaner architectural fix is to materialize a
-                // session-local `.mcp.json` containing only the relevant
-                // connector's MCP server and pass `strictMcpConfig: true` —
-                // that prevents deferral entirely (one MCP server → schemas fit
-                // in the working set). Punted because it requires extracting
-                // server configs from the user's global file per integration.
+                // Architectural alternative (punted): materialize a session-local
+                // `.mcp.json` containing only the relevant connector's MCP server
+                // and pass `strictMcpConfig: true` — that prevents deferral
+                // entirely (one MCP server → schemas fit in the working set).
+                // Not done because it requires extracting server configs from
+                // the user's global file per integration.
                 allowedTools: [toolName, DEFERRED_TOOL_DISCOVERY_TOOL_NAME],
                 // Defense-in-depth: even with allowedTools restricted to a tight
                 // set, keep the absolute-block layer (rm -rf, sudo, secret file
@@ -283,9 +283,9 @@ export async function runDelegatedTool(deps, params) {
                     // next `readMessages` iteration — wrapping it as
                     // `Error("Claude Code returned an error result: <text>")`. That
                     // throw would land in the outer catch and misclassify as
-                    // `subprocess_crashed`, discarding the captured cost. Audit log
-                    // (2026-04-29) showed 5 such failures with num_turns=0,
-                    // tokens=0, masking that this was actually `error_max_turns`.
+                    // `subprocess_crashed`, discarding the captured cost. Without
+                    // this break, `error_max_turns` failures land in the audit log
+                    // with num_turns=0 / tokens=0, masking what really happened.
                     // Breaking here lets the post-loop classifier run with the
                     // captured terminalSubtype, terminalErrors, wrongToolName, and
                     // cost intact.
@@ -798,4 +798,3 @@ export async function runDelegatedTask(deps, params) {
         deps.readTokenManager?.revoke(sessionDir);
     }
 }
-//# sourceMappingURL=claude-delegated.js.map

package/dist/core/backends/claude-errors.d.ts

@@ -36,4 +36,3 @@ export type ErrorLike = {
 export declare function isClaudeCodeQuotaError(error: unknown): boolean;
 export declare function isClaudeCodeMaxBudgetError(error: unknown): boolean;
 export declare function extractClaudeCodeQuotaResetHint(error: unknown): ClaudeCodeQuotaResetHint | null;
-//# sourceMappingURL=claude-errors.d.ts.map

package/dist/core/backends/claude-errors.js

@@ -68,4 +68,3 @@ export function extractClaudeCodeQuotaResetHint(error) {
         rawLabel: error.message.slice(match.index).replace(/^resets?\s+/i, "").trim(),
     };
 }
-//# sourceMappingURL=claude-errors.js.map

package/dist/core/backends/claude-probe.d.ts

@@ -100,4 +100,3 @@ export declare function extractClaudeProbeTools(message: unknown): string[];
 /** @internal — exported for `claude-code-core.ts:probeTools`; not part of
  *  the module's public surface. */
 export declare function describeClaudeProbeResultError(result: SDKResultMessage): string;
-//# sourceMappingURL=claude-probe.d.ts.map

package/dist/core/backends/claude-probe.js

@@ -333,4 +333,3 @@ export function describeClaudeProbeResultError(result) {
     }
     return result.subtype;
 }
-//# sourceMappingURL=claude-probe.js.map

package/dist/core/backends/claude-tool-collection.d.ts

@@ -132,4 +132,3 @@ export declare function buildSecurityHooks(deps: SecurityHooksDeps, allowMode?:
         hooks: ((input: HookInput) => Promise<HookJSONOutput>)[];
     }[];
 };
-//# sourceMappingURL=claude-tool-collection.d.ts.map