@bridge4dev/runner 0.27.0 → 0.30.0

package/dist/adapters/claude.js

@@ -5,7 +5,7 @@ import { AsyncQueue } from '../async-queue.js';
 import { log } from '../log.js';
 import { mcpConfigPath } from '../paths.js';
 import { evaluateToolUse, maskSecrets, maskString } from '../policy.js';
-import { AGENT_MODES, } from './types.js';
+import { availableModes, MODE_REFUSED_TEXT, MODE_WITHDRAWN_TEXT, } from './types.js';
 import { answerSummary, answerValue, discussMessage, invalidationMessage, mirrorOptions, newAskId, MAX_OPTIONS, MAX_QUESTIONS, OPTION_TEXT_LIMIT, QUESTION_TEXT_LIMIT, } from './questions.js';
 // Claude adapter over the Agent SDK. Three live-verified gotchas (plan §2):
 //  1. Bare tool names in `allowedTools` auto-approve BEFORE canUseTool — we
@@ -65,14 +65,77 @@ export function scrubbedEnv() {
     }
     return env;
 }
+/**
+ * The one env var the allowlist above refuses, added back for exactly one mode
+ * (ticket #156).
+ *
+ * The CLI's own guard, read out of the binary verbatim:
+ *
+ * ```js
+ * if (t === "bypassPermissions" || r) {
+ *   if (typeof process.getuid === "function" && process.getuid() === 0
+ *       && process.env.IS_SANDBOX !== "1" && !Z.CLAUDE_CODE_BUBBLEWRAP)
+ *     console.error("--dangerously-skip-permissions cannot be used with root/sudo privileges …"),
+ *     process.exit(1)
+ * }
+ * ```
+ *
+ * The runner's default install is root (`install.sh`), so on an ordinary
+ * machine «Unrestricted» did not degrade — it killed the session at launch with
+ * exit code 1. On the machine this was found on it happened to start, because
+ * `~/.claude/settings.json` carries `env: { IS_SANDBOX: "1" }` and this adapter
+ * loads user settings; that is a hole in the scrub covering a bug, not a fix.
+ *
+ * The condition here is the CLI's own, no wider: `full` AND uid 0. It is safe
+ * precisely where it is applied — `bypassPermissions` is the mode in which the
+ * SDK never calls `canUseTool` (it says so itself), so layer 1 is already inert
+ * and there is nothing left for `IS_SANDBOX` to weaken. In every other mode the
+ * scrub stands, which is what the comment on `ENV_ALLOWLIST` has always meant.
+ */
+function agentEnv(mode) {
+    const env = scrubbedEnv();
+    if (mode === 'full' && process.getuid?.() === 0)
+        env['IS_SANDBOX'] = '1';
+    return env;
+}
 // Normalized mode → Claude permission mode (session-5 plan §2). `full` is the
 // owner's explicit call (2026-07-24): "same as Claude works now, we don't
 // restrict anything" — in that mode the SDK stops calling canUseTool at all,
 // so the layer-1 policy cannot gate tools either; the dashboard says so.
+//
+// `auto` maps to the CLI's `default` rung, and the reason is the whole of
+// QA-128's one surviving BLOCKER — it was `'auto'` for most of this ticket and
+// had to come back.
+//
+// The CLI's own `auto` rung runs a MODEL CLASSIFIER over each tool call, and
+// what the classifier approves never becomes a `can_use_tool` request. This
+// adapter's only route into layer 1 is `canUseTool`. So in that rung
+// `evaluateToolUse` is not consulted, and the rules the product calls
+// unconditional — `sudo`, `git push`, docker control, secret paths, writes
+// outside the worktree, anything inside `.git` — are simply not applied.
+//
+// Measured, not reasoned. Same adapter, same options, only the model differs:
+//
+//   sonnet  (has the auto rung)  : `sudo -n id` → ran, policy consulted 0 times
+//   haiku-4.5 (has no auto rung) : `sudo -n id` → DENIED by policy
+//
+// Haiku is why this took a second pass to see: it refuses the rung outright
+// (`auto mode unavailable for this model`) and the CLI quietly falls back to
+// `default`, so a probe run on it shows the layer working perfectly.
+//
+// Nothing is lost by mapping to `default`. The CLI's rung was never what made
+// «Auto» mean «only the hard limits» — `effectiveTrust(trust, 'auto') → AUTO`
+// in `policy.ts` is, and it needs `canUseTool` to be reached to say so. What
+// `default` gives up is the classifier's convenience; what it keeps is the only
+// place the hard limits are enforced at all.
+//
+// `full` is the deliberate exception: `bypassPermissions` also stops calling
+// `canUseTool`, and there that IS the meaning of the mode — the dashboard says
+// so, and STRICT workspaces are not offered it.
 const MODE_TO_PERMISSION = {
     ask: 'default',
     plan: 'plan',
-    auto: 'acceptEdits',
+    auto: 'default',
     full: 'bypassPermissions',
 };
 const SYSTEM_APPEND = [
@@ -186,6 +249,23 @@ class ClaudeSession {
     /** Guards against overlapping capability probes. */
     capabilitiesInFlight = false;
     mode;
+    /**
+     * A launch-time mode this workspace does not allow, remembered so the feed
+     * can say so once the event queue is live (`full` on a STRICT workspace).
+     */
+    modeRefusedAtLaunch = null;
+    /**
+     * This process was launched with the bypass capability, so `setPermissionMode`
+     * may reach `bypassPermissions` on it.
+     *
+     * The CLI ties the capability to the LAUNCH, not to the current mode: a
+     * session started with the flag can be tightened to `default` and raised back
+     * to bypass freely (both verified live), while one started without it is
+     * refused outright. So this is the honest predicate for
+     * `modeSwitchNeedsRelaunch`, and it is not the same question as
+     * «is the mode `full` right now».
+     */
+    launchedWithBypass;
     model;
     /**
      * Reasoning effort pinned for this session (ticket #111).
@@ -244,10 +324,56 @@ class ClaudeSession {
      * about the task — the live set typically precedes it (QA-111 m4).
      */
     skipTaskIds = new Set();
+    /**
+     * Uuid of the last message the CLI put in its transcript (ticket #126).
+     *
+     * This is the anchor a conversation rewind is measured from: handing it back
+     * as `resumeSessionAt` resumes the session with everything after it dropped.
+     * Every message type carries one — user echoes included, which is what makes
+     * "rewind to just before MY message" expressible at all.
+     */
+    lastMessageUuid = null;
+    /**
+     * A Stop the USER asked for is in flight.
+     *
+     * Aborting a turn mid-tool-use makes the SDK end it with
+     * `result{subtype:'error_during_execution'}`, which is indistinguishable
+     * from a crash by its shape alone — and `turn_end{ok:false}` puts the whole
+     * session in FAILED. So the one thing that CAN tell them apart is whether we
+     * asked: this flag is set by `interrupt()` and read by the result that
+     * follows it.
+     *
+     * Codex has always drawn the same distinction (`status: 'interrupted'` is
+     * reported `ok: true`); this is Claude catching up, not a new rule.
+     */
+    aborting = false;
+    /**
+     * The conversation is moving again — whatever a Stop armed is spent.
+     *
+     * Called from EVERY path that hands the agent something to act on, not just
+     * from `send()`: a Stop with nothing to interrupt produces no result at all,
+     * so a flag cleared only on a result stays armed and reports the NEXT turn's
+     * genuine failure as a clean stop (QA-120 M2). That is the original defect
+     * with the sign flipped, and the sign that loses data is this one — a run
+     * that failed would be reported as finished, with the reason dropped.
+     */
+    resumingTurn() {
+        this.aborting = false;
+    }
     events = this.output;
     constructor(spec, queryFn) {
         this.spec = spec;
-        this.mode = spec.mode ?? 'ask';
+        // Refused rather than honoured, and BEFORE anything is built from it: on a
+        // STRICT workspace `full` would launch the CLI in `bypassPermissions`, and
+        // there layer 1 is never consulted — the manager's shield would be spent by
+        // whoever opened the session (ticket #156). The notice goes out in the
+        // constructor's own emit block below, once `output` can carry it.
+        const requested = spec.mode ?? 'ask';
+        this.mode = availableModes(spec.trustMode).includes(requested) ? requested : 'ask';
+        if (this.mode !== requested) {
+            this.modeRefusedAtLaunch = requested;
+        }
+        this.launchedWithBypass = this.mode === 'full';
         if (spec.model)
             this.model = spec.model;
         // Gated, not copied: a pin stored against a model that no longer offers it
@@ -277,7 +403,7 @@ class ClaudeSession {
         this.mcpConfigFile = mcpConfigFile;
         const options = {
             cwd: spec.cwd,
-            env: scrubbedEnv(),
+            env: agentEnv(this.mode),
             /**
              * Everything the machine's own Claude has (owner's call, 2026-07-30).
              *
@@ -299,6 +425,14 @@ class ClaudeSession {
              */
             settingSources: ['user', 'project', 'local'],
             permissionMode: MODE_TO_PERMISSION[this.mode],
+            // The SDK's own words: "Must be set to `true` when using
+            // `permissionMode: 'bypassPermissions'`." It was never set, so
+            // «Unrestricted» asked the CLI for a mode it had not been given
+            // permission to offer (ticket #156). Passed only for `full`: as root the
+            // CLI refuses to START at all when this flag is present without
+            // `IS_SANDBOX=1`, so setting it unconditionally would take every mode
+            // down with it — verified live, exit code 1 on a plain `ask` session.
+            ...(this.mode === 'full' ? { allowDangerouslySkipPermissions: true } : {}),
             systemPrompt: {
                 type: 'preset',
                 preset: 'claude_code',
@@ -321,6 +455,15 @@ class ClaudeSession {
             // `applyFlagSettings` call `setEffort` makes.
             ...(spec.effort === ULTRACODE ? { settings: { ultracode: true } } : {}),
             ...(spec.resumeProviderSessionId ? { resume: spec.resumeProviderSessionId } : {}),
+            // Ticket #126, conversation rewind. `resumeSessionAt` replays the
+            // transcript only up to (and including) this uuid; `forkSession` makes
+            // the result a NEW session id instead of truncating the old file, so the
+            // conversation the user rewound away from is still on disk afterwards.
+            // The SDK's own note applies and is repeated in the UI: a forked session
+            // starts without undo history.
+            ...(spec.resumeProviderSessionId && spec.resumeAtAnchor
+                ? { resumeSessionAt: spec.resumeAtAnchor, forkSession: true }
+                : {}),
             ...(spec.maxBudgetUsd !== undefined ? { maxBudgetUsd: spec.maxBudgetUsd } : {}),
             // Ticket #119. NOT `mcpServers` — the SDK JSON-stringifies that option
             // straight into argv (`sdk.mjs`: `H.push("--mcp-config", Re({mcpServers:ke}))`),
@@ -357,6 +500,10 @@ class ClaudeSession {
         if (this.mcpFallbackNotice) {
             this.emit({ type: 'notice', level: 'warn', text: this.mcpFallbackNotice });
         }
+        if (this.modeRefusedAtLaunch) {
+            this.emit({ type: 'notice', level: 'warn', text: MODE_REFUSED_TEXT });
+            this.emit({ type: 'settings', mode: this.mode });
+        }
         this.lastTaskFingerprint = JSON.stringify({ done: 0, total: 0, tasks: [] });
         this.emit({ type: 'agent_tasks', tasks: [], done: 0, total: 0 });
         // Report what the agent can do right away. `system:init` only arrives with
@@ -560,7 +707,11 @@ class ClaudeSession {
         this.adoptLiveModel(this.liveWireModel ?? this.model);
         const capabilities = {
             models: this.knownModels,
-            modes: [...AGENT_MODES],
+            // Read from `spec` on every publication, not captured once: the workspace
+            // trust level changes under a running session (`setWorkspacePolicy`), and
+            // a manager tightening to STRICT has to see «Unrestricted» leave the
+            // picker rather than stay there as an offer that will be refused.
+            modes: availableModes(this.spec.trustMode),
             // Cap the list: it lands in an event payload with a hard size limit.
             commands: commands.slice(0, 150).map((c) => ({
                 name: c.name,
@@ -638,10 +789,103 @@ class ClaudeSession {
         // worst case. Fire-and-forget, same as the end-of-turn call.
         this.refreshContextUsage();
     }
+    /**
+     * Can this live process reach `mode`, or does the supervisor have to bring a
+     * new one up? (ticket #156)
+     *
+     * Only the `full` boundary matters, and only in the direction the CLI
+     * refuses. Crossing it OUTWARD works live — a bypass-launched session accepts
+     * `setPermissionMode('default')` and starts consulting `canUseTool` again,
+     * verified live — but it is answered `true` here as well, deliberately: that
+     * process still carries `--allow-dangerously-skip-permissions` and, as root,
+     * `IS_SANDBOX=1`. Leaving a session that is once more gated running with the
+     * ungated process's environment is the kind of residue that is correct today
+     * and quietly wrong after the next CLI release. One rule, both directions,
+     * nothing left over.
+     */
+    modeSwitchNeedsRelaunch(mode) {
+        if (!availableModes(this.spec.trustMode).includes(mode))
+            return false;
+        return (mode === 'full') !== this.launchedWithBypass;
+    }
     async setMode(mode) {
-        await this.q.setPermissionMode(MODE_TO_PERMISSION[mode]);
+        if (!availableModes(this.spec.trustMode).includes(mode)) {
+            this.emit({ type: 'notice', level: 'warn', text: MODE_REFUSED_TEXT });
+            // The picker has already moved; say what the mode actually is so it moves
+            // back, instead of showing a setting the session is not in.
+            this.emit({ type: 'settings', mode: this.mode });
+            return;
+        }
+        // The mode is recorded whatever the CLI says (QA-128). Its permission rung
+        // is an optimisation; the layer that produces the cards a user sees is
+        // ours, and it reads `this.mode`. Leaving the field behind because the CLI
+        // does not offer `auto` on this model would be #157 all over again.
+        await this.applyPermissionMode(mode);
         this.mode = mode;
         this.emit({ type: 'settings', mode });
+        // Ticket #157. The cards already on screen are the reason a person reaches
+        // for this control in the first place — the agent has stopped and is
+        // waiting on one. Judging only the NEXT tool call left the visible one
+        // exactly where it was, which reads as «the switch did nothing».
+        this.releasePermissionsAllowedNow();
+    }
+    /**
+     * Move the live CLI to this mode's permission rung, degrading rather than
+     * throwing when it refuses one (QA-128).
+     *
+     * Never rethrows: the caller has already decided what the session's mode is,
+     * and the CLI's opinion about its own rung must not undo that.
+     */
+    async applyPermissionMode(mode) {
+        try {
+            await this.q.setPermissionMode(MODE_TO_PERMISSION[mode]);
+        }
+        catch (error) {
+            // Swallowed on purpose. The CLI refuses rungs per MODEL, not only per
+            // request — `Cannot set permission mode to auto: auto mode unavailable
+            // for this model`, measured on `claude-haiku-4-5`, which our own picker
+            // offers. Letting that throw is what the caller must never allow: the
+            // exception would land before `this.mode` is written, the dashboard would
+            // show the new mode, and the layer that raises the cards would still be
+            // on the old one. That is ticket #157, reproduced by its own fix.
+            log.warn('claude: setPermissionMode refused — the session mode still stands', {
+                wanted: MODE_TO_PERMISSION[mode],
+                error: String(error),
+            });
+        }
+    }
+    /**
+     * Re-judge every open permission card under the rules in force NOW, and let
+     * through the ones that no longer need a human (ticket #157).
+     *
+     * Only in the permissive direction: a card that becomes `deny` or stays `ask`
+     * is left alone. Denying something the user is looking at — and had every
+     * right to approve — would be taking a decision away from them, which is the
+     * mistake session 12 spent its whole length undoing.
+     */
+    releasePermissionsAllowedNow() {
+        for (const [requestId, pending] of [...this.pending]) {
+            if (!pending.fromPolicy)
+                continue;
+            const verdict = evaluateToolUse(pending.toolName, pending.input, {
+                trustMode: this.spec.trustMode,
+                mode: this.mode,
+                ...(this.spec.agentAutoCommit === undefined
+                    ? {}
+                    : { agentAutoCommit: this.spec.agentAutoCommit }),
+                worktreePath: this.spec.cwd,
+            });
+            if (verdict.decision !== 'allow')
+                continue;
+            this.emit({
+                type: 'permission_resolved',
+                requestId,
+                allow: true,
+                source: 'policy',
+                reason: `the session mode changed — ${verdict.reason}`,
+            });
+            pending.resolve({ behavior: 'allow', updatedInput: pending.input });
+        }
     }
     /**
      * Session 15: the project's trust level and auto-commit switch, changed
@@ -649,10 +893,50 @@ class ClaudeSession {
      * every tool call, so the next one already sees it.
      */
     setWorkspacePolicy(policy) {
+        const trustChanged = policy.trustMode !== undefined && policy.trustMode !== this.spec.trustMode;
         if (policy.trustMode !== undefined)
             this.spec.trustMode = policy.trustMode;
         if (policy.agentAutoCommit !== undefined)
             this.spec.agentAutoCommit = policy.agentAutoCommit;
+        if (!trustChanged)
+            return;
+        // The manager tightened to STRICT while this session was running with
+        // nothing gated. Waiting for a relaunch would leave the shield down for the
+        // rest of the turn, so this one is applied live and immediately: the CLI
+        // accepts a TIGHTENING from bypass on the same process (verified live), and
+        // from the next tool call `canUseTool` — and layer 1 with it — is consulted
+        // again. The process keeps the launch flags it can no longer use; being
+        // gated a moment sooner is worth more than that tidiness.
+        if (this.mode === 'full' && !availableModes(this.spec.trustMode).includes('full')) {
+            this.mode = 'ask';
+            // The WITHDRAWN sentence, not the refusal one (QA-128): nobody in this
+            // session asked for anything — a manager changed the project.
+            this.emit({ type: 'notice', level: 'warn', text: MODE_WITHDRAWN_TEXT });
+            this.emit({ type: 'settings', mode: this.mode });
+            void this.q.setPermissionMode(MODE_TO_PERMISSION[this.mode]).catch((error) => {
+                // The control request is the ONLY thing standing between «the manager
+                // set this project to Strict» and an agent that still gates nothing
+                // (QA-128). A warning in journald is not a response to that: if the
+                // process will not be tightened, it does not get to keep running.
+                log.warn('claude: could not tighten a full session after a STRICT switch', {
+                    error: String(error),
+                });
+                this.emit({
+                    type: 'notice',
+                    level: 'warn',
+                    text: 'This project was set to Strict trust and the running agent refused to switch its permission checks back on, so the session was stopped. Start it again to continue.',
+                });
+                this.stop('session_stopped');
+            });
+        }
+        // A tightening to STRICT has to take `full` out of the picker, and a
+        // loosening has to put it back — the list is computed from `spec` and only
+        // reaches the dashboard through a capabilities frame (ticket #156).
+        this.refreshCapabilities();
+        // Loosening the workspace releases what it no longer needs a human for, the
+        // same way a mode switch does. Tightening changes nothing here on purpose:
+        // this only ever lets cards through, never withdraws one.
+        this.releasePermissionsAllowedNow();
     }
     /**
      * Change the reasoning-effort level (tickets #111, #112).
@@ -1010,6 +1294,9 @@ class ClaudeSession {
         }
         const verdict = evaluateToolUse(toolName, input, {
             trustMode: this.spec.trustMode,
+            // Ticket #156: the missing argument. Everything else in this object was
+            // already here; the session's own mode was not, so «Auto» decided nothing.
+            mode: this.mode,
             ...(this.spec.agentAutoCommit === undefined
                 ? {}
                 : { agentAutoCommit: this.spec.agentAutoCommit }),
@@ -1037,10 +1324,13 @@ class ClaudeSession {
             ...(opts.description ? { description: opts.description } : {}),
             input: truncateInput(input),
         });
-        return this.waitForAnswer(opts, toolName);
+        return this.waitForAnswer(opts, toolName, input);
     }
     /** Park the tool call until the dashboard answers (or the request aborts). */
-    waitForAnswer(opts, toolName) {
+    waitForAnswer(opts, toolName, 
+    // The RAW input, not the truncated copy that went on the card: this is what
+    // the tool is released with, and what a later re-judgement is judged on.
+    input) {
         return new Promise((resolve) => {
             const settle = (result) => {
                 if (this.pending.delete(opts.requestId))
@@ -1048,6 +1338,8 @@ class ClaudeSession {
             };
             this.pending.set(opts.requestId, {
                 toolName,
+                input: input ?? {},
+                fromPolicy: input !== undefined,
                 resolve: settle,
             });
             opts.signal.addEventListener('abort', () => {
@@ -1110,6 +1402,7 @@ class ClaudeSession {
             log.warn('claude: answer for a question that is no longer open', { askId: reply.askId });
             return false;
         }
+        this.resumingTurn();
         // Validated BEFORE the ask is consumed: an answer with nothing in it would
         // otherwise release the tool call with `answers: {}` — the very shape of
         // the auto-answer this session deleted — and leave the card unanswerable.
@@ -1219,6 +1512,7 @@ class ClaudeSession {
             log.warn('claude: permission answer for unknown request', { requestId });
             return;
         }
+        this.resumingTurn();
         this.emit({
             type: 'permission_resolved',
             requestId,
@@ -1246,6 +1540,7 @@ class ClaudeSession {
             this.answerQuestion({ askId: openAsk, action: 'discuss', text });
             return;
         }
+        this.resumingTurn();
         const accepted = this.input.push({
             type: 'user',
             message: { role: 'user', content: text },
@@ -1258,13 +1553,37 @@ class ClaudeSession {
         }
     }
     async interrupt() {
+        this.aborting = true;
         try {
             await this.q.interrupt();
         }
         catch (error) {
+            // The abort never reached the SDK, so any failure that arrives now is the
+            // agent's own and must be reported as one.
+            this.aborting = false;
             log.warn('claude: interrupt failed', { error: String(error) });
         }
     }
+    conversationAnchor() {
+        return this.lastMessageUuid;
+    }
+    /**
+     * `/compact` — the CLI's own command, delivered as ordinary user input.
+     *
+     * Deliberately not routed through `send()`: that one diverts text into an
+     * open question card, and a question is exactly the state in which the user
+     * is most likely to look at a full context meter and press the button.
+     */
+    async compact() {
+        if (this.stopped)
+            return false;
+        this.resumingTurn();
+        return this.input.push({
+            type: 'user',
+            message: { role: 'user', content: '/compact' },
+            parent_tool_use_id: null,
+        });
+    }
     stop(reason = 'session_stopped') {
         if (this.stopped)
             return;
@@ -1305,6 +1624,26 @@ class ClaudeSession {
     async consume() {
         try {
             for await (const msg of this.q) {
+                // Ticket #126: where we are in the transcript, remembered BEFORE the
+                // message is interpreted.
+                //
+                // ONLY a finished assistant message of the MAIN conversation. The SDK
+                // stamps a uuid on roughly thirty message kinds — `system:init`, hook
+                // notifications, rate-limit events, tool progress, the closing
+                // `result` — and none of them is something the CLI can resume at. Its
+                // own contract is explicit: «The message ID should be from
+                // `SDKAssistantMessage.uuid`».
+                //
+                // Taking whichever came last handed the CLI, on a fresh session, the
+                // uuid of `system:init` — and the next launch died with «No message
+                // found with message.uuid of …», which is a FAILED session and a
+                // conversation that was never actually rewound.
+                //
+                // `parent_tool_use_id` excludes a subagent's own messages: they live
+                // inside a Task tool call, not in the conversation being resumed.
+                if (msg.type === 'assistant' && msg.parent_tool_use_id === null && msg.uuid) {
+                    this.lastMessageUuid = msg.uuid;
+                }
                 switch (msg.type) {
                     case 'system': {
                         if (msg.subtype === 'init') {
@@ -1393,16 +1732,32 @@ class ClaudeSession {
                         // otherwise, and it is the last thing anybody sees.
                         this.endTaskTurn();
                         this.refreshContextUsage();
-                        if (msg.subtype === 'success') {
-                            this.emit({ type: 'turn_end', ok: true });
-                        }
-                        else {
+                        // Consumed here whichever way the turn ended: one Stop arms this
+                        // once, for exactly one result.
+                        const aborted = this.aborting;
+                        this.aborting = false;
+                        const failure = msg.subtype === 'success' ? '' : classifyError(msg.subtype, msg.errors);
+                        if (failure && isRewindError(failure)) {
+                            // Not a failed turn — a refused resume. The CLI answers a bad
+                            // `resumeSessionAt` with exactly this and nothing else (no
+                            // `system:init`, no assistant message), so reporting it as a
+                            // turn failure moved the session to FAILED for a rewind that had
+                            // simply not been possible.
                             this.emit({
-                                type: 'turn_end',
-                                ok: false,
-                                errorMessage: classifyError(msg.subtype, msg.errors),
+                                type: 'error',
+                                message: classifyRunError(failure),
+                                code: 'rewind_failed',
                             });
                         }
+                        else if (msg.subtype === 'success' || aborted) {
+                            // A turn the user stopped is not a failed turn. Reporting it as
+                            // one moved the session to FAILED, which is terminal — pressing
+                            // Stop cost people the session they meant to keep.
+                            this.emit({ type: 'turn_end', ok: true, ...(aborted ? { aborted: true } : {}) });
+                        }
+                        else {
+                            this.emit({ type: 'turn_end', ok: false, errorMessage: failure });
+                        }
                         break;
                     }
                     default:
@@ -1526,7 +1881,11 @@ function stringifyContent(content) {
     return content === undefined ? '' : JSON.stringify(content);
 }
 function classifyError(subtype, errors) {
-    const detail = errors.length ? `: ${maskString(errors.join('; ').slice(0, 500))}` : '';
+    // Optional on purpose despite the SDK's type: a `result` without `errors`
+    // threw from inside the event pump, which the loop's catch turned into a
+    // plain `error` event — so the turn that failed never ENDED, and the session
+    // sat at RUNNING with no way to tell.
+    const detail = errors?.length ? `: ${maskString(errors.join('; ').slice(0, 500))}` : '';
     switch (subtype) {
         case 'error_max_budget_usd':
             return 'Session budget (USD) exceeded — the run was stopped';
@@ -1556,14 +1915,30 @@ function isAuthError(message) {
 function isResumeError(message) {
     return /no conversation found|session .{0,40}not found|could not resume|invalid session id/i.test(message);
 }
+/**
+ * The CLI refused the point we asked it to resume at.
+ *
+ * Its exact wording, captured from the CLI itself: «No message found with
+ * message.uuid of: <uuid>». It arrives as a `result` with no `system:init`
+ * before it, and the query then throws with the same sentence — so this is
+ * matched on both paths.
+ */
+function isRewindError(message) {
+    return /no message found with message\.uuid/i.test(message);
+}
 function errorCode(message) {
     if (isAuthError(message))
         return 'auth_expired';
+    if (isRewindError(message))
+        return 'rewind_failed';
     if (isResumeError(message))
         return 'resume_failed';
     return undefined;
 }
 export function classifyRunError(message) {
+    if (isRewindError(message)) {
+        return 'The conversation could not be rewound to that point — the agent still remembers everything after it';
+    }
     if (isAuthError(message)) {
         return 'Claude authentication expired on this server — re-login is required (claude setup-token)';
     }