@inetafrica/open-claudia 3.0.43 → 3.0.44

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## v3.0.44 — Safety refusals explain themselves, and one refusal no longer poisons every turn after it
+
+- **A Claude safety refusal now tells you why instead of dumping a raw API error.** When the model declines a request (`stop_reason: "refusal"`), the API attaches a category and sometimes an explanation — but all you saw was "API Error … appears to violate our Usage Policy" with a request id buried inside. The refusal is now detected structurally from the stream (`stop_details` category/explanation, with a text-parse fallback when the CLI flattens it into the error string) and surfaced as a clear ⛔ diagnostic: the reason, the request ID (for support), and your options (/new, rephrase, /model or /backend).
+- **One refusal no longer bricks the whole conversation.** The safety classifier scores the *entire* conversation, so resuming a session whose context tripped it re-sent the flagged material and refused again — every turn, even for innocent new messages; the only escape was knowing to type /new. Now the poisoned session is **quarantined** the moment a resumed turn is refused: its id is recorded in user state (bounded to 20, survives restarts), the stale active pointer is healed, and nothing resumes it again — the natural next turn and even an explicit `/continue <id>` are forced fresh. Session ids the CLI rotates mid-run are quarantined too.
+- **Your refused message is retried for you, once, in a fresh session.** After quarantining, the same prompt is automatically replayed in a brand-new session — you see "♻️ That refusal came from flagged context in the old session — quarantined it, retrying your message in a fresh one" and then the actual answer, so you keep working without re-typing anything. Strictly one-shot: if the fresh run is also refused, the new message itself is the problem and you get the full diagnostic with no retry loop; capture/background runs never auto-retry.
+- **Agent-space / OpenClaw:** no new deps, env, or schema change (a `quarantinedSessions` map is added to per-user state; old state files load cleanly); Docker image builds FROM the existing `:base`. Changes span `core/providers/events.js`/`claude-events.js` (detection), `core/state.js` (quarantine bookkeeping), `core/run-context.js` (resume guard), `core/runner.js` (diagnostic + one-shot retry); covered by new `test-provider-refusal-recovery.js`, a fake-agent `refusal` scenario, and runner e2e cases. Existing pods pick it up on their next approved upgrade.
+
 ## v3.0.43 — Telegram stops rebooting into a dead network: outages now pause-and-wait instead of restart-storming
 
 - **A host-wide network blip no longer triggers a reboot storm.** v3.0.42 fixed the *in-loop* poll wedge (a poisoned reused poller) so it heals in place — but it still kept the 10-minute `process.exit(1)` backstop, which fired even when the *entire host* had lost the network (a laptop sleep/wake, or pod egress starvation where Telegram poll+send, Kazee WS and Spaces WS all drop together). Exiting into a dead network just relaunched straight back into the same outage, so you'd see "Back online and ready! Running v3.0.42" every ~14 minutes, busting the prompt cache and spamming the chat. Now the self-exit is **reachability-gated**: before it ever restarts the process it runs a fresh, connection-fresh HEAD probe to `api.telegram.org`, and only exits if that probe genuinely **succeeds** — proving the API is reachable and it's a real in-process wedge worth a clean restart, not the host being offline.

package/core/providers/claude-events.js

@@ -4,6 +4,7 @@ const {
   normalizeDecoderError,
   normalizedUsage,
   providerErrorFlags,
+  refusalDetailsFromMessage,
 } = require("./events");
 
 function createClaudeParserState() {
@@ -14,6 +15,7 @@ function createClaudeParserState() {
     tools: new Map(),
     seenUsage: new Set(),
     totalCostUsd: 0,
+    refusal: null,
   };
 }
 
@@ -30,6 +32,27 @@ function claudeErrorMessage(rawEvent) {
   return "Claude provider failed";
 }
 
+function captureRefusal(state, stopReason, stopDetails) {
+  if (stopReason !== "refusal") return;
+  state.refusal = {
+    category: stopDetails?.category ?? null,
+    explanation: stopDetails?.explanation ?? null,
+  };
+}
+
+function claudeFailureEvent(message, state) {
+  const flags = providerErrorFlags(message);
+  const event = { type: "error", message, ...flags };
+  if (flags.refusal || state.refusal) {
+    const parsed = refusalDetailsFromMessage(message);
+    event.refusal = true;
+    event.refusalCategory = state.refusal?.category ?? null;
+    event.refusalExplanation = state.refusal?.explanation || parsed.explanation || null;
+    event.requestId = parsed.requestId;
+  }
+  return event;
+}
+
 function normalizeClaudeEvent(rawEvent, state = createClaudeParserState()) {
   if (!rawEvent || typeof rawEvent !== "object") return [];
   const decoderFailure = normalizeDecoderError(rawEvent);
@@ -41,6 +64,9 @@ function normalizeClaudeEvent(rawEvent, state = createClaudeParserState()) {
   }
 
   if (rawEvent.type === "stream_event") {
+    if (rawEvent.event?.type === "message_delta") {
+      captureRefusal(state, rawEvent.event.delta?.stop_reason, rawEvent.event.delta?.stop_details ?? rawEvent.event.stop_details);
+    }
     const delta = rawEvent.event?.type === "content_block_delta" ? rawEvent.event.delta : null;
     if (delta?.type === "text_delta" && typeof delta.text === "string" && delta.text) {
       state.sawText = true;
@@ -51,6 +77,7 @@ function normalizeClaudeEvent(rawEvent, state = createClaudeParserState()) {
 
   if (rawEvent.type === "assistant") {
     const events = [];
+    captureRefusal(state, rawEvent.message?.stop_reason, rawEvent.message?.stop_details);
     for (const block of rawEvent.message?.content || []) {
       if (block?.type === "text" && typeof block.text === "string" && block.text) {
         state.sawText = true;
@@ -95,8 +122,7 @@ function normalizeClaudeEvent(rawEvent, state = createClaudeParserState()) {
     state.terminal = true;
     if (Number.isFinite(rawEvent.total_cost_usd)) state.totalCostUsd = rawEvent.total_cost_usd;
     if (rawEvent.is_error || /^error/.test(String(rawEvent.subtype || ""))) {
-      const message = claudeErrorMessage(rawEvent);
-      return [{ type: "error", message, ...providerErrorFlags(message) }];
+      return [claudeFailureEvent(claudeErrorMessage(rawEvent), state)];
     }
     const events = [];
     const session = sessionEvent(rawEvent.session_id, state);
@@ -104,12 +130,19 @@ function normalizeClaudeEvent(rawEvent, state = createClaudeParserState()) {
     const usage = normalizedUsage(rawEvent.usage, "turn", state.seenUsage);
     if (usage) events.push(usage);
     const hasStructuredOutput = Object.prototype.hasOwnProperty.call(rawEvent, "structured_output");
+    const resultText = typeof rawEvent.result === "string" ? rawEvent.result : "";
+    if (state.refusal && !hasStructuredOutput && !state.sawText && !resultText.trim()) {
+      // A refusal the CLI reports as a "successful" empty turn would otherwise
+      // surface as "(no output)" — fail it with the real reason instead.
+      events.push(claudeFailureEvent('The model refused this request (stop_reason "refusal").', state));
+      return events;
+    }
     const structuredText = hasStructuredOutput ? JSON.stringify(rawEvent.structured_output) : "";
     events.push({
       type: "result",
       text: hasStructuredOutput
         ? (structuredText === undefined ? "" : structuredText)
-        : (state.sawText ? "" : (typeof rawEvent.result === "string" ? rawEvent.result : "")),
+        : (state.sawText ? "" : resultText),
       sessionId: rawEvent.session_id || state.sessionId || null,
     });
     return events;

package/core/providers/events.js

@@ -131,9 +131,19 @@ function providerErrorFlags(message) {
   return {
     authError: /unauthori[sz]ed|not (?:logged in|authenticated)|unauthenticated|login required|authentication failed|auth failed|invalid api key|no credentials|401/.test(text),
     usageLimit: /usage limit|spend limit|monthly cycle|quota|rate limit/.test(text),
+    refusal: /refusals-and-fallback|usage policy|safety classifier|stop_reason['":\s]*refusal/.test(text),
   };
 }
 
+// The CLI flattens the API's stop_details into the error text; recover the
+// human-readable pieces so the chat message can lead with the actual reason.
+function refusalDetailsFromMessage(message) {
+  const text = String(message || "");
+  const requestId = text.match(/\breq_[A-Za-z0-9]+\b/)?.[0] || null;
+  const explanation = text.match(/This request triggered[^.]+\./i)?.[0]?.trim() || null;
+  return { requestId, explanation };
+}
+
 function normalizeDecoderError(rawEvent) {
   if (!rawEvent || rawEvent.type !== "decoder.error") return null;
   // Warning, not error: a single oversized or malformed record is skippable.
@@ -171,6 +181,7 @@ module.exports = {
   normalizeDecoderError,
   normalizedUsage,
   providerErrorFlags,
+  refusalDetailsFromMessage,
   selectTerminalText,
   usageFingerprint,
 };

package/core/run-context.js

@@ -97,9 +97,14 @@ function captureRunContext({
   }
   const project = projectSnapshot(state, cwd, opts.project);
   const activeSessionId = state.activeSessions?.[project.name]?.[provider] || null;
-  const admittedSessionId = opts.fresh
+  const requestedSessionId = opts.fresh
     ? null
     : (opts.resumeSessionId || activeSessionId || null);
+  // A quarantined session's provider-side context tripped a safety refusal;
+  // resuming would re-send the flagged context and refuse again. Force the
+  // turn fresh instead (explicit resume requests included).
+  const quarantinedResume = !!(requestedSessionId && state.quarantinedSessions?.[requestedSessionId]);
+  const admittedSessionId = quarantinedResume ? null : requestedSessionId;
   const origin = serializableOrigin(opts.origin, store || {});
   const resolvedChannelId = channelId != null
     ? String(channelId)
@@ -128,9 +133,10 @@ function captureRunContext({
     cwd: cwd || project.dir || null,
     replyToMsgId: replyToMsgId == null ? null : String(replyToMsgId),
     userPrompt: prompt,
-    fresh: !!opts.fresh,
-    continueSession: !!opts.continueSession,
-    resumeSessionId: opts.resumeSessionId || null,
+    fresh: !!opts.fresh || quarantinedResume,
+    continueSession: quarantinedResume ? false : !!opts.continueSession,
+    resumeSessionId: quarantinedResume ? null : (opts.resumeSessionId || null),
+    quarantinedResume,
     skipAutoCompact: !!opts.skipAutoCompact,
     timeoutMs: Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : null,
     maxTurns: Number.isFinite(opts.maxTurns) ? opts.maxTurns : null,

package/core/runner.js

@@ -14,7 +14,7 @@ const {
 const {
   currentState, saveState, recordSession,
   resetSessionUsage, acquireRunLock, getActiveProvider, getProjectKey,
-  getProviderSession, setProviderSession, clearProviderSession, getUsageForSession, commitProviderCompaction,
+  getProviderSession, setProviderSession, clearProviderSession, quarantineProviderSession, getUsageForSession, commitProviderCompaction,
 } = require("./state");
 const { chatContext, currentChannelId, currentAdapter } = require("./context");
 const { buildTurnPrompt } = require("./system-prompt");
@@ -525,7 +525,11 @@ async function executeProviderInvocation(options = {}) {
   else if (closeInfo.signal) failure = stableRunError(`Provider process exited on signal ${closeInfo.signal}`, "PROVIDER_SIGNAL_EXIT", { signal: closeInfo.signal });
   else if (rawErrors.length) {
     const event = rawErrors[0];
-    failure = stableRunError(event.message || "Provider reported an error", event.authError ? "PROVIDER_UNAUTHENTICATED" : (event.usageLimit ? "PROVIDER_USAGE_LIMIT" : "PROVIDER_EVENT_ERROR"), event);
+    failure = stableRunError(
+      event.message || "Provider reported an error",
+      event.refusal ? "PROVIDER_REFUSAL" : (event.authError ? "PROVIDER_UNAUTHENTICATED" : (event.usageLimit ? "PROVIDER_USAGE_LIMIT" : "PROVIDER_EVENT_ERROR")),
+      event,
+    );
   } else if (closeInfo.code !== 0) failure = stableRunError(`Provider process exited with code ${closeInfo.code}`, "PROVIDER_NONZERO_EXIT", { exitCode: closeInfo.code });
   else if (!terminalSeen) failure = stableRunError("Provider stream ended without a terminal event", "PROVIDER_MISSING_TERMINAL");
   else if (!cleanupOutcome.ok) failure = cleanupOutcome.error;
@@ -1394,6 +1398,26 @@ function providerRunDiagnostic(result, runContext) {
   if (code === "PROVIDER_USAGE_LIMIT") {
     return `${label} reported a usage or rate limit. Check that provider's account status or select another configured provider.`;
   }
+  if (code === "PROVIDER_REFUSAL") {
+    const details = result.error?.details || {};
+    const reason = [
+      details.refusalCategory ? `[${details.refusalCategory}]` : null,
+      details.refusalExplanation || null,
+    ].filter(Boolean).join(" ");
+    const lines = [
+      `⛔ ${label} declined this turn — the model's safety classifier refused the request (a policy block, not a crash).`,
+    ];
+    if (reason) lines.push(`Reason: ${reason}`);
+    if (details.requestId) lines.push(`Request ID: ${details.requestId}`);
+    lines.push(
+      "",
+      "The classifier scores the whole conversation, not just your last message — so retrying in this session usually refuses again. Options:",
+      "• /new — fresh session without the flagged context",
+      "• Rephrase, or drop the material that tripped it",
+      "• /model or /backend — a different model can usually serve the same request",
+    );
+    return lines.join("\n");
+  }
   const detail = result.stderr ? `\n\nStderr:\n${result.stderr.slice(-1200)}` : "";
   return `${label} run failed: ${result.error?.message || "unknown provider failure"}${detail}`;
 }
@@ -1899,6 +1923,57 @@ function drainQueuedMessages(state) {
   return Promise.resolve();
 }
 
+// A refusal on a RESUMED session is almost always the safety classifier
+// rejecting flagged material in the old context — which every resume re-sends
+// — not the user's new message. Recovery: quarantine the poisoned session so
+// nothing resumes it again, then replay the same prompt once in a fresh
+// session. A refusal on already-fresh context gets no retry (the new message
+// itself is the problem), and the retry run never retries again.
+function shouldRetryRefusedRun(result, runContext, { capture = false, refusalRetried = false } = {}) {
+  return !capture
+    && !refusalRetried
+    && runContext?.purpose === "foreground"
+    && !!runContext?.sessionId
+    && !!result
+    && !result.ok
+    && result.error?.code === "PROVIDER_REFUSAL";
+}
+
+function quarantineRefusedRun(result, runContext, state) {
+  const details = result.error?.details || {};
+  const record = { reason: "refusal", requestId: details.requestId || null };
+  try {
+    quarantineProviderSession(state, runContext.provider, runContext.project?.name, runContext.sessionId, record);
+    // The CLI rotates session ids on resume; the rotated id observed this run
+    // carries the same poisoned context, so quarantine it too.
+    if (result.sessionId && result.sessionId !== runContext.sessionId) {
+      quarantineProviderSession(state, runContext.provider, runContext.project?.name, result.sessionId, record);
+    }
+    saveState({ strict: true });
+    return true;
+  } catch (error) {
+    console.error("refusal quarantine failed:", redactSensitive(String(error.message || error)));
+    return false;
+  }
+}
+
+function refusalRetryContext(runContext, state) {
+  return deepFreeze({
+    ...runContext,
+    runId: typeof crypto.randomUUID === "function"
+      ? crypto.randomUUID()
+      : `run-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`,
+    admittedAt: Date.now(),
+    sessionId: null,
+    admittedSessionId: null,
+    previousSessionId: getProviderSession(state, runContext.provider, runContext.project?.name) || null,
+    fresh: true,
+    continueSession: false,
+    resumeSessionId: null,
+    quarantinedResume: true,
+  });
+}
+
 async function executeAdmittedRun(runContext, state, store, capture, ownsAdmissionLock, executionOptions = {}) {
   const tracksMainRun = ownsAdmissionLock && !capture;
   if (tracksMainRun) state.activeRunContext = runContext;
@@ -1928,6 +2003,16 @@ async function executeAdmittedRun(runContext, state, store, capture, ownsAdmissi
     stopTyping();
   }
 
+  if (shouldRetryRefusedRun(result, runContext, { capture, refusalRetried: executionOptions.refusalRetried })
+    && quarantineRefusedRun(result, runContext, state)) {
+    try { service.turnObserver?.onTurnSettled(false); } catch (e) { /* best-effort */ }
+    // Re-arm the admission lock across the notice's async gap so a racing
+    // incoming message queues behind the retry instead of interleaving.
+    if (ownsAdmissionLock) state.preparingRun = true;
+    await send("♻️ That refusal came from flagged context in the old session — quarantined it, retrying your message in a fresh one.").catch(() => {});
+    return executeAdmittedRun(refusalRetryContext(runContext, state), state, store, capture, ownsAdmissionLock, { ...executionOptions, refusalRetried: true });
+  }
+
   if (tracksMainRun) {
     sideChatCoordinator.noteMainResult(runContext, result);
     for (const item of state.messageQueue) {
@@ -2114,6 +2199,9 @@ module.exports = {
   runAgent,
   runAgentCapture,
   runAgentSilent,
+  shouldRetryRefusedRun,
+  quarantineRefusedRun,
+  refusalRetryContext,
   shouldStartSideChat,
   runSideChatRequest,
   enqueueSideChatRequest,

package/core/state.js

@@ -428,6 +428,50 @@ function clearProviderSession(state, providerId, projectName) {
   return true;
 }
 
+const MAX_QUARANTINED_SESSIONS = 20;
+
+function boundQuarantinedSessions(source) {
+  if (!isRecord(source)) return {};
+  return Object.fromEntries(
+    Object.entries(source)
+      .filter(([sessionId, record]) => sessionId && isRecord(record))
+      .sort((a, b) => (a[1].at || 0) - (b[1].at || 0))
+      .slice(-MAX_QUARANTINED_SESSIONS)
+      .map(([sessionId, record]) => [sessionId, { ...record }]),
+  );
+}
+
+// A quarantined session is one whose provider-side context tripped the model's
+// safety classifier (stop_reason "refusal"). Resuming it re-sends the flagged
+// context and refuses again, so it must never be resumed — the run-context
+// capture forces such turns fresh. Quarantining also drops the active pointer
+// when it still points at the poisoned session.
+function quarantineProviderSession(state, providerId, projectName, sessionId, details = {}) {
+  const provider = normalizeProviderId(providerId, null);
+  if (!state || !provider || typeof sessionId !== "string" || !sessionId) return false;
+  if (!isRecord(state.quarantinedSessions)) state.quarantinedSessions = {};
+  state.quarantinedSessions[sessionId] = {
+    provider,
+    project: projectNameFrom(projectName) || getProjectKey(state, projectName) || null,
+    reason: String(details.reason || "refusal"),
+    requestId: details.requestId || null,
+    at: Number.isFinite(details.at) ? details.at : Date.now(),
+  };
+  state.quarantinedSessions = boundQuarantinedSessions(state.quarantinedSessions);
+  const project = getProjectKey(state, projectName);
+  if (project && getProviderSession(state, provider, project) === sessionId) {
+    clearProviderSession(state, provider, project);
+  }
+  return true;
+}
+
+function isSessionQuarantined(state, sessionId) {
+  return !!(sessionId
+    && typeof sessionId === "string"
+    && isRecord(state?.quarantinedSessions)
+    && isRecord(state.quarantinedSessions[sessionId]));
+}
+
 function getProviderSettings(state, providerId) {
   if (!state || typeof state !== "object") throw new TypeError("state is required");
   const provider = normalizeProviderId(providerId || getActiveProvider(state), null);
@@ -542,6 +586,7 @@ function createUserState(userId) {
     streamBuffer: "",
     streamInterval: null,
     activeSessions: normalizeActiveSessions(saved.activeSessions),
+    quarantinedSessions: boundQuarantinedSessions(saved.quarantinedSessions),
     providerSettings: normalizeProviderSettings(saved.providerSettings),
     usageBySession: boundUsageBySession(saved.usageBySession),
     messageQueue: [],
@@ -693,6 +738,7 @@ function serializeUserState(state, existing = {}) {
     ...existing,
     currentSession: state.currentSession,
     activeSessions: normalizeActiveSessions(state.activeSessions),
+    quarantinedSessions: boundQuarantinedSessions(state.quarantinedSessions),
     providerSettings: normalizeProviderSettings(state.providerSettings),
     usageBySession: boundUsageBySession(state.usageBySession),
     settings: serializeCommonSettings(state.settings),
@@ -1367,6 +1413,8 @@ module.exports = {
   getProviderSession,
   setProviderSession,
   clearProviderSession,
+  quarantineProviderSession,
+  isSessionQuarantined,
   getProviderSettings,
   getActiveUsage,
   getUsageForSession,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.0.43",
+  "version": "3.0.44",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {
@@ -9,7 +9,7 @@
   "scripts": {
     "setup": "node setup.js",
     "start": "node bot.js",
-    "pretest": "node test-provider-fixture.js && node test-provider-core-prompt.js && node test-provider-prompt-parity.js && node test-provider-env-isolation.js && node test-provider-resume-parity.js && node test-provider-bootstrap.js && node test-provider-registry.js && node test-provider-stream-decoder.js && node test-provider-events.js && node test-provider-claude.js && node test-provider-codex.js && node test-provider-runner.js && node test-provider-run-lifecycle.js && node test-provider-gateway.js && node test-provider-side-chat.js && node test-single-runtime.js && node test-provider-migration-backup.js && node test-provider-state-migration.js && node test-provider-session-history.js && node test-provider-session-commands.js && node test-provider-compaction.js && node test-provider-scheduler.js && node test-credential-capture.js && node test-cursor-removal.js && node test-utility-provider-policy.js && node test-provider-subagent.js && node test-provider-recall.js && node test-provider-pack-review.js && node test-memory-mutation-queue.js && node test-provider-dream.js && node test-provider-enforcer.js && node test-provider-tool-hooks.js && node test-provider-boot-matrix.js && node test-provider-capabilities.js && node test-provider-language.js && node test-provider-coupling-audit.js && node test-provider-parity-e2e.js && node test-kazee-channel-health.js && node test-prompt-budget.js && node test-agency-ledger.js && node test-agency-deliberate.js && node test-guardrail.js && node test-spaces-comment-content.js",
+    "pretest": "node test-provider-fixture.js && node test-provider-core-prompt.js && node test-provider-prompt-parity.js && node test-provider-env-isolation.js && node test-provider-resume-parity.js && node test-provider-bootstrap.js && node test-provider-registry.js && node test-provider-stream-decoder.js && node test-provider-events.js && node test-provider-claude.js && node test-provider-codex.js && node test-provider-runner.js && node test-provider-refusal-recovery.js && node test-provider-run-lifecycle.js && node test-provider-gateway.js && node test-provider-side-chat.js && node test-single-runtime.js && node test-provider-migration-backup.js && node test-provider-state-migration.js && node test-provider-session-history.js && node test-provider-session-commands.js && node test-provider-compaction.js && node test-provider-scheduler.js && node test-credential-capture.js && node test-cursor-removal.js && node test-utility-provider-policy.js && node test-provider-subagent.js && node test-provider-recall.js && node test-provider-pack-review.js && node test-memory-mutation-queue.js && node test-provider-dream.js && node test-provider-enforcer.js && node test-provider-tool-hooks.js && node test-provider-boot-matrix.js && node test-provider-capabilities.js && node test-provider-language.js && node test-provider-coupling-audit.js && node test-provider-parity-e2e.js && node test-kazee-channel-health.js && node test-prompt-budget.js && node test-agency-ledger.js && node test-agency-deliberate.js && node test-guardrail.js && node test-spaces-comment-content.js",
     "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-walker-score.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-score-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-cokept-warming.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-search.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-extractive-injection.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-queue-routing.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-packs.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-persona.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-pipeline.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-relationship-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-relationship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-enforcer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-identity-prune.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-message-id.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-delivery-contract.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-run-lock.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-web-sessions.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-poll-recovery.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-409-grace.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-conflict-heal-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-single-instance.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-streaming-split.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-spaces-autoenable.js"
   },
   "files": [

package/test-fixtures/fake-agent-cli.js

@@ -252,6 +252,28 @@ function inferSessionId() {
 
 function claudeEvents(sessionId) {
   const init = { type: "system", subtype: "init", session_id: sessionId };
+  if (scenario === "refusal") {
+    return [
+      init,
+      {
+        type: "assistant",
+        message: {
+          role: "assistant",
+          content: [],
+          stop_reason: "refusal",
+          stop_details: { type: "refusal", category: "cyber", explanation: "This request was declined because it could enable cyber harm." },
+        },
+        session_id: sessionId,
+      },
+      {
+        type: "result",
+        subtype: "error_during_execution",
+        is_error: true,
+        session_id: sessionId,
+        result: "API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Request ID: req_fixture123",
+      },
+    ];
+  }
   if (scenario === "auth-failure") {
     return [
       init,
@@ -332,6 +354,12 @@ function claudeEvents(sessionId) {
 
 function codexEvents(sessionId) {
   const started = { type: "thread.started", thread_id: sessionId };
+  if (scenario === "refusal") {
+    return [
+      started,
+      { type: "turn.failed", error: { message: "Your request was rejected by the safety classifier under the usage policy." } },
+    ];
+  }
   if (scenario === "auth-failure") {
     return [
       started,
@@ -491,7 +519,7 @@ async function main() {
     setInterval(() => {}, 1000);
     return;
   }
-  if (scenario === "auth-failure") {
+  if (scenario === "auth-failure" || scenario === "refusal") {
     process.exitCode = 1;
     return;
   }

package/test-fixtures/sim-no-sqlite.js

@@ -0,0 +1,14 @@
+// Preload shim: makes require("node:sqlite") throw, reproducing CI's node:20
+// where the module is absent. Release lesson (v3.0.39): run changed tests with
+//   NODE_OPTIONS=--require ./test-fixtures/sim-no-sqlite.js
+// before cutting a version, or node22-vs-node20 graph divergences slip through.
+"use strict";
+
+const Module = require("module");
+const originalLoad = Module._load;
+Module._load = function patchedLoad(request, ...rest) {
+  if (request === "node:sqlite" || request === "sqlite") {
+    throw new Error("node:sqlite unavailable (sim-no-sqlite shim)");
+  }
+  return originalLoad.call(this, request, ...rest);
+};

package/test-provider-events.js

@@ -117,8 +117,78 @@ assert.deepStrictEqual(claudeAuth, [{
   message: "Authentication failed",
   authError: true,
   usageLimit: false,
+  refusal: false,
 }]);
 
+// Refusal surfaced only through the CLI's flattened error text (no structured
+// stop_details): flagged, reason sentence + request id recovered from the text.
+const refusalText = "API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). This request triggered restrictions on violative cyber content and was blocked under Anthropic's Usage Policy. To learn more, see https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback. Try rephrasing the request or attempting a different approach.\n\nRequest ID: req_011CdCrJnhWPXeW3PsPFJEb5";
+const claudeRefusal = normalizeClaudeEvent({
+  type: "result",
+  is_error: true,
+  subtype: "error_during_execution",
+  result: refusalText,
+}, createClaudeParserState());
+assert.strictEqual(claudeRefusal.length, 1);
+assert.strictEqual(claudeRefusal[0].type, "error");
+assert.strictEqual(claudeRefusal[0].refusal, true);
+assert.strictEqual(claudeRefusal[0].authError, false);
+assert.strictEqual(claudeRefusal[0].usageLimit, false);
+assert.strictEqual(claudeRefusal[0].requestId, "req_011CdCrJnhWPXeW3PsPFJEb5");
+assert.match(claudeRefusal[0].refusalExplanation, /violative cyber content/);
+
+// Structured stop_details from the assistant message wins over text parsing.
+const refusalState = createClaudeParserState();
+normalizeClaudeEvent({
+  type: "assistant",
+  message: {
+    content: [],
+    stop_reason: "refusal",
+    stop_details: { type: "refusal", category: "cyber", explanation: "This request was declined because it could enable cyber harm." },
+  },
+}, refusalState);
+const structuredRefusal = normalizeClaudeEvent({
+  type: "result",
+  is_error: true,
+  subtype: "error_during_execution",
+  result: "API Error: request blocked",
+}, refusalState);
+assert.strictEqual(structuredRefusal[0].refusal, true);
+assert.strictEqual(structuredRefusal[0].refusalCategory, "cyber");
+assert.match(structuredRefusal[0].refusalExplanation, /cyber harm/);
+
+// A refusal the CLI reports as a "successful" empty turn must fail with the
+// reason instead of settling as an empty "(no output)" result.
+const silentState = createClaudeParserState();
+normalizeClaudeEvent({
+  type: "assistant",
+  message: { content: [], stop_reason: "refusal", stop_details: { type: "refusal", category: null, explanation: null } },
+}, silentState);
+const silent = normalizeClaudeEvent({
+  type: "result",
+  subtype: "success",
+  is_error: false,
+  session_id: "claude-refusal-session",
+  result: "",
+}, silentState);
+assert.strictEqual(silent.at(-1).type, "error");
+assert.strictEqual(silent.at(-1).refusal, true);
+
+// A refusal stop_reason with answer text already streamed must NOT hijack the
+// successful result path.
+const partialState = createClaudeParserState();
+normalizeClaudeEvent({
+  type: "assistant",
+  message: { content: [{ type: "text", text: "partial answer" }], stop_reason: "refusal" },
+}, partialState);
+assert.strictEqual(normalizeClaudeEvent({
+  type: "result",
+  subtype: "success",
+  is_error: false,
+  session_id: "claude-partial-session",
+  result: "",
+}, partialState).at(-1).type, "result");
+
 const codexState = createCodexParserState();
 assert.deepStrictEqual(normalizeCodexEvent(samples.codex.session, codexState), [
   { type: "session", sessionId: "codex-thread-1" },
@@ -151,6 +221,7 @@ assert.deepStrictEqual(codexAuth, [{
   message: "401 Unauthorized",
   authError: true,
   usageLimit: false,
+  refusal: false,
 }]);
 
 const decoderError = { type: "decoder.error", code: "MALFORMED_JSON", message: "Malformed provider JSONL record" };

package/test-provider-language.js

@@ -86,7 +86,20 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // every 30s, resuming cleanly the moment connectivity returns. Poll-health logs
 // are timestamped. Confined to channels/telegram/adapter.js; new cases in
 // test-telegram-poll-recovery.js cover the pause+resume and the gated exit.
-assert.strictEqual(pkg.version, "3.0.43", "release version must remain unchanged without explicit approval");
+// 3.0.44 approved by Sumeet 2026-07-20 ("push"): safety-refusal handling +
+// poisoned-session recovery. The API's stop_reason "refusal" scores the WHOLE
+// conversation, so a session whose context tripped the classifier refused every
+// resumed turn (the flagged material was re-sent each time) and the user only
+// saw a raw AUP error dump with no way forward but knowing to type /new.
+// Refusals are now detected structurally (stop_details category/explanation,
+// text-parse fallback on the flattened CLI error) and mapped to PROVIDER_REFUSAL
+// with a clear diagnostic (reason, request ID, /new + rephrase + model options).
+// Recovery: the refused session is QUARANTINED (bounded persisted map in user
+// state; never resumed again — natural turns, explicit /continue, and rotated
+// ids all forced fresh) and the refused prompt is auto-retried exactly ONCE in
+// a fresh session behind a ♻️ notice. A refusal on already-fresh context gets
+// no retry (the new message itself is the problem); capture runs never retry.
+assert.strictEqual(pkg.version, "3.0.44", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-runner.js

@@ -262,6 +262,56 @@ async function main() {
   assert.strictEqual(authFailure.error.code, "PROVIDER_UNAUTHENTICATED");
   assert.match(authFailure.diagnostic, /Authentication failed/i);
 
+  // A safety refusal on a resumed session must surface as PROVIDER_REFUSAL
+  // with the structured reason (category/explanation/request id) intact — the
+  // inputs the poisoned-session recovery quarantines and retries on.
+  const refusalCapture = path.join(root, "refusal-capture.json");
+  const refusalProviders = makeProviders(
+    { claude: refusalCapture, codex: captures.codex },
+    { claude: { FAKE_AGENT_SCENARIO: "refusal" } },
+  );
+  mutable.activeSessions["project-a"].claude = "claude-poisoned-session";
+  const refusalService = createRunnerService({
+    getState: () => mutable,
+    getStore: () => ({ channelId: "fixture-channel", transport: "telegram" }),
+    resolveProvider: (id) => refusalProviders[id],
+    buildTurnPrompt: simpleBundle,
+    cleanup: async () => {},
+  });
+  const refused = await refusalService.runAgentCapture("REFUSAL SENTINEL", projectA);
+  assert.strictEqual(refused.ok, false);
+  assert.strictEqual(refused.admittedSessionId, "claude-poisoned-session", "refusal run resumed the poisoned session");
+  assert.strictEqual(refused.error.code, "PROVIDER_REFUSAL");
+  assert.strictEqual(refused.error.details.refusal, true);
+  assert.strictEqual(refused.error.details.refusalCategory, "cyber");
+  assert.match(refused.error.details.refusalExplanation, /cyber harm/);
+  assert.strictEqual(refused.error.details.requestId, "req_fixture123");
+  assert.match(refused.diagnostic, /Usage Policy/);
+  assert.match(refused.diagnostic, /req_fixture123/);
+  const refusalArgv = JSON.parse(fs.readFileSync(refusalCapture, "utf8")).argv;
+  assert.ok(refusalArgv.includes("claude-poisoned-session"), "refusal run resumed via --resume");
+
+  // The quarantine guard: once the session is quarantined, the SAME turn shape
+  // is admitted fresh — no --resume, healthy success in a new session.
+  mutable.quarantinedSessions = {
+    "claude-poisoned-session": { provider: "claude", project: "project-a", reason: "refusal", at: Date.now() },
+  };
+  const recoveredProviders = makeProviders({ claude: refusalCapture, codex: captures.codex });
+  const recoveredService = createRunnerService({
+    getState: () => mutable,
+    getStore: () => ({ channelId: "fixture-channel", transport: "telegram" }),
+    resolveProvider: (id) => recoveredProviders[id],
+    buildTurnPrompt: simpleBundle,
+    cleanup: async () => {},
+  });
+  const recovered = await recoveredService.runAgentCapture("RECOVERY SENTINEL", projectA);
+  assert.strictEqual(recovered.ok, true);
+  assert.strictEqual(recovered.admittedSessionId, null, "quarantined session must not be admitted");
+  assert.strictEqual(recovered.sessionId, "claude-fresh-session");
+  const recoveredArgv = JSON.parse(fs.readFileSync(refusalCapture, "utf8")).argv;
+  assert.ok(!recoveredArgv.includes("--resume"), "quarantined resume is forced fresh");
+  assert.ok(!recoveredArgv.includes("claude-poisoned-session"));
+
   console.log("provider runner OK");
 }