@nomix-ai/nomix-harness 0.2.5 → 0.2.6

package/dist/kernel/subagent-claude-code/lib/types/run.js

@@ -13,10 +13,76 @@ import { scrubbedParentEnv, } from '../../../subprocess/lib/index.js';
 import { claudeSpawnSpec, ManagedClaudeCodeProcess, } from "./process.js";
 /** Default POSIX grace between subprocess termination tiers. */
 export const DEFAULT_DISPOSE_GRACE_MS = 3_000;
+/** Claude Code permission modes that cannot wait for a human response. */
+export const CLAUDE_CODE_PERMISSION_MODES = [
+    'dontAsk',
+    'acceptEdits',
+    'auto',
+    'plan',
+    'bypassPermissions',
+];
+/** Safe default for unattended Claude Code runs. */
+export const DEFAULT_CLAUDE_CODE_PERMISSION_MODE = 'dontAsk';
+const SUPPORTED_UNATTENDED_DIALOG_KINDS = [
+    'refusal_fallback_prompt',
+];
+function failureDiagnostic(facts) {
+    const fields = [
+        'product: Claude Code',
+        `stage: ${facts.stage}`,
+        `category: ${facts.category}`,
+    ];
+    const exitCode = facts.outcome?.exitCode;
+    if (exitCode !== null && exitCode !== undefined) {
+        fields.push(`exit code: ${exitCode}`);
+    }
+    const signal = facts.outcome?.signal;
+    if (signal !== null && signal !== undefined) {
+        fields.push(`signal: ${signal}`);
+    }
+    return `Product subagent failure (${fields.join('; ')})`;
+}
+class ClaudeCodeFailure extends Error {
+    facts;
+    constructor(facts, cause) {
+        super(`subagent-claude-code: ${failureDiagnostic(facts)}`, cause === undefined ? undefined : { cause });
+        this.facts = facts;
+        this.name = 'ClaudeCodeFailure';
+    }
+}
+function sdkFailureCategory(subtype) {
+    switch (subtype) {
+        case 'error_during_execution':
+        case 'error_max_turns':
+        case 'error_max_budget_usd':
+        case 'error_max_structured_output_retries':
+            return subtype;
+        default:
+            return 'unknown';
+    }
+}
+/**
+ * Hide an unpublished product startup failure behind fixed safe facts.
+ * @param cause - original host-side failure retained only on the Error cause chain.
+ * @returns a rejection safe to expose through the subagent start boundary.
+ */
+export function claudeCodeStartupFailure(cause) {
+    return new ClaudeCodeFailure({
+        stage: 'query-start',
+        category: 'unknown',
+    }, cause);
+}
+function unattendedDiagnostic(mode, request, decision, reason) {
+    return `Claude Code unattended decision (mode: ${mode}; request: ${request}; decision: ${decision}): ${reason}`;
+}
 function thrown(value) {
     /* v8 ignore next -- typed SDK and subprocess failures reject with Error. */
     return value instanceof Error ? value : new Error(String(value));
 }
+/** Read live request cancellation across awaited startup cleanup. */
+function isAborted(signal) {
+    return signal.aborted;
+}
 /* jscpd:ignore-end */
 /**
  * Validate and preserve the one-shot task before crossing the SDK boundary.
@@ -45,13 +111,20 @@ export function textTask(prompt) {
  * @returns exact final text for a successful, non-error result.
  */
 export function successfulResult(message) {
-    if (message.subtype !== 'success'
-        || message.is_error
-        || message.result.trim().length === 0) {
-        const detail = message.subtype === 'success'
-            ? 'success result was marked as an error or contained no answer'
-            : message.errors.join('; ') || message.subtype;
-        throw new Error(`subagent-claude-code: Claude Code failed: ${detail}`);
+    if (message.subtype !== 'success') {
+        const category = sdkFailureCategory(message.subtype);
+        const detail = category === 'unknown'
+            ? undefined
+            : message.errors.join('; ');
+        throw new ClaudeCodeFailure({ stage: 'query-run', category }, detail === undefined || detail.length === 0
+            ? undefined
+            : new Error(detail));
+    }
+    if (message.is_error || message.result.trim().length === 0) {
+        throw new ClaudeCodeFailure({
+            stage: 'query-run',
+            category: 'invalid-success',
+        });
     }
     return message.result;
 }
@@ -59,17 +132,27 @@ export function successfulResult(message) {
  * Consume the complete SDK stream and require one strict success plus normal
  * iterator completion.
  * @param query - published official SDK query.
+ * @param onPermissionDenied - records a safe fact when the SDK reports native denial.
+ * @param onResult - records that the SDK supplied a terminal result message.
  * @returns the completed shared result.
  */
-export async function consumeClaudeQuery(query) {
+export async function consumeClaudeQuery(query, onPermissionDenied, onResult) {
     let answer;
     for await (const message of query) {
+        if (message.type === 'system' && message.subtype === 'permission_denied') {
+            onPermissionDenied?.();
+            continue;
+        }
         if (message.type !== 'result')
             continue;
+        onResult?.();
         answer = successfulResult(message);
     }
     if (answer === undefined) {
-        throw new Error('subagent-claude-code: Claude Code ended without a result');
+        throw new ClaudeCodeFailure({
+            stage: 'query-run',
+            category: 'missing-result',
+        });
     }
     return {
         output: [{ type: 'text', text: answer }],
@@ -80,7 +163,8 @@ export async function consumeClaudeQuery(query) {
  * Close the official query, terminate the managed process tree, and wait for
  * the subprocess owner to prove it is gone.
  * @param query - official SDK query, when creation reached that point.
- * @param child - shared-service handle that owns the CLI process tree.
+ * @param child - live shared-service handle that owns the CLI process tree;
+ * spawn-failed handles settle at the startup boundary instead.
  */
 export async function disposeClaudeCodeChild(query, child) {
     const failures = [];
@@ -90,47 +174,70 @@ export async function disposeClaudeCodeChild(query, child) {
     catch (error) {
         failures.push(thrown(error));
     }
-    if (child.pid > 0) {
-        child.terminate();
-        try {
-            await child.waitForExit();
-        }
-        catch (error) {
-            failures.push(thrown(error));
-        }
-    }
+    child.terminate();
     try {
-        await child.done;
+        await child.waitForExit();
     }
     catch (error) {
         failures.push(thrown(error));
     }
+    const outcome = await child.done;
     const firstFailure = failures[0];
-    if (failures.length === 1 && firstFailure !== undefined)
-        throw firstFailure;
-    if (failures.length > 1) {
-        throw new AggregateError(failures, 'subagent-claude-code: query and process cleanup failed');
+    if (firstFailure !== undefined) {
+        const facts = {
+            stage: 'teardown',
+            category: 'unknown',
+            outcome,
+        };
+        const cause = failures.length === 1
+            ? firstFailure
+            : new AggregateError(failures, 'Claude Code teardown failures');
+        throw new ClaudeCodeFailure(facts, cause);
     }
 }
 /**
  * Build the fixed official SDK options for one one-shot provider run.
  * @param spec - Workspace, environment, process service, and disposal policy.
  * @param controller - per-run cancellation owner.
- * @param capture - receives the real managed child synchronously from the SDK hook.
+ * @param capture - receives the shared child and SDK-facing process synchronously.
+ * @param captureDiagnostic - receives safe facts from unattended interaction callbacks.
  * @returns options that inherit native settings while disabling persistence and user questions.
  */
-export function claudeQueryOptions(spec, controller, capture) {
+export function claudeQueryOptions(spec, controller, capture, captureDiagnostic) {
     return {
         abortController: controller,
         cwd: spec.cwd,
-        pathToClaudeCodeExecutable: spec.executable,
         env: { ...scrubbedParentEnv(), ...spec.env },
         persistSession: false,
-        disallowedTools: ['AskUserQuestion'],
+        disallowedTools: spec.permissionMode === 'plan'
+            ? ['AskUserQuestion', 'ExitPlanMode']
+            : ['AskUserQuestion'],
+        permissionMode: spec.permissionMode,
+        ...spec.permissionMode === 'bypassPermissions'
+            ? { allowDangerouslySkipPermissions: true }
+            : {
+                canUseTool: () => {
+                    captureDiagnostic(unattendedDiagnostic(spec.permissionMode, 'tool permission', 'denied', 'the provider does not request human approval'));
+                    return Promise.resolve({
+                        behavior: 'deny',
+                        message: 'This unattended Claude Code subagent cannot request human approval.',
+                    });
+                },
+            },
+        onElicitation: () => {
+            captureDiagnostic(unattendedDiagnostic(spec.permissionMode, 'MCP elicitation', 'declined', 'the provider does not collect interactive MCP input'));
+            return Promise.resolve({ action: 'decline' });
+        },
+        onUserDialog: () => {
+            captureDiagnostic(unattendedDiagnostic(spec.permissionMode, 'user dialog', 'cancelled', 'the provider does not render blocking dialogs'));
+            return Promise.resolve({ behavior: 'cancelled' });
+        },
+        supportedDialogKinds: SUPPORTED_UNATTENDED_DIALOG_KINDS,
         spawnClaudeCodeProcess: (options) => {
             const child = spec.spawn(claudeSpawnSpec(options, spec.disposeGraceMs));
-            capture(child);
-            return new ManagedClaudeCodeProcess(child);
+            const process = new ManagedClaudeCodeProcess(child);
+            capture(child, process);
+            return process;
         },
     };
 }
@@ -153,14 +260,35 @@ export async function startClaudeCodeRun(request, spec) {
     };
     const onAbort = () => { requestCancel(); };
     request.signal.addEventListener('abort', onAbort, { once: true });
+    const reportFailure = (error) => {
+        try {
+            spec.onError?.(error, 'error');
+        }
+        catch {
+            // Host diagnostic logging cannot replace the product failure.
+        }
+    };
     let child;
     let query;
+    let managedProcess;
+    let diagnostic;
+    const capturePermissionDiagnostic = (value) => {
+        diagnostic = value;
+    };
+    const prependFailureDiagnostic = (facts) => {
+        const failure = failureDiagnostic(facts);
+        diagnostic = diagnostic === undefined
+            ? failure
+            : `${failure}\n${diagnostic}`;
+    };
+    const captureChild = (captured, process) => {
+        child = captured;
+        managedProcess = process;
+    };
     try {
         query = officialQuery({
             prompt,
-            options: claudeQueryOptions(spec, controller, (captured) => {
-                child = captured;
-            }),
+            options: claudeQueryOptions(spec, controller, captureChild, capturePermissionDiagnostic),
         });
         if (child === undefined || child.pid <= 0) {
             throw new Error('subagent-claude-code: official SDK did not publish a controllable Claude Code process');
@@ -172,13 +300,58 @@ export async function startClaudeCodeRun(request, spec) {
     catch (error) {
         request.signal.removeEventListener('abort', onAbort);
         const cancelledBeforeCleanup = controller.signal.aborted;
+        // Let child.done publish a concurrently observed exit before classification.
+        await Promise.resolve();
+        const startupOutcome = managedProcess?.outcome;
+        const startupFacts = {
+            stage: 'query-start',
+            category: 'unknown',
+            outcome: startupOutcome,
+        };
+        const startupFailure = (cause = error) => new ClaudeCodeFailure(startupFacts, thrown(cause));
         requestCancel();
+        if (child !== undefined && child.pid <= 0) {
+            let closeError;
+            try {
+                query?.close();
+            }
+            catch (disposeError) {
+                closeError = thrown(disposeError);
+            }
+            let spawnError = thrown(error);
+            try {
+                await child.done;
+            }
+            catch (childError) {
+                spawnError = thrown(childError);
+            }
+            if (closeError !== undefined) {
+                const failure = startupFailure(spawnError);
+                const cleanupFailure = new ClaudeCodeFailure({
+                    stage: 'teardown',
+                    category: 'unknown',
+                }, closeError);
+                const aggregate = new AggregateError([failure, cleanupFailure], `${failure.message}; ${cleanupFailure.message}`);
+                reportFailure(aggregate);
+                throw aggregate;
+            }
+            if (cancelledBeforeCleanup || isAborted(request.signal)) {
+                throw new Error('subagent-claude-code: request was aborted before SDK startup');
+            }
+            const failure = startupFailure(spawnError);
+            reportFailure(failure);
+            throw failure;
+        }
         if (child !== undefined) {
             try {
                 await disposeClaudeCodeChild(query, child);
             }
             catch (disposeError) {
-                throw new AggregateError([thrown(error), thrown(disposeError)], 'subagent-claude-code: startup failed and CLI cleanup also failed');
+                const failure = startupFailure();
+                const cleanupFailure = thrown(disposeError);
+                const aggregate = new AggregateError([failure, cleanupFailure], `${failure.message}; ${cleanupFailure.message}`);
+                reportFailure(aggregate);
+                throw aggregate;
             }
         }
         else if (query !== undefined) {
@@ -186,20 +359,64 @@ export async function startClaudeCodeRun(request, spec) {
                 query.close();
             }
             catch (disposeError) {
-                throw new AggregateError([thrown(error), thrown(disposeError)], 'subagent-claude-code: startup failed and query cleanup also failed');
+                const failure = startupFailure();
+                const cleanupFailure = new ClaudeCodeFailure({
+                    stage: 'teardown',
+                    category: 'unknown',
+                }, thrown(disposeError));
+                const aggregate = new AggregateError([failure, cleanupFailure], `${failure.message}; ${cleanupFailure.message}`);
+                reportFailure(aggregate);
+                throw aggregate;
             }
         }
-        // oxlint-disable-next-line typescript/no-unnecessary-condition -- the request can abort while process cleanup is awaited.
-        if (cancelledBeforeCleanup || request.signal.aborted) {
+        if (cancelledBeforeCleanup || isAborted(request.signal)) {
             throw new Error('subagent-claude-code: request was aborted before SDK startup');
         }
-        throw thrown(error);
+        const failure = startupFailure();
+        reportFailure(failure);
+        throw failure;
     }
     const publishedQuery = query;
     const publishedChild = child;
+    let receivedResult = false;
     const result = settleRunResult({
-        attempt: () => consumeClaudeQuery(publishedQuery),
+        attempt: async () => {
+            try {
+                return await consumeClaudeQuery(publishedQuery, () => {
+                    capturePermissionDiagnostic(unattendedDiagnostic(spec.permissionMode, 'tool permission', 'denied', 'Claude Code denied the request before an interactive prompt'));
+                }, () => {
+                    receivedResult = true;
+                });
+            }
+            catch (error) {
+                const processOutcome = managedProcess?.outcome;
+                let facts;
+                if (error instanceof ClaudeCodeFailure) {
+                    facts = { ...error.facts, outcome: processOutcome };
+                }
+                else if (processOutcome !== undefined && !receivedResult) {
+                    facts = {
+                        stage: 'process',
+                        category: 'process-exit',
+                        outcome: processOutcome,
+                    };
+                }
+                else {
+                    facts = {
+                        stage: 'query-run',
+                        category: 'unknown',
+                        outcome: processOutcome,
+                    };
+                }
+                prependFailureDiagnostic(facts);
+                // Keep the SDK category and cause; the diagnostic adds later process facts.
+                throw error instanceof ClaudeCodeFailure
+                    ? error
+                    : new ClaudeCodeFailure(facts, thrown(error));
+            }
+        },
         collectOutput: () => [],
+        collectDiagnostic: () => diagnostic,
         cancelled: () => controller.signal.aborted,
         onError: spec.onError,
         signal: request.signal,
@@ -211,7 +428,16 @@ export async function startClaudeCodeRun(request, spec) {
         signal: request.signal,
         onAbort,
         requestCancel,
-        teardown: () => disposeClaudeCodeChild(publishedQuery, publishedChild),
+        teardown: async () => {
+            try {
+                await disposeClaudeCodeChild(publishedQuery, publishedChild);
+            }
+            catch (error) {
+                const failure = thrown(error);
+                reportFailure(failure);
+                throw failure;
+            }
+        },
     });
 }
 //# sourceMappingURL=run.js.map

package/dist/kernel/subagent-claude-code/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-subagent-claude-code",
   "description": "One-shot Claude Code subagent provider over the official Agent SDK",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },
@@ -28,9 +28,15 @@
   "files": [
     "lib/index.js",
     "lib/invariant.js",
+    "cordis.patch.yml",
     "lib/types/**/*.d.ts"
   ],
   "license": "MIT",
+  "nomix": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
   "peerDependencies": {
     "@nomix-ai/nomix-invariants": "workspace:^",
     "@nomix-ai/nomix-llm": "workspace:^",
@@ -43,7 +49,9 @@
   "dependencies": {
     "@anthropic-ai/sdk": "0.93.0",
     "@anthropic-ai/claude-agent-sdk": "0.3.220",
-    "@nomix-ai/schemastery": "workspace:^"
+    "@nomix-ai/schemastery": "workspace:^",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@nomix-ai/nomix-agent": "workspace:^",

package/dist/kernel/subagent-codex/cordis.patch.yml

@@ -0,0 +1,5 @@
+# Optional Profile Bundle: register the Codex provider on the Host plane only.
+# Agent Presets grant the model-facing tool independently.
+- insert:
+    - id: subagent-codex
+      name: '@nomix-ai/nomix-subagent-codex'