@the-open-engine/zeroshot 6.39.1 → 6.40.0

package/scripts/omp/runtime-identities.js

@@ -10,6 +10,7 @@ const BUN_PACKAGE_NAME = 'bun';
 const BUN_RUNTIME_VERSION = '1.3.14';
 const SIDECAR_RELATIVE_PATH = path.join('scripts', 'omp', 'sidecar.ts');
 const HOST_SUPERVISOR_RELATIVE_PATH = path.join('scripts', 'omp', 'host-supervisor.ts');
+const ACTIVE_CONTAINER_INVOCATION = Symbol('active-container-invocation');
 const HOST_SDK_PLATFORM_KEYS = Object.freeze(['linux:arm64', 'linux:x64']);
 
 const BUN_PLATFORM_PACKAGES = Object.freeze({
@@ -227,24 +228,26 @@ function resolveOmpSdkRuntime(options = {}) {
   if (!fileExists(hostSupervisorPath)) {
     throw new Error(`OMP SDK host supervisor is missing: ${hostSupervisorPath}`);
   }
-  let containmentProbe;
-  try {
-    containmentProbe = JSON.parse(
-      String(readContainmentProbe(bunExecutable, hostSupervisorPath)).trim()
-    );
-  } catch (error) {
-    throw new Error(`Unable to attest Linux subreaper/pidfd containment: ${error.message}`);
-  }
-  if (
-    containmentProbe?.protocolVersion !== 1 ||
-    containmentProbe?.type !== 'cleanup-attestation' ||
-    containmentProbe?.status !== 'clean' ||
-    containmentProbe?.mode !== 'linux-subreaper-pidfd' ||
-    containmentProbe?.subreaper !== true ||
-    containmentProbe?.pidfd !== true ||
-    containmentProbe?.ownedProcessCount !== 0
-  ) {
-    throw new Error('Linux subreaper/pidfd containment probe returned invalid evidence');
+  if (runtimeOptions.activeInvocation !== ACTIVE_CONTAINER_INVOCATION) {
+    let containmentProbe;
+    try {
+      containmentProbe = JSON.parse(
+        String(readContainmentProbe(bunExecutable, hostSupervisorPath)).trim()
+      );
+    } catch (error) {
+      throw new Error(`Unable to attest Linux subreaper/pidfd containment: ${error.message}`);
+    }
+    if (
+      containmentProbe?.protocolVersion !== 1 ||
+      containmentProbe?.type !== 'cleanup-attestation' ||
+      containmentProbe?.status !== 'clean' ||
+      containmentProbe?.mode !== 'linux-subreaper-pidfd' ||
+      containmentProbe?.subreaper !== true ||
+      containmentProbe?.pidfd !== true ||
+      containmentProbe?.ownedProcessCount !== 0
+    ) {
+      throw new Error('Linux subreaper/pidfd containment probe returned invalid evidence');
+    }
   }
   return Object.freeze({
     bunExecutable,
@@ -261,6 +264,15 @@ function resolveOmpSdkRuntime(options = {}) {
     sidecarPath,
   });
 }
+
+function resolveOmpSdkContainerRuntime(options = {}) {
+  // Image inspection may run as PID 1, where no parent process exists to supervise. The actual
+  // provider invocation still starts the supervisor and requires its final cleanup attestation.
+  return resolveOmpSdkRuntime({
+    ...options,
+    activeInvocation: ACTIVE_CONTAINER_INVOCATION,
+  });
+}
 module.exports = {
   BUN_PACKAGE_INTEGRITY,
   BUN_PACKAGE_NAME,
@@ -279,5 +291,6 @@ module.exports = {
   REQUIRED_OMP_SDK_SOURCES,
   SIDECAR_RELATIVE_PATH,
   assertPackageIdentity,
+  resolveOmpSdkContainerRuntime,
   resolveOmpSdkRuntime,
 };

package/scripts/omp/runtime.js

@@ -12,6 +12,7 @@ const {
   REQUIRED_OMP_SDK_SOURCES,
   SIDECAR_RELATIVE_PATH,
   assertPackageIdentity,
+  resolveOmpSdkContainerRuntime,
   resolveOmpSdkRuntime,
 } = require('./runtime-identities');
 const { validateOmpSdkReleaseAssets } = require('./runtime-release');
@@ -28,6 +29,7 @@ module.exports = {
   REQUIRED_OMP_SDK_SOURCES,
   SIDECAR_RELATIVE_PATH,
   assertPackageIdentity,
+  resolveOmpSdkContainerRuntime,
   resolveOmpSdkRuntime,
   validateOmpSdkReleaseAssets,
 };

package/src/agent/agent-lifecycle.js

@@ -221,6 +221,7 @@ function start(agent) {
  */
 async function stop(agent) {
   stopLivenessCheck(agent);
+  agent._cancelStartDelay?.();
 
   const hasNestedExecutions = agent.nestedExecutions?.hasActive === true;
   if (!agent.running && !agent.currentTask && !hasNestedExecutions && !agent._currentExecution) {
@@ -440,7 +441,21 @@ async function applyValidatorJitter(agent) {
       `[Agent ${agent.id}] Adding ${Math.round(jitterMs / 1000)}s jitter to prevent lock contention`
     );
   }
-  await new Promise((resolve) => setTimeout(resolve, jitterMs));
+  await new Promise((resolve) => {
+    let settled = false;
+    let timer;
+    let cancel;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (agent._cancelStartDelay === cancel) agent._cancelStartDelay = null;
+      resolve();
+    };
+    cancel = finish;
+    timer = setTimeout(finish, jitterMs);
+    agent._cancelStartDelay = cancel;
+  });
 }
 
 function publishTaskStarted(agent, triggeringMessage) {
@@ -641,6 +656,7 @@ async function runTaskAttempt(agent, triggeringMessage) {
   // Spawn provider task
   agent.state = 'executing_task';
   await applyValidatorJitter(agent);
+  if (!agent.running) return;
   publishTaskStarted(agent, triggeringMessage);
 
   let result;

package/src/agent/agent-task-executor.js

@@ -18,6 +18,7 @@ const { StringDecoder } = require('string_decoder');
 const { getNestedExecutionRegistry, TaskExecutionHandle } = require('./task-execution-handle');
 const os = require('os');
 const { parseProviderChunk, getProvider } = require('../providers');
+const { decodeTaskLogLine } = require('../task-log-line');
 const { getTask, getTaskBySpawnOwnershipToken } = require('../../task-lib/store.js');
 const { OMP_SESSIONLESS_ENV } = require('../../task-lib/omp-storage-root.js');
 const { loadSettings } = require('../../lib/settings.js');
@@ -1268,9 +1269,10 @@ async function waitForTaskReady(agent, taskId, maxRetries = 10, delayMs = 200) {
 
 const MAX_STATUS_FAILURES = 30;
 
-function createLogFollowState() {
+function createLogFollowState(taskId = null) {
   const state = {
     controlPlaneOutput: createControlPlaneOutputState(),
+    taskId,
     logFilePath: null,
     lastSize: 0,
     pollInterval: null,
@@ -1471,28 +1473,26 @@ function lookupLogFilePath(ctPath, taskId) {
 }
 
 function parseTimestampedLine(line) {
-  let timestamp = Date.now();
-  let content = line.replace(/\r$/, '');
-  let timestamped = false;
-
-  const timestampMatch = content.match(/^\[(\d{13})\](.*)$/);
-  if (timestampMatch) {
-    timestamp = parseInt(timestampMatch[1], 10);
-    content = timestampMatch[2];
-    timestamped = true;
-  }
-
-  return { timestamp, content, timestamped };
+  const decoded = decodeTaskLogLine(line);
+  return {
+    timestamp: decoded.timestamp ?? Date.now(),
+    content: decoded.content,
+    timestamped: decoded.timestamped,
+    providerOutput: decoded.providerOutput,
+    providerStdoutFramed: decoded.channel === 'provider_stdout',
+  };
 }
 
-function shouldSkipLogLine(content, providerName, timestamped) {
+function shouldSkipLogLine(
+  content,
+  providerName,
+  timestamped,
+  providerOutput,
+  providerStdoutFramed = false
+) {
+  if (!providerOutput) return true;
+  if (providerStdoutFramed) return false;
   if (providerName === 'pi') {
-    if (
-      content.startsWith('[ZEROSHOT][PROVIDER_STDERR] ') ||
-      content.startsWith('[ZEROSHOT][FATAL] ')
-    ) {
-      return true;
-    }
     if (timestamped) return false;
     return (
       /^={50}$/.test(content) ||
@@ -1504,7 +1504,6 @@ function shouldSkipLogLine(content, providerName, timestamped) {
     content.startsWith('===') ||
     content.startsWith('Finished:') ||
     content.startsWith('Exit code:') ||
-    content.startsWith('[ZEROSHOT][PROVIDER_STDERR] ') ||
     (content.includes('"type":"system"') && content.includes('"subtype":"init"'))
   );
 }
@@ -1522,7 +1521,7 @@ function isValidJsonLine(content) {
   }
 }
 
-function publishAgentOutputRecord(agent, providerName, record) {
+function publishAgentOutputRecord(agent, providerName, taskId, record) {
   agent._publish({
     topic: 'AGENT_OUTPUT',
     receiver: 'broadcast',
@@ -1536,6 +1535,7 @@ function publishAgentOutputRecord(agent, providerName, record) {
         role: agent.role,
         iteration: agent.iteration,
         provider: providerName,
+        ...(taskId ? { taskId } : {}),
       },
     },
   });
@@ -1545,8 +1545,9 @@ function broadcastAgentLine({ agent, providerName, state, line }) {
   const followerState = ensureControlPlaneOutputState(state);
   if (!line.trim()) return;
 
-  const { timestamp, content, timestamped } = parseTimestampedLine(line);
-  if (shouldSkipLogLine(content, providerName, timestamped)) {
+  const { timestamp, content, timestamped, providerOutput, providerStdoutFramed } =
+    parseTimestampedLine(line);
+  if (shouldSkipLogLine(content, providerName, timestamped, providerOutput, providerStdoutFramed)) {
     return;
   }
   const controlPlaneContent = redactTerminalFailureForControlPlane(
@@ -1567,14 +1568,14 @@ function broadcastAgentLine({ agent, providerName, state, line }) {
   }
 
   publishLiveControlPlaneRecord(followerState.controlPlaneOutput, record, (item) =>
-    publishAgentOutputRecord(agent, providerName, item)
+    publishAgentOutputRecord(agent, providerName, followerState.taskId, item)
   );
 }
 
 function flushAgentOutput(agent, providerName, state) {
   const followerState = ensureControlPlaneOutputState(state);
   flushTerminalControlPlaneOutput(followerState.controlPlaneOutput, (record) =>
-    publishAgentOutputRecord(agent, providerName, record)
+    publishAgentOutputRecord(agent, providerName, followerState.taskId, record)
   );
 }
 
@@ -2117,7 +2118,7 @@ function createLogFollower({
   executionHandle = null,
 }) {
   return new Promise((resolve, reject) => {
-    const state = createLogFollowState();
+    const state = createLogFollowState(taskId);
     state.skipStructuredResultCheck = skipStructuredResultCheck;
     state.nested = nested;
     state.logFilePath = lookupLogFilePath(ctPath, taskId);
@@ -3022,17 +3023,6 @@ function buildIsolatedLifecycleHandle({
   };
 }
 
-function parseIsolatedLogLine(line) {
-  const timestampMatch = line.match(/^\[(\d{13}|\d{4}-\d{2}-\d{2}T[^\]]+)\]\s*(.*)$/);
-  const timestamp = timestampMatch
-    ? /^\d{13}$/.test(timestampMatch[1])
-      ? Number.parseInt(timestampMatch[1], 10)
-      : new Date(timestampMatch[1]).getTime()
-    : Date.now();
-  const content = timestampMatch ? timestampMatch[2] : line;
-  return { timestamp, content, timestamped: timestampMatch !== null };
-}
-
 function publishIsolatedOutputRecord(agent, providerName, taskId, record) {
   agent.messageBus.publish({
     cluster_id: agent.cluster.id,
@@ -3052,8 +3042,14 @@ function publishIsolatedOutputRecord(agent, providerName, taskId, record) {
 }
 
 function retainIsolatedLine(state, providerName, line) {
-  const { timestamp, content, timestamped } = parseIsolatedLogLine(line);
-  if (!content.trim() || shouldSkipLogLine(content, providerName, timestamped)) return null;
+  const { timestamp, content, timestamped, providerOutput, providerStdoutFramed } =
+    parseTimestampedLine(line);
+  if (
+    !content.trim() ||
+    shouldSkipLogLine(content, providerName, timestamped, providerOutput, providerStdoutFramed)
+  ) {
+    return null;
+  }
   const controlPlaneContent = redactTerminalFailureForControlPlane(state, providerName, content);
   return appendControlPlaneRecord(state.controlPlaneOutput, {
     content: controlPlaneContent,

package/src/agent/output-extraction-failures.js

@@ -5,6 +5,20 @@ const piExtraction = require("./output-extraction-pi");
 const { MAX_CLI_ERROR_BYTES, cliErrorDetail } = errorDetail;
 const { isObjectRecord, parseJsonRecordLine } = jsonExtraction;
 const { extractSettledPiFailure } = piExtraction;
+const OMP_SDK_ERROR_CODES = new Map([
+    ['invalid-request', 'request'],
+    ['model-resolution', 'model'],
+    ['model-fallback', 'model'],
+    ['provider-auth', 'auth'],
+    ['provider-rate-limit', 'rate-limit'],
+    ['provider-timeout', 'timeout'],
+    ['provider-error', 'provider'],
+    ['schema-violation', 'schema'],
+    ['cancelled', 'cancelled'],
+    ['sdk-error', 'sdk'],
+    ['cleanup-error', 'cleanup'],
+    ['internal-error', 'internal'],
+]);
 function firstTruthyValue(...values) {
     for (const value of values) {
         if (value)
@@ -54,6 +68,63 @@ function opencodeFailureFromObject(value) {
     const source = firstTruthyValue(recordField(recordField(error, 'data'), 'message'), recordField(error, 'message'), recordField(error, 'name'));
     return { ...cliErrorDetail(source, 'Session error'), provider: 'opencode' };
 }
+function hasExactKeys(value, expected) {
+    return (Object.keys(value).length === expected.length &&
+        expected.every((key) => Object.prototype.hasOwnProperty.call(value, key)));
+}
+function isOmpSdkIdentity(value, nameField, expectedName, expectedVersion) {
+    return (isObjectRecord(value) &&
+        value[nameField] === expectedName &&
+        value.version === expectedVersion &&
+        hasExactKeys(value, [nameField, 'version']));
+}
+function ompSdkErrorMetadata(value) {
+    if (!isObjectRecord(value))
+        return null;
+    const { category, code, redacted, retryable } = value;
+    if (typeof code !== 'string' ||
+        typeof category !== 'string' ||
+        OMP_SDK_ERROR_CODES.get(code) !== category ||
+        typeof retryable !== 'boolean' ||
+        redacted !== true ||
+        !hasExactKeys(value, ['category', 'code', 'redacted', 'retryable'])) {
+        return null;
+    }
+    return { category, code, retryable };
+}
+function ompProviderCategory(error) {
+    if (error.category === 'auth')
+        return 'authentication';
+    return error.retryable ? 'transient' : 'permanent';
+}
+function isOmpSdkRunId(value) {
+    return (typeof value === 'string' &&
+        value.length <= 128 &&
+        /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(value));
+}
+function isOmpSdkErrorEnvelope(value) {
+    return (value.protocolVersion === 1 &&
+        value.type === 'error' &&
+        isOmpSdkRunId(value.runId) &&
+        hasExactKeys(value, ['backend', 'error', 'protocolVersion', 'runId', 'runtime', 'type']) &&
+        isOmpSdkIdentity(value.backend, 'id', 'omp-sdk', '17.2.1') &&
+        isOmpSdkIdentity(value.runtime, 'name', 'bun', '1.3.14'));
+}
+function ompSdkFailureFromObject(value) {
+    const error = ompSdkErrorMetadata(value.error);
+    if (error === null || !isOmpSdkErrorEnvelope(value))
+        return null;
+    const detail = `OMP SDK ${error.code} (${error.category})`;
+    return {
+        ...cliErrorDetail(detail, 'OMP SDK turn failed'),
+        provider: 'omp',
+        providerCategory: ompProviderCategory(error),
+        providerClassification: {
+            retryable: error.retryable,
+            kind: error.retryable ? 'unknown-retryable' : 'permanent-pattern',
+        },
+    };
+}
 function failureFromProviderObject(value, providerName) {
     if (!isObjectRecord(value))
         return null;
@@ -65,6 +136,8 @@ function failureFromProviderObject(value, providerName) {
         return geminiFailureFromObject(value);
     if (providerName === 'opencode')
         return opencodeFailureFromObject(value);
+    if (providerName === 'omp')
+        return ompSdkFailureFromObject(value);
     return null;
 }
 function vertexModelFromResult(parsed, useVertex) {

package/src/agent/output-extraction-failures.ts

@@ -12,6 +12,21 @@ const { MAX_CLI_ERROR_BYTES, cliErrorDetail } = errorDetail;
 const { isObjectRecord, parseJsonRecordLine } = jsonExtraction;
 const { extractSettledPiFailure } = piExtraction;
 
+const OMP_SDK_ERROR_CODES = new Map([
+  ['invalid-request', 'request'],
+  ['model-resolution', 'model'],
+  ['model-fallback', 'model'],
+  ['provider-auth', 'auth'],
+  ['provider-rate-limit', 'rate-limit'],
+  ['provider-timeout', 'timeout'],
+  ['provider-error', 'provider'],
+  ['schema-violation', 'schema'],
+  ['cancelled', 'cancelled'],
+  ['sdk-error', 'sdk'],
+  ['cleanup-error', 'cleanup'],
+  ['internal-error', 'internal'],
+]);
+
 function firstTruthyValue(...values: readonly unknown[]): unknown {
   for (const value of values) {
     if (value) return value;
@@ -71,12 +86,97 @@ function opencodeFailureFromObject(value: JsonRecord): CliFailure | null {
   return { ...cliErrorDetail(source, 'Session error'), provider: 'opencode' };
 }
 
+function hasExactKeys(value: JsonRecord, expected: readonly string[]): boolean {
+  return (
+    Object.keys(value).length === expected.length &&
+    expected.every((key) => Object.prototype.hasOwnProperty.call(value, key))
+  );
+}
+
+function isOmpSdkIdentity(
+  value: unknown,
+  nameField: 'id' | 'name',
+  expectedName: string,
+  expectedVersion: string
+): boolean {
+  return (
+    isObjectRecord(value) &&
+    value[nameField] === expectedName &&
+    value.version === expectedVersion &&
+    hasExactKeys(value, [nameField, 'version'])
+  );
+}
+
+interface OmpSdkErrorMetadata {
+  readonly category: string;
+  readonly code: string;
+  readonly retryable: boolean;
+}
+
+function ompSdkErrorMetadata(value: unknown): OmpSdkErrorMetadata | null {
+  if (!isObjectRecord(value)) return null;
+  const { category, code, redacted, retryable } = value;
+  if (
+    typeof code !== 'string' ||
+    typeof category !== 'string' ||
+    OMP_SDK_ERROR_CODES.get(code) !== category ||
+    typeof retryable !== 'boolean' ||
+    redacted !== true ||
+    !hasExactKeys(value, ['category', 'code', 'redacted', 'retryable'])
+  ) {
+    return null;
+  }
+  return { category, code, retryable };
+}
+
+function ompProviderCategory(
+  error: OmpSdkErrorMetadata
+): NonNullable<CliFailure['providerCategory']> {
+  if (error.category === 'auth') return 'authentication';
+  return error.retryable ? 'transient' : 'permanent';
+}
+
+function isOmpSdkRunId(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    value.length <= 128 &&
+    /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(value)
+  );
+}
+
+function isOmpSdkErrorEnvelope(value: JsonRecord): boolean {
+  return (
+    value.protocolVersion === 1 &&
+    value.type === 'error' &&
+    isOmpSdkRunId(value.runId) &&
+    hasExactKeys(value, ['backend', 'error', 'protocolVersion', 'runId', 'runtime', 'type']) &&
+    isOmpSdkIdentity(value.backend, 'id', 'omp-sdk', '17.2.1') &&
+    isOmpSdkIdentity(value.runtime, 'name', 'bun', '1.3.14')
+  );
+}
+
+function ompSdkFailureFromObject(value: JsonRecord): CliFailure | null {
+  const error = ompSdkErrorMetadata(value.error);
+  if (error === null || !isOmpSdkErrorEnvelope(value)) return null;
+  const detail = `OMP SDK ${error.code} (${error.category})`;
+  return {
+    ...cliErrorDetail(detail, 'OMP SDK turn failed'),
+    provider: 'omp',
+    providerCategory: ompProviderCategory(error),
+    providerClassification: {
+      retryable: error.retryable,
+      kind: error.retryable ? 'unknown-retryable' : 'permanent-pattern',
+    },
+  };
+}
+
 function failureFromProviderObject(value: unknown, providerName: string): CliFailure | null {
   if (!isObjectRecord(value)) return null;
   if (providerName === 'claude') return claudeFailureFromObject(value);
   if (providerName === 'codex') return codexFailureFromObject(value);
   if (providerName === 'gemini') return geminiFailureFromObject(value);
   if (providerName === 'opencode') return opencodeFailureFromObject(value);
+  if (providerName === 'omp') return ompSdkFailureFromObject(value);
   return null;
 }
 

package/src/agent/output-extraction-json.js

@@ -1,4 +1,5 @@
 "use strict";
+const task_log_line_1 = require("../task-log-line");
 function isObjectRecord(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
@@ -14,10 +15,6 @@ if (!isProvidersParserBoundary(rawProviders)) {
     throw new TypeError('providers module must expose parseProviderChunk');
 }
 const { parseProviderChunk } = rawProviders;
-function timestampBody(text) {
-    const match = /^\[(\d{13})\](.*)$/.exec(text);
-    return match ? (match[2] || '').trimStart() : null;
-}
 function prefixedJsonBody(text) {
     if (text.startsWith('{') || text.startsWith('['))
         return null;
@@ -33,8 +30,10 @@ function stripTimestamp(line) {
     const normalized = line.trim().replace(/\r$/, '');
     if (!normalized)
         return '';
-    const withoutTimestamp = timestampBody(normalized) ?? normalized;
-    return prefixedJsonBody(withoutTimestamp) ?? withoutTimestamp;
+    const decoded = (0, task_log_line_1.decodeTaskLogLine)(normalized);
+    if (!decoded.providerOutput)
+        return '';
+    return prefixedJsonBody(decoded.content) ?? decoded.content;
 }
 function parseJsonRecordLine(line) {
     const content = stripTimestamp(line);

package/src/agent/output-extraction-json.ts

@@ -1,4 +1,5 @@
 import type { JsonRecord, ProvidersParserBoundary } from './output-extraction-types';
+import { decodeTaskLogLine } from '../task-log-line';
 
 function isObjectRecord(value: unknown): value is JsonRecord {
   return value !== null && typeof value === 'object' && !Array.isArray(value);
@@ -20,11 +21,6 @@ if (!isProvidersParserBoundary(rawProviders)) {
 }
 const { parseProviderChunk } = rawProviders;
 
-function timestampBody(text: string): string | null {
-  const match = /^\[(\d{13})\](.*)$/.exec(text);
-  return match ? (match[2] || '').trimStart() : null;
-}
-
 function prefixedJsonBody(text: string): string | null {
   if (text.startsWith('{') || text.startsWith('[')) return null;
   const separatorIndex = text.indexOf('|');
@@ -38,8 +34,9 @@ function stripTimestamp(line: unknown): string {
   const normalized = line.trim().replace(/\r$/, '');
   if (!normalized) return '';
 
-  const withoutTimestamp = timestampBody(normalized) ?? normalized;
-  return prefixedJsonBody(withoutTimestamp) ?? withoutTimestamp;
+  const decoded = decodeTaskLogLine(normalized);
+  if (!decoded.providerOutput) return '';
+  return prefixedJsonBody(decoded.content) ?? decoded.content;
 }
 
 function parseJsonRecordLine(line: string): JsonRecord | null {

package/src/agent/output-extraction-types.ts

@@ -16,6 +16,11 @@ export interface CliErrorDetail {
 
 export interface CliFailure extends CliErrorDetail {
   provider: string;
+  providerCategory?: 'authentication' | 'permanent' | 'transient';
+  providerClassification?: {
+    retryable: boolean;
+    kind: 'permanent-pattern' | 'unknown-retryable';
+  };
 }
 
 export interface CliError {

package/src/agent/provider-terminal-failure.js

@@ -73,8 +73,8 @@ function extractProviderFailure(output, providerName) {
     const cliError = extractCliFailure(output, providerName);
     if (!cliError)
         return null;
-    const classification = classifyProviderFailure(providerName, cliError.error);
-    const category = categoryForProviderFailure(cliError.error, classification);
+    const classification = cliError.providerClassification ?? classifyProviderFailure(providerName, cliError.error);
+    const category = cliError.providerCategory ?? categoryForProviderFailure(cliError.error, classification);
     return {
         error: `Provider ${cliError.provider} failed (${category}; ${classification.kind})`,
         provider: cliError.provider,

package/src/agent/provider-terminal-failure.ts

@@ -89,8 +89,10 @@ function extractProviderFailure(output: string, providerName: string): ProviderF
   const cliError = extractCliFailure(output, providerName);
   if (!cliError) return null;
 
-  const classification = classifyProviderFailure(providerName, cliError.error);
-  const category = categoryForProviderFailure(cliError.error, classification);
+  const classification =
+    cliError.providerClassification ?? classifyProviderFailure(providerName, cliError.error);
+  const category =
+    cliError.providerCategory ?? categoryForProviderFailure(cliError.error, classification);
   return {
     error: `Provider ${cliError.provider} failed (${category}; ${classification.kind})`,
     provider: cliError.provider,

package/src/agent-cli-provider/adapters/claude.ts

@@ -315,7 +315,7 @@ export const claudeAdapter: StructuredOutputRecoveryAdapter = {
   displayName: 'Claude',
   binary: 'claude',
   adapterVersion: '1',
-  credentialEnvKeys: ['ANTHROPIC_API_KEY', 'CLAUDE_API_KEY'],
+  credentialEnvKeys: ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'CLAUDE_API_KEY'],
   modelCatalog: MODEL_CATALOG,
   levelMapping: LEVEL_MAPPING,
   defaultLevel: 'level2',