@wjarka/cezarion 0.16.0 → 0.17.0

package/dist/core/claude-cli-runner.js

@@ -6,8 +6,8 @@ import { fileURLToPath } from 'node:url';
 import { dirname, resolve as resolvePath } from 'node:path';
 import { parseAskMarker } from './ask.js';
 import { AUTO_END_DELAY_MS, DEFAULT_RUN_TIMEOUT_MS, EOF_KILL_GRACE_MS, EOF_TERM_GRACE_MS, KILL_GRACE_MS, boundOutputDrainAfterExit, } from './runner-runtime.js';
-import { isSignalTerminationExit, trackChildExit } from './agent-runner.js';
-import { signalSession, spawnSessionLeader } from './session-process.js';
+import { isSignalTerminationExit, trackChildExit, unknownToolGrant } from './agent-runner.js';
+import { signalSession, spawnSessionLeader, waitForEofExit } from './session-process.js';
 import { buildChildEnv } from './agent-env.js';
 import { cezarToolEnvNames, cezarToolNames } from '../ci-wait/tools.js';
 import { costWeightedTokens } from './usage.js';
@@ -23,8 +23,8 @@ export function resolveClaudeExecutable(override) {
  * `AgentRunner` over the Claude Code CLI in headless stream-json mode. Auth =
  * the host's logged-in Pro/Max subscription (no API key needed). Sandboxing is
  * `--allowedTools` (default-deny for anything not listed) + running inside the
- * repo `cwd`; `Bash` is narrowed to `Bash(<prefix>:*)` patterns only when
- * `bashAllowlist` is set — the zero-config default has no allowlist, so `Bash`
+ * repo `cwd`; `Bash` is narrowed to `Bash(<prefix>:*)` patterns only when the
+ * grant carries a `bashAllowlist` — the zero-config default has none, so `Bash`
  * is unrestricted shell access (#430).
  *
  * Session mechanics (multi-turn stdin, EOF watchdog, reopen window) follow
@@ -43,9 +43,8 @@ export const CLAUDE_SPEC_SUPPORT = {
     userPrompt: { honored: true, via: 'text block of the first stream-json user message on stdin' },
     images: { honored: true, via: 'image blocks ahead of the text in the first stdin message' },
     cwd: { honored: true, via: 'spawn cwd' },
-    allowedTools: { honored: true, via: '--allowedTools, through buildAllowedTools' },
-    restrictNativeDelegation: { honored: true, via: '--disallowedTools Agent,Task (D1)' },
-    bashAllowlist: { honored: true, via: 'Bash(<prefix>:*) entries in --allowedTools, one per prefix' },
+    toolGrant: { honored: true, via: '--allowedTools, through buildAllowedTools, with a bashAllowlist as Bash(<prefix>:*) entries, one per prefix; unset and an empty list send none' },
+    restrictNativeDelegation: { honored: true, via: '--disallowedTools Agent,Task,Workflow (D1); context: fork skills are not blocked' },
     additionalDirectories: { honored: true, via: '--add-dir, once per directory' },
     env: { honored: true, via: 'merged over the child env through buildChildEnv' },
     model: { honored: true, via: '--model' },
@@ -78,7 +77,7 @@ export class ClaudeCliRunner {
         this.lastSession?.interrupt();
     }
     startSession(spec, onEvent, opts = {}) {
-        const args = buildClaudeArgs(spec, process.env, { replayUserMessages: supportsReplayUserMessages(this.bin) });
+        const args = buildClaudeArgs(spec, process.env, claudeHelpFeatures(this.bin));
         let child;
         try {
             child = spawnSessionLeader(this.bin, args, {
@@ -125,6 +124,28 @@ export class ClaudeCliRunner {
         const humanUnsettled = new Set();
         let queuedTurnPending = false;
         const submissions = new InputSubmissions();
+        // Only live, observed success grants replay eligibility (hearsay-tools/cezarion#1351).
+        let reportedModel;
+        let reportedSession;
+        let successfulIdentity;
+        let attemptDidWork = false;
+        const sentLines = new Map();
+        const deferredHuman = [];
+        let refusalRetry;
+        let refusalTimer;
+        const cancelRefusalRetry = () => {
+            if (refusalTimer)
+                clearTimeout(refusalTimer);
+            refusalTimer = undefined;
+            refusalRetry = undefined;
+        };
+        child.once('exit', () => {
+            if (refusalTimer)
+                clearTimeout(refusalTimer);
+            refusalTimer = undefined;
+            // Retain the diagnosis until stdout drains: a final result can still
+            // be buffered when the process exit event arrives.
+        });
         const scheduleAutoEnd = () => {
             // Never arm the close window while an accepted turn is still running:
             // the timer the opening result would start here has nothing to cancel it,
@@ -132,7 +153,7 @@ export class ClaudeCliRunner {
             // result brings the count to 0 and arms the window as before.
             if (!opts.autoEndAfterFirstTurn || !stdinOpen || autoEndTimer || agentWritePending)
                 return;
-            if (unsettled.size > 0)
+            if (unsettled.size > 0 || refusalRetry || deferredHuman.length)
                 return;
             autoEndTimer = setTimeout(() => {
                 autoEndTimer = undefined;
@@ -143,9 +164,18 @@ export class ClaudeCliRunner {
         };
         let pendingMarkerAsk = false;
         let turnTextStart = 0;
-        const sendMessage = (content, acknowledge, inputIds = [], humanFollowUp = false) => {
+        const sendMessage = (content, acknowledge, inputIds = [], humanFollowUp = false, retryWrite = false) => {
             if (!stdinOpen)
                 return false;
+            if (refusalRetry && !retryWrite) {
+                if (!humanFollowUp)
+                    return false;
+                const id = randomUUID();
+                // Snapshot now: caller-owned arrays must not change an accepted input.
+                deferredHuman.push({ id, content: structuredClone(content) });
+                humanUnsettled.add(id);
+                return true;
+            }
             // A line written while a turn runs joins that turn instead of opening one (#505).
             const opensTurn = unsettled.size === 0;
             if (opensTurn)
@@ -154,6 +184,7 @@ export class ClaudeCliRunner {
             if (opensTurn) {
                 pendingMarkerAsk = false;
                 turnTextStart = textChunks.length;
+                attemptDidWork = false;
             }
             // A follow-up inside the reopen window cancels the scheduled close.
             if (autoEndTimer) {
@@ -170,6 +201,7 @@ export class ClaudeCliRunner {
             try {
                 child.stdin.write(`${line}\n`, acknowledge);
                 unsettled.add(uuid);
+                sentLines.set(uuid, line);
                 // Agent writes always pass an acknowledgement, even without inputIds (nudges, #544).
                 // The opening/seed prompt shares this path without an ack, but it is not a human
                 // follow-up — only session.sendMessage holds (#871 / #486).
@@ -192,8 +224,10 @@ export class ClaudeCliRunner {
         // 143 instead of dying from the signal, so without this flag our own
         // teardown reads as an agent failure (#703).
         let terminatedByCezar = false;
-        const signalChild = (signal) => {
-            terminatedByCezar = true;
+        let explicitEnd = false;
+        let automaticCleanupStarted = false;
+        const signalChild = (signal, intentional = true) => {
+            terminatedByCezar ||= intentional;
             signalSession(child, signal);
         };
         // Every watchdog below asks "is the child still alive?" — and that question
@@ -202,9 +236,14 @@ export class ClaudeCliRunner {
         // has to follow real termination or it never fires (#844).
         const hasExited = trackChildExit(child);
         const end = () => {
+            if (!hasExited()) {
+                explicitEnd = true;
+                terminatedByCezar ||= automaticCleanupStarted;
+            }
             if (!stdinOpen)
                 return;
             stdinOpen = false;
+            cancelRefusalRetry();
             try {
                 child.stdin.end();
             }
@@ -222,14 +261,17 @@ export class ClaudeCliRunner {
             }, EOF_TERM_GRACE_MS);
             eofTermTimer.unref?.();
         };
-        const interrupt = () => {
+        const interrupt = (intentional = true) => {
+            if (!hasExited())
+                terminatedByCezar ||= intentional;
             stdinOpen = false;
+            cancelRefusalRetry();
             if (hasExited() || killTimer)
                 return;
-            signalChild('SIGTERM');
+            signalChild('SIGTERM', intentional);
             killTimer = setTimeout(() => {
                 if (!hasExited())
-                    signalChild('SIGKILL');
+                    signalChild('SIGKILL', intentional);
             }, KILL_GRACE_MS);
             killTimer.unref?.();
         };
@@ -258,6 +300,16 @@ export class ClaudeCliRunner {
             }, limitMs);
             deadline.unref?.();
         }
+        // EOF retains the existing grace and escalation order. Only attribution depends on evidence.
+        const cleanupAfterEof = async () => {
+            if (!timedOut && !hasExited()) {
+                const state = await waitForEofExit(child);
+                if (state !== 'exited') {
+                    automaticCleanupStarted = true;
+                    interrupt(explicitEnd || state === 'live');
+                }
+            }
+        };
         const result = (async () => {
             let outputFailure;
             try {
@@ -292,7 +344,86 @@ export class ClaudeCliRunner {
                         continue;
                     }
                     opts.onActivity?.();
-                    const mappedMessage = normalizeIntentionalTeardownResult(msg, terminatedByCezar);
+                    if (msg.type === 'system' && msg.subtype === 'init') {
+                        reportedModel = typeof msg.model === 'string' && msg.model !== '' ? msg.model : undefined;
+                        reportedSession = typeof msg.session_id === 'string' && msg.session_id !== '' ? msg.session_id : undefined;
+                    }
+                    // Background tasks and hooks can start work without assistant content
+                    // or token usage. Only init is known to be identity-only metadata.
+                    if ((msg.type === 'system' && msg.subtype !== 'init') || msg.type === 'tool_progress')
+                        attemptDidWork = true;
+                    if (msg.type === 'assistant' || msg.type === 'user') {
+                        // A refusal's own visible text is diagnostic, not model work. Any
+                        // other output, tool call/result, reasoning or nonzero usage forbids replay.
+                        if (msg.message?.usage && !zeroClaudeUsage(msg.message.usage))
+                            attemptDidWork = true;
+                        const content = msg.message?.content;
+                        if (content !== undefined && !Array.isArray(content))
+                            attemptDidWork = true;
+                        for (const block of Array.isArray(content) ? content : []) {
+                            if (!block || typeof block !== 'object') {
+                                attemptDidWork = true;
+                                continue;
+                            }
+                            const b = block;
+                            if (b.type !== 'text' || selectedModelRefusal(b.text) !== reportedModel || !reportedModel)
+                                attemptDidWork = true;
+                        }
+                    }
+                    const identity = reportedModel && reportedSession ? JSON.stringify([reportedSession, reportedModel]) : undefined;
+                    const retryable = !terminatedByCezar && stdinOpen && !attemptDidWork
+                        && msg.type === 'result' && msg.is_error === true
+                        && identity !== undefined && identity === successfulIdentity
+                        && selectedModelRefusal(msg.result) === reportedModel
+                        && zeroClaudeUsage(msg.usage)
+                        && zeroClaudeModelUsage(msg.modelUsage)
+                        && (msg.total_cost_usd === undefined || msg.total_cost_usd === 0)
+                        && unsettled.size === 1
+                        && (msg.user_message_uuids === undefined || (Array.isArray(msg.user_message_uuids) && msg.user_message_uuids.length === 1
+                            && msg.user_message_uuids[0] === [...unsettled][0]));
+                    const uuid = [...unsettled][0];
+                    const lineToRetry = uuid ? sentLines.get(uuid) : undefined;
+                    if (retryable && uuid && lineToRetry && (!refusalRetry || refusalRetry.attempts < 2)) {
+                        // Native attempts remain balanced, but a retryable result must not
+                        // emit v1 error/turn-end: those would fail or park the workflow.
+                        emitUi(state => mapClaudeMessage(msg, state));
+                        refusalRetry ??= { uuid, line: lineToRetry, message: msg.result, attempts: 0 };
+                        const retry = refusalRetry;
+                        const delay = retry.attempts++ === 0 ? 5000 : 15000;
+                        onEvent?.({ type: 'note', message: `Claude model refusal: ${retry.message}; retrying (${retry.attempts}/2) in ${delay / 1000}s` });
+                        refusalTimer = setTimeout(() => {
+                            refusalTimer = undefined;
+                            if (!stdinOpen || hasExited() || refusalRetry !== retry)
+                                return;
+                            const input = JSON.parse(retry.line);
+                            // A fresh native UUID, the same logical input IDs, and byte-for-byte
+                            // content. Already-observed consumption is never acknowledged twice.
+                            const ids = submissions.consume(retry.uuid);
+                            const human = humanUnsettled.delete(retry.uuid);
+                            unsettled.delete(retry.uuid);
+                            sentLines.delete(retry.uuid);
+                            if (!sendMessage(input.message.content, error => {
+                                if (!error || !stdinOpen)
+                                    return;
+                                cancelRefusalRetry();
+                                onEvent?.({ type: 'error', message: retry.message });
+                                interrupt();
+                            }, ids, human, true)) {
+                                cancelRefusalRetry();
+                                onEvent?.({ type: 'error', message: retry.message });
+                                interrupt();
+                                return;
+                            }
+                            retry.uuid = [...unsettled][0];
+                            retry.line = sentLines.get(retry.uuid);
+                        }, delay);
+                        refusalTimer.unref?.();
+                        continue;
+                    }
+                    // Keep the original diagnosis on exhaustion, even if the final result
+                    // differs. Other errors outside a retry still use their native message.
+                    const originalRefusal = msg.type === 'result' && msg.is_error && refusalRetry?.message;
+                    const mappedMessage = normalizeIntentionalTeardownResult(originalRefusal ? { ...msg, result: originalRefusal } : msg, terminatedByCezar);
                     emitUi((state) => mapClaudeMessage(mappedMessage, state));
                     let delta = 0;
                     try {
@@ -309,6 +440,10 @@ export class ClaudeCliRunner {
                         onEvent?.({ type: 'token-usage', tokensUsed });
                     }
                     if (msg.type === 'result') {
+                        if (msg.is_error !== true && msg.subtype === 'success' && costWeightedTokens(msg.usage) > 0)
+                            successfulIdentity = identity;
+                        const wasRetrying = refusalRetry !== undefined;
+                        cancelRefusalRetry();
                         if (typeof msg.total_cost_usd === 'number' && Number.isFinite(msg.total_cost_usd) && msg.total_cost_usd >= 0) {
                             onEvent?.({ type: 'cost', usd: msg.total_cost_usd });
                         }
@@ -324,6 +459,7 @@ export class ClaudeCliRunner {
                         // pipe, and only a named UUID or a replay echo proves the model read it (#486).
                         const covered = settled.flatMap(id => {
                             unsettled.delete(id);
+                            sentLines.delete(id);
                             if (named)
                                 humanUnsettled.delete(id);
                             return msg.is_error === true ? [] : submissions.consume(id);
@@ -338,7 +474,21 @@ export class ClaudeCliRunner {
                         // CLI never runs must not look like activity. Decided before the turn-end
                         // callback, which may itself submit (and announce) the next prompt.
                         queuedTurnPending = unsettled.size > 0;
+                        // Remaining inputs belong to the next turn. Clear the completed
+                        // turn's work before any queued frame (including system activity)
+                        // arrives; resetting at its first assistant frame would erase work.
+                        if (queuedTurnPending)
+                            attemptDidWork = false;
                         onEvent?.({ type: 'turn-end' });
+                        // Drain later human input only after a successful logical turn.
+                        // Failed turns retain the hold until the workflow tears down.
+                        if (wasRetrying && msg.is_error !== true && stdinOpen) {
+                            for (const input of deferredHuman.splice(0)) {
+                                humanUnsettled.delete(input.id);
+                                sendMessage(input.content, undefined, [], true);
+                            }
+                            opts.onAgentInputReady?.();
+                        }
                         scheduleAutoEnd();
                     }
                 }
@@ -356,24 +506,13 @@ export class ClaudeCliRunner {
                     clearTimeout(deadline);
                 if (autoEndTimer)
                     clearTimeout(autoEndTimer);
+                if (refusalRetry && stdinOpen && !terminatedByCezar && !timedOut) {
+                    onEvent?.({ type: 'error', message: refusalRetry.message });
+                }
                 stdinOpen = false;
+                cancelRefusalRetry();
             }
-            // Clean stdout EOF is not a read failure, but a still-running child would
-            // leave waitForExit hanging on a timeout-less session. Give the normal
-            // EOF→exit race a tick, then use the same SIGTERM→SIGKILL path as interrupt().
-            if (!timedOut && !hasExited()) {
-                await new Promise((resolve) => {
-                    if (hasExited())
-                        return resolve();
-                    const done = () => { child.off('exit', done); child.off('close', done); clearTimeout(timer); resolve(); };
-                    const timer = setTimeout(done, 50);
-                    timer.unref?.();
-                    child.once('exit', done);
-                    child.once('close', done);
-                });
-                if (!hasExited())
-                    interrupt();
-            }
+            await cleanupAfterEof();
             const exitCode = await waitForExit(child);
             // Draining/destroying stdout is not process exit. Keep timeout escalation
             // armed until the child has actually settled.
@@ -429,9 +568,9 @@ export class ClaudeCliRunner {
         const session = {
             result,
             sendMessage: content => sendMessage(content, undefined, [], true),
-            sendAgentMessage: (content, inputIds = []) => {
+            sendAgentMessage: (content, inputIds = [], options) => {
                 // #505: allowed mid-turn — the CLI steers the line into the running turn.
-                if (!stdinOpen || pendingMarkerAsk || agentWritePending)
+                if (!stdinOpen || refusalRetry || (pendingMarkerAsk && !options?.besideQuestion) || agentWritePending)
                     return false;
                 let resolve, reject;
                 const acknowledged = new Promise((yes, no) => { resolve = yes; reject = no; });
@@ -459,7 +598,10 @@ export class ClaudeCliRunner {
                 // transport boundary, not a promise that the model executed the input.
                 return acknowledged;
             },
-            discardQueuedMessages: () => undefined,
+            discardQueuedMessages: () => {
+                for (const input of deferredHuman.splice(0))
+                    humanUnsettled.delete(input.id);
+            },
             holdsHumanInput: () => humanUnsettled.size > 0,
             heldHumanInputCount: () => humanUnsettled.size,
             end,
@@ -473,34 +615,25 @@ export class ClaudeCliRunner {
         return session;
     }
 }
-/**
- * Build the headless argv. `--input-format stream-json` reads user messages
- * from stdin; `--output-format stream-json --verbose` gives per-event NDJSON;
- * `--permission-mode dontAsk` keeps headless runs non-interactive: tools in
- * `--allowedTools` proceed and everything else is denied instead of prompting.
- * `CEZ_CLAUDE_PERMISSION_MODE` selects `dontAsk` / `acceptEdits` / `bypass`
- * (`bypass` emits `--dangerously-skip-permissions` instead). Unset or unknown
- * keeps today's path: `CEZ_APPROVAL_GATE=1` opts into `acceptEdits` (#435).
- * `CEZ_CLAUDE_SETTING_SOURCES` optionally adds `--setting-sources`.
- */
-/** `--replay-user-messages` is the read signal (#505), but an older CLI rejects unknown
- * options at startup. Read the installed CLI's own `--help` once per binary; without the
- * flag, result coverage (`user_message_uuids`) still reports reads. */
-const replaySupport = new Map();
-export function supportsReplayUserMessages(bin) {
-    const known = replaySupport.get(bin);
+/** Read the installed CLI's own `--help` once per binary. */
+const helpFeatures = new Map();
+export function claudeHelpFeatures(bin) {
+    const known = helpFeatures.get(bin);
     if (known !== undefined)
         return known;
-    let supported = false;
+    let help = '';
     try {
-        supported = execFileSync(bin, ['--help'], { encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'ignore'] })
-            .includes('--replay-user-messages');
+        help = execFileSync(bin, ['--help'], { encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'ignore'] });
     }
     catch {
-        supported = false;
+        help = '';
     }
-    replaySupport.set(bin, supported);
-    return supported;
+    const features = {
+        replayUserMessages: help.includes('--replay-user-messages'),
+        includeHookEvents: help.includes('--include-hook-events'),
+    };
+    helpFeatures.set(bin, features);
+    return features;
 }
 export function buildClaudeArgs(spec, env = process.env, features = { replayUserMessages: true }) {
     const args = [
@@ -513,6 +646,31 @@ export function buildClaudeArgs(spec, env = process.env, features = { replayUser
     // Echo each stdin line when the model consumes it: the consumption signal (#505).
     if (features.replayUserMessages)
         args.push('--replay-user-messages');
+    // Every hook's lifecycle, so the transcript can show what hooks told the agent (#961).
+    if (features.includeHookEvents)
+        args.push('--include-hook-events');
+    args.push(...claudePermissionArgs(env));
+    const settingSources = env.CEZ_CLAUDE_SETTING_SOURCES;
+    if (settingSources) {
+        args.push('--setting-sources', settingSources);
+    }
+    if (spec.systemPrompt) {
+        args.push('--append-system-prompt', spec.systemPrompt);
+    }
+    args.push(...claudeSessionArgs(spec), ...claudeToolArgs(spec));
+    if (spec.model) {
+        args.push('--model', spec.model);
+    }
+    const effort = parseEffort(spec.effort);
+    if (effort)
+        args.push('--effort', effort);
+    for (const dir of spec.additionalDirectories ?? []) {
+        args.push('--add-dir', dir);
+    }
+    return args;
+}
+function claudePermissionArgs(env) {
+    const args = [];
     const permissionMode = env.CEZ_CLAUDE_PERMISSION_MODE;
     if (permissionMode === 'bypass') {
         args.push('--dangerously-skip-permissions');
@@ -523,13 +681,10 @@ export function buildClaudeArgs(spec, env = process.env, features = { replayUser
     else {
         args.push('--permission-mode', env.CEZ_APPROVAL_GATE === '1' ? 'acceptEdits' : 'dontAsk');
     }
-    const settingSources = env.CEZ_CLAUDE_SETTING_SOURCES;
-    if (settingSources) {
-        args.push('--setting-sources', settingSources);
-    }
-    if (spec.systemPrompt) {
-        args.push('--append-system-prompt', spec.systemPrompt);
-    }
+    return args;
+}
+function claudeSessionArgs(spec) {
+    const args = [];
     // Pin the session so the user can `claude --resume <sessionId>` in the repo
     // to take over interactively after a run. With `resume` we reopen the
     // existing on-disk conversation instead.
@@ -541,11 +696,20 @@ export function buildClaudeArgs(spec, env = process.env, features = { replayUser
             args.push('--session-id', spec.sessionId);
         }
     }
+    return args;
+}
+function claudeToolArgs(spec) {
+    const args = [];
     // Claude 2.1.260 --help: per-process deny rules; Agent is current, Task
-    // remains the name in older harnesses/recorded fixtures. Never widen grants.
+    // remains the name in older harnesses/recorded fixtures. Workflow runs a
+    // script that starts subagents; a free 2.1.303 probe (`/reload-plugins` as
+    // the only stream-json line) lists it in init `tools` under `Agent,Task` and
+    // drops it under this deny. `context: fork` skills still start a subagent
+    // (AGENT_PROTOCOL.md D1 forked-skill gap, hearsay-tools/cezarion#1284).
+    // Never widen grants.
     if (spec.restrictNativeDelegation)
-        args.push('--disallowedTools', 'Agent,Task');
-    const allowed = buildAllowedTools(spec.allowedTools ?? [], spec.bashAllowlist);
+        args.push('--disallowedTools', 'Agent,Task,Workflow');
+    const allowed = claudeAllowedTools(spec.toolGrant);
     if (spec.cezarTools) {
         const { name, command, args: toolArgs } = spec.cezarTools;
         args.push('--mcp-config', JSON.stringify({ mcpServers: { [name]: {
@@ -558,17 +722,22 @@ export function buildClaudeArgs(spec, env = process.env, features = { replayUser
     if (allowed.length > 0) {
         args.push('--allowedTools', allowed.join(','));
     }
-    if (spec.model) {
-        args.push('--model', spec.model);
-    }
-    const effort = parseEffort(spec.effort);
-    if (effort)
-        args.push('--effort', effort);
-    for (const dir of spec.additionalDirectories ?? []) {
-        args.push('--add-dir', dir);
-    }
     return args;
 }
+/**
+ * The `--allowedTools` entries for each grant kind. No entries sends no flag, so
+ * Claude's permission mode and the user's settings decide; an empty list does
+ * the same (hearsay-tools/cezarion#1849).
+ */
+function claudeAllowedTools(grant) {
+    switch (grant.kind) {
+        case 'unset': return [];
+        case 'step-default':
+        case 'inherited':
+        case 'explicit': return buildAllowedTools(grant.tools, grant.bashAllowlist);
+        default: return unknownToolGrant(grant);
+    }
+}
 /**
  * Map `allowedTools` onto claude's `--allowedTools` syntax. `Bash` with a
  * `bashAllowlist` becomes one `Bash(<prefix>:*)` entry per allowed prefix;
@@ -599,6 +768,41 @@ function mockClaudePath() {
     // here = <pkg>/dist/core (built) or <pkg>/src/core (tsx dev).
     return resolvePath(here, '..', '..', 'scripts', 'mock-claude.mjs');
 }
+/** Fail closed on absent/partial/invalid usage; include cache and nested counters. */
+function zeroClaudeUsage(usage) {
+    if (!usage || typeof usage !== 'object' || Array.isArray(usage))
+        return false;
+    const record = usage;
+    if (record.input_tokens !== 0 || record.output_tokens !== 0)
+        return false;
+    const zero = (value) => typeof value === 'number' ? value === 0
+        : value !== null && typeof value === 'object' && !Array.isArray(value) && Object.values(value).every(zero);
+    return Object.entries(record).every(([key, value]) => 
+    // Claude includes this non-accounting metadata in some usage envelopes.
+    (key === 'service_tier' && typeof value === 'string') || zero(value));
+}
+/** Per-model accounting must agree with the aggregate before replay is safe. */
+function zeroClaudeModelUsage(usage) {
+    if (usage === undefined)
+        return true;
+    if (!usage || typeof usage !== 'object' || Array.isArray(usage))
+        return false;
+    return Object.values(usage).every(model => {
+        if (!model || typeof model !== 'object' || Array.isArray(model))
+            return false;
+        const record = model;
+        if (record.inputTokens !== 0 || record.outputTokens !== 0)
+            return false;
+        return Object.entries(record).every(([key, value]) => key === 'contextWindow' || key === 'maxOutputTokens'
+            ? typeof value === 'number' && Number.isFinite(value) && value >= 0
+            : value === 0);
+    });
+}
+function selectedModelRefusal(text) {
+    return typeof text === 'string'
+        ? /^There's an issue with the selected model \(([^()]+)\)\. It may not exist or you may not have access to it\. Run --model to pick a different model\.$/.exec(text.trim())?.[1]
+        : undefined;
+}
 function normalizeIntentionalTeardownResult(msg, terminatedByCezar) {
     if (terminatedByCezar
         && msg.type === 'result'