infraweaver 0.3.7 → 0.3.8

package/dist/mcp/terraform/tools/validate.d.ts

@@ -1,16 +1,21 @@
 import type { LocalToolContext } from "../../localContext.js";
-import { checkArgumentsAgainstSchema, collectProviderRequirements, scanFmt, scanTflint, scanValidate } from "../scanners.js";
+import { checkArgumentsAgainstSchema, collectProviderRequirements, initFailures, scanFmt, scanTflint, scanValidate } from "../scanners.js";
 export interface ValidateScanners {
     scanFmt: typeof scanFmt;
     scanValidate: typeof scanValidate;
     scanTflint: typeof scanTflint;
     collectProviderRequirements: typeof collectProviderRequirements;
     checkArgumentsAgainstSchema: typeof checkArgumentsAgainstSchema;
+    initFailures: typeof initFailures;
 }
 export declare function runValidate(ctx: LocalToolContext, scanners?: ValidateScanners): Promise<import("../../shared.js").ToolOk<{
     passed: boolean;
-    checks_ran: ("checkov" | "infraweaver" | "reviewer" | "terraform-fmt" | "terraform-validate" | "tflint" | "trivy")[];
+    checks_ran: ("betterleaks" | "checkov" | "infraweaver" | "reviewer" | "terraform-fmt" | "terraform-validate" | "tflint" | "trivy")[];
     validate_incomplete: boolean;
+    init_failed: {
+        root: string;
+        error: string;
+    }[];
     remaining_issues: import("../types.js").Concern[];
     preexisting_fmt_drift: string[];
     providers: import("../scanners.js").ProviderRequirement[];

package/dist/mcp/terraform/tools/verifyRemediation.d.ts

@@ -18,7 +18,7 @@ export declare function runVerifyRemediation(ctx: LocalToolContext, { concern_id
     regressions_note?: string;
     confidence: import("../decisions.js").Confidence;
     confidence_reasons: string[];
-    scanners_ran: ("checkov" | "infraweaver" | "reviewer" | "terraform-fmt" | "terraform-validate" | "tflint" | "trivy")[];
+    scanners_ran: ("betterleaks" | "checkov" | "infraweaver" | "reviewer" | "terraform-fmt" | "terraform-validate" | "tflint" | "trivy")[];
 }>>;
 export declare function TerraformVerifyRemediationTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
     concern_ids: string[];

package/dist/mcp/terraform/treeLayout.d.ts

@@ -0,0 +1,57 @@
+/** A variable file assigned to a root by the `var_files` setting. */
+export interface VarFileMapping {
+    /** the root module's directory, relative to the scan directory ("" = itself) */
+    root: string;
+    /** the variable file, relative to the scan directory */
+    file: string;
+}
+export interface RootLayout {
+    /** the root module's directory, relative to the scan directory ("" = itself) */
+    dir: string;
+    /** the root's directory and every local module directory it calls, transitively */
+    closure: string[];
+    /** the variable files Terraform loads by itself, in its load order */
+    autoVarFiles: string[];
+    /** variable files passed with `-var-file`: from `var_files`, or matched to this root */
+    varFiles: string[];
+    /** the root's configuration and its modules', for finding files it reads by name */
+    source: string;
+}
+export interface TreeLayout {
+    roots: RootLayout[];
+    /** every directory that holds Terraform configuration */
+    tfDirs: string[];
+    /** variable files no root could be matched to, and why */
+    unmatched: {
+        file: string;
+        reason: string;
+    }[];
+}
+/** True when `dir` is `ancestor` or lies beneath it. */
+export declare function isWithin(dir: string, ancestor: string): boolean;
+/** The names a variable file assigns at its top level. */
+export declare function varFileKeys(text: string, json: boolean): string[];
+/** The tree's root modules, what each reaches, and the variable files each loads. */
+export declare function treeLayout(cwd: string, explicit?: readonly VarFileMapping[]): TreeLayout;
+/** `root=file` lines (the `var_files` setting) as mappings; malformed lines are reported. */
+export declare function parseVarFileMappings(raw: string | undefined): {
+    mappings: VarFileMapping[];
+    invalid: string[];
+};
+/**
+ * The directories a pull request's scan must cover, from the layouts of both
+ * sides and the files it changed (relative to the scan directory). A root is
+ * reached when a changed file lies in a directory of its closure, is one of
+ * its variable files, or is named in its configuration (a policy read with
+ * `file()`, wherever it lives); every directory of a reached root's closure is kept.
+ * A changed configuration file no root reaches keeps its own directory, as a
+ * whole-tree scan would have scanned it. Null — scan everything — when a
+ * scanner or Infraweaver settings file changed.
+ */
+export declare function scopeFor(layouts: readonly TreeLayout[], changed: Iterable<string>): string[] | null;
+/**
+ * The directories to leave out of a scan that should cover only `keep`: every
+ * configuration directory that is neither kept nor above a kept one, and only
+ * the topmost of those, since skipping a directory skips what is beneath it.
+ */
+export declare function skipDirsFor(tfDirs: readonly string[], keep: readonly string[]): string[];

package/dist/mcp/terraform/types.d.ts

@@ -33,7 +33,7 @@ export interface Concern {
      * ✗→✓ verifiable. `reviewer` marks a concern loaded from a terraform-reviewer
      * findings.json whose original tool isn't one Infraweaver re-runs (tfsec / infracost
      * / llm) — its provenance lives in `rule_id`. */
-    source: "terraform-fmt" | "terraform-validate" | "tflint" | "trivy" | "checkov" | "infraweaver" | "reviewer";
+    source: "terraform-fmt" | "terraform-validate" | "tflint" | "trivy" | "checkov" | "infraweaver" | "betterleaks" | "reviewer";
     /** original namespaced rule, e.g. "trivy:AVD-AWS-0088" */
     rule_id: string;
     severity: Severity;

package/dist/phases/applyPlan.d.ts

@@ -25,8 +25,6 @@ export interface SkippedSuggestion {
     path: string;
     reason: string;
 }
-/** The text of a comment's `suggestion` block, without its closing newline. */
-export declare function suggestionText(body: string): string | undefined;
 export declare function planApply(input: {
     comments: readonly ReviewCommentLike[];
     /** root comment id → whether its thread is still open */

package/dist/toolState.d.ts

@@ -2,6 +2,7 @@ import type { DiffCoverageState } from "./vendor/@infraweaver-io/ci/diffCoverage
 import { type ProgressComment, type ProgressCommentType } from "./vendor/@infraweaver-io/ci/progressComment.js";
 import type { AgentUsage } from "./vendor/@infraweaver-io/models/usage.js";
 import { DispatchRecorder } from "./agents/dispatchMetrics.js";
+import type { StagedReview } from "./mcp/review.js";
 import { type ScanSession } from "./mcp/terraform/scanSession.js";
 import type { PrepResult } from "./prep/types.js";
 import type { AgentDiagnostic } from "./utils/agent/agentHangReport.js";
@@ -91,6 +92,7 @@ export interface ToolState {
     beforeSha?: string;
     selectedMode?: string;
     remediationPrsOpened?: number;
+    pushedHeads?: Map<string, string>;
     scanSession?: ScanSession;
     orgModuleHcl?: Map<string, string>;
     prepushFailureCount: number;
@@ -103,6 +105,7 @@ export interface ToolState {
         nodeId: string;
         reviewedSha: string | undefined;
     };
+    stagedReview?: StagedReview | undefined;
     reviewReplies?: Map<number, {
         commentId: number;
         url: string | undefined;

package/dist/utils/agent/codexOAuth.d.ts

@@ -1,5 +1,5 @@
 /**
- * Pure-stdlib (fetch + Buffer) Codex OAuth refresh + JWT exp decoding.
+ * Codex OAuth refresh (fetch) + JWT exp decoding (jose, decode-only).
  *
  * Deliberately free of node:child_process / spawn / mkdtemp: the Cloud's
  * Next.js server imports `refreshCodexAuthBody` through the

package/dist/utils/cli.d.ts

@@ -1,10 +1,4 @@
 /**
  * CLI utilities
  */
-export { formatIndentedField, formatJsonValue, formatUsageSummary, log, writeSummary, } from "./log.js";
-/**
- * Finds a CLI executable path by checking if it's installed globally
- * @param name The name of the CLI executable to find
- * @returns The path to the CLI executable, or null if not found
- */
-export declare function findCliPath(name: string): string | null;
+export { formatJsonValue, formatUsageSummary, log, writeSummary } from "./log.js";

package/dist/utils/cloud/cloudReport.d.ts

@@ -62,7 +62,7 @@ export declare function buildReportBody(toolState: ToolState): {
     findings: {
         concern_id: string;
         concern_key: string;
-        source: "checkov" | "infraweaver" | "reviewer" | "terraform-fmt" | "terraform-validate" | "tflint" | "trivy";
+        source: "betterleaks" | "checkov" | "infraweaver" | "reviewer" | "terraform-fmt" | "terraform-validate" | "tflint" | "trivy";
         rule_id: string;
         severity: "critical" | "high" | "info" | "low" | "medium";
         category: "correctness" | "cost" | "security" | "style";

package/dist/utils/config/baseRefConfig.d.ts

@@ -55,7 +55,7 @@ import { type InfraweaverFileValues } from "./infraweaverConfig.js";
  * asserts that partition, so a key added later cannot silently default to
  * "PR-controllable".
  */
-export declare const GATE_RELEVANT_CONFIG_KEYS: readonly ["allowed_paths", "protected_paths", "required_controls", "severity_threshold", "autonomy_threshold", "tools_enabled", "scan_scope", "iac_languages", "repeated_literal_threshold"];
+export declare const GATE_RELEVANT_CONFIG_KEYS: readonly ["allowed_paths", "protected_paths", "required_controls", "severity_threshold", "autonomy_threshold", "tools_enabled", "scan_scope", "iac_languages", "repeated_literal_threshold", "var_files", "review_comment_limit"];
 /**
  * Keys a PR may set from its own head: none can hide a finding, relax a
  * guardrail, or shrink what is scanned. `language` is prose only; `grouping` is

package/dist/utils/config/infraweaverConfig.d.ts

@@ -31,7 +31,7 @@ export declare const INFRAWEAVER_CONFIG_FILENAMES: readonly [".infraweaver.json"
 /** the repo-level keys `.infraweaver.yml` may set. Each is the snake_case name of
  * the matching action input, so the file value can be fed straight through the
  * input's own parser in `resolvePayload`. */
-export declare const INFRAWEAVER_CONFIG_KEYS: readonly ["tools_enabled", "protected_paths", "allowed_paths", "scan_scope", "iac_languages", "language", "severity_threshold", "grouping", "autonomy_threshold", "module_catalogue", "repeated_literal_threshold", "required_controls"];
+export declare const INFRAWEAVER_CONFIG_KEYS: readonly ["tools_enabled", "protected_paths", "allowed_paths", "scan_scope", "iac_languages", "language", "severity_threshold", "grouping", "autonomy_threshold", "module_catalogue", "repeated_literal_threshold", "required_controls", "var_files", "review_comment_limit"];
 export type InfraweaverConfigKey = (typeof INFRAWEAVER_CONFIG_KEYS)[number];
 /** normalized string values (lists newline-joined), keyed by input name. */
 export type InfraweaverFileValues = Partial<Record<InfraweaverConfigKey, string>>;

package/dist/utils/config/payload.d.ts

@@ -1,4 +1,5 @@
 import type { PayloadEvent } from "../../external.js";
+import { type VarFileMapping } from "../../mcp/terraform/treeLayout.js";
 import type { RepoSettings } from "../cloud/runContext.js";
 export { parseMode, resolveEffectivePrompt, VETTED_MODE_PROMPTS, } from "../prompt/modePrompts.js";
 export { parseConcernIds, parseLanguage, parseRefactorSource, type RefactorSource, type UserFacingLanguage, withConcernFocus, withLanguageDirective, withRefactorSource, } from "../prompt/promptDirectives.js";
@@ -45,6 +46,8 @@ export declare const Inputs: import("arktype/internal/variants/object.ts").Objec
     protected_paths?: string | undefined;
     autonomy_threshold?: string | undefined;
     repeated_literal_threshold?: string | undefined;
+    var_files?: string | undefined;
+    review_comment_limit?: string | undefined;
     required_controls?: string | undefined;
     gitleaks?: string | undefined;
     cost_increase_block_usd?: string | undefined;
@@ -129,6 +132,8 @@ managedCredentials?: {
     protectedPaths: string[] | undefined;
     autonomyThreshold: string | undefined;
     repeatedLiteralThreshold: number | undefined;
+    varFiles: VarFileMapping[] | undefined;
+    reviewCommentLimit: number;
     requiredControls: string[] | undefined;
     gitleaks: boolean;
     costIncreaseBlockUsd: number | undefined;

package/dist/utils/markdownTable.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Flatten text into one markdown table cell: escape pipes (an unescaped `|`
+ * starts a new column and shears the row) and fold newlines, which would end the
+ * row, into single spaces.
+ */
+export declare function tableCell(text: string): string;

package/dist/utils/setup/toolLicensing.d.ts

@@ -12,7 +12,7 @@
  * [[toolSelection]].
  */
 /** every external tool the engine can be configured to run. */
-export type ToolId = "terraform" | "tflint" | "trivy" | "checkov" | "infracost" | "gitleaks" | "conftest" | "terratest" | "terratag" | "terraform_mcp" | "opentofu_mcp";
+export type ToolId = "terraform" | "tflint" | "trivy" | "checkov" | "infracost" | "gitleaks" | "betterleaks" | "conftest" | "terratest" | "terratag" | "terraform_mcp" | "opentofu_mcp";
 /**
  * Coarse licence family the gate reasons about:
  *   - `permissive`     — MIT / Apache-2.0 / BSD / ISC: default-enabled.

package/dist/utils/unifiedDiff.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The one unified-diff reader: hunk headers, line classification and per-side
+ * line numbering for every caller that walks a patch — a single GitHub `patch`
+ * fragment (hunks only, no file headers), a truncated review-comment `diff_hunk`,
+ * or a multi-file `git diff`.
+ *
+ * Deliberately TOLERANT, and that is why this is not jsdiff's `parsePatch`: that
+ * one validates every hunk's line counts and throws on a mismatch, but GitHub's
+ * `diff_hunk` is cut off at the commented line by design, and the callers here are
+ * pure functions fed external text where a parse error must not cost the whole
+ * result. Lines are numbered from the hunk header and classified by their marker;
+ * the declared counts are used for exactly one thing (see below).
+ */
+/** a parsed `@@ -a,b +c,d @@` header; an omitted count is 1, as git writes it */
+export type HunkHeader = {
+    oldStart: number;
+    oldCount: number;
+    newStart: number;
+    newCount: number;
+};
+export type DiffLine = 
+/** a `@@` hunk header */
+{
+    kind: "hunk";
+    raw: string;
+    header: HunkHeader;
+}
+/** a `+++` new-side file header; `path` has `b/` stripped, `/dev/null` for a deletion */
+ | {
+    kind: "file";
+    raw: string;
+    path: string;
+} | {
+    kind: "add";
+    raw: string;
+    text: string;
+    newLine: number;
+} | {
+    kind: "remove";
+    raw: string;
+    text: string;
+    oldLine: number;
+} | {
+    kind: "context";
+    raw: string;
+    text: string;
+    oldLine: number;
+    newLine: number;
+}
+/** anything else: `diff --git`/`---`/`index` headers, ``,
+ *  lines outside any hunk, or an unknown marker — never numbered */
+ | {
+    kind: "meta";
+    raw: string;
+};
+export declare function parseHunkHeader(line: string): HunkHeader | null;
+/**
+ * Classify and number every line of `diff`.
+ *
+ * `--- `/`+++ ` are file headers only OUTSIDE a hunk body: once a hunk's declared
+ * counts are used up (or before any hunk). Inside one they are a removed line
+ * starting `-- ` or an added line starting `++ `, which a marker-only reader would
+ * mistake for the next file. Everything else ignores the counts, so a truncated
+ * hunk or a hand-written one with wrong counts still numbers its lines.
+ *
+ * An empty line inside a hunk is a context line whose single space was stripped,
+ * except the input's LAST line — that is the artefact of a trailing newline.
+ */
+export declare function parseDiffLines(diff: string): DiffLine[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infraweaver",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   "keywords": [
     "ai-coding-agent",
@@ -73,6 +73,7 @@
     "fixtures:state": "node scripts/synthesise-state.ts",
     "gen:aws-prices": "node scripts/generate-aws-price-snapshot.ts",
     "gen:azure-prices": "node scripts/generate-azure-price-snapshot.ts",
+    "gen:checkov-severities": "node scripts/generate-checkov-severities.ts",
     "gen:crosswalk-digest": "node scripts/generate-crosswalk-digest.ts",
     "knip": "knip",
     "lint": "biome check .",
@@ -92,50 +93,55 @@
     "upDeps": "pnpm up --latest"
   },
   "devDependencies": {
-    "@actions/cache": "^6.2.0",
+    "@actions/cache": "^6.3.0",
     "@actions/core": "^3.0.1",
-    "@anthropic-ai/claude-code": "2.1.266",
-    "@biomejs/biome": "2.5.12",
+    "@anthropic-ai/claude-code": "2.1.285",
+    "@biomejs/biome": "2.5.15",
     "@cdktf/hcl2json": "^0.21.0",
-    "@infraweaver-io/attest": "^0.1.6",
-    "@infraweaver-io/ci": "^0.1.7",
-    "@infraweaver-io/core": "^0.1.4",
-    "@infraweaver-io/crosswalk": "^1.1.0",
-    "@infraweaver-io/models": "^0.1.5",
-    "@infraweaver-io/policy-spec": "^1.1.0",
-    "@infraweaver-io/report-contract": "^0.1.4",
-    "@infraweaver-io/sandbox": "^0.1.7",
-    "@modelcontextprotocol/client": "^2.0.0",
+    "@fast-check/vitest": "^0.5.0",
+    "@infraweaver-io/attest": "^0.1.7",
+    "@infraweaver-io/ci": "^0.1.8",
+    "@infraweaver-io/core": "^0.1.5",
+    "@infraweaver-io/crosswalk": "^1.2.0",
+    "@infraweaver-io/models": "^0.1.6",
+    "@infraweaver-io/policy-spec": "^1.2.0",
+    "@infraweaver-io/report-contract": "^0.1.5",
+    "@infraweaver-io/sandbox": "^0.1.8",
+    "@modelcontextprotocol/client": "^2.2.0",
+    "@octokit/auth-app": "^8.3.1",
+    "@octokit/openapi-webhooks-types": "^12.1.0",
     "@octokit/plugin-throttling": "^11.0.5",
     "@octokit/rest": "^22.0.1",
-    "@octokit/webhooks-types": "^7.6.1",
-    "@opencode-ai/sdk": "1.18.30",
+    "@opencode-ai/sdk": "1.18.33",
     "@standard-schema/spec": "1.1.0",
     "@stryker-mutator/core": "^10.0.0",
     "@stryker-mutator/vitest-runner": "^10.0.0",
     "@toon-format/toon": "^4.1.1",
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.6.3",
     "@types/turndown": "^5.0.6",
-    "@vitest/coverage-v8": "^5.0.0",
+    "@vitest/coverage-v8": "^5.0.3",
     "ajv": "^8.20.0",
     "arg": "^5.0.2",
-    "arkregex": "0.0.8",
-    "arktype": "2.2.3",
-    "dotenv": "^17.4.2",
+    "arkregex": "0.0.10",
+    "arktype": "2.2.5",
+    "dotenv": "^18.0.5",
     "esbuild": "^0.28.2",
-    "fastmcp": "^4.20.6",
-    "file-type": "^22.0.2",
-    "knip": "^6.35.0",
-    "opencode-ai": "1.18.30",
+    "fast-check": "^4.10.2",
+    "fastmcp": "^4.22.1",
+    "file-type": "^22.1.1",
+    "jose": "^6.2.12",
+    "knip": "^6.39.0",
+    "lefthook": "^2.1.16",
+    "opencode-ai": "1.18.33",
     "package-manager-detector": "^1.8.0",
     "picocolors": "^1.1.1",
     "table": "^6.9.0",
     "turndown": "^7.2.4",
     "typescript": "7.0.2",
-    "undici": "^8.10.2",
-    "verkit": "0.4.0",
-    "vitest": "^5.0.0",
-    "yaml": "^2.9.0"
+    "undici": "^8.11.2",
+    "verkit": "0.5.0",
+    "vitest": "^5.0.3",
+    "yaml": "^2.9.1"
   },
   "engines": {
     "node": ">=24",

package/src/agents/claude.ts

@@ -75,6 +75,11 @@ import {
   MCP_SERVER_TOKEN_ENV,
   mergeAgentUsage,
 } from "#app/agents/shared";
+import {
+  createToolPlaneWatch,
+  ToolPlaneLostError,
+  type ToolPlaneWatch,
+} from "#app/agents/toolPlaneWatch";
 import { writePolicyPath } from "#app/agents/writePolicy";
 import { PRODUCT_NAME } from "#app/brand";
 import { infraweaverMcpName } from "#app/external";
@@ -260,7 +265,7 @@ function writePretoolGateAssets(
  * 'sonnet' | 'opus' | 'haiku') and takes precedence over what's set here —
  * we don't pass it; the per-subagent `model` field is the right default.
  *
- * The `model` is route-aware: the bare Anthropic-API id `claude-sonnet-5`
+ * The `model` is route-aware: the bare Anthropic-API id `claude-sonnet-5-5`
  * is only valid on the direct API. On Bedrock (`eu.anthropic.…`) and Vertex
  * (`@`-versioned) routes that id is rejected, and claude-code does not
  * translate per-agent model names — so on those routes we omit `model`
@@ -282,7 +287,7 @@ export function buildAgentsJson(routeAware?: { isBedrock: boolean; isVertex: boo
         "Reads only — no writes, no state-changing shell or MCP calls, no nested subagent dispatch.",
       prompt: REVIEWER_SYSTEM_PROMPT,
       // omit on non-direct-API routes so the id can't be rejected by the provider.
-      ...(inheritOrchestratorModel ? {} : { model: "claude-sonnet-5" }),
+      ...(inheritOrchestratorModel ? {} : { model: "claude-sonnet-5-5" }),
     },
   };
   return JSON.stringify(agents);
@@ -290,7 +295,7 @@ export function buildAgentsJson(routeAware?: { isBedrock: boolean; isVertex: boo
 
 // ── model helpers ─────────────────────────────────────────────────────────────
 
-// claude CLI expects bare model names (e.g. "claude-sonnet-5"), not provider-prefixed specifiers
+// claude CLI expects bare model names (e.g. "claude-sonnet-5-5"), not provider-prefixed specifiers
 export function stripProviderPrefix(specifier: string): string {
   const slashIndex = specifier.indexOf("/");
   return slashIndex > 0 ? specifier.slice(slashIndex + 1) : specifier;
@@ -558,8 +563,13 @@ interface ClaudeRunState {
   // LLM10. The activity watchdog bounds silence; a remediation loop that keeps
   // emitting tokens is never silent, so it needs its own bound. Aborting the
   // spawn is what actually stops consumption — returning a flag would let the
-  // CLI keep burning tokens until it happened to finish.
-  quotaAbort: AbortController;
+  // CLI keep burning tokens until it happened to finish. Aborted with the
+  // reason: a quota error, or the tool server being lost (see toolPlane).
+  stopRun: AbortController;
+  // tool_use id → tool name, so a tool result can be told apart by the tool
+  // that produced it.
+  toolNames: Map<string, string>;
+  toolPlane: ToolPlaneWatch;
   // The source key must be unique PER INVOCATION, not per label: a `--resume`
   // retry reuses the label but starts a fresh accumulator from zero, and the
   // quota charges only increases — so a shared key would make every retry's
@@ -595,7 +605,9 @@ function newClaudeRunState(params: RunParams): ClaudeRunState {
     accumulatedTokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
     accumulatedCostUsd: 0,
     tokensLogged: false,
-    quotaAbort: new AbortController(),
+    stopRun: new AbortController(),
+    toolNames: new Map(),
+    toolPlane: createToolPlaneWatch(),
     quotaSource: `${params.label}#${nextQuotaSourceId()}`,
     recentStderr: [],
     recentNonJsonStdout: [],
@@ -624,10 +636,10 @@ function timerFor(state: ClaudeRunState, label: string): ThinkingTimer {
 
 function chargeTokenQuota(state: ClaudeRunState): void {
   const quota = state.params.tokenQuota;
-  if (!quota || state.quotaAbort.signal.aborted) return;
+  if (!quota || state.stopRun.signal.aborted) return;
   if (!quota.observe(state.quotaSource, state.accumulatedTokens)) return;
   log.info(`» ${state.params.label}: ${quota.gap()}`);
-  state.quotaAbort.abort(new TokenQuotaExceededError(quota.gap()));
+  state.stopRun.abort(new TokenQuotaExceededError(quota.gap()));
 }
 
 // The money half of the same bound. Claude Code reports cost only on the
@@ -637,10 +649,10 @@ function chargeTokenQuota(state: ClaudeRunState): void {
 // stops before spending anything.
 function chargeCostQuota(state: ClaudeRunState): void {
   const quota = state.params.costQuota;
-  if (!quota || state.quotaAbort.signal.aborted) return;
+  if (!quota || state.stopRun.signal.aborted) return;
   if (!quota.observe(state.quotaSource, state.accumulatedCostUsd)) return;
   log.info(`» ${state.params.label}: ${quota.gap()}`);
-  state.quotaAbort.abort(new CostQuotaExceededError(quota.gap()));
+  state.stopRun.abort(new CostQuotaExceededError(quota.gap()));
 }
 
 function buildUsage(state: ClaudeRunState): AgentUsage | undefined {
@@ -674,6 +686,7 @@ function onSystemEvent(state: ClaudeRunState, event: ClaudeSystemEvent): void {
 function onAssistantToolUse(state: ClaudeRunState, label: string, block: ContentBlock): void {
   const { params } = state;
   const toolName = block.name || "unknown";
+  if (block.id) state.toolNames.set(block.id, toolName);
   // only the orchestrator's tool calls feed the diff-coverage tracker —
   // a specialist subagent reading the diff cannot satisfy the primary
   // reviewer's coverage obligation. Matches the opencode path's
@@ -814,6 +827,16 @@ function onUserEvent(state: ClaudeRunState, event: ClaudeUserEvent): void {
       } else {
         log.debug(withLabel(label, `» tool output: ${outputContent}`));
       }
+
+      const lost = state.toolPlane.observe({
+        toolName: block.tool_use_id ? state.toolNames.get(block.tool_use_id) : undefined,
+        isError: block.is_error === true,
+        text: outputContent,
+      });
+      if (lost && !state.stopRun.signal.aborted) {
+        log.info(`» ${state.params.label}: ${lost.message}`);
+        state.stopRun.abort(lost);
+      }
     }
   }
 }
@@ -1133,6 +1156,18 @@ function failRun(state: ClaudeRunState, error: unknown): ClaudeRunResult {
     };
   }
 
+  // The same: the run was stopped on purpose, and why is already the message.
+  if (error instanceof ToolPlaneLostError) {
+    log.info(`» ${params.label} stopped after ${(duration / 1000).toFixed(1)}s: ${message}`);
+    return {
+      success: false,
+      output: state.finalOutput || state.output.toString(),
+      error: message,
+      usage: buildUsage(state),
+      sessionId: state.sessionId,
+    };
+  }
+
   const stderrContext = state.recentStderr.slice(-10).join("\n");
   const diagnosis = state.lastProviderError
     ? `likely cause: ${state.lastProviderError}`
@@ -1171,9 +1206,9 @@ export async function runClaude(params: RunParams): Promise<ClaudeRunResult> {
       // sit well under it, so no per-toolcall suspend bracketing is needed.
       activityTimeout: AGENT_ACTIVITY_TIMEOUT_MS,
       onActivityTimeout: params.onActivityTimeout,
-      // LLM10: kills the CLI (and its group) the moment the run's token
-      // ceiling is reached. See chargeTokenQuota above.
-      abortSignal: state.quotaAbort.signal,
+      // kills the CLI (and its group) the moment the run's token ceiling is
+      // reached (chargeTokenQuota) or its tool server is lost (onUserEvent).
+      abortSignal: state.stopRun.signal,
       stdio: ["ignore", "pipe", "pipe"],
       // run claude in its own process group so SIGKILL on activity timeout /
       // outer cancellation reaches any subprocesses it spawns (rg, file

package/src/agents/claudePretoolGate.ts

@@ -38,16 +38,12 @@
 import { WRITE_GATE_HELPERS_SOURCE } from "@infraweaver-io/sandbox/writeGateSource";
 import { PRODUCT_NAME } from "#app/brand";
 
-/**
- * The pinned `@anthropic-ai/claude-code` version against which the subagent
- * gate's `agent_id` discriminator was last verified (see the contract notes in
- * the gate source below). The gate fails OPEN for subagents if claude-code ever
- * stops populating `agent_id` in the PreToolUse hook payload, so a version bump
- * must be paired with a re-verification of `createBaseHookInput`.
- *
- * `claudePretoolGate.test.ts` asserts this equals the version pinned in
- * `package.json` — that test fails on any bump, forcing the re-verification
- * before the pin and this constant are updated together.
+/*
+ * The subagent gate's `agent_id` discriminator (see the contract notes in the
+ * gate source below) is an assumption about claude-code's PreToolUse hook
+ * payload. The gate fails OPEN for subagents if claude-code ever stops
+ * populating `agent_id`, so it is worth re-checking `createBaseHookInput` when
+ * claude-code moves a long way.
  *
  * 2.1.266 verified 2026-09-26 against the schema embedded in the installed
  * binary: the base hook input still declares `agent_id` as
@@ -70,10 +66,8 @@ import { PRODUCT_NAME } from "#app/brand";
  * Scope of this verification, stated honestly: it is static inspection of the
  * shipped binary. No CI job exercises the Claude subagent gate against a live
  * agent — `security-tests.yml` is deliberately opencode-only (free keyless
- * model; Claude Code cannot use an `opencode/*` gateway model). So this pin,
- * plus the tripwire test, IS the contract check. Keep both.
+ * model; Claude Code cannot use an `opencode/*` gateway model).
  */
-export const CLAUDE_CODE_AGENT_ID_VERIFIED_VERSION = "2.1.266" as const;
 
 /**
  * Source written to `<ctx.tmpdir>/infraweaver-pretool-gate.mjs`. Plain ESM,
@@ -196,10 +190,8 @@ process.stdin.on("end", () => {
   // subagent discriminator: on the orchestrator's main thread agent_id is
   // undefined. agent_type can be set on the orchestrator itself via --agent,
   // so it's not a reliable subagent discriminator on its own; agent_id is.
-  // contract verified against @anthropic-ai/claude-code 2.1.220 (pinned in
-  // package.json; see CLAUDE_CODE_AGENT_ID_VERIFIED_VERSION + the version
-  // tripwire in claudePretoolGate.test.ts); re-verify createBaseHookInput if
-  // that bumps — if agent_id ever stops being populated the gate fails OPEN.
+  // contract last verified against @anthropic-ai/claude-code 2.1.266 — if
+  // agent_id ever stops being populated the gate fails OPEN.
   if (!agentId) process.exit(0);
   const bare = stripMcpPrefix(toolName);
   if (!SUBAGENT_DENIED_TOOLS.has(bare)) process.exit(0);

package/src/agents/sessionLabeler.ts

@@ -19,6 +19,8 @@
  * the read-only contract — only for log readability.
  */
 
+import pc from "picocolors";
+
 export interface TaskDispatchInput {
   description?: string | undefined;
   subagent_type?: string | undefined;
@@ -168,9 +170,7 @@ export class SessionLabeler {
  * as the dormant withLogPrefix-based ones.
  */
 export function formatWithLabel(label: string, message: string): string {
-  const MAGENTA = "\x1b[35m";
-  const RESET = "\x1b[0m";
-  const colored = `${MAGENTA}[${label}]${RESET} `;
+  const colored = `${pc.magenta(`[${label}]`)} `;
   return message
     .split("\n")
     .map((line) => `${colored}${line}`)