fix(task-intelligence): port missing classifier branches from aegis-daemon

The deployed aegis-web worker bundles two copies of classifyTaskFailure —
one from @stackbilt/aegis-core (this package) and one from aegis-daemon's
local web/src/. Both cc-tasks route copies are also bundled, and Hono's
first-registered-wins rule routes POST /api/cc-tasks/:id/complete to the
core copy here, shadowing the daemon override.

The daemon's copy had gained six classifier branches since the aegis-core
migration that were never ported upstream, so every failure matching them
was silently relabeled as generic_task_failure in production telemetry.
Task-failure-pattern detector then filed bogus self-improvement issues
(Stackbilt-dev/aegis#430, #431) against this bucket.

Ported forward:
- max_turns_exceeded  (primary symptom — 7/7 generic_task_failure in last
  7d were actually Claude turn-limit hits)
- credit_exhausted    (runner_credit_exhausted system contract)
- auth_failure        (runner_auth_degraded)
- environment_failure (runner_environment_degraded, exit 3 + env signals)
- hallucinated_task   (dreaming/self-improvement targets that don't exist)
- work_already_done   (agent saw nothing to do, didn't signal completion)

Also broadened branch_conflict detection to catch `branch ... already
exists` without requiring `open pr`, and flipped it to retryable=true
since the taskrunner now auto-closes stale PRs on retry.

Added ENVIRONMENT_FAILURE_PATTERNS + isEnvironmentFailure helper for the
exit-3 environment-vs-completion disambiguation.

Ordering within classifyTaskFailure matches the daemon copy exactly, so
behavior is byte-for-byte identical once this ships.

Validation:
- 9 new tests in web/tests/task-intelligence.test.ts, including one
  pinning the exact #430 symptom (Exit code 1 + [max_turns_exceeded]
  result → max_turns_exceeded kind, retryable=true)
- Full web test suite: 63 files, 1436 pass, 1 skipped
- Typecheck clean in aegis-oss/web and in aegis-daemon/web (downstream
  consumer via file:../../aegis-oss/web)

Not ported: TaskBlastRadius interface / preflight.blast_radius field —
tied to aegis-daemon's v1.95.0 self-improvement blast gate, no consumer
in this package.

Refs Stackbilt-dev/aegis#430, Stackbilt-dev/aegis#431

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 2 people

web/src/task-intelligence.ts

@@ -75,6 +75,32 @@ export function parseTaskAutopsy(raw: string | Record<string, unknown> | null |
   return parseJsonObject<TaskFailureAutopsy>(raw);
 }
 
+// Environment failure patterns — tool/dependency/infra issues that exit code 3 can mask
+const ENVIRONMENT_FAILURE_PATTERNS = [
+  /npm\s+(err|error|warn).*install/i,
+  /enoent.*npm/i,
+  /cannot find module/i,
+  /module not found/i,
+  /permission denied/i,
+  /eacces/i,
+  /network\s+(error|timeout|unreachable)/i,
+  /connection\s+(refused|reset|timed?\s*out)/i,
+  /no\s+such\s+file\s+or\s+directory/i,
+  /spawn\s+\S+\s+enoent/i,
+  /command\s+failed.*install/i,
+  /failed\s+to\s+(fetch|download|install)/i,
+  /dependency\s+(resolution|install)\s+fail/i,
+  /exit\s+code\s+1.*npm\s+install/i,
+  /errno\s+\d+/i,
+  /segmentation\s+fault/i,
+  /out\s+of\s+memory/i,
+  /disk\s+(full|space)/i,
+];
+
+function isEnvironmentFailure(haystack: string): boolean {
+  return ENVIRONMENT_FAILURE_PATTERNS.some(p => p.test(haystack));
+}
+
 export function classifyTaskFailure(input: FailureInput): TaskFailureAutopsy {
   const warnings = input.preflight?.warnings ?? [];
   const signals = [
@@ -125,12 +151,15 @@ export function classifyTaskFailure(input: FailureInput): TaskFailureAutopsy {
     );
   }
 
-  if (haystack.includes('exists on remote') && haystack.includes('open pr')) {
+  if (
+    (haystack.includes('exists on remote') && haystack.includes('open pr')) ||
+    (haystack.includes('branch') && haystack.includes('already exists') && !haystack.includes('repo not found'))
+  ) {
     return createAutopsy(
       'branch_conflict',
-      false,
-      'Task branch already exists on the remote, suggesting an unresolved earlier run or open PR.',
-      'Close or merge the existing branch/PR, or rerun with a new branch identity.',
+      true,
+      'Task branch already exists on the remote from a prior run. The taskrunner now auto-closes stale PRs and cleans up branches on retry.',
+      'Retry the task — the taskrunner will clean up the stale branch automatically.',
       signals,
     );
   }
@@ -157,6 +186,40 @@ export function classifyTaskFailure(input: FailureInput): TaskFailureAutopsy {
     );
   }
 
+  // Credit/billing exhaustion — runner hit API spend limits
+  if (
+    haystack.includes('credit balance') ||
+    haystack.includes('credit limit') ||
+    haystack.includes('insufficient credits') ||
+    haystack.includes('billing') ||
+    haystack.includes('payment required') ||
+    haystack.includes('rate limit') && haystack.includes('credit')
+  ) {
+    return createAutopsy(
+      'credit_exhausted',
+      false,
+      'Task failed because the LLM provider credit balance was exhausted or billing limit was reached.',
+      'Top up credits or adjust the runner configuration (e.g. switch from --bare API to Claude Code OAuth).',
+      signals,
+      'runner_credit_exhausted',
+    );
+  }
+
+  // Authentication failures — invalid or expired API keys/tokens
+  if (
+    (haystack.includes('unauthorized') || haystack.includes('401') || haystack.includes('authentication failed') || haystack.includes('api key') && haystack.includes('invalid')) &&
+    !haystack.includes('repo')  // avoid false matches on repo auth
+  ) {
+    return createAutopsy(
+      'auth_failure',
+      false,
+      'Task failed due to an authentication or authorization error with an external service.',
+      'Check and rotate the relevant API key or token, then retry.',
+      signals,
+      'runner_auth_degraded',
+    );
+  }
+
   if (input.exitCode === 127 || haystack.includes('command not found')) {
     return createAutopsy(
       'command_missing',
@@ -181,6 +244,72 @@ export function classifyTaskFailure(input: FailureInput): TaskFailureAutopsy {
     );
   }
 
+  // Exit code 3 with environment failure signals → environment_failure (not retryable)
+  // These are tool/dependency/infra issues, not missing completion signals.
+  // Real examples: npm install failures, missing CLI tools, network timeouts.
+  if (input.exitCode === 3 && isEnvironmentFailure(haystack)) {
+    return createAutopsy(
+      'environment_failure',
+      false,
+      'Task failed due to an environment or tool-availability issue on the runner.',
+      'Investigate the runner environment: check tool versions, network access, and dependency availability before retrying.',
+      signals,
+      'runner_environment_degraded',
+    );
+  }
+
+  // max_turns_exceeded — Claude hit the turn limit before completing.
+  // This is retryable (with higher max_turns or a simpler task scope).
+  // Must come before completion_signal_missing since both can have exit code 3,
+  // but max_turns is a distinct, actionable failure with a clear fix.
+  if (haystack.includes('max_turns') || haystack.includes('error_max_turns') || haystack.includes('ran out of turns')) {
+    const hasPr = haystack.includes('[taskrunner] pr:') || haystack.includes('pr created') || haystack.includes('pull request');
+    return createAutopsy(
+      'max_turns_exceeded',
+      true,
+      hasPr
+        ? 'Task hit the turn limit but created a PR — work was likely completed, signal was not emitted before timeout.'
+        : 'Task hit the turn limit before completing. Claude ran out of turns without emitting a completion signal.',
+      hasPr
+        ? 'Review the PR — task may be complete. If so, mark as success. Otherwise, retry with higher max_turns or split the task.'
+        : 'Retry with higher max_turns (current limit may be too low for the task scope) or split into smaller subtasks.',
+      signals,
+    );
+  }
+
+  // Hallucinated task — agent determined the target doesn't exist
+  if (
+    haystack.includes("doesn't exist") && haystack.includes('hallucinated') ||
+    haystack.includes('does not exist') && (haystack.includes('dreaming') || haystack.includes('self-improvement')) ||
+    haystack.includes('code that doesn\'t exist')
+  ) {
+    return createAutopsy(
+      'hallucinated_task',
+      false,
+      'Task referenced code or components that do not exist — likely generated by dreaming/self-improvement without verification.',
+      'Improve task source (dreaming/self-improvement) to verify targets exist before queuing.',
+      signals,
+    );
+  }
+
+  // "Nothing to do" — agent determined work was already done but didn't signal completion
+  if (
+    haystack.includes('already resolved') ||
+    haystack.includes('already complete') ||
+    haystack.includes('already confirmed') ||
+    haystack.includes('already processed') ||
+    haystack.includes('nothing to do') ||
+    haystack.includes('no action needed')
+  ) {
+    return createAutopsy(
+      'work_already_done',
+      false,
+      'Agent determined the work was already completed or unnecessary, but did not emit a completion signal.',
+      'Task should be marked as success — the agent correctly identified no work was needed. Consider improving the taskrunner to recognize "already done" as a valid completion.',
+      signals,
+    );
+  }
+
   if (haystack.includes('completion signal not found') || input.exitCode === 3) {
     return createAutopsy(
       'completion_signal_missing',

web/tests/task-intelligence.test.ts

@@ -61,6 +61,87 @@ describe('task intelligence', () => {
     expect(autopsy.system_contract).toBe('content_public_route_drift');
   });
 
+  it('classifies max_turns_exceeded as retryable even when exit code is 1', () => {
+    const autopsy = classifyTaskFailure({
+      title: 'Post-deploy visual QA: aegis',
+      repo: 'aegis',
+      error: 'Exit code 1',
+      result: '[max_turns_exceeded] Task ran out of turns (12 used, unknown). Increase max_turns or simplify the task.',
+      exitCode: 1,
+    });
+
+    expect(autopsy.kind).toBe('max_turns_exceeded');
+    expect(autopsy.retryable).toBe(true);
+  });
+
+  it('classifies max_turns with existing PR as completed-but-unsignaled', () => {
+    const autopsy = classifyTaskFailure({
+      error: 'Exit code 1',
+      result: '[max_turns_exceeded] Task ran out of turns. Pull request created: https://github.com/x/y/pull/1',
+      exitCode: 1,
+    });
+
+    expect(autopsy.kind).toBe('max_turns_exceeded');
+    expect(autopsy.summary).toContain('created a PR');
+  });
+
+  it('classifies credit exhaustion as non-retryable runner contract failure', () => {
+    const autopsy = classifyTaskFailure({
+      error: 'Your credit balance is too low to access the API',
+    });
+
+    expect(autopsy.kind).toBe('credit_exhausted');
+    expect(autopsy.retryable).toBe(false);
+    expect(autopsy.system_contract).toBe('runner_credit_exhausted');
+  });
+
+  it('classifies auth failures as runner_auth_degraded', () => {
+    const autopsy = classifyTaskFailure({
+      error: '401 unauthorized',
+      result: 'authentication failed against the provider',
+    });
+
+    expect(autopsy.kind).toBe('auth_failure');
+    expect(autopsy.system_contract).toBe('runner_auth_degraded');
+  });
+
+  it('classifies exit code 3 with npm errors as environment_failure, not completion_signal_missing', () => {
+    const autopsy = classifyTaskFailure({
+      error: 'npm ERR! install failed',
+      result: 'Cannot find module foo',
+      exitCode: 3,
+    });
+
+    expect(autopsy.kind).toBe('environment_failure');
+    expect(autopsy.system_contract).toBe('runner_environment_degraded');
+  });
+
+  it('classifies work_already_done when agent reports nothing to do', () => {
+    const autopsy = classifyTaskFailure({
+      result: 'This issue has already been resolved in commit abc123 — nothing to do',
+    });
+
+    expect(autopsy.kind).toBe('work_already_done');
+  });
+
+  it('classifies hallucinated tasks from dreaming source', () => {
+    const autopsy = classifyTaskFailure({
+      title: 'fix: dreaming cycle task',
+      result: 'The file referenced in the task does not exist in the repo',
+    });
+
+    expect(autopsy.kind).toBe('hallucinated_task');
+  });
+
+  it('classifies branch_conflict as retryable (auto-cleanup)', () => {
+    const autopsy = classifyTaskFailure({
+      result: 'Error: branch auto/docs/123 already exists on remote',
+    });
+
+    expect(autopsy.kind).toBe('branch_conflict');
+    expect(autopsy.retryable).toBe(true);
+  });
+
   it('deduplicates contract alerts by contract and repo', () => {
     const alerts = collectContractAlerts([
       {