fix(hooks): pass failed commands through verbatim, never distill a non-zero exit into success (#120) (#121)

OMNI's normalize layer parsed each agent's failure signal and then discarded
it: Codex `exit_code` was never read into CodexInput, Pi `isError` was
`#[allow(dead_code)]`, and MCP `result.isError` was documented in a comment but
never deserialized. So a command that failed still ran the full distiller, and a
failed command's output could be summarised into something that reads as success
— the worst outcome, because a fabricated success terminates investigation while
a fabricated error only costs a retry.

Fix, at the single point where format knowledge already lives:
- NormalizedInput gains `failed`, set from each agent's own signal (Codex
  exit_code != 0, Pi isError, MCP result.isError).
- One guard in post_tool::process_payload: `if normalized.failed { return None }`
  — passthrough, host keeps the raw bytes at zero marker cost.

Claude Code needs no code change: it sends a failed command as a bare
`tool_response` string ("Error: Exit code N…") that never matches
ClaudeToolResponse, so parsing already bails to None (passthrough). A regression
test locks that in so a future, more-lenient parser can't silently reintroduce
the fabrication.

Verified end-to-end through the real binary: a failed `docker build`
(exit_code 1) that previously distilled 9207→6090 B now passes through (0 B
emitted, host keeps raw); the same output with exit_code 0 still distills to
6090 B, so savings on successful commands are untouched. Teeth proven by
disabling the guard and watching the Codex/Pi/MCP tests go red.

Out of scope, noted for follow-up: the `omni exec`/pipe path reads piped stdout
only and never sees the child exit code, so hardening it needs exec.rs to
capture and forward the code — a separate change.

Author: fajarhide

src/hooks/normalize.rs

@@ -24,6 +24,7 @@ pub struct NormalizedInput {
     pub command: String,   // command yang dieksekusi
     pub content: String,   // output dari tool
     pub agent_id: String,  // untuk session isolation
+    pub failed: bool,      // command exited non-zero / agent signalled an error (#120)
 }
 
 /// Detect agent format dari raw JSON string
@@ -179,6 +180,11 @@ fn normalize_claude_code(input: &str, agent_id: String) -> Option<NormalizedInpu
         command,
         content,
         agent_id,
+        // Claude Code sends a failed command as a bare `tool_response` string
+        // ("Error: Exit code N…"), which never matches ClaudeToolResponse, so
+        // parsing bails to None (passthrough) before reaching here. Reaching this
+        // point means the tool_response object parsed, i.e. the command succeeded.
+        failed: false,
     })
 }
 
@@ -213,7 +219,6 @@ fn normalize_pi(input: &str, agent_id: String) -> Option<NormalizedInput> {
     #[derive(Deserialize)]
     struct PiToolResponse {
         result: Option<Value>,
-        #[allow(dead_code)]
         #[serde(default)]
         #[serde(rename = "isError")]
         is_error: bool,
@@ -249,6 +254,7 @@ fn normalize_pi(input: &str, agent_id: String) -> Option<NormalizedInput> {
         command,
         content,
         agent_id,
+        failed: response.is_error,
     })
 }
 
@@ -306,6 +312,7 @@ fn normalize_opencode(input: &str, agent_id: String) -> Option<NormalizedInput>
         command: parsed.command.unwrap_or_default(),
         content,
         agent_id,
+        failed: false, // OpenCode payload carries no exit/error signal
     })
 }
 
@@ -375,6 +382,7 @@ fn normalize_vscode_continue(input: &str, agent_id: String) -> Option<Normalized
         command,
         content,
         agent_id,
+        failed: false, // Continue.dev payload carries no exit/error signal
     })
 }
 
@@ -389,6 +397,7 @@ fn normalize_codex(input: &str, agent_id: String) -> Option<NormalizedInput> {
         output: Option<String>,
         stdout: Option<String>,
         stderr: Option<String>,
+        exit_code: Option<i64>,
     }
 
     let parsed: CodexInput = serde_json::from_str(input).ok()?;
@@ -413,6 +422,7 @@ fn normalize_codex(input: &str, agent_id: String) -> Option<NormalizedInput> {
         command: parsed.command.unwrap_or_default(),
         content,
         agent_id,
+        failed: parsed.exit_code.is_some_and(|c| c != 0),
     })
 }
 
@@ -430,6 +440,7 @@ fn normalize_aider(input: &str, agent_id: String) -> Option<NormalizedInput> {
         command,
         content: input.to_string(),
         agent_id,
+        failed: false, // Aider pipes raw stdout only; no exit signal available
     })
 }
 
@@ -444,13 +455,15 @@ fn normalize_generic_mcp(input: &str, agent_id: String) -> Option<NormalizedInpu
     #[derive(Deserialize)]
     struct McpResultContent {
         content: Option<Value>,
+        #[serde(default)]
+        #[serde(rename = "isError")]
+        is_error: bool,
     }
 
     let parsed: McpResult = serde_json::from_str(input).ok()?;
-    let content = parsed
-        .result
-        .and_then(|r| r.content)
-        .and_then(|c| extract_value_content(&c))?;
+    let result = parsed.result?;
+    let failed = result.is_error;
+    let content = result.content.and_then(|c| extract_value_content(&c))?;
 
     if content.is_empty() {
         return None;
@@ -465,6 +478,7 @@ fn normalize_generic_mcp(input: &str, agent_id: String) -> Option<NormalizedInpu
         command,
         content,
         agent_id,
+        failed,
     })
 }
 

src/hooks/post_tool.rs

@@ -31,6 +31,14 @@ pub fn process_payload(
 ) -> Option<String> {
     let normalized = crate::hooks::normalize::normalize(input_str)?;
 
+    // #120: a command that exited non-zero passes through verbatim — never distilled.
+    // Distillation must never turn a failed command into output that reads as success
+    // (a fabricated success terminates investigation; a fabricated error only costs a
+    // retry). Emit nothing: the host keeps the original bytes at zero marker cost.
+    if normalized.failed {
+        return None;
+    }
+
     if crate::guard::env::is_passthrough() {
         return None;
     }
@@ -1129,4 +1137,83 @@ mod tests {
         let out = process_payload(&input.to_string(), None, None);
         assert!(out.is_none(), "Edit tool should still return None");
     }
+
+    // ── #120: failed commands pass through verbatim, never distilled ──────
+
+    /// Distillable output that a passing command WOULD get summarised, but the
+    /// non-zero exit must force passthrough (None).
+    fn distillable_noise() -> String {
+        std::fs::read_to_string("tests/fixtures/heavy_noise.txt")
+            .expect("heavy_noise fixture missing")
+    }
+
+    #[test]
+    fn codex_nonzero_exit_passes_through() {
+        let input = serde_json::json!({
+            "action": "run",
+            "command": "docker build .",
+            "result": distillable_noise(),
+            "exit_code": 1,
+        });
+        let out = process_payload(&input.to_string(), None, None);
+        assert!(
+            out.is_none(),
+            "a failed command must pass through verbatim, not be distilled"
+        );
+    }
+
+    #[test]
+    fn codex_zero_exit_still_distills() {
+        // Guards the guard: a successful command with the same output is still distilled.
+        let input = serde_json::json!({
+            "action": "run",
+            "command": "docker build .",
+            "result": distillable_noise(),
+            "exit_code": 0,
+        });
+        let out = process_payload(&input.to_string(), None, None);
+        assert!(
+            out.is_some(),
+            "a successful command must still be distilled"
+        );
+    }
+
+    #[test]
+    fn pi_error_passes_through() {
+        let input = serde_json::json!({
+            "toolName": "Bash",
+            "command": "vault kv list apps/x",
+            "toolResponse": { "result": distillable_noise(), "isError": true },
+        });
+        let out = process_payload(&input.to_string(), None, None);
+        assert!(out.is_none(), "Pi isError=true must pass through verbatim");
+    }
+
+    #[test]
+    fn mcp_error_passes_through() {
+        let input = serde_json::json!({
+            "jsonrpc": "2.0",
+            "id": 1,
+            "result": { "content": distillable_noise(), "isError": true },
+        });
+        let out = process_payload(&input.to_string(), None, None);
+        assert!(out.is_none(), "MCP isError=true must pass through verbatim");
+    }
+
+    #[test]
+    fn claude_code_failure_string_passes_through() {
+        // Claude Code sends a failed command as a bare `tool_response` STRING, which
+        // must never be parsed into a success summary. Locks in the passthrough so a
+        // future, more-lenient parser can't silently reintroduce the fabrication.
+        let input = serde_json::json!({
+            "tool_name": "Bash",
+            "tool_input": {"command": "vault kv list apps/x"},
+            "tool_response": "Error: Exit code 2\nGet \"https://vault/…\": i/o timeout",
+        });
+        let out = process_payload(&input.to_string(), None, None);
+        assert!(
+            out.is_none(),
+            "Claude Code failure string must pass through verbatim"
+        );
+    }
 }