BUG: CC session halts on tool failure — no retry or approval surfacing

[OneStepAt4time]

Bug Description

When Claude Code encounters a tool failure (e.g., unauthenticated gh api call, web search unavailable), the CC process halts instead of retrying or surfacing the error to the user for approval. The session dies silently on transient/external failures.

Impact

• P1 — Breaks iterative development loops. A 4h+ session can die on a single failed tool call with no recovery path.
• Affects any tool that may fail transiently (web search, GitHub API, file system edge cases).

Reproduction Steps

1. Start a session via ag run <prompt> that will trigger a tool call
2. Arrange for the tool to fail (e.g., unauthenticated GH API, missing web search provider)
3. Observe: CC stops after the tool failure
4. No retry, no error surfaced to Telegram/dashboard for approval, no recovery prompt

Expected Behavior

• CC should surface tool failures to the approval layer (Telegram / dashboard)
• User can approve/reject retry or skip the failed tool call
• Session continues rather than halting

Root Cause (Hypothesis)

The ACP bridge or Aegis runner may not handle tool-error events from Claude Code. When CC reports a tool failure, the bridge either:

• Does not forward the error to the approval queue
• Does not propagate the error back to CC, causing CC to wait indefinitely
• Does not implement retry logic in the runner layer

Evidence

Found during endurance test #4683 (2026-06-13).

Acceptance Criteria

• Tool failure in CC session is surfaced to Telegram / dashboard approval queue
• User can approve retry or skip from approval interface
• Session continues after handled tool failure
• E2E test: trigger tool failure → observe approval prompt → approve → session continues

Related

• [P1] Endurance test: 4h+ CC development session through Aegis #4683 (endurance test findings)
• [P0] CC tool results never delivered via ACP bridge — long sessions hang at first tool call #4689 (auto-approve permissions — related but distinct: this is about failure recovery, not permission defaults)

[OneStepAt4time]

Triage (Athena) — Priority upgraded P2→P1. Tool-failure halting breaks the 4h+ dev session promise from #4683. No retry or approval surfacing means a single transient failure kills the session. Routing to Hep for runner-layer fix.