fix(eval): capture gitclaw tool calls + hook/policy denials

The tool-compliance scorer was blind to gitagent: gitclaw emits tool calls as
TOP-LEVEL sdk_messages (type:"tool_use", toolName/args) and tool results as
type:"tool_result", not nested in an assistant message's content blocks like the
Claude SDK. So toolCalls/policyDenials came back empty and the scorer scored
"compliant" by default. Denials also surface as text ("Tool 'cli' denied"), not
the SDK's structured permission_denials.

- Parse top-level tool_use/tool_result into the transcript (→ toolCalls).
- recordDenial() extracts the blocked tool name from "Tool 'X' denied/blocked"
  text so a policy-blocked forbidden tool is scored compliant for gitagent too.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: patel-lyzr

packages/agentos-server/src/eval-runner.ts

@@ -212,6 +212,14 @@ export async function runAgainstHarness(
   const tMessages = new Map<string, TranscriptEntry[]>();
   const tOrder: string[] = [];
 
+  // gitclaw/hook denials surface as text, not the Claude SDK's structured
+  // `permission_denials`. Pull the tool name out of "Tool 'cli' denied/blocked"
+  // so the tool-compliance scorer can treat a policy-blocked tool as compliant.
+  const recordDenial = (text: string): void => {
+    const m = /\bTool ['"]?([\w.-]+)['"]?\s+(?:was\s+)?(?:denied|blocked)/i.exec(text);
+    if (m && !permissionDenials.some((d) => d.tool_name === m[1])) permissionDenials.push({ tool_name: m[1] });
+  };
+
   const handleFrame = (frame: string) => {
     let evName = "";
     let data: any = null;
@@ -272,10 +280,30 @@ export async function runAgainstHarness(
       if (typeof payload.result === "string") output = payload.result;
       if (typeof payload.total_cost_usd === "number") costUsd = payload.total_cost_usd;
       if (Array.isArray(payload.permission_denials)) permissionDenials = payload.permission_denials;
+    } else if (type === "tool_use") {
+      // gitclaw (and other engines) emit tool calls as TOP-LEVEL messages
+      // (`toolName`/`args`) rather than nested in an assistant message's content.
+      const name = typeof payload.toolName === "string" ? payload.toolName : typeof payload.name === "string" ? payload.name : "";
+      if (name) {
+        const id = `gtu-${tOrder.length}`;
+        tOrder.push(id);
+        tMessages.set(id, [{ type: "tool_use", tool: name, input: payload.args ?? payload.input }]);
+      }
+    } else if (type === "tool_result") {
+      // Top-level tool result. A policy/hook block arrives here as an error
+      // ("Tool 'cli' denied") — recordDenial extracts the tool for the scorer.
+      const content = typeof payload.content === "string"
+        ? payload.content
+        : Array.isArray(payload.content) ? payload.content.map((x: any) => x?.text ?? "").join("") : "";
+      const id = `gtr-${tOrder.length}`;
+      tOrder.push(id);
+      tMessages.set(id, [{ type: "tool_result", text: content, isError: payload.isError === true }]);
+      recordDenial(content);
     } else if (typeof payload.content === "string" && payload.content.trim()) {
       // Engines that surface the assistant's final text as a bare `content`
       // string (gitagent/deepagents/wrapped envelopes) with no Claude-SDK
       // `result` frame. Captured into the transcript → `output || lastText`.
+      recordDenial(payload.content);
       const id = `c-${tOrder.length}`;
       if (!tMessages.has(id)) tOrder.push(id);
       tMessages.set(id, [{ type: "text", text: payload.content }]);