fix(audit): set pathToClaudeCodeExecutable on all direct SDK call sites (B-006)

[George-iam]

Summary

Fixes B-006: audit worker in the bundled CJS build crashed on every session close with TypeError: fileURLToPath(undefined). Auto-learning (memories, decisions, safety rules, handoff extraction) was effectively dead on v0.2.7. Telemetry showed 14 consecutive audit_complete=failed events on 2026-04-13 from the developer machine; any external user on v0.2.7 hits the same crash.

Root cause

The Claude Agent SDK resolves its own executable via import.meta.url, which is undefined in the bundled CJS output and crashes inside fileURLToPath(). D-121 fixed this for the main MCP server by setting pathToClaudeCodeExecutable in the shared buildAgentQueryOptions() helper — but session-auditor and memory-extractor built their own options objects by hand and bypassed the helper, so the fix never reached the audit path.

Stack trace from .axme-code/audit-worker-logs/:

TypeError [ERR_INVALID_ARG_TYPE]: The "path" argument must be of type string or an instance of URL. Received undefined
    at fileURLToPath (node:internal/url:1487:11)
    at HL (/home/georgeb/.local/bin/axme-code:10771:43)
    at runSingleAuditCall (axme-code:57739:18)
    at runSessionAudit (axme-code:57628:25)
    at runSessionCleanup (axme-code:58693:21)

Changes

• src/utils/agent-options.ts — export findClaudePath() so ad-hoc queryOpts can set pathToClaudeCodeExecutable without going through the full builder (different roles want different tool allowlists; the builder is too opinionated for the strict auditor/format/memory paths).
• src/agents/session-auditor.ts — import findClaudePath, set pathToClaudeCodeExecutable: claudePath on both runSingleAuditCall and formatAuditResult queryOpts.
• src/agents/memory-extractor.ts — same fix on runMemoryExtraction queryOpts. Currently tree-shaken (no callers), but fixed to keep future reuse safe and consistent.
• test/agent-sdk-paths.test.ts (new) — static regression guard. Walks src/agents/**.ts, finds every file calling sdk.query(, and fails if neither buildAgentQueryOptions nor findClaudePath is imported. No SDK, no claude binary, no network — safe in CI.

Verification

Static:

• npm test — 478/478 pass (3 new tests in agent-sdk-paths.test.ts)
• npx tsc --noEmit — clean
• npm run build — clean
• grep pathToClaudeCodeExecutable dist/cli.mjs → 3 hits (helper + both session-auditor sites)

End-to-end smoke test on a real failed session (cb524f4b-8cc9-4e5c-9c50-21930f9001ac):

Before fix:

auditStatus: failed
auditAttempts: 1
lastAuditError: [runSessionAudit] The \"path\" argument must be of type string or an instance of URL. Received undefined

Ran node dist/cli.mjs audit-session --workspace ... --session cb524f4b... against the freshly-built bundle. Result:

{
  \"sessionId\": \"cb524f4b-...\",
  \"auditRan\": true,
  \"memories\": 0,
  \"decisions\": 0,
  \"safetyRules\": 0,
  \"handoffSaved\": false,
  \"worklogSummary\": true,
  \"oracleRescanned\": false,
  \"costUsd\": 1.0823125500000004
}

After fix:

auditStatus: done
auditedAt: 2026-04-14T07:38:31.094Z
lastAuditError: (none)

Audit log (.axme-code/audit-logs/2026-04-14T07-36-55_cb524f4b.json): phase: finished, promptTokens: 95120, chunks: 1, durationMs: 95181, costUsd: 1.08. Full LLM round-trip, no crash.

Test plan

• Local bundle audits a real failed session without crashing
• Merge, bump to v0.2.8, cut binary release
• After install of v0.2.8, telemetry: `audit_complete` outcome=failed count drops to 0 on v0.2.8 machines

Fixes B-006.

🤖 Generated with Claude Code