feat(tess): wire durable interaction surfaces (#732)

apps/gateway/src/agent/runtime-provider-registry.service.ts

@@ -77,7 +77,7 @@ function configuredAgentName(): string {
   return agentName;
 }
 
-class RuntimeApprovalDeniedError extends Error {
+export class RuntimeApprovalDeniedError extends Error {
   constructor() {
     super('Runtime termination approval denied');
   }
@@ -301,7 +301,7 @@ export class RuntimeProviderService {
       return result;
     } catch (error: unknown) {
       const durationMs = Date.now() - startedAt;
-      if (invocationStarted && !(error instanceof RuntimeApprovalDeniedError)) {
+      if (invocationStarted && !this.isAuthorizationDenied(error)) {
         await this.recordFailure(providerId, operation, scope, resourceId, durationMs);
       } else {
         await this.record(
@@ -360,6 +360,17 @@ export class RuntimeProviderService {
     }
   }
 
+  private isAuthorizationDenied(error: unknown): boolean {
+    return (
+      error instanceof RuntimeApprovalDeniedError ||
+      error instanceof ForbiddenException ||
+      (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        (error as { code?: unknown }).code === 'forbidden')
+    );
+  }
+
   private provider(providerId: string): AgentRuntimeProvider {
     try {
       return this.registry.require(providerId);