feat(llm): structured error taxonomy with a shared HarnessError base (RFC 005 pt 2)

Introduce HarnessError in dsh-llm (the leaf package): a stable machine-routable
code distinct from the message, cause chaining, name from the subclass, plus
isHarnessError. LlmError, ToolArgsError, and InvariantError now extend it.

Tool failures carry the structure end-to-end: ToolExecutionResult gains
error: { name, code } (populated from a thrown HarnessError), and the loop
forwards it onto the tool/result session event (which gained the same optional
field) for retry/sandbox plugins and replay. The loop's toError wraps non-Error
throws in a HarnessError(code: UNKNOWN, cause) instead of a bare Error.

Landed last and in isolation so it's a pure upgrade over the plain Error+code
the earlier PRs used — independently revertible. Graduates RFC 005 pt 2 ->
ADR 0015; RFC 005 now fully implemented.

packages/llm/src/error.ts

@@ -0,0 +1,33 @@
+/**
+ * The harness error taxonomy: one base class so failures carry a stable,
+ * machine-routable `code` and chain their `cause`, instead of flattening to a
+ * bare message string. Per-package errors extend {@link HarnessError}; the
+ * tool layer surfaces `{ name, code }` on results and the session `tool/result`
+ * event so retry/sandbox plugins and replay can distinguish failure classes.
+ *
+ * Lives in dsh-llm (the leaf package every other imports) so a single base is
+ * shared without a new dependency edge. See ADR 0015.
+ *
+ * @module @deepseek-ai/dsh-llm/error
+ */
+
+/**
+ * Base class for all harness errors. Carries a `code` (stable, programmatic —
+ * e.g. `NO_ADAPTER`, `INVALID_ARGS`, `INVARIANT`) distinct from the
+ * human-readable `message`, and supports `cause` chaining via the standard
+ * `ErrorOptions`. `name` defaults to the subclass constructor name.
+ */
+export class HarnessError extends Error {
+  readonly code: string
+
+  constructor(message: string, code: string, options?: ErrorOptions) {
+    super(message, options)
+    this.code = code
+    this.name = new.target.name
+  }
+}
+
+/** Narrow an arbitrary thrown value to a HarnessError (for `instanceof` at seams). */
+export function isHarnessError(value: unknown): value is HarnessError {
+  return value instanceof HarnessError
+}

packages/llm/src/index.ts

@@ -9,9 +9,11 @@
 import { Context, Service } from 'cordis'
 import type { ContentBlock, GenerateOptions, GenerateResult, StreamChunk } from './types.ts'
 import { BlockAssembler } from './assembler.ts'
+import { HarnessError } from './error.ts'
 
 export * from './brand.ts'
 export * from './never.ts'
+export * from './error.ts'
 export * from './types.ts'
 export { BlockAssembler } from './assembler.ts'
 
@@ -31,14 +33,14 @@ declare module 'cordis' {
 }
 
 /**
- * Typed error for LLM-related failures. The `code` string enables programmatic
- * handling (e.g. `AUTH`, `RATE_LIMIT`, `NO_ADAPTER`); `status` carries the HTTP
- * status when the error originated from a non-2xx provider response (absent for
- * protocol/usage errors that have no HTTP status).
+ * Typed error for LLM-related failures. Extends {@link HarnessError}, so the
+ * `code` string (e.g. `AUTH`, `RATE_LIMIT`, `NO_ADAPTER`) is shared taxonomy;
+ * `status` carries the HTTP status when the error originated from a non-2xx
+ * provider response (absent for protocol/usage errors that have no HTTP status).
  */
-export class LlmError extends Error {
-  constructor(message: string, public code: string, public status?: number) {
-    super(message)
+export class LlmError extends HarnessError {
+  constructor(message: string, code: string, public status?: number, options?: ErrorOptions) {
+    super(message, code, options)
     this.name = 'LlmError'
   }
 }