@agentproto/adapter-claude-code-cloud 0.0.0-stage → 0.2.0

package/dist/index.d.ts

@@ -0,0 +1,454 @@
+import { AgentCliHandle, AgentCliRuntime } from '@agentproto/driver-agent-cli';
+export { AgentCliHandle, AgentCliRuntime } from '@agentproto/driver-agent-cli';
+import { Agent, AgentSideConnection, InitializeRequest, InitializeResponse, NewSessionRequest, NewSessionResponse, LoadSessionRequest, LoadSessionResponse, PromptRequest, PromptResponse, CancelNotification, SetSessionConfigOptionRequest, SetSessionConfigOptionResponse, SetSessionModeRequest, SetSessionModeResponse, SessionUpdate, StopReason } from '@agentclientprotocol/sdk';
+
+/**
+ * The vendor-client surface (AIP-66 Appendix A): start a Claude Code cloud
+ * session under a PTY, send follow-ups headlessly, and preflight the
+ * claude.ai login. The CLI is the only supported way to CREATE and PROMPT a
+ * cloud session — the sessions API (sessions-api.ts) is observe-only.
+ *
+ * Every child process runs with ANTHROPIC_API_KEY and the Claude Code
+ * gateway/redirect toggles deleted from its env (AIP-66 §8): a leftover
+ * toggle or API key would make the CLI authenticate a different way and
+ * refuse (or worse, re-route) the cloud call. The token the CLI reads from
+ * the user's own login is never touched, logged or persisted here.
+ *
+ * The binary runner is injectable so tests can drive every path — auth
+ * preflight, trust prompt, output parsing — from fixtures without a live
+ * claude CLI or a real PTY.
+ */
+/** Env keys deleted from every claude child this adapter spawns (AIP-66 §8). */
+declare const CLAUDE_CODE_GATEWAY_ENV_UNSET: readonly string[];
+/** Copy `base` with every {@link CLAUDE_CODE_GATEWAY_ENV_UNSET} key deleted. */
+declare function cloudChildEnv(base?: Record<string, string | undefined>): Record<string, string>;
+interface RunResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+interface RunOpts {
+    cwd: string;
+    env: Record<string, string>;
+    timeoutMs?: number;
+    /** "ignore" detaches stdin so a non-interactive call can never TTY-block. */
+    stdin?: "ignore";
+}
+interface PtyHandle {
+    write(data: string): void;
+    result: Promise<{
+        code: number;
+        output: string;
+    }>;
+}
+interface PtyRunOpts extends RunOpts {
+    onData?: (chunk: string) => void;
+}
+/** What {@link startCloudSession} / {@link sendPrompt} drive. Tests inject a
+ *  fake; production uses {@link defaultCloudCliRunner}. */
+interface CloudCliRunner {
+    run(cmd: string, args: string[], opts: RunOpts): Promise<RunResult>;
+    runPty(cmd: string, args: string[], opts: PtyRunOpts): PtyHandle;
+}
+/** Real runner: child_process for headless calls, node-pty (optional dep)
+ *  for the TTY-required `claude --cloud` start. */
+declare function defaultCloudCliRunner(): CloudCliRunner;
+interface AuthStatus {
+    loggedIn: boolean;
+    authMethod?: string;
+}
+/** Parse `claude auth status` JSON output. */
+declare function parseAuthStatus(stdout: string): AuthStatus;
+/**
+ * Refuse the spawn before any side effect when the claude CLI is missing,
+ * not logged in, or authenticated by API key — cloud sessions require a
+ * claude.ai sign-in (verified live: an ANTHROPIC_API_KEY env makes the CLI
+ * refuse with "Cloud sessions need a claude.ai sign-in").
+ */
+declare function preflightAuth(runner: CloudCliRunner, opts: {
+    cwd: string;
+    env: Record<string, string>;
+}): Promise<AuthStatus>;
+interface StartedCloudSession {
+    /** CLI-spelled id (`session_<id>`), ready for `--cloud` / `--teleport`. */
+    sessionId: string;
+    url: string;
+    title?: string;
+}
+/** Parse the `claude --cloud` start transcript: the id from the "Resume
+ *  with:" line (falling back to the View URL's path), the URL, and the
+ *  session title. Returns null when no session id can be found. */
+declare function parseCloudStartOutput(output: string): StartedCloudSession | null;
+interface StartCloudSessionOpts {
+    runner?: CloudCliRunner;
+    env?: Record<string, string | undefined>;
+    cwd: string;
+    /** Hard cap on the interactive start (PTY) — default 120s. */
+    timeoutMs?: number;
+    /** Skip the auth preflight (tests only; production always preflights). */
+    skipPreflight?: boolean;
+}
+/**
+ * Start a cloud session: `claude --cloud "<prompt>"` under a PTY (the CLI
+ * requires a TTY here), answering the first-run folder-trust prompt, then
+ * parse the printed session id / URL and exit. The vendor runs the first
+ * turn; observe it via the sessions API.
+ */
+declare function startCloudSession(prompt: string, opts: StartCloudSessionOpts): Promise<StartedCloudSession>;
+interface SendPromptOpts {
+    runner?: CloudCliRunner;
+    env?: Record<string, string | undefined>;
+    cwd: string;
+    timeoutMs?: number;
+    skipPreflight?: boolean;
+}
+/**
+ * Send a follow-up turn: `claude -p "<text>" --cloud <session id>` with
+ * stdin detached (no TTY). Send-only by design — the CLI prints "Sent to
+ * cloud session." and never the reply; the reply is observed via the
+ * sessions API. Accepts `session_`/`cse_` ids.
+ */
+declare function sendPrompt(sessionId: string, text: string, opts: SendPromptOpts): Promise<{
+    stdout: string;
+}>;
+
+/**
+ * Thin client for the undocumented Claude Code cloud sessions API
+ * (AIP-66 Appendix A). Base https://api.anthropic.com; requests carry
+ * `Authorization: Bearer <claude.ai OAuth access token>`,
+ * `anthropic-version: 2023-06-01` and `x-organization-uuid`.
+ *
+ * The credential is the user's claude.ai login, owned by the claude CLI
+ * (AIP-66 §8): this module never logs it, never persists it, and never
+ * writes it anywhere — it lives only in request headers for the lifetime
+ * of a call. On 401 the credential source is re-read exactly once (the
+ * token may have been refreshed since process start), then the call fails
+ * with a message that tells the user how to log in.
+ *
+ * All network access goes through an injectable `fetch` so tests can drive
+ * the client from fixtures — no live Anthropic call is ever made from here.
+ */
+/** A claude.ai OAuth credential. `accessToken` is the bearer the API wants;
+ *  `orgUuid` is the `x-organization-uuid` header (from `~/.claude.json`'s
+ *  `.oauthAccount.organizationUuid`). NEVER logged or persisted. */
+interface CloudCredential {
+    accessToken: string;
+    orgUuid?: string;
+}
+/** Where the host reads the vendor login from (AIP-66 §8). Implementations
+ *  must not cache a token across an explicit invalidate() — a 401 re-read
+ *  has to be able to observe a refreshed login. */
+interface CredentialSource {
+    get(): Promise<CloudCredential>;
+}
+/** macOS keychain credential: `security find-generic-password -s "Claude
+ *  Code-credentials" -w` returns JSON whose `.claudeAiOauth.accessToken` is
+ *  the bearer; the org uuid comes from `~/.claude.json`. `execFile` and the
+ *  file reader are injectable for tests; the token never leaves this module
+ *  except as a request header. */
+declare function keychainCredentialSource(deps?: {
+    execFileImpl?: (cmd: string, args: string[]) => Promise<{
+        stdout: string;
+    }>;
+    readFileSyncImpl?: (path: string) => Promise<string>;
+    homedir?: () => string;
+}): CredentialSource;
+/** Env credential for hosts/tests that inject the login themselves:
+ *  CLAUDE_CLOUD_OAUTH_TOKEN (+ optional CLAUDE_CLOUD_ORG_UUID). */
+declare function envCredentialSource(env?: Record<string, string | undefined>): CredentialSource;
+/** One entry of GET /v1/code/sessions/{id}/events (newest first). The
+ *  `payload` is the Claude Code stream-json SDK message for `user` /
+ *  `assistant` / `result` events. */
+interface CloudSessionEvent {
+    created_at: string;
+    event_id: string;
+    event_type: string;
+    /** A STRING of an integer, strictly increasing within the session. The
+     *  ordering key: parse with `Number()` (see {@link eventSequence}). */
+    sequence_num: string;
+    /** Who produced the event — "worker" (the vendor's harness) or "client". */
+    source?: string;
+    payload: unknown;
+}
+interface CloudEventsPage {
+    data: CloudSessionEvent[];
+    /** The `sequence_num` of the OLDEST event on the page, present on the
+     *  first (newest) page. Pass back as `?cursor=<n>` to fetch the NEXT
+     *  OLDER page — the cursor pages BACKWARD in time, never forward. */
+    resume_cursor?: string;
+    /** Alias for {@link resume_cursor}, seen on the first page only. */
+    next_cursor?: string;
+}
+/** GET /v1/code/sessions/{id} — wrapped in `response_shape`. */
+interface CloudSessionState {
+    id: string;
+    title: string;
+    status: string;
+    status_bucket?: string;
+    worker_status?: string;
+    connection_status?: string;
+    last_event_at?: string;
+    session_url?: string;
+    post_turn_summary?: string;
+    [key: string]: unknown;
+}
+interface CloudGetSessionResponse {
+    response_shape: CloudSessionState;
+    [key: string]: unknown;
+}
+/** One entry of GET /v1/code/sessions — id is spelled `cse_<suffix>`, the
+ *  same suffix the CLI's `session_<suffix>` carries. */
+interface CloudSessionSummary {
+    id: string;
+    title: string;
+    status: "active" | "archived" | string;
+    environment_kind?: "anthropic_cloud" | "bridge" | string;
+    config?: {
+        model?: string;
+        origin?: string;
+        [key: string]: unknown;
+    };
+    created_at?: string;
+    [key: string]: unknown;
+}
+interface CloudListSessionsResponse {
+    data: CloudSessionSummary[];
+    resume_token?: string;
+}
+/**
+ * Normalize a session id to the API's own `cse_<suffix>` spelling. Accepts
+ * `session_<suffix>` (what the CLI prints and `--cloud` takes) and
+ * `cse_<suffix>` (what the API listing returns); rejects anything else so a
+ * malformed id can never be interpolated into a request path.
+ */
+declare function normalizeSessionId(id: string): string;
+/** Normalize to the CLI's own `session_<suffix>` spelling (for `--cloud`,
+ *  `--teleport`). Same acceptance set as {@link normalizeSessionId}. */
+declare function toCliSessionId(id: string): string;
+interface SessionsApiOptions {
+    /** Credential source; re-read once on a 401, then the call fails. */
+    credentials: CredentialSource;
+    /** Injectable fetch — tests pass a fixture router; default is globalThis.fetch. */
+    fetchImpl?: typeof fetch;
+    /** Override for proxies/mirrors; default https://api.anthropic.com. */
+    baseUrl?: string;
+}
+declare class SessionsApi {
+    #private;
+    constructor(options: SessionsApiOptions);
+    /** GET /v1/code/sessions/{id} */
+    getSession(id: string): Promise<CloudGetSessionResponse>;
+    /**
+     * GET /v1/code/sessions/{id}/events — newest first. With no `cursor` this
+     * returns the NEWEST page; pass the page's `resume_cursor` (the oldest
+     * event's `sequence_num`) as `cursor` to fetch the next OLDER page.
+     */
+    listEvents(id: string, opts?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<CloudEventsPage>;
+    /** GET /v1/code/sessions?limit=N */
+    listSessions(opts?: {
+        limit?: number;
+    }): Promise<CloudListSessionsResponse>;
+}
+
+/**
+ * The AIP-44 ACP server for Claude Code cloud sessions (AIP-66). This is
+ * the binary the daemon spawns (`bin/claude-code-cloud-acp.mjs` → dist):
+ * the vendor owns the machine and the harness, so this server does not run
+ * any agent — it relays.
+ *
+ *   - `session/new` validates the cwd as a pushed, clean git checkout
+ *     (AIP-66 §3) BEFORE any vendor side effect.
+ *   - first `session/prompt` → `claude --cloud "<prompt>"` (start), later
+ *     ones → `claude -p … --cloud <id>` (send-only).
+ *   - `session/load` RE-ATTACHES to the vendor session id the host
+ *     persisted on `meta.cloud.sessionId` (AIP-66 §5): the adopted id makes
+ *     the next prompt a `sendPrompt` — the relay never starts a replacement
+ *     vendor session.
+ *   - the learned identity (`{ vendor, sessionId, url }`) is reported to
+ *     the host through the meta file named by `AGENTPROTO_CLOUD_SESSION_META_FILE`
+ *     (meta-file.ts) — never a credential (AIP-66 §8).
+ *   - the turn is then observed via the sessions API: events are mapped
+ *     with @agentproto/adapter-claude-sdk's stream-json → ACP mappers
+ *     (the payloads ARE Claude Code stream-json SDK messages — reused, not
+ *     forked), and ONLY the vendor's own `result` event ends the prompt
+ *     (AIP-66 §6: never a timer, never silence). Transient read failures
+ *     (HTTP 5xx, network) are retried with backoff before the prompt fails.
+ *   - `result` carries `total_cost_usd` + `usage` → an ACP `usage_update`
+ *     (AIP-66 §7); a result without usage emits none — unmeasured, never
+ *     zero.
+ *   - `session/cancel` is unsupported: the vendor exposes no interrupt
+ *     verb, and AIP-66 §6 says a host without one reports it unsupported.
+ */
+
+/** Poll cadence: 2s, backing off to 10s while the turn is still running. */
+declare const POLL_INITIAL_MS = 2000;
+declare const POLL_MAX_MS = 10000;
+/** The observe surface the turn loop needs — satisfied by {@link SessionsApi}. */
+interface CloudEventsClient {
+    listEvents(id: string, opts?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<CloudEventsPage>;
+}
+/** The start/send surface — satisfied by cli.ts's functions. */
+interface CloudCliDeps {
+    startCloudSession(prompt: string, opts: {
+        cwd: string;
+    }): Promise<StartedCloudSession>;
+    sendPrompt(sessionId: string, text: string, opts: {
+        cwd: string;
+    }): Promise<{
+        stdout: string;
+    }>;
+}
+interface ClaudeCloudAcpDeps {
+    /** Events client. Default: real {@link SessionsApi} on the keychain login. */
+    api?: CloudEventsClient;
+    /** Vendor CLI. Default: cli.ts's start/send against the real runner. */
+    cli?: CloudCliDeps;
+    /** Repo-source validator (AIP-66 §3). Default: real git invocations. */
+    validateRepo?: (cwd: string) => Promise<void>;
+    sleep?: (ms: number) => Promise<void>;
+    pollInitialMs?: number;
+    pollMaxMs?: number;
+}
+/** Map a `result` event's payload to ACP updates. AIP-66 §7: usage is
+ *  reported only when the vendor's event carries it; absent usage is
+ *  UNMEASURED — never a fabricated zero. The shared mapper handles the
+ *  shape; we normalize the two fields it reads defensively (`modelUsage`,
+ *  `usage`). */
+declare function resultEventUpdates(payload: unknown): SessionUpdate[];
+/** Stop reason from the `result` payload: an error (or any non-success
+ *  subtype) stops as `refusal` — ACP has no dedicated error stop. */
+declare function resultStopReason(payload: unknown): StopReason;
+declare class ClaudeCloudAcpAgent implements Agent {
+    #private;
+    constructor(conn: AgentSideConnection, deps?: ClaudeCloudAcpDeps);
+    initialize(_params: InitializeRequest): Promise<InitializeResponse>;
+    authenticate(): Promise<void>;
+    newSession(params: NewSessionRequest): Promise<NewSessionResponse>;
+    /**
+     * AIP-66 §5 re-attach: ADOPT the vendor session id the host persisted on
+     * `meta.cloud.sessionId` as this ACP session's vendor session. No vendor
+     * side effect happens here — the next `session/prompt` goes through
+     * `sendPrompt` (`claude -p … --cloud <id>`), never `startCloudSession`,
+     * so a resumed relay can never replace the vendor's session with a new
+     * one. The adopted id is also reported back to the host's meta file so a
+     * re-attach against a fresh config dir still carries the §5 mapping.
+     *
+     * Fails closed on an id the vendor could never own (e.g. the ACP uuid of
+     * a spawn whose vendor id was never learned): no session is started in
+     * its place.
+     */
+    loadSession(params: LoadSessionRequest): Promise<LoadSessionResponse>;
+    prompt(params: PromptRequest): Promise<PromptResponse>;
+    /** Unsupported: the vendor exposes no interrupt verb (AIP-66 §6). Throwing
+     *  reports it — the in-flight poll loop is NOT aborted (we cannot stop the
+     *  cloud turn; lying "cancelled" would violate §6's end-on-vendor-event
+     *  rule). */
+    cancel(_params: CancelNotification): Promise<void>;
+    /** No runtime-configurable options (no model menu — the vendor picks the
+     *  model). Empty set so a host that tries to set one doesn't error. */
+    setSessionConfigOption(_params: SetSessionConfigOptionRequest): Promise<SetSessionConfigOptionResponse>;
+    /** No agent-specific modes; accept and ignore. */
+    setSessionMode(_params: SetSessionModeRequest): Promise<SetSessionModeResponse>;
+}
+/** Boot the ACP server over stdio — what bin/claude-code-cloud-acp.mjs runs. */
+declare function runAcpOverStdio(deps?: ClaudeCloudAcpDeps): AgentSideConnection;
+
+/**
+ * AIP-66 §5/§8 — how this relay REPORTS the learned vendor session
+ * identity to the host.
+ *
+ * The host (the runtime's `session-spawn.ts` + `cloud-vendors.ts`) hands
+ * the relay the path of a file inside the session's isolated config dir via
+ * `AGENTPROTO_CLOUD_SESSION_META_FILE`. Once the vendor has returned a
+ * session id — after `claude --cloud` prints it, or when `session/load`
+ * adopts the id persisted on `meta.cloud.sessionId` — the relay writes
+ * exactly the three §5 fields `{ vendor, sessionId, url }` there, and the
+ * host polls that file (`watchCloudSessionMeta`) to stamp
+ * `meta.cloud = { vendor, sessionId, url }` onto the descriptor.
+ *
+ * ONLY those three fields are ever written: the vendor's OAuth credential
+ * never enters this file, logs or events (AIP-66 §8). The write is
+ * best-effort and atomic (temp file + rename), so a failed side-file write
+ * can never sink the turn that learned the id — the host's poll simply
+ * keeps watching.
+ */
+/** Env var carrying the absolute path of the meta file. Mirrors the
+ *  runtime's `CLOUD_SESSION_META_FILE_ENV` (cloud-vendors.ts) — the two
+ *  must stay byte-identical or the relay writes where nobody reads. */
+declare const CLOUD_SESSION_META_FILE_ENV = "AGENTPROTO_CLOUD_SESSION_META_FILE";
+/** The vendor slug this adapter relays to (AIP-66 §2 `CloudVendor.slug`,
+ *  registry entry `anthropic` → adapter `claude-code-cloud`). */
+declare const CLOUD_VENDOR_SLUG = "anthropic";
+/** The §5 mapping the relay reports. NEVER carries a credential. */
+interface CloudSessionMetaReport {
+    vendor: string;
+    /** Vendor session id — CLI spelling (`session_<id>`). */
+    sessionId: string;
+    /** Session URL when known (the start path prints it; a re-attach may
+     *  inherit it from the file already on disk). */
+    url?: string;
+}
+/**
+ * Write `{ vendor, sessionId, url }` to the meta file the host named in
+ * `AGENTPROTO_CLOUD_SESSION_META_FILE`. Returns the path written, or null
+ * when the env var is unset or the write failed (best-effort: the host's
+ * poll retries, and a cloud turn must never fail over a side file).
+ *
+ * A re-attach (`session/load`) carries no URL — when the id on disk matches
+ * the one being reported, the existing `url` is preserved so the host's
+ * later read keeps the full §5 mapping.
+ */
+declare function writeCloudSessionMeta(meta: CloudSessionMetaReport, opts?: {
+    env?: Record<string, string | undefined>;
+}): Promise<string | null>;
+
+/**
+ * AIP-66 §3 (repo source): a managed cloud agent runs on a git remote and
+ * ref — never on an uploaded working tree. The host MUST refuse the spawn
+ * when `cwd` is not a git checkout with a remote, when the working tree is
+ * dirty, or when HEAD is not reachable from the remote.
+ *
+ * Pure git-invocation logic with an injectable runner so tests can drive
+ * every refusal from fixtures (no real repo required).
+ */
+/** Runs `git <args…>` in `cwd`; resolves with the exit code + streams. */
+type GitRunner = (args: string[], cwd: string) => Promise<{
+    code: number;
+    stdout: string;
+    stderr: string;
+}>;
+declare const defaultGitRunner: GitRunner;
+/**
+ * Refuse (throw) unless `cwd` is a clean git checkout whose HEAD is
+ * contained in some `origin/*` ref. Each error names the failed condition —
+ * the ACP server surfaces it as the `session/new` failure.
+ */
+declare function validateRepoSource(cwd: string, git?: GitRunner): Promise<void>;
+
+/**
+ * @agentproto/adapter-claude-code-cloud — AIP-66 managed cloud agent adapter
+ * for Anthropic Claude Code cloud sessions.
+ *
+ * Unlike `@agentproto/adapter-claude-code` (local harness, host machine),
+ * this adapter relays a session the VENDOR hosts end to end: the vendor
+ * boots the machine, runs Claude Code in it, and exposes the session
+ * through `claude --cloud` / `claude -p --cloud` plus the undocumented
+ * Claude Code sessions API. No agentproto daemon runs inside; the host
+ * controls neither the machine nor the harness — so this manifest is
+ * deliberately smaller and refuses the spawn fields that could never take
+ * effect (AIP-66 §4).
+ *
+ *   import { claudeCodeCloud } from "@agentproto/adapter-claude-code-cloud"
+ */
+
+declare const CLOUD_REFUSED_SPAWN_FIELDS: readonly ["sandbox", "worktree", "commandSandbox", "mcpServers", "daemonMount", "bundles", "browser", "appServe", "inference"];
+declare const claudeCodeCloud: AgentCliHandle;
+declare function claudeCodeCloudRuntime(): AgentCliRuntime;
+
+export { type AuthStatus, CLAUDE_CODE_GATEWAY_ENV_UNSET, CLOUD_REFUSED_SPAWN_FIELDS, CLOUD_SESSION_META_FILE_ENV, CLOUD_VENDOR_SLUG, ClaudeCloudAcpAgent, type ClaudeCloudAcpDeps, type CloudCliDeps, type CloudCliRunner, type CloudCredential, type CloudEventsClient, type CloudEventsPage, type CloudGetSessionResponse, type CloudSessionEvent, type CloudSessionMetaReport, type CloudSessionState, type CloudSessionSummary, type CredentialSource, type GitRunner, POLL_INITIAL_MS, POLL_MAX_MS, type RunOpts, type RunResult, SessionsApi, type SessionsApiOptions, type StartedCloudSession, claudeCodeCloud, claudeCodeCloudRuntime, cloudChildEnv, defaultCloudCliRunner, defaultGitRunner, envCredentialSource, keychainCredentialSource, normalizeSessionId, parseAuthStatus, parseCloudStartOutput, preflightAuth, resultEventUpdates, resultStopReason, runAcpOverStdio, sendPrompt, startCloudSession, toCliSessionId, validateRepoSource, writeCloudSessionMeta };

package/dist/index.mjs

@@ -0,0 +1,115 @@
+export { CLAUDE_CODE_GATEWAY_ENV_UNSET, CLOUD_SESSION_META_FILE_ENV, CLOUD_VENDOR_SLUG, ClaudeCloudAcpAgent, POLL_INITIAL_MS, POLL_MAX_MS, SessionsApi, cloudChildEnv, defaultCloudCliRunner, defaultGitRunner, envCredentialSource, keychainCredentialSource, normalizeSessionId, parseAuthStatus, parseCloudStartOutput, preflightAuth, resultEventUpdates, resultStopReason, runAcpOverStdio, sendPrompt, startCloudSession, toCliSessionId, validateRepoSource, writeCloudSessionMeta } from './chunk-RSQRK7X6.mjs';
+import { fileURLToPath } from 'url';
+import { defineAgentCli, createAgentCliRuntime } from '@agentproto/driver-agent-cli';
+
+/**
+ * @agentproto/adapter-claude-code-cloud v0.1.0
+ * AIP-66 managed cloud agent adapter: Claude Code cloud sessions behind ACP.
+ */
+var acpBin = fileURLToPath(
+  new URL("../bin/claude-code-cloud-acp.mjs", import.meta.url)
+);
+var CLOUD_REFUSED_SPAWN_FIELDS = [
+  "sandbox",
+  "worktree",
+  "commandSandbox",
+  "mcpServers",
+  "daemonMount",
+  "bundles",
+  "browser",
+  "appServe",
+  "inference"
+];
+var claudeCodeCloud = defineAgentCli({
+  name: "claude-code-cloud",
+  id: "claude-code-cloud",
+  description: "AIP-66 managed cloud agent adapter for Anthropic Claude Code cloud sessions. The vendor owns the machine and the harness: starts via `claude --cloud` (TTY), prompts via `claude -p --cloud <id>`, observes via the Claude Code sessions API, projected onto stdio ACP. Refuses the AIP-66 \xA74 spawn fields (sandbox, worktree, commandSandbox, mcpServers, daemonMount, bundles, browser, appServe, inference) \u2014 the vendor can never apply them. Requires a claude.ai sign-in (API-key auth is refused) and a clean, pushed git checkout.",
+  version: "0.1.0",
+  bin: "node",
+  bin_args: [acpBin],
+  install: [
+    {
+      method: "npm",
+      package: "@agentproto/adapter-claude-code-cloud",
+      global: true
+    }
+  ],
+  // Presence probe against the vendor client this adapter relays to — the
+  // pinned floor is the oldest CLI observed to support `--cloud` / the
+  // sessions API (AIP-66 Appendix A: 2.1.296–2.1.299).
+  version_check: {
+    cmd: "claude --version",
+    parse: "(\\d+\\.\\d+\\.\\d+)",
+    range: ">=2.1.296",
+    timeout_ms: 15e3
+  },
+  // Auth is the user's OWN claude.ai login inside the claude CLI (keychain
+  // on macOS) — never an injected env credential (AIP-66 §8). No `state.env`
+  // because an API-key env would be scrubbed, not consumed; the preflight
+  // refuses an api_key-authenticated CLI outright.
+  auth: {
+    ref: "./CLAUDE-CODE-CLOUD.md",
+    login: {
+      cmd: "claude auth login",
+      interactive: true
+    }
+  },
+  // The machine is the vendor's; there is no host-side sandbox to describe.
+  sandbox: "Managed cloud (AIP-66): the vendor boots the machine and runs Claude Code on it. No agentproto daemon runs inside; the session URL is surfaced so the user can inspect what ran.",
+  protocol: "acp",
+  acp: "./CLAUDE-CODE-CLOUD.md",
+  session: {
+    // One agentproto session = one vendor cloud session (AIP-66 §5);
+    // follow-up turns send to the same vendor session.
+    mode: "persistent",
+    idle_timeout_ms: 18e5,
+    context_carryover: true
+  },
+  // NO `models` menu: the vendor picks and bills the model inside its own
+  // harness; the host has no model to select or route (AIP-66 §4 — `model`
+  // is only meaningful when the vendor client accepts it, and this CLI's
+  // cloud path exposes no model flag).
+  capabilities: {
+    // Turns stream back as ACP updates while the vendor runs them.
+    streaming: true,
+    // The vendor harness's own tools (Read/Edit/Bash/…) surface as ACP
+    // tool_call / tool_call_update updates from the session's events.
+    tool_calls: true,
+    sub_agents: false,
+    file_io: true,
+    multimodal: false,
+    // Re-attach is via the persisted vendor session id (AIP-66 §5): the
+    // host hands it back as ACP `session/load`, which ADOPTS it — the next
+    // prompt is a send to that same vendor session, never a new start.
+    resumable: true,
+    // Send-only prompting: the CLI never returns the reply on the prompt
+    // path; the reply is observed via the sessions API.
+    bidirectional: false
+  },
+  tags: [
+    "claude-code",
+    "anthropic",
+    "cloud",
+    "aip-66",
+    "acp",
+    "agent-runtime",
+    "coding"
+  ],
+  metadata: {
+    aip: 66,
+    // The harness the vendor runs (AIP-66 §2 CloudVendor.harnesses).
+    harness: "claude-code",
+    cloud: {
+      vendor: "anthropic"
+    },
+    // AIP-66 §4 refused spawn fields, machine-readable for the host gate.
+    refusedSpawnFields: [...CLOUD_REFUSED_SPAWN_FIELDS]
+  }
+});
+function claudeCodeCloudRuntime() {
+  return createAgentCliRuntime(claudeCodeCloud);
+}
+
+export { CLOUD_REFUSED_SPAWN_FIELDS, claudeCodeCloud, claudeCodeCloudRuntime };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;AA4BA,IAAM,MAAA,GAAS,aAAA;AAAA,EACb,IAAI,GAAA,CAAI,kCAAA,EAAoC,MAAA,CAAA,IAAA,CAAY,GAAG;AAC7D,CAAA;AAMO,IAAM,0BAAA,GAA6B;AAAA,EACxC,SAAA;AAAA,EACA,UAAA;AAAA,EACA,gBAAA;AAAA,EACA,YAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF;AAEO,IAAM,kBAAkC,cAAA,CAAe;AAAA,EAC5D,IAAA,EAAM,mBAAA;AAAA,EACN,EAAA,EAAI,mBAAA;AAAA,EACJ,WAAA,EACE,ohBAAA;AAAA,EAQF,OAAA,EAAS,OAAA;AAAA,EACT,GAAA,EAAK,MAAA;AAAA,EACL,QAAA,EAAU,CAAC,MAAM,CAAA;AAAA,EACjB,OAAA,EAAS;AAAA,IACP;AAAA,MACE,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS,uCAAA;AAAA,MACT,MAAA,EAAQ;AAAA;AACV,GACF;AAAA;AAAA;AAAA;AAAA,EAIA,aAAA,EAAe;AAAA,IACb,GAAA,EAAK,kBAAA;AAAA,IACL,KAAA,EAAO,sBAAA;AAAA,IACP,KAAA,EAAO,WAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,EAAM;AAAA,IACJ,GAAA,EAAK,wBAAA;AAAA,IACL,KAAA,EAAO;AAAA,MACL,GAAA,EAAK,mBAAA;AAAA,MACL,WAAA,EAAa;AAAA;AACf,GACF;AAAA;AAAA,EAEA,OAAA,EACE,kLAAA;AAAA,EAGF,QAAA,EAAU,KAAA;AAAA,EACV,GAAA,EAAK,wBAAA;AAAA,EACL,OAAA,EAAS;AAAA;AAAA;AAAA,IAGP,IAAA,EAAM,YAAA;AAAA,IACN,eAAA,EAAiB,IAAA;AAAA,IACjB,iBAAA,EAAmB;AAAA,GACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,YAAA,EAAc;AAAA;AAAA,IAEZ,SAAA,EAAW,IAAA;AAAA;AAAA;AAAA,IAGX,UAAA,EAAY,IAAA;AAAA,IACZ,UAAA,EAAY,KAAA;AAAA,IACZ,OAAA,EAAS,IAAA;AAAA,IACT,UAAA,EAAY,KAAA;AAAA;AAAA;AAAA;AAAA,IAIZ,SAAA,EAAW,IAAA;AAAA;AAAA;AAAA,IAGX,aAAA,EAAe;AAAA,GACjB;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,aAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAA;AAAA,IACA,QAAA;AAAA,IACA,KAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,QAAA,EAAU;AAAA,IACR,GAAA,EAAK,EAAA;AAAA;AAAA,IAEL,OAAA,EAAS,aAAA;AAAA,IACT,KAAA,EAAO;AAAA,MACL,MAAA,EAAQ;AAAA,KACV;AAAA;AAAA,IAEA,kBAAA,EAAoB,CAAC,GAAG,0BAA0B;AAAA;AAEtD,CAAC;AAEM,SAAS,sBAAA,GAA0C;AACxD,EAAA,OAAO,sBAAsB,eAAe,CAAA;AAC9C","file":"index.mjs","sourcesContent":["/**\n * @agentproto/adapter-claude-code-cloud — AIP-66 managed cloud agent adapter\n * for Anthropic Claude Code cloud sessions.\n *\n * Unlike `@agentproto/adapter-claude-code` (local harness, host machine),\n * this adapter relays a session the VENDOR hosts end to end: the vendor\n * boots the machine, runs Claude Code in it, and exposes the session\n * through `claude --cloud` / `claude -p --cloud` plus the undocumented\n * Claude Code sessions API. No agentproto daemon runs inside; the host\n * controls neither the machine nor the harness — so this manifest is\n * deliberately smaller and refuses the spawn fields that could never take\n * effect (AIP-66 §4).\n *\n *   import { claudeCodeCloud } from \"@agentproto/adapter-claude-code-cloud\"\n */\n\nimport { fileURLToPath } from \"node:url\"\nimport {\n  createAgentCliRuntime,\n  defineAgentCli,\n  type AgentCliHandle,\n  type AgentCliRuntime,\n} from \"@agentproto/driver-agent-cli\"\n\n// Self-locating: the built handle spawns `node <this-pkg>/bin/…\n// claude-code-cloud-acp.mjs`. From dist/index.mjs the bin sits one level up,\n// so the same build works whether the daemon resolves this package from\n// node_modules or a user runs the published bin directly.\nconst acpBin = fileURLToPath(\n  new URL(\"../bin/claude-code-cloud-acp.mjs\", import.meta.url),\n)\n\n// AIP-66 §4 refused spawn fields — no meaning for a vendor-owned harness, so\n// the host MUST refuse a cloud spawn that sets any of them rather than\n// ignore them. Documented here (and in CLAUDE-CODE-CLOUD.md) so the runtime\n// gate and users share one list.\nexport const CLOUD_REFUSED_SPAWN_FIELDS = [\n  \"sandbox\",\n  \"worktree\",\n  \"commandSandbox\",\n  \"mcpServers\",\n  \"daemonMount\",\n  \"bundles\",\n  \"browser\",\n  \"appServe\",\n  \"inference\",\n] as const\n\nexport const claudeCodeCloud: AgentCliHandle = defineAgentCli({\n  name: \"claude-code-cloud\",\n  id: \"claude-code-cloud\",\n  description:\n    \"AIP-66 managed cloud agent adapter for Anthropic Claude Code cloud \" +\n    \"sessions. The vendor owns the machine and the harness: starts via \" +\n    \"`claude --cloud` (TTY), prompts via `claude -p --cloud <id>`, observes \" +\n    \"via the Claude Code sessions API, projected onto stdio ACP. Refuses \" +\n    \"the AIP-66 §4 spawn fields (sandbox, worktree, commandSandbox, \" +\n    \"mcpServers, daemonMount, bundles, browser, appServe, inference) — the \" +\n    \"vendor can never apply them. Requires a claude.ai sign-in (API-key \" +\n    \"auth is refused) and a clean, pushed git checkout.\",\n  version: \"0.1.0\",\n  bin: \"node\",\n  bin_args: [acpBin],\n  install: [\n    {\n      method: \"npm\",\n      package: \"@agentproto/adapter-claude-code-cloud\",\n      global: true,\n    },\n  ],\n  // Presence probe against the vendor client this adapter relays to — the\n  // pinned floor is the oldest CLI observed to support `--cloud` / the\n  // sessions API (AIP-66 Appendix A: 2.1.296–2.1.299).\n  version_check: {\n    cmd: \"claude --version\",\n    parse: \"(\\\\d+\\\\.\\\\d+\\\\.\\\\d+)\",\n    range: \">=2.1.296\",\n    timeout_ms: 15_000,\n  },\n  // Auth is the user's OWN claude.ai login inside the claude CLI (keychain\n  // on macOS) — never an injected env credential (AIP-66 §8). No `state.env`\n  // because an API-key env would be scrubbed, not consumed; the preflight\n  // refuses an api_key-authenticated CLI outright.\n  auth: {\n    ref: \"./CLAUDE-CODE-CLOUD.md\",\n    login: {\n      cmd: \"claude auth login\",\n      interactive: true,\n    },\n  },\n  // The machine is the vendor's; there is no host-side sandbox to describe.\n  sandbox:\n    \"Managed cloud (AIP-66): the vendor boots the machine and runs Claude \" +\n    \"Code on it. No agentproto daemon runs inside; the session URL is \" +\n    \"surfaced so the user can inspect what ran.\",\n  protocol: \"acp\",\n  acp: \"./CLAUDE-CODE-CLOUD.md\",\n  session: {\n    // One agentproto session = one vendor cloud session (AIP-66 §5);\n    // follow-up turns send to the same vendor session.\n    mode: \"persistent\",\n    idle_timeout_ms: 1_800_000,\n    context_carryover: true,\n  },\n  // NO `models` menu: the vendor picks and bills the model inside its own\n  // harness; the host has no model to select or route (AIP-66 §4 — `model`\n  // is only meaningful when the vendor client accepts it, and this CLI's\n  // cloud path exposes no model flag).\n  capabilities: {\n    // Turns stream back as ACP updates while the vendor runs them.\n    streaming: true,\n    // The vendor harness's own tools (Read/Edit/Bash/…) surface as ACP\n    // tool_call / tool_call_update updates from the session's events.\n    tool_calls: true,\n    sub_agents: false,\n    file_io: true,\n    multimodal: false,\n    // Re-attach is via the persisted vendor session id (AIP-66 §5): the\n    // host hands it back as ACP `session/load`, which ADOPTS it — the next\n    // prompt is a send to that same vendor session, never a new start.\n    resumable: true,\n    // Send-only prompting: the CLI never returns the reply on the prompt\n    // path; the reply is observed via the sessions API.\n    bidirectional: false,\n  },\n  tags: [\n    \"claude-code\",\n    \"anthropic\",\n    \"cloud\",\n    \"aip-66\",\n    \"acp\",\n    \"agent-runtime\",\n    \"coding\",\n  ],\n  metadata: {\n    aip: 66,\n    // The harness the vendor runs (AIP-66 §2 CloudVendor.harnesses).\n    harness: \"claude-code\",\n    cloud: {\n      vendor: \"anthropic\",\n    },\n    // AIP-66 §4 refused spawn fields, machine-readable for the host gate.\n    refusedSpawnFields: [...CLOUD_REFUSED_SPAWN_FIELDS],\n  },\n})\n\nexport function claudeCodeCloudRuntime(): AgentCliRuntime {\n  return createAgentCliRuntime(claudeCodeCloud)\n}\n\nexport {\n  ClaudeCloudAcpAgent,\n  runAcpOverStdio,\n  resultEventUpdates,\n  resultStopReason,\n  POLL_INITIAL_MS,\n  POLL_MAX_MS,\n  type ClaudeCloudAcpDeps,\n  type CloudCliDeps,\n  type CloudEventsClient,\n} from \"./acp-server.js\"\nexport {\n  CLOUD_SESSION_META_FILE_ENV,\n  CLOUD_VENDOR_SLUG,\n  writeCloudSessionMeta,\n  type CloudSessionMetaReport,\n} from \"./meta-file.js\"\nexport {\n  cloudChildEnv,\n  defaultCloudCliRunner,\n  parseAuthStatus,\n  parseCloudStartOutput,\n  preflightAuth,\n  sendPrompt,\n  startCloudSession,\n  CLAUDE_CODE_GATEWAY_ENV_UNSET,\n  type AuthStatus,\n  type CloudCliRunner,\n  type RunOpts,\n  type RunResult,\n  type StartedCloudSession,\n} from \"./cli.js\"\nexport {\n  SessionsApi,\n  envCredentialSource,\n  keychainCredentialSource,\n  normalizeSessionId,\n  toCliSessionId,\n  type CloudCredential,\n  type CloudEventsPage,\n  type CloudGetSessionResponse,\n  type CloudSessionEvent,\n  type CloudSessionState,\n  type CloudSessionSummary,\n  type CredentialSource,\n  type SessionsApiOptions,\n} from \"./sessions-api.js\"\nexport {\n  validateRepoSource,\n  defaultGitRunner,\n  type GitRunner,\n} from \"./repo-source.js\"\nexport type { AgentCliHandle, AgentCliRuntime }\n"]}

package/package.json

@@ -1,6 +1,74 @@
 {
   "name": "@agentproto/adapter-claude-code-cloud",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "@agentproto/adapter-claude-code-cloud — AIP-66 managed-cloud-agent adapter for Anthropic Claude Code cloud sessions. Relays `claude --cloud` / `claude -p --cloud` and the undocumented Claude Code sessions API behind an AIP-44 ACP server; the vendor owns the machine and the harness, no agentproto daemon runs inside.",
+  "keywords": [
+    "agentproto",
+    "aip-44",
+    "aip-45",
+    "aip-66",
+    "claude-code",
+    "anthropic",
+    "cloud",
+    "acp",
+    "agent-cli",
+    "adapter"
+  ],
+  "homepage": "https://agentproto.sh/docs/aip-45",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/agentproto/ts",
+    "directory": "adapters/claude-code-cloud"
+  },
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "dist/index.mjs",
+  "module": "dist/index.mjs",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "agentproto-claude-code-cloud-acp": "./bin/claude-code-cloud-acp.mjs"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "default": "./dist/index.mjs"
+    },
+    "./CLAUDE-CODE-CLOUD.md": "./CLAUDE-CODE-CLOUD.md",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "CLAUDE-CODE-CLOUD.md",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@agentclientprotocol/sdk": "^0.21.1",
+    "@agentproto/adapter-claude-sdk": "0.7.24",
+    "@agentproto/driver-agent-cli": "2.13.0",
+    "@agentproto/provider-presets": "0.7.0"
+  },
+  "optionalDependencies": {
+    "node-pty": "^1.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.5",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.7",
+    "@agentproto/tooling": "0.1.0"
+  },
+  "scripts": {
+    "dev": "tsup --watch",
+    "build": "tsup",
+    "clean": "rm -rf dist",
+    "check-types": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest"
+  }
 }