@agentproto/adapter-claude-code 0.1.1 → 1.0.0

package/CLAUDE-CODE.md

@@ -55,6 +55,15 @@ capabilities:
 modes:
   - id: default
     description: Standard interactive mode with per-tool permission prompts.
+  - id: lean
+    description: >-
+      Drop Claude Code's bundled skills and workflows from context (built-in
+      slash commands stay typable but are hidden from the model). Plugins,
+      project `.claude/skills/`, and `.claude/commands/` are unaffected. The
+      wrapper has no CLI flag for this — the underlying `claude` binary reads
+      `CLAUDE_CODE_DISABLE_BUNDLED_SKILLS` directly, so this mode is env-only.
+    env:
+      CLAUDE_CODE_DISABLE_BUNDLED_SKILLS: "1"
   - id: plan
     description: Plan-only mode — Claude Code reasons and proposes but does not edit or run commands.
     bin_args_append: ["--permission-mode", "plan"]
@@ -64,18 +73,103 @@ modes:
   - id: bypass-permissions
     description: Skip all permission prompts. Use only in trusted automation contexts.
     bin_args_append: ["--permission-mode", "bypassPermissions"]
+  - id: moonshot
+    description: >-
+      Moonshot (Kimi) gateway. Pre-wires ANTHROPIC_BASE_URL to Moonshot's
+      Anthropic-compatible endpoint and scrubs the ambient ANTHROPIC_API_KEY
+      (via env_unset) so it can't leak to the third-party host. Supply the
+      Moonshot key via the `auth_token` option and pick a model via `model`
+      (conventional: 'kimi-k2.7-code'). Without auth_token the spawn has no
+      credentials and fails cleanly.
+    env:
+      ANTHROPIC_BASE_URL: https://api.moonshot.ai/anthropic
+    env_unset:
+      - ANTHROPIC_API_KEY
+      - CLAUDE_CODE_USE_BEDROCK
+      - CLAUDE_CODE_USE_VERTEX
+      - CLAUDE_CODE_USE_FOUNDRY
+      - CLAUDE_CODE_USE_ANTHROPIC_AWS
+      - CLAUDE_CODE_USE_MANTLE
+      - CLAUDE_CODE_USE_GATEWAY
+  - id: openrouter
+    description: >-
+      OpenRouter gateway. Pre-wires ANTHROPIC_BASE_URL to OpenRouter's
+      Anthropic-compatible endpoint and scrubs the ambient ANTHROPIC_API_KEY
+      (same auth-hygiene rationale as `moonshot`). Pick a model via `model`
+      (e.g. 'z-ai/glm-5.2', 'moonshotai/kimi-k2') and supply the OpenRouter
+      key via `auth_token`.
+    env:
+      ANTHROPIC_BASE_URL: https://openrouter.ai/api/v1
+    env_unset:
+      - ANTHROPIC_API_KEY
+      - CLAUDE_CODE_USE_BEDROCK
+      - CLAUDE_CODE_USE_VERTEX
+      - CLAUDE_CODE_USE_FOUNDRY
+      - CLAUDE_CODE_USE_ANTHROPIC_AWS
+      - CLAUDE_CODE_USE_MANTLE
+      - CLAUDE_CODE_USE_GATEWAY
+  - id: deepseek
+    description: >-
+      DeepSeek gateway. Pre-wires ANTHROPIC_BASE_URL to DeepSeek's
+      Anthropic-compatible endpoint and scrubs the ambient ANTHROPIC_API_KEY
+      (same auth-hygiene rationale as `moonshot`/`openrouter`). Pick a model
+      via `model` (conventional: 'deepseek-v4-pro', 'deepseek-v4-flash') and
+      supply the DeepSeek key via `auth_token`.
+    env:
+      ANTHROPIC_BASE_URL: https://api.deepseek.com/anthropic
+    env_unset:
+      - ANTHROPIC_API_KEY
+      - CLAUDE_CODE_USE_BEDROCK
+      - CLAUDE_CODE_USE_VERTEX
+      - CLAUDE_CODE_USE_FOUNDRY
+      - CLAUDE_CODE_USE_ANTHROPIC_AWS
+      - CLAUDE_CODE_USE_MANTLE
+      - CLAUDE_CODE_USE_GATEWAY
 options:
   - id: model
-    type: enum
-    enum: [claude-sonnet-4-6, claude-opus-4-7, claude-haiku-4-5]
-    description: Override the default model for this operator binding.
-    bin_args_template: ["--model", "{value}"]
+    type: string
+    description: >-
+      Anthropic model ID or wrapper alias (e.g. 'claude-sonnet-5', 'sonnet',
+      'opus'), applied via ACP session/set_config_option after the session is
+      created. An id the wrapper can't resolve is warned about and ignored
+      (the session keeps the claude-code default). Omit to use the default.
+      Required for non-Claude models reached through a gateway mode
+      (e.g. 'deepseek-v4-pro' under `deepseek`, 'kimi-k2.7-code' under `moonshot`).
   - id: max_turns
     type: integer
     min: 1
     max: 200
     description: Hard cap on tool-use turns within a single send. Claude Code stops after this many cycles.
     bin_args_template: ["--max-turns", "{value}"]
+  - id: base_url
+    type: string
+    description: >-
+      Custom Anthropic base URL, injected as ANTHROPIC_BASE_URL. Front real
+      Anthropic, Bedrock/Vertex/Azure, or an Anthropic-compatible gateway.
+      Setting it auto-scrubs the ambient ANTHROPIC_API_KEY and all cloud-provider
+      toggles (Bedrock/Vertex/Foundry/Mantle) so it can't leak to a third-party
+      host — pair with `auth_token` to supply a per-spawn gateway key. The
+      `moonshot`/`openrouter`/`deepseek` modes are pre-wired presets over this
+      same shape.
+    env:
+      ANTHROPIC_BASE_URL: "{value}"
+    env_unset:
+      - ANTHROPIC_API_KEY
+      - CLAUDE_CODE_USE_BEDROCK
+      - CLAUDE_CODE_USE_VERTEX
+      - CLAUDE_CODE_USE_FOUNDRY
+      - CLAUDE_CODE_USE_ANTHROPIC_AWS
+      - CLAUDE_CODE_USE_MANTLE
+      - CLAUDE_CODE_USE_GATEWAY
+  - id: auth_token
+    type: string
+    description: >-
+      Bearer token for the Anthropic API or a compatible gateway, injected as
+      ANTHROPIC_AUTH_TOKEN (sent as `Authorization: Bearer`). Pair with
+      `base_url` (or a `moonshot`/`openrouter`/`deepseek` mode) to target a
+      gateway with a per-spawn key instead of the ambient ANTHROPIC_API_KEY.
+    env:
+      ANTHROPIC_AUTH_TOKEN: "{value}"
 continuation:
   # `native-resume` is the right default now that the wrapper supports
   # `loadSession`: each turn cold-spawns claude with no overhead, then

package/LICENSE

@@ -1,21 +1,202 @@
-MIT License
-
-Copyright (c) 2026 agentproto contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/index.mjs

@@ -1,10 +1,23 @@
 import { defineAgentCli, createAgentCliRuntime } from '@agentproto/driver-agent-cli';
+import { ANTHROPIC_CORE_SCRUB_ENV, ANTHROPIC_GATEWAY_PRESETS } from '@agentproto/provider-presets';
 
 /**
  * @agentproto/adapter-claude-code v0.1.0-alpha
  * AIP-45 adapter for Anthropic's Claude Code via @agentclientprotocol/claude-agent-acp.
  */
 
+var CLAUDE_CODE_CLOUD_TOGGLES = [
+  "CLAUDE_CODE_USE_BEDROCK",
+  "CLAUDE_CODE_USE_VERTEX",
+  "CLAUDE_CODE_USE_FOUNDRY",
+  "CLAUDE_CODE_USE_ANTHROPIC_AWS",
+  "CLAUDE_CODE_USE_MANTLE",
+  "CLAUDE_CODE_USE_GATEWAY"
+];
+var CLAUDE_CODE_GATEWAY_ENV_UNSET = [
+  ...ANTHROPIC_CORE_SCRUB_ENV,
+  ...CLAUDE_CODE_CLOUD_TOGGLES
+];
 var claudeCode = defineAgentCli({
   name: "claude-code",
   id: "claude-code",
@@ -29,6 +42,40 @@ var claudeCode = defineAgentCli({
     ref: "./SECRETS.md",
     state: { env: ["ANTHROPIC_API_KEY"] }
   },
+  // Deterministic billing-auth (subscription vs api-key), resolved by the
+  // runtime (@agentproto/runtime's resolveAuthSpec) and applied MECHANICALLY
+  // by the driver. EXPLICIT credential selection, not scrub-by-absence: the
+  // resolver SETS exactly one credential env var (from a named config/store
+  // ref, never the ambient shell) and SCRUBS the conflicting one(s), so which
+  // credential — and thus which billing — a spawn uses is *stated*, never
+  // inferred from whatever the daemon's launching shell exported (the outage
+  // this surface exists to prevent).
+  //
+  // provider "anthropic" ⇒ api-key mode SETS providerEnvVar("anthropic") =
+  // ANTHROPIC_API_KEY (derived from the catalog, not re-listed here) and
+  // scrubs the subscription-family creds (CLAUDE_CODE_OAUTH_TOKEN +
+  // ANTHROPIC_AUTH_TOKEN). authEnforce "always" preserves #312: claude-code
+  // engages on EVERY spawn and fails fast with no credential.
+  //
+  // authSubscription: "subscription" SETS CLAUDE_CODE_OAUTH_TOKEN to a bearer
+  // token minted via `claude setup-token` (bills Max/Pro, not API credits) —
+  // the var Claude Code documents for that token and the ONLY one that yields
+  // the clean native claude.ai-login path. (The same token as
+  // ANTHROPIC_AUTH_TOKEN authenticates but is treated as a generic override
+  // that disables connectors — the degraded path, so it's a `conflictEnv` to
+  // scrub, never the setEnv.) `conflictEnv` (ANTHROPIC_AUTH_TOKEN) is scrubbed
+  // in BOTH modes; `unsetEnvAdd` (cloud toggles + ANTHROPIC_BASE_URL) only in
+  // subscription (native) mode — matching #312's exact byte-for-byte scrub set
+  // in each mode (asserted by the regression snapshot test). ANTHROPIC_API_KEY
+  // is NOT listed in unsetEnvAdd because it derives from providerEnvVar and is
+  // scrubbed as the non-set credential automatically.
+  provider: "anthropic",
+  authEnforce: "always",
+  authSubscription: {
+    setEnv: "CLAUDE_CODE_OAUTH_TOKEN",
+    conflictEnv: ["ANTHROPIC_AUTH_TOKEN"],
+    unsetEnvAdd: [...CLAUDE_CODE_CLOUD_TOGGLES, "ANTHROPIC_BASE_URL"]
+  },
   sandbox: "./SANDBOX.md",
   protocol: "acp",
   acp: "./claude-code-acp.ACP.md",
@@ -37,15 +84,20 @@ var claudeCode = defineAgentCli({
     idle_timeout_ms: 18e5,
     context_carryover: true
   },
+  // Every id below is validated against the wrapper's live
+  // `session/new` → configOptions[model] selector: the wrapper resolves
+  // these (via its own `resolveModelPreference`) and rejects anything it
+  // can't — a rejected `session/set_config_option` used to kill the spawn
+  // (agentproto#186; the apply is now best-effort, see @agentproto/acp's
+  // newSession). Stale ids that the wrapper no longer offers were removed:
+  // `claude-sonnet-4-6` (the old default), `claude-opus-4-7`, `claude-opus-4-6`.
   models: {
-    default: "claude-sonnet-4-6",
+    default: "claude-sonnet-5",
     allowed: [
       "claude-sonnet-5",
-      "claude-sonnet-4-6",
       "claude-opus-4-8",
-      "claude-opus-4-7",
-      "claude-opus-4-6",
-      "claude-haiku-4-5"
+      "claude-haiku-4-5",
+      "claude-fable-5"
     ],
     env: { anthropic: "ANTHROPIC_API_KEY" }
   },
@@ -104,6 +156,11 @@ var claudeCode = defineAgentCli({
   // against a repo actively trying to escalate its own trust level.
   modes: [
     { id: "default", description: "Standard interactive mode." },
+    {
+      id: "lean",
+      description: "Drop Claude Code's bundled skills and workflows from context (built-in slash commands stay typable but are hidden from the model). Plugins, project `.claude/skills/`, and `.claude/commands/` are unaffected. The ACP wrapper has no CLI flag for this \u2014 the underlying claude binary reads CLAUDE_CODE_DISABLE_BUNDLED_SKILLS directly, so this mode is env-only.",
+      env: { CLAUDE_CODE_DISABLE_BUNDLED_SKILLS: "1" }
+    },
     {
       id: "plan",
       description: "Plan-only mode \u2014 Claude Code reasons and proposes a plan, requesting explicit approval before writing files or running commands. Applied via a per-session CLAUDE_CONFIG_DIR override (see comment above `modes`); can be defeated by a target repo's own committed, escalated .claude/settings.json.",
@@ -118,6 +175,43 @@ var claudeCode = defineAgentCli({
       id: "bypass-permissions",
       description: "Skip all permission prompts. Use only in trusted automation contexts.",
       bin_args_append: ["--permission-mode", "bypassPermissions"]
+    },
+    // ── Gateway modes ───────────────────────────────────────────────
+    // The claude binary honors ANTHROPIC_BASE_URL + ANTHROPIC_AUTH_TOKEN,
+    // so it can front any Anthropic-compatible gateway (Moonshot, OpenRouter,
+    // LiteLLM, claude-code-router) the same way @agentproto/adapter-claude-sdk
+    // does. These modes pre-wire the endpoint and — critically — scrub the
+    // ambient ANTHROPIC_API_KEY plus the cloud-provider redirect toggles
+    // (CLAUDE_CODE_USE_BEDROCK/_VERTEX/…) via env_unset so the real Anthropic
+    // credential can neither leak to nor 401 against a third-party host, and
+    // a leftover cloud toggle can't override the gateway base_url. The
+    // operator supplies the gateway key via the `auth_token` option (injected
+    // as ANTHROPIC_AUTH_TOKEN, sent as `Authorization: Bearer`) and picks a
+    // model via `model` (e.g. 'kimi-k2.7-code', 'z-ai/glm-5.2') — the ACP
+    // wrapper applies it via session/set_config_option after newSession.
+    {
+      id: ANTHROPIC_GATEWAY_PRESETS.moonshot.id,
+      description: "Moonshot (Kimi) gateway. Pre-wires ANTHROPIC_BASE_URL to Moonshot's Anthropic-compatible endpoint and scrubs the ambient ANTHROPIC_API_KEY so it can't leak to the third-party host. Supply the Moonshot key via the `auth_token` option and pick a model via `model` (conventional: 'kimi-k2.7-code'). Without auth_token the spawn has no credentials and fails cleanly \u2014 the real Anthropic key is never sent.",
+      env: {
+        ANTHROPIC_BASE_URL: ANTHROPIC_GATEWAY_PRESETS.moonshot.baseUrl
+      },
+      env_unset: CLAUDE_CODE_GATEWAY_ENV_UNSET
+    },
+    {
+      id: ANTHROPIC_GATEWAY_PRESETS.openrouter.id,
+      description: "OpenRouter gateway. Pre-wires ANTHROPIC_BASE_URL to OpenRouter's Anthropic-compatible endpoint and scrubs the ambient ANTHROPIC_API_KEY (same auth-hygiene rationale as `moonshot`). Pick a model via `model` (e.g. 'z-ai/glm-5.2', 'deepseek/deepseek-v4-pro', 'moonshotai/kimi-k2') and supply the OpenRouter key via `auth_token`.",
+      env: {
+        ANTHROPIC_BASE_URL: ANTHROPIC_GATEWAY_PRESETS.openrouter.baseUrl
+      },
+      env_unset: CLAUDE_CODE_GATEWAY_ENV_UNSET
+    },
+    {
+      id: ANTHROPIC_GATEWAY_PRESETS.deepseek.id,
+      description: "DeepSeek gateway. Pre-wires ANTHROPIC_BASE_URL to DeepSeek's Anthropic-compatible endpoint and scrubs the ambient ANTHROPIC_API_KEY (same auth-hygiene rationale as `moonshot`/`openrouter`). Pick a model via `model` (conventional: 'deepseek-v4-pro', 'deepseek-v4-flash') and supply the DeepSeek key via `auth_token`.",
+      env: {
+        ANTHROPIC_BASE_URL: ANTHROPIC_GATEWAY_PRESETS.deepseek.baseUrl
+      },
+      env_unset: CLAUDE_CODE_GATEWAY_ENV_UNSET
     }
   ],
   options: [
@@ -125,12 +219,12 @@ var claudeCode = defineAgentCli({
       id: "model",
       // string (not enum) so any valid Anthropic model ID is accepted
       // without requiring a code change to expand the list. Applied via
-      // ACP session/set_config_option(configId:"model") after newSession
-      // — the claude-agent-acp wrapper does not forward its own CLI args
-      // to the underlying claude process, so bin_args_template alone
-      // cannot select the model.
+      // ANTHROPIC_MODEL env var so the claude binary picks it up directly
+      // — the claude-agent-acp wrapper only forwards CLI args when --cli
+      // is passed, otherwise it runs in ACP mode and ignores argv.
       type: "string",
-      description: "Anthropic model ID (e.g. 'claude-opus-4-8', 'claude-sonnet-4-6'). Applied via ACP session/set_config_option after the session is created. Omit to use the claude-code default."
+      description: "Anthropic model ID or wrapper alias (e.g. 'claude-opus-4-8', 'claude-sonnet-5', 'sonnet', 'opus'). Set via ANTHROPIC_MODEL env var so the claude binary uses it directly. Omit to use the claude-code default.",
+      env: { ANTHROPIC_MODEL: "{value}" }
     },
     {
       id: "effort",
@@ -151,6 +245,35 @@ var claudeCode = defineAgentCli({
       max: 200,
       description: "Hard cap on tool-use turns within a single send. Claude Code stops after this many cycles.",
       bin_args_template: ["--max-turns", "{value}"]
+    },
+    {
+      id: "base_url",
+      // Injected into the child env as ANTHROPIC_BASE_URL — the claude binary
+      // honors it, so this fronts real Anthropic, Bedrock/Vertex/Azure, or an
+      // Anthropic-compatible gateway (LiteLLM / claude-code-router / Moonshot
+      // / OpenRouter). Auto-scrubs the ambient ANTHROPIC_API_KEY + cloud
+      // redirect toggles the moment it's set (symmetric with the moonshot/
+      // openrouter modes and with claude-sdk's buildQueryOptions scrub) so the
+      // real Anthropic credential can never leak to a third-party host — pair
+      // with `auth_token` to supply the gateway key. A base_url pointed at a
+      // real-Anthropic mirror that still wants the ambient key is the one
+      // shape this breaks; that's an acceptable trade for the default being
+      // leak-safe (matches claude-sdk).
+      type: "string",
+      description: "Custom Anthropic base URL. Injected as ANTHROPIC_BASE_URL in the child env \u2014 front real Anthropic, Bedrock/Vertex/Azure, or an Anthropic-compatible gateway. Auto-scrubs the ambient ANTHROPIC_API_KEY + cloud redirect toggles when set (so the real key can't leak to a third-party host) \u2014 pair with `auth_token` to supply the gateway credential. For Moonshot/OpenRouter the dedicated modes pre-wire the URL too. Omit to use the default endpoint.",
+      env: { ANTHROPIC_BASE_URL: "{value}" },
+      env_unset: CLAUDE_CODE_GATEWAY_ENV_UNSET
+    },
+    {
+      id: "auth_token",
+      // Injected into the child env as ANTHROPIC_AUTH_TOKEN — the claude
+      // binary sends it as `Authorization: Bearer <token>`, which
+      // Anthropic-compatible gateways (Moonshot, OpenRouter) accept. Pair
+      // with base_url (or a gateway mode) for a per-spawn key instead of the
+      // ambient ANTHROPIC_API_KEY.
+      type: "string",
+      description: "Bearer token for the Anthropic API or a compatible gateway. Injected as ANTHROPIC_AUTH_TOKEN in the child env (sent as `Authorization: Bearer`). Pair with `base_url` (or a `moonshot`/`openrouter` mode) to target a gateway with a per-spawn key instead of the ambient ANTHROPIC_API_KEY. Omit to use ANTHROPIC_API_KEY from the environment.",
+      env: { ANTHROPIC_AUTH_TOKEN: "{value}" }
     }
   ],
   continuation: {
@@ -171,7 +294,20 @@ var claudeCode = defineAgentCli({
       key_scope: ["conversation", "operator"]
     }
   },
-  tags: ["claude-code", "anthropic", "acp", "agent-runtime", "coding"]
+  tags: ["claude-code", "anthropic", "acp", "agent-runtime", "coding"],
+  metadata: {
+    // Opts claude-code into `agentproto install skill/<slug>` fan-out (no
+    // --target given). Claude Code skills install as a whole plugin
+    // bundle, not per-skill drops — `unit: "whole-pack"` tells the
+    // fan-out dispatcher to emit the pack once, not once per requested
+    // skill slug. See
+    // packages/cli/src/commands/skill-install/types.ts `AdapterSkillsTarget`.
+    skills: {
+      format: "claude-plugin",
+      unit: "whole-pack",
+      outDir: "~/.claude/plugins/agentproto"
+    }
+  }
 });
 function claudeCodeRuntime() {
   return createAgentCliRuntime(claudeCode);

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;AAYO,IAAM,aAA6B,cAAA,CAAe;AAAA,EACvD,IAAA,EAAM,aAAA;AAAA,EACN,EAAA,EAAI,aAAA;AAAA,EACJ,WAAA,EACE,uLAAA;AAAA,EACF,OAAA,EAAS,OAAA;AAAA,EACT,GAAA,EAAK,KAAA;AAAA,EACL,QAAA,EAAU,CAAC,IAAA,EAAM,uCAAuC,CAAA;AAAA,EACxD,OAAA,EAAS;AAAA,IACP;AAAA,MACE,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS,uCAAA;AAAA,MACT,MAAA,EAAQ;AAAA;AACV,GACF;AAAA,EACA,aAAA,EAAe;AAAA,IACb,GAAA,EAAK,wDAAA;AAAA,IACL,KAAA,EAAO,sBAAA;AAAA,IACP,KAAA,EAAO,UAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,GAAA,EAAK,cAAA;AAAA,IACL,KAAA,EAAO,EAAE,GAAA,EAAK,CAAC,mBAAmB,CAAA;AAAE,GACtC;AAAA,EACA,OAAA,EAAS,cAAA;AAAA,EACT,QAAA,EAAU,KAAA;AAAA,EACV,GAAA,EAAK,0BAAA;AAAA,EACL,OAAA,EAAS;AAAA,IACP,IAAA,EAAM,YAAA;AAAA,IACN,eAAA,EAAiB,IAAA;AAAA,IACjB,iBAAA,EAAmB;AAAA,GACrB;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,OAAA,EAAS,mBAAA;AAAA,IACT,OAAA,EAAS;AAAA,MACP,iBAAA;AAAA,MACA,mBAAA;AAAA,MACA,iBAAA;AAAA,MACA,iBAAA;AAAA,MACA,iBAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,GAAA,EAAK,EAAE,SAAA,EAAW,mBAAA;AAAoB,GACxC;AAAA,EACA,YAAA,EAAc;AAAA,IACZ,SAAA,EAAW,IAAA;AAAA,IACX,UAAA,EAAY,IAAA;AAAA,IACZ,UAAA,EAAY,KAAA;AAAA,IACZ,OAAA,EAAS,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKT,UAAA,EAAY,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQZ,SAAA,EAAW,IAAA;AAAA,IACX,aAAA,EAAe,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOf,WAAA,EAAa;AAAA,GACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,KAAA,EAAO;AAAA,IACL,EAAE,EAAA,EAAI,SAAA,EAAW,WAAA,EAAa,4BAAA,EAA6B;AAAA,IAC3D;AAAA,MACE,EAAA,EAAI,MAAA;AAAA,MACJ,WAAA,EACE,4SAAA;AAAA,MAIF,eAAA,EAAiB,CAAC,mBAAA,EAAqB,MAAM;AAAA,KAC/C;AAAA,IACA;AAAA,MACE,EAAA,EAAI,cAAA;AAAA,MACJ,WAAA,EAAa,gDAAA;AAAA,MACb,eAAA,EAAiB,CAAC,mBAAA,EAAqB,aAAa;AAAA,KACtD;AAAA,IACA;AAAA,MACE,EAAA,EAAI,oBAAA;AAAA,MACJ,WAAA,EACE,uEAAA;AAAA,MACF,eAAA,EAAiB,CAAC,mBAAA,EAAqB,mBAAmB;AAAA;AAC5D,GACF;AAAA,EACA,OAAA,EAAS;AAAA,IACP;AAAA,MACE,EAAA,EAAI,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOJ,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EACE;AAAA,KAGJ;AAAA,IACA;AAAA,MACE,EAAA,EAAI,QAAA;AAAA,MACJ,IAAA,EAAM,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAON,MAAM,CAAC,KAAA,EAAO,UAAU,MAAA,EAAQ,OAAA,EAAS,OAAO,WAAW,CAAA;AAAA,MAC3D,WAAA,EACE;AAAA,KAIJ;AAAA,IACA;AAAA,MACE,EAAA,EAAI,WAAA;AAAA,MACJ,IAAA,EAAM,SAAA;AAAA,MACN,GAAA,EAAK,CAAA;AAAA,MACL,GAAA,EAAK,GAAA;AAAA,MACL,WAAA,EACE,4FAAA;AAAA,MACF,iBAAA,EAAmB,CAAC,aAAA,EAAe,SAAS;AAAA;AAC9C,GACF;AAAA,EACA,YAAA,EAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWZ,OAAA,EAAS,eAAA;AAAA,IACT,SAAA,EAAW,CAAC,eAAA,EAAiB,gBAAA,EAAkB,cAAc,MAAM,CAAA;AAAA,IACnE,cAAA,EAAgB;AAAA,MACd,eAAA,EAAiB,IAAA;AAAA,MACjB,SAAA,EAAW,CAAC,cAAA,EAAgB,UAAU;AAAA;AACxC,GACF;AAAA,EACA,MAAM,CAAC,aAAA,EAAe,WAAA,EAAa,KAAA,EAAO,iBAAiB,QAAQ;AACrE,CAAC;AAEM,SAAS,iBAAA,GAAqC;AACnD,EAAA,OAAO,sBAAsB,UAAU,CAAA;AACzC","file":"index.mjs","sourcesContent":["/**\n * @agentproto/adapter-claude-code — AIP-45 adapter for Anthropic's\n * Claude Code via the @agentclientprotocol/claude-agent-acp wrapper.\n */\n\nimport {\n  createAgentCliRuntime,\n  defineAgentCli,\n  type AgentCliHandle,\n  type AgentCliRuntime,\n} from \"@agentproto/driver-agent-cli\"\n\nexport const claudeCode: AgentCliHandle = defineAgentCli({\n  name: \"claude-code\",\n  id: \"claude-code\",\n  description:\n    \"Anthropic's Claude Code wrapped as an ACP agent via @agentclientprotocol/claude-agent-acp. Spawned via `npx -y @agentclientprotocol/claude-agent-acp` and driven over stdio JSON-RPC.\",\n  version: \"0.1.0\",\n  bin: \"npx\",\n  bin_args: [\"-y\", \"@agentclientprotocol/claude-agent-acp\"],\n  install: [\n    {\n      method: \"npm\",\n      package: \"@agentclientprotocol/claude-agent-acp\",\n      global: true,\n    },\n  ],\n  version_check: {\n    cmd: \"npm view @agentclientprotocol/claude-agent-acp version\",\n    parse: \"(\\\\d+\\\\.\\\\d+\\\\.\\\\d+)\",\n    range: \">=0.30.0\",\n    timeout_ms: 15_000,\n  },\n  auth: {\n    ref: \"./SECRETS.md\",\n    state: { env: [\"ANTHROPIC_API_KEY\"] },\n  },\n  sandbox: \"./SANDBOX.md\",\n  protocol: \"acp\",\n  acp: \"./claude-code-acp.ACP.md\",\n  session: {\n    mode: \"persistent\",\n    idle_timeout_ms: 1_800_000,\n    context_carryover: true,\n  },\n  models: {\n    default: \"claude-sonnet-4-6\",\n    allowed: [\n      \"claude-sonnet-5\",\n      \"claude-sonnet-4-6\",\n      \"claude-opus-4-8\",\n      \"claude-opus-4-7\",\n      \"claude-opus-4-6\",\n      \"claude-haiku-4-5\",\n    ],\n    env: { anthropic: \"ANTHROPIC_API_KEY\" },\n  },\n  capabilities: {\n    streaming: true,\n    tool_calls: true,\n    sub_agents: false,\n    file_io: true,\n    // ACP wrapper forwards `image` content blocks in user prompts\n    // straight to Anthropic Messages API. Hosts SHOULD send images\n    // inline (see CLAUDE-CODE.md) instead of passing paths and\n    // hoping the model uses Read.\n    multimodal: true,\n    // The wrapper (@agentclientprotocol/claude-agent-acp >= 0.30)\n    // advertises `loadSession: true` and exposes the full session\n    // lifecycle (newSession / loadSession / resumeSession / forkSession)\n    // over JSON-RPC. Pairs with `continuation.default: native-resume`\n    // below — the host persists the sessionId and reattaches to the\n    // existing session across cold starts (api restart, sandbox reap,\n    // multi-machine).\n    resumable: true,\n    bidirectional: true,\n    // Claude Code's Read tool can ingest any absolute path the host\n    // surfaces via the prompt. Pair with the daemon's POST /files/upload\n    // route + a host UI drag-drop handler: drop a file → daemon writes\n    // to `cwd/.agentproto-attachments/<name>` → host pastes the path\n    // into the terminal → Claude reads it natively. No protocol-level\n    // multimodal round-trip needed; pure file-path injection.\n    file_attach: true,\n  },\n  // `bin_args_append: [\"--permission-mode\", ...]` below is a no-op against\n  // the @agentclientprotocol/claude-agent-acp wrapper — it never reads\n  // `--permission-mode` from argv. The wrapper instead resolves\n  // `permissions.defaultMode` exclusively via the SDK's `resolveSettings`,\n  // which merges `${CLAUDE_CONFIG_DIR}/settings.json` (user tier),\n  // `<cwd>/.claude/settings(.local).json` (project tier), and a managed\n  // tier. The driver (`packages/driver/agent-cli/src/define-agent-cli.ts`,\n  // `resolveClaudeCodePermissionMode`) makes the mode actually take effect\n  // by pointing a per-session `CLAUDE_CONFIG_DIR` at a throwaway temp dir\n  // containing `{\"permissions\":{\"defaultMode\":\"<value>\"}}` — reading the\n  // same `--permission-mode <value>` pair declared here as its one source\n  // of truth for the value vocabulary. `bin_args_append` is kept for a\n  // future wrapper version that might start reading argv.\n  //\n  // Known limitation (empirically confirmed, not just theorized): a target\n  // repo that commits its own escalated `.claude/settings.json`\n  // `permissions.defaultMode` (e.g. \"bypassPermissions\") does NOT let the\n  // repo's escalation win — the wrapper's `filterEscalatingDefaultMode`\n  // strips an escalating project-tier value entirely — but it also means\n  // OUR requested mode is defeated in the same merge pass (project tier\n  // out-prioritizes the user tier for the raw merge, before the filter\n  // ever runs). The net effect for that adversarial case is the session\n  // falls back to \"default\" (normal per-action prompting) rather than the\n  // requested mode. This does not reintroduce the original bug (silent,\n  // zero-prompt writes) — it just doesn't guarantee plan-only reasoning\n  // against a repo actively trying to escalate its own trust level.\n  modes: [\n    { id: \"default\", description: \"Standard interactive mode.\" },\n    {\n      id: \"plan\",\n      description:\n        \"Plan-only mode — Claude Code reasons and proposes a plan, requesting explicit \" +\n        \"approval before writing files or running commands. Applied via a per-session \" +\n        \"CLAUDE_CONFIG_DIR override (see comment above `modes`); can be defeated by a \" +\n        \"target repo's own committed, escalated .claude/settings.json.\",\n      bin_args_append: [\"--permission-mode\", \"plan\"],\n    },\n    {\n      id: \"accept-edits\",\n      description: \"Auto-accept file edits; commands still prompt.\",\n      bin_args_append: [\"--permission-mode\", \"acceptEdits\"],\n    },\n    {\n      id: \"bypass-permissions\",\n      description:\n        \"Skip all permission prompts. Use only in trusted automation contexts.\",\n      bin_args_append: [\"--permission-mode\", \"bypassPermissions\"],\n    },\n  ],\n  options: [\n    {\n      id: \"model\",\n      // string (not enum) so any valid Anthropic model ID is accepted\n      // without requiring a code change to expand the list. Applied via\n      // ACP session/set_config_option(configId:\"model\") after newSession\n      // — the claude-agent-acp wrapper does not forward its own CLI args\n      // to the underlying claude process, so bin_args_template alone\n      // cannot select the model.\n      type: \"string\" as const,\n      description:\n        \"Anthropic model ID (e.g. 'claude-opus-4-8', 'claude-sonnet-4-6'). \" +\n        \"Applied via ACP session/set_config_option after the session is created. \" +\n        \"Omit to use the claude-code default.\",\n    },\n    {\n      id: \"effort\",\n      type: \"enum\" as const,\n      // Effort is model-dependent: the same label maps to different\n      // underlying compute budgets across models, and the model's own\n      // default differs (Sonnet 4.6 / Opus 4.8 default to \"high\";\n      // Opus 4.7 defaults to \"xhigh\"). \"max\" and \"ultracode\" are\n      // session-only — not valid in persisted settings. Omit to keep\n      // the model's own default rather than hardcoding one here.\n      enum: [\"low\", \"medium\", \"high\", \"xhigh\", \"max\", \"ultracode\"],\n      description:\n        \"Reasoning effort level. Model-dependent: the same label ≠ the same \" +\n        \"compute budget across models, and defaults differ by model \" +\n        \"(e.g. Sonnet 4.6 / Opus 4.8 default to 'high'; Opus 4.7 to 'xhigh'). \" +\n        \"'max' and 'ultracode' are session-only. Omit to keep the model's own default.\",\n    },\n    {\n      id: \"max_turns\",\n      type: \"integer\" as const,\n      min: 1,\n      max: 200,\n      description:\n        \"Hard cap on tool-use turns within a single send. Claude Code stops after this many cycles.\",\n      bin_args_template: [\"--max-turns\", \"{value}\"],\n    },\n  ],\n  continuation: {\n    // native-resume: each turn cold-spawns claude, then ACP `loadSession`\n    // reattaches to the saved sessionId. Survives api restarts, sandbox\n    // reaps, multi-machine — claude reads its own JSONL session store.\n    // Requires the host to register `configureNativeResume({load, save})`\n    // hooks; without them the strategy degrades to per-spawn behaviour\n    // (no continuity).\n    //\n    // pinned-session is still supported as a fallback for hosts that\n    // haven't wired the resume hooks yet — same warm-process semantics\n    // as pre-AIP-45-extension behaviour.\n    default: \"native-resume\",\n    supported: [\"native-resume\", \"pinned-session\", \"transcript\", \"none\"],\n    pinned_session: {\n      idle_timeout_ms: 1_800_000,\n      key_scope: [\"conversation\", \"operator\"],\n    },\n  },\n  tags: [\"claude-code\", \"anthropic\", \"acp\", \"agent-runtime\", \"coding\"],\n})\n\nexport function claudeCodeRuntime(): AgentCliRuntime {\n  return createAgentCliRuntime(claudeCode)\n}\n\nexport type { AgentCliHandle, AgentCliRuntime }\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;AAwBA,IAAM,yBAAA,GAAsC;AAAA,EAC1C,yBAAA;AAAA,EACA,wBAAA;AAAA,EACA,yBAAA;AAAA,EACA,+BAAA;AAAA,EACA,wBAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,6BAAA,GAA0C;AAAA,EAC9C,GAAG,wBAAA;AAAA,EACH,GAAG;AACL,CAAA;AAEO,IAAM,aAA6B,cAAA,CAAe;AAAA,EACvD,IAAA,EAAM,aAAA;AAAA,EACN,EAAA,EAAI,aAAA;AAAA,EACJ,WAAA,EACE,uLAAA;AAAA,EACF,OAAA,EAAS,OAAA;AAAA,EACT,GAAA,EAAK,KAAA;AAAA,EACL,QAAA,EAAU,CAAC,IAAA,EAAM,uCAAuC,CAAA;AAAA,EACxD,OAAA,EAAS;AAAA,IACP;AAAA,MACE,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS,uCAAA;AAAA,MACT,MAAA,EAAQ;AAAA;AACV,GACF;AAAA,EACA,aAAA,EAAe;AAAA,IACb,GAAA,EAAK,wDAAA;AAAA,IACL,KAAA,EAAO,sBAAA;AAAA,IACP,KAAA,EAAO,UAAA;AAAA,IACP,UAAA,EAAY;AAAA,GACd;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,GAAA,EAAK,cAAA;AAAA,IACL,KAAA,EAAO,EAAE,GAAA,EAAK,CAAC,mBAAmB,CAAA;AAAE,GACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BA,QAAA,EAAU,WAAA;AAAA,EACV,WAAA,EAAa,QAAA;AAAA,EACb,gBAAA,EAAkB;AAAA,IAChB,MAAA,EAAQ,yBAAA;AAAA,IACR,WAAA,EAAa,CAAC,sBAAsB,CAAA;AAAA,IACpC,WAAA,EAAa,CAAC,GAAG,yBAAA,EAA2B,oBAAoB;AAAA,GAClE;AAAA,EACA,OAAA,EAAS,cAAA;AAAA,EACT,QAAA,EAAU,KAAA;AAAA,EACV,GAAA,EAAK,0BAAA;AAAA,EACL,OAAA,EAAS;AAAA,IACP,IAAA,EAAM,YAAA;AAAA,IACN,eAAA,EAAiB,IAAA;AAAA,IACjB,iBAAA,EAAmB;AAAA,GACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAA,EAAQ;AAAA,IACN,OAAA,EAAS,iBAAA;AAAA,IACT,OAAA,EAAS;AAAA,MACP,iBAAA;AAAA,MACA,iBAAA;AAAA,MACA,kBAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,GAAA,EAAK,EAAE,SAAA,EAAW,mBAAA;AAAoB,GACxC;AAAA,EACA,YAAA,EAAc;AAAA,IACZ,SAAA,EAAW,IAAA;AAAA,IACX,UAAA,EAAY,IAAA;AAAA,IACZ,UAAA,EAAY,KAAA;AAAA,IACZ,OAAA,EAAS,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKT,UAAA,EAAY,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQZ,SAAA,EAAW,IAAA;AAAA,IACX,aAAA,EAAe,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOf,WAAA,EAAa;AAAA,GACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2BA,KAAA,EAAO;AAAA,IACL,EAAE,EAAA,EAAI,SAAA,EAAW,WAAA,EAAa,4BAAA,EAA6B;AAAA,IAC3D;AAAA,MACE,EAAA,EAAI,MAAA;AAAA,MACJ,WAAA,EACE,0WAAA;AAAA,MAKF,GAAA,EAAK,EAAE,kCAAA,EAAoC,GAAA;AAAI,KACjD;AAAA,IACA;AAAA,MACE,EAAA,EAAI,MAAA;AAAA,MACJ,WAAA,EACE,4SAAA;AAAA,MAIF,eAAA,EAAiB,CAAC,mBAAA,EAAqB,MAAM;AAAA,KAC/C;AAAA,IACA;AAAA,MACE,EAAA,EAAI,cAAA;AAAA,MACJ,WAAA,EAAa,gDAAA;AAAA,MACb,eAAA,EAAiB,CAAC,mBAAA,EAAqB,aAAa;AAAA,KACtD;AAAA,IACA;AAAA,MACE,EAAA,EAAI,oBAAA;AAAA,MACJ,WAAA,EACE,uEAAA;AAAA,MACF,eAAA,EAAiB,CAAC,mBAAA,EAAqB,mBAAmB;AAAA,KAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAcA;AAAA,MACE,EAAA,EAAI,0BAA0B,QAAA,CAAS,EAAA;AAAA,MACvC,WAAA,EACE,wZAAA;AAAA,MAMF,GAAA,EAAK;AAAA,QACH,kBAAA,EAAoB,0BAA0B,QAAA,CAAS;AAAA,OACzD;AAAA,MACA,SAAA,EAAW;AAAA,KACb;AAAA,IACA;AAAA,MACE,EAAA,EAAI,0BAA0B,UAAA,CAAW,EAAA;AAAA,MACzC,WAAA,EACE,uUAAA;AAAA,MAKF,GAAA,EAAK;AAAA,QACH,kBAAA,EAAoB,0BAA0B,UAAA,CAAW;AAAA,OAC3D;AAAA,MACA,SAAA,EAAW;AAAA,KACb;AAAA,IACA;AAAA,MACE,EAAA,EAAI,0BAA0B,QAAA,CAAS,EAAA;AAAA,MACvC,WAAA,EACE,6TAAA;AAAA,MAKF,GAAA,EAAK;AAAA,QACH,kBAAA,EAAoB,0BAA0B,QAAA,CAAS;AAAA,OACzD;AAAA,MACA,SAAA,EAAW;AAAA;AACb,GACF;AAAA,EACA,OAAA,EAAS;AAAA,IACP;AAAA,MACE,EAAA,EAAI,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMJ,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EACE,gNAAA;AAAA,MAGF,GAAA,EAAK,EAAE,eAAA,EAAiB,SAAA;AAAU,KACpC;AAAA,IACA;AAAA,MACE,EAAA,EAAI,QAAA;AAAA,MACJ,IAAA,EAAM,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAON,MAAM,CAAC,KAAA,EAAO,UAAU,MAAA,EAAQ,OAAA,EAAS,OAAO,WAAW,CAAA;AAAA,MAC3D,WAAA,EACE;AAAA,KAIJ;AAAA,IACA;AAAA,MACE,EAAA,EAAI,WAAA;AAAA,MACJ,IAAA,EAAM,SAAA;AAAA,MACN,GAAA,EAAK,CAAA;AAAA,MACL,GAAA,EAAK,GAAA;AAAA,MACL,WAAA,EACE,4FAAA;AAAA,MACF,iBAAA,EAAmB,CAAC,aAAA,EAAe,SAAS;AAAA,KAC9C;AAAA,IACA;AAAA,MACE,EAAA,EAAI,UAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYJ,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EACE,scAAA;AAAA,MAOF,GAAA,EAAK,EAAE,kBAAA,EAAoB,SAAA,EAAU;AAAA,MACrC,SAAA,EAAW;AAAA,KACb;AAAA,IACA;AAAA,MACE,EAAA,EAAI,YAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMJ,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EACE,kVAAA;AAAA,MAKF,GAAA,EAAK,EAAE,oBAAA,EAAsB,SAAA;AAAU;AACzC,GACF;AAAA,EACA,YAAA,EAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWZ,OAAA,EAAS,eAAA;AAAA,IACT,SAAA,EAAW,CAAC,eAAA,EAAiB,gBAAA,EAAkB,cAAc,MAAM,CAAA;AAAA,IACnE,cAAA,EAAgB;AAAA,MACd,eAAA,EAAiB,IAAA;AAAA,MACjB,SAAA,EAAW,CAAC,cAAA,EAAgB,UAAU;AAAA;AACxC,GACF;AAAA,EACA,MAAM,CAAC,aAAA,EAAe,WAAA,EAAa,KAAA,EAAO,iBAAiB,QAAQ,CAAA;AAAA,EACnE,QAAA,EAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOR,MAAA,EAAQ;AAAA,MACN,MAAA,EAAQ,eAAA;AAAA,MACR,IAAA,EAAM,YAAA;AAAA,MACN,MAAA,EAAQ;AAAA;AACV;AAEJ,CAAC;AAEM,SAAS,iBAAA,GAAqC;AACnD,EAAA,OAAO,sBAAsB,UAAU,CAAA;AACzC","file":"index.mjs","sourcesContent":["/**\n * @agentproto/adapter-claude-code — AIP-45 adapter for Anthropic's\n * Claude Code via the @agentclientprotocol/claude-agent-acp wrapper.\n */\n\nimport {\n  createAgentCliRuntime,\n  defineAgentCli,\n  type AgentCliHandle,\n  type AgentCliRuntime,\n} from \"@agentproto/driver-agent-cli\"\nimport {\n  ANTHROPIC_CORE_SCRUB_ENV,\n  ANTHROPIC_GATEWAY_PRESETS,\n} from \"@agentproto/provider-presets\"\n\n// Cloud-provider redirect toggles that must be scrubbed alongside the core\n// ANTHROPIC_API_KEY whenever the claude binary is pointed at a non-Anthropic\n// gateway — a leftover toggle would override ANTHROPIC_BASE_URL and silently\n// route back to Bedrock/Vertex/etc. The core ANTHROPIC_API_KEY scrub itself\n// is sourced from @agentproto/provider-presets (the single source of truth for\n// gateway facts), so a new native-Anthropic credential env var added there is\n// picked up here automatically. Shared by the moonshot/openrouter modes and\n// the base_url option.\nconst CLAUDE_CODE_CLOUD_TOGGLES: string[] = [\n  \"CLAUDE_CODE_USE_BEDROCK\",\n  \"CLAUDE_CODE_USE_VERTEX\",\n  \"CLAUDE_CODE_USE_FOUNDRY\",\n  \"CLAUDE_CODE_USE_ANTHROPIC_AWS\",\n  \"CLAUDE_CODE_USE_MANTLE\",\n  \"CLAUDE_CODE_USE_GATEWAY\",\n]\nconst CLAUDE_CODE_GATEWAY_ENV_UNSET: string[] = [\n  ...ANTHROPIC_CORE_SCRUB_ENV,\n  ...CLAUDE_CODE_CLOUD_TOGGLES,\n]\n\nexport const claudeCode: AgentCliHandle = defineAgentCli({\n  name: \"claude-code\",\n  id: \"claude-code\",\n  description:\n    \"Anthropic's Claude Code wrapped as an ACP agent via @agentclientprotocol/claude-agent-acp. Spawned via `npx -y @agentclientprotocol/claude-agent-acp` and driven over stdio JSON-RPC.\",\n  version: \"0.1.0\",\n  bin: \"npx\",\n  bin_args: [\"-y\", \"@agentclientprotocol/claude-agent-acp\"],\n  install: [\n    {\n      method: \"npm\",\n      package: \"@agentclientprotocol/claude-agent-acp\",\n      global: true,\n    },\n  ],\n  version_check: {\n    cmd: \"npm view @agentclientprotocol/claude-agent-acp version\",\n    parse: \"(\\\\d+\\\\.\\\\d+\\\\.\\\\d+)\",\n    range: \">=0.30.0\",\n    timeout_ms: 15_000,\n  },\n  auth: {\n    ref: \"./SECRETS.md\",\n    state: { env: [\"ANTHROPIC_API_KEY\"] },\n  },\n  // Deterministic billing-auth (subscription vs api-key), resolved by the\n  // runtime (@agentproto/runtime's resolveAuthSpec) and applied MECHANICALLY\n  // by the driver. EXPLICIT credential selection, not scrub-by-absence: the\n  // resolver SETS exactly one credential env var (from a named config/store\n  // ref, never the ambient shell) and SCRUBS the conflicting one(s), so which\n  // credential — and thus which billing — a spawn uses is *stated*, never\n  // inferred from whatever the daemon's launching shell exported (the outage\n  // this surface exists to prevent).\n  //\n  // provider \"anthropic\" ⇒ api-key mode SETS providerEnvVar(\"anthropic\") =\n  // ANTHROPIC_API_KEY (derived from the catalog, not re-listed here) and\n  // scrubs the subscription-family creds (CLAUDE_CODE_OAUTH_TOKEN +\n  // ANTHROPIC_AUTH_TOKEN). authEnforce \"always\" preserves #312: claude-code\n  // engages on EVERY spawn and fails fast with no credential.\n  //\n  // authSubscription: \"subscription\" SETS CLAUDE_CODE_OAUTH_TOKEN to a bearer\n  // token minted via `claude setup-token` (bills Max/Pro, not API credits) —\n  // the var Claude Code documents for that token and the ONLY one that yields\n  // the clean native claude.ai-login path. (The same token as\n  // ANTHROPIC_AUTH_TOKEN authenticates but is treated as a generic override\n  // that disables connectors — the degraded path, so it's a `conflictEnv` to\n  // scrub, never the setEnv.) `conflictEnv` (ANTHROPIC_AUTH_TOKEN) is scrubbed\n  // in BOTH modes; `unsetEnvAdd` (cloud toggles + ANTHROPIC_BASE_URL) only in\n  // subscription (native) mode — matching #312's exact byte-for-byte scrub set\n  // in each mode (asserted by the regression snapshot test). ANTHROPIC_API_KEY\n  // is NOT listed in unsetEnvAdd because it derives from providerEnvVar and is\n  // scrubbed as the non-set credential automatically.\n  provider: \"anthropic\",\n  authEnforce: \"always\",\n  authSubscription: {\n    setEnv: \"CLAUDE_CODE_OAUTH_TOKEN\",\n    conflictEnv: [\"ANTHROPIC_AUTH_TOKEN\"],\n    unsetEnvAdd: [...CLAUDE_CODE_CLOUD_TOGGLES, \"ANTHROPIC_BASE_URL\"],\n  },\n  sandbox: \"./SANDBOX.md\",\n  protocol: \"acp\",\n  acp: \"./claude-code-acp.ACP.md\",\n  session: {\n    mode: \"persistent\",\n    idle_timeout_ms: 1_800_000,\n    context_carryover: true,\n  },\n  // Every id below is validated against the wrapper's live\n  // `session/new` → configOptions[model] selector: the wrapper resolves\n  // these (via its own `resolveModelPreference`) and rejects anything it\n  // can't — a rejected `session/set_config_option` used to kill the spawn\n  // (agentproto#186; the apply is now best-effort, see @agentproto/acp's\n  // newSession). Stale ids that the wrapper no longer offers were removed:\n  // `claude-sonnet-4-6` (the old default), `claude-opus-4-7`, `claude-opus-4-6`.\n  models: {\n    default: \"claude-sonnet-5\",\n    allowed: [\n      \"claude-sonnet-5\",\n      \"claude-opus-4-8\",\n      \"claude-haiku-4-5\",\n      \"claude-fable-5\",\n    ],\n    env: { anthropic: \"ANTHROPIC_API_KEY\" },\n  },\n  capabilities: {\n    streaming: true,\n    tool_calls: true,\n    sub_agents: false,\n    file_io: true,\n    // ACP wrapper forwards `image` content blocks in user prompts\n    // straight to Anthropic Messages API. Hosts SHOULD send images\n    // inline (see CLAUDE-CODE.md) instead of passing paths and\n    // hoping the model uses Read.\n    multimodal: true,\n    // The wrapper (@agentclientprotocol/claude-agent-acp >= 0.30)\n    // advertises `loadSession: true` and exposes the full session\n    // lifecycle (newSession / loadSession / resumeSession / forkSession)\n    // over JSON-RPC. Pairs with `continuation.default: native-resume`\n    // below — the host persists the sessionId and reattaches to the\n    // existing session across cold starts (api restart, sandbox reap,\n    // multi-machine).\n    resumable: true,\n    bidirectional: true,\n    // Claude Code's Read tool can ingest any absolute path the host\n    // surfaces via the prompt. Pair with the daemon's POST /files/upload\n    // route + a host UI drag-drop handler: drop a file → daemon writes\n    // to `cwd/.agentproto-attachments/<name>` → host pastes the path\n    // into the terminal → Claude reads it natively. No protocol-level\n    // multimodal round-trip needed; pure file-path injection.\n    file_attach: true,\n  },\n  // `bin_args_append: [\"--permission-mode\", ...]` below is a no-op against\n  // the @agentclientprotocol/claude-agent-acp wrapper — it never reads\n  // `--permission-mode` from argv. The wrapper instead resolves\n  // `permissions.defaultMode` exclusively via the SDK's `resolveSettings`,\n  // which merges `${CLAUDE_CONFIG_DIR}/settings.json` (user tier),\n  // `<cwd>/.claude/settings(.local).json` (project tier), and a managed\n  // tier. The driver (`packages/driver/agent-cli/src/define-agent-cli.ts`,\n  // `resolveClaudeCodePermissionMode`) makes the mode actually take effect\n  // by pointing a per-session `CLAUDE_CONFIG_DIR` at a throwaway temp dir\n  // containing `{\"permissions\":{\"defaultMode\":\"<value>\"}}` — reading the\n  // same `--permission-mode <value>` pair declared here as its one source\n  // of truth for the value vocabulary. `bin_args_append` is kept for a\n  // future wrapper version that might start reading argv.\n  //\n  // Known limitation (empirically confirmed, not just theorized): a target\n  // repo that commits its own escalated `.claude/settings.json`\n  // `permissions.defaultMode` (e.g. \"bypassPermissions\") does NOT let the\n  // repo's escalation win — the wrapper's `filterEscalatingDefaultMode`\n  // strips an escalating project-tier value entirely — but it also means\n  // OUR requested mode is defeated in the same merge pass (project tier\n  // out-prioritizes the user tier for the raw merge, before the filter\n  // ever runs). The net effect for that adversarial case is the session\n  // falls back to \"default\" (normal per-action prompting) rather than the\n  // requested mode. This does not reintroduce the original bug (silent,\n  // zero-prompt writes) — it just doesn't guarantee plan-only reasoning\n  // against a repo actively trying to escalate its own trust level.\n  modes: [\n    { id: \"default\", description: \"Standard interactive mode.\" },\n    {\n      id: \"lean\",\n      description:\n        \"Drop Claude Code's bundled skills and workflows from context (built-in slash \" +\n        \"commands stay typable but are hidden from the model). Plugins, project \" +\n        \"`.claude/skills/`, and `.claude/commands/` are unaffected. The ACP wrapper has \" +\n        \"no CLI flag for this — the underlying claude binary reads \" +\n        \"CLAUDE_CODE_DISABLE_BUNDLED_SKILLS directly, so this mode is env-only.\",\n      env: { CLAUDE_CODE_DISABLE_BUNDLED_SKILLS: \"1\" },\n    },\n    {\n      id: \"plan\",\n      description:\n        \"Plan-only mode — Claude Code reasons and proposes a plan, requesting explicit \" +\n        \"approval before writing files or running commands. Applied via a per-session \" +\n        \"CLAUDE_CONFIG_DIR override (see comment above `modes`); can be defeated by a \" +\n        \"target repo's own committed, escalated .claude/settings.json.\",\n      bin_args_append: [\"--permission-mode\", \"plan\"],\n    },\n    {\n      id: \"accept-edits\",\n      description: \"Auto-accept file edits; commands still prompt.\",\n      bin_args_append: [\"--permission-mode\", \"acceptEdits\"],\n    },\n    {\n      id: \"bypass-permissions\",\n      description:\n        \"Skip all permission prompts. Use only in trusted automation contexts.\",\n      bin_args_append: [\"--permission-mode\", \"bypassPermissions\"],\n    },\n    // ── Gateway modes ───────────────────────────────────────────────\n    // The claude binary honors ANTHROPIC_BASE_URL + ANTHROPIC_AUTH_TOKEN,\n    // so it can front any Anthropic-compatible gateway (Moonshot, OpenRouter,\n    // LiteLLM, claude-code-router) the same way @agentproto/adapter-claude-sdk\n    // does. These modes pre-wire the endpoint and — critically — scrub the\n    // ambient ANTHROPIC_API_KEY plus the cloud-provider redirect toggles\n    // (CLAUDE_CODE_USE_BEDROCK/_VERTEX/…) via env_unset so the real Anthropic\n    // credential can neither leak to nor 401 against a third-party host, and\n    // a leftover cloud toggle can't override the gateway base_url. The\n    // operator supplies the gateway key via the `auth_token` option (injected\n    // as ANTHROPIC_AUTH_TOKEN, sent as `Authorization: Bearer`) and picks a\n    // model via `model` (e.g. 'kimi-k2.7-code', 'z-ai/glm-5.2') — the ACP\n    // wrapper applies it via session/set_config_option after newSession.\n    {\n      id: ANTHROPIC_GATEWAY_PRESETS.moonshot.id,\n      description:\n        \"Moonshot (Kimi) gateway. Pre-wires ANTHROPIC_BASE_URL to Moonshot's \" +\n        \"Anthropic-compatible endpoint and scrubs the ambient ANTHROPIC_API_KEY \" +\n        \"so it can't leak to the third-party host. Supply the Moonshot key via \" +\n        \"the `auth_token` option and pick a model via `model` (conventional: \" +\n        \"'kimi-k2.7-code'). Without auth_token the spawn has no credentials and \" +\n        \"fails cleanly — the real Anthropic key is never sent.\",\n      env: {\n        ANTHROPIC_BASE_URL: ANTHROPIC_GATEWAY_PRESETS.moonshot.baseUrl,\n      },\n      env_unset: CLAUDE_CODE_GATEWAY_ENV_UNSET,\n    },\n    {\n      id: ANTHROPIC_GATEWAY_PRESETS.openrouter.id,\n      description:\n        \"OpenRouter gateway. Pre-wires ANTHROPIC_BASE_URL to OpenRouter's \" +\n        \"Anthropic-compatible endpoint and scrubs the ambient ANTHROPIC_API_KEY \" +\n        \"(same auth-hygiene rationale as `moonshot`). Pick a model via `model` \" +\n        \"(e.g. 'z-ai/glm-5.2', 'deepseek/deepseek-v4-pro', 'moonshotai/kimi-k2') \" +\n        \"and supply the OpenRouter key via `auth_token`.\",\n      env: {\n        ANTHROPIC_BASE_URL: ANTHROPIC_GATEWAY_PRESETS.openrouter.baseUrl,\n      },\n      env_unset: CLAUDE_CODE_GATEWAY_ENV_UNSET,\n    },\n    {\n      id: ANTHROPIC_GATEWAY_PRESETS.deepseek.id,\n      description:\n        \"DeepSeek gateway. Pre-wires ANTHROPIC_BASE_URL to DeepSeek's \" +\n        \"Anthropic-compatible endpoint and scrubs the ambient ANTHROPIC_API_KEY \" +\n        \"(same auth-hygiene rationale as `moonshot`/`openrouter`). Pick a model \" +\n        \"via `model` (conventional: 'deepseek-v4-pro', 'deepseek-v4-flash') and \" +\n        \"supply the DeepSeek key via `auth_token`.\",\n      env: {\n        ANTHROPIC_BASE_URL: ANTHROPIC_GATEWAY_PRESETS.deepseek.baseUrl,\n      },\n      env_unset: CLAUDE_CODE_GATEWAY_ENV_UNSET,\n    },\n  ],\n  options: [\n    {\n      id: \"model\",\n      // string (not enum) so any valid Anthropic model ID is accepted\n      // without requiring a code change to expand the list. Applied via\n      // ANTHROPIC_MODEL env var so the claude binary picks it up directly\n      // — the claude-agent-acp wrapper only forwards CLI args when --cli\n      // is passed, otherwise it runs in ACP mode and ignores argv.\n      type: \"string\" as const,\n      description:\n        \"Anthropic model ID or wrapper alias (e.g. 'claude-opus-4-8', \" +\n        \"'claude-sonnet-5', 'sonnet', 'opus'). Set via ANTHROPIC_MODEL env \" +\n        \"var so the claude binary uses it directly. Omit to use the claude-code default.\",\n      env: { ANTHROPIC_MODEL: \"{value}\" },\n    },\n    {\n      id: \"effort\",\n      type: \"enum\" as const,\n      // Effort is model-dependent: the same label maps to different\n      // underlying compute budgets across models, and the model's own\n      // default differs (Sonnet 4.6 / Opus 4.8 default to \"high\";\n      // Opus 4.7 defaults to \"xhigh\"). \"max\" and \"ultracode\" are\n      // session-only — not valid in persisted settings. Omit to keep\n      // the model's own default rather than hardcoding one here.\n      enum: [\"low\", \"medium\", \"high\", \"xhigh\", \"max\", \"ultracode\"],\n      description:\n        \"Reasoning effort level. Model-dependent: the same label ≠ the same \" +\n        \"compute budget across models, and defaults differ by model \" +\n        \"(e.g. Sonnet 4.6 / Opus 4.8 default to 'high'; Opus 4.7 to 'xhigh'). \" +\n        \"'max' and 'ultracode' are session-only. Omit to keep the model's own default.\",\n    },\n    {\n      id: \"max_turns\",\n      type: \"integer\" as const,\n      min: 1,\n      max: 200,\n      description:\n        \"Hard cap on tool-use turns within a single send. Claude Code stops after this many cycles.\",\n      bin_args_template: [\"--max-turns\", \"{value}\"],\n    },\n    {\n      id: \"base_url\",\n      // Injected into the child env as ANTHROPIC_BASE_URL — the claude binary\n      // honors it, so this fronts real Anthropic, Bedrock/Vertex/Azure, or an\n      // Anthropic-compatible gateway (LiteLLM / claude-code-router / Moonshot\n      // / OpenRouter). Auto-scrubs the ambient ANTHROPIC_API_KEY + cloud\n      // redirect toggles the moment it's set (symmetric with the moonshot/\n      // openrouter modes and with claude-sdk's buildQueryOptions scrub) so the\n      // real Anthropic credential can never leak to a third-party host — pair\n      // with `auth_token` to supply the gateway key. A base_url pointed at a\n      // real-Anthropic mirror that still wants the ambient key is the one\n      // shape this breaks; that's an acceptable trade for the default being\n      // leak-safe (matches claude-sdk).\n      type: \"string\" as const,\n      description:\n        \"Custom Anthropic base URL. Injected as ANTHROPIC_BASE_URL in the \" +\n        \"child env — front real Anthropic, Bedrock/Vertex/Azure, or an \" +\n        \"Anthropic-compatible gateway. Auto-scrubs the ambient \" +\n        \"ANTHROPIC_API_KEY + cloud redirect toggles when set (so the real \" +\n        \"key can't leak to a third-party host) — pair with `auth_token` to \" +\n        \"supply the gateway credential. For Moonshot/OpenRouter the dedicated \" +\n        \"modes pre-wire the URL too. Omit to use the default endpoint.\",\n      env: { ANTHROPIC_BASE_URL: \"{value}\" },\n      env_unset: CLAUDE_CODE_GATEWAY_ENV_UNSET,\n    },\n    {\n      id: \"auth_token\",\n      // Injected into the child env as ANTHROPIC_AUTH_TOKEN — the claude\n      // binary sends it as `Authorization: Bearer <token>`, which\n      // Anthropic-compatible gateways (Moonshot, OpenRouter) accept. Pair\n      // with base_url (or a gateway mode) for a per-spawn key instead of the\n      // ambient ANTHROPIC_API_KEY.\n      type: \"string\" as const,\n      description:\n        \"Bearer token for the Anthropic API or a compatible gateway. Injected \" +\n        \"as ANTHROPIC_AUTH_TOKEN in the child env (sent as `Authorization: \" +\n        \"Bearer`). Pair with `base_url` (or a `moonshot`/`openrouter` mode) \" +\n        \"to target a gateway with a per-spawn key instead of the ambient \" +\n        \"ANTHROPIC_API_KEY. Omit to use ANTHROPIC_API_KEY from the environment.\",\n      env: { ANTHROPIC_AUTH_TOKEN: \"{value}\" },\n    },\n  ],\n  continuation: {\n    // native-resume: each turn cold-spawns claude, then ACP `loadSession`\n    // reattaches to the saved sessionId. Survives api restarts, sandbox\n    // reaps, multi-machine — claude reads its own JSONL session store.\n    // Requires the host to register `configureNativeResume({load, save})`\n    // hooks; without them the strategy degrades to per-spawn behaviour\n    // (no continuity).\n    //\n    // pinned-session is still supported as a fallback for hosts that\n    // haven't wired the resume hooks yet — same warm-process semantics\n    // as pre-AIP-45-extension behaviour.\n    default: \"native-resume\",\n    supported: [\"native-resume\", \"pinned-session\", \"transcript\", \"none\"],\n    pinned_session: {\n      idle_timeout_ms: 1_800_000,\n      key_scope: [\"conversation\", \"operator\"],\n    },\n  },\n  tags: [\"claude-code\", \"anthropic\", \"acp\", \"agent-runtime\", \"coding\"],\n  metadata: {\n    // Opts claude-code into `agentproto install skill/<slug>` fan-out (no\n    // --target given). Claude Code skills install as a whole plugin\n    // bundle, not per-skill drops — `unit: \"whole-pack\"` tells the\n    // fan-out dispatcher to emit the pack once, not once per requested\n    // skill slug. See\n    // packages/cli/src/commands/skill-install/types.ts `AdapterSkillsTarget`.\n    skills: {\n      format: \"claude-plugin\",\n      unit: \"whole-pack\",\n      outDir: \"~/.claude/plugins/agentproto\",\n    },\n  },\n})\n\nexport function claudeCodeRuntime(): AgentCliRuntime {\n  return createAgentCliRuntime(claudeCode)\n}\n\nexport type { AgentCliHandle, AgentCliRuntime }\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentproto/adapter-claude-code",
-  "version": "0.1.1",
+  "version": "1.0.0",
   "description": "@agentproto/adapter-claude-code — AIP-45 AGENT-CLI adapter for Anthropic's Claude Code via @agentclientprotocol/claude-agent-acp. Spawns the ACP wrapper and drives Claude Code as an agentproto agent CLI.",
   "keywords": [
     "agentproto",
@@ -17,7 +17,7 @@
     "url": "https://github.com/agentproto/ts",
     "directory": "adapters/claude-code"
   },
-  "license": "MIT",
+  "license": "Apache-2.0",
   "type": "module",
   "main": "dist/index.mjs",
   "module": "dist/index.mjs",
@@ -41,7 +41,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@agentproto/driver-agent-cli": "0.3.0"
+    "@agentproto/driver-agent-cli": "1.0.0",
+    "@agentproto/provider-presets": "0.3.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.2",