@ai-sdk/harness-claude-code 1.0.95 → 1.0.97

package/src/claude-code-auth.ts

@@ -3,12 +3,14 @@ import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import type {
+  HarnessV1Authentication,
   HarnessV1RequestTransformation,
   HarnessV1RequestTransformationSources,
 } from '@ai-sdk/harness';
 import {
   createCredentialRequestTransformation,
   getAiGatewayAuthFromEnv,
+  isHarnessAuthenticationEnvironment,
 } from '@ai-sdk/harness/utils';
 
 export const CLAUDE_CODE_CREDENTIAL_ENVIRONMENT_VARIABLES = [
@@ -67,36 +69,14 @@ export function createClaudeCodeRequestTransformations({
 
 export type ClaudeCodeResolvedAuthenticationMode = 'direct' | 'ai-gateway';
 
-export type ClaudeCodeAuthenticationMode =
-  | ClaudeCodeResolvedAuthenticationMode
-  | 'auto';
-
-/**
- * @deprecated Passing an object to auth options is deprecated. Use a `ClaudeCodeAuthenticationMode` string value ("auto" | "direct" | "ai-gateway") instead, and pass credentials via environment variables.
- */
-export type LegacyClaudeCodeAuthOptions = {
-  readonly anthropic?: {
-    readonly apiKey?: string;
-    readonly authToken?: string;
-    readonly baseUrl?: string;
-  };
-  readonly gateway?: {
-    readonly apiKey?: string;
-    readonly baseUrl?: string;
-  };
-};
-
-export type ClaudeCodeAuthOptions =
-  | ClaudeCodeAuthenticationMode
-  | LegacyClaudeCodeAuthOptions;
+export type ClaudeCodeAuthenticationMode = HarnessV1Authentication;
 
 /**
  * Resolve the environment-variable blob the bridge needs to authenticate
  * with Anthropic (directly or via the Vercel AI Gateway). Precedence:
  *
- *   1. Explicit `auth.anthropic` — pin to direct Anthropic auth.
- *   2. Explicit `auth.gateway` — pin to gateway-routed auth.
- *   3. Auto-detect from the host process env: gateway first
+ *   1. An explicit authentication mode pins the selected route.
+ *   2. Auto-detect from the host process env: gateway first
  *      (`AI_GATEWAY_API_KEY` / `VERCEL_OIDC_TOKEN`), then direct
  *      (`ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN`).
  */
@@ -112,46 +92,50 @@ export type ResolveClaudeCodeEnvOptions = {
 };
 
 export function resolveClaudeCodeEnv(
-  auth: ClaudeCodeAuthOptions | undefined,
+  auth: ClaudeCodeAuthenticationMode | undefined,
   processEnv: Record<string, string | undefined> = process.env,
   options: ResolveClaudeCodeEnvOptions = {},
 ): Record<string, string> {
-  const normalizedAuth = normalizeClaudeCodeAuthToLegacyAuth(auth);
-
-  const readApiKey = options.readApiKeyHelper ?? readApiKeyHelper;
-  if (normalizedAuth?.anthropic) {
+  const suppliedEnvironment = isHarnessAuthenticationEnvironment(auth);
+  const authenticationEnvironment = suppliedEnvironment ? auth : processEnv;
+
+  const readApiKey =
+    suppliedEnvironment || auth === 'direct'
+      ? () => undefined
+      : (options.readApiKeyHelper ?? readApiKeyHelper);
+  if (auth === 'direct') {
     return pickAnthropic({
-      explicit: normalizedAuth.anthropic,
-      processEnv,
+      processEnv: authenticationEnvironment,
       readApiKey,
     });
   }
 
-  const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({ env: processEnv });
-  if (normalizedAuth?.gateway) {
-    return pickGateway({
-      explicit: normalizedAuth.gateway,
-      gatewayAuthFromEnv,
-    });
-  }
-  if (gatewayAuthFromEnv.apiKey) {
-    return pickGateway({
-      explicit: {},
-      gatewayAuthFromEnv,
-    });
+  const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({
+    env: authenticationEnvironment,
+  });
+  if (auth === 'ai-gateway' || gatewayAuthFromEnv.apiKey) {
+    return pickGateway({ gatewayAuthFromEnv });
   }
 
-  return pickAnthropic({ processEnv, readApiKey });
+  return pickAnthropic({
+    processEnv: authenticationEnvironment,
+    readApiKey,
+  });
 }
 
 export function resolveClaudeCodeAuthenticationMode(
-  auth: ClaudeCodeAuthOptions | undefined,
+  auth: ClaudeCodeAuthenticationMode | undefined,
   processEnv: Record<string, string | undefined> = process.env,
 ): ClaudeCodeResolvedAuthenticationMode {
-  if (auth === 'direct' || (typeof auth !== 'string' && auth?.anthropic)) {
+  if (isHarnessAuthenticationEnvironment(auth)) {
+    return getAiGatewayAuthFromEnv({ env: auth }).apiKey
+      ? 'ai-gateway'
+      : 'direct';
+  }
+  if (auth === 'direct') {
     return 'direct';
   }
-  if (auth === 'ai-gateway' || (typeof auth !== 'string' && auth?.gateway)) {
+  if (auth === 'ai-gateway') {
     return 'ai-gateway';
   }
   return getAiGatewayAuthFromEnv({ env: processEnv }).apiKey
@@ -159,46 +143,20 @@ export function resolveClaudeCodeAuthenticationMode(
     : 'direct';
 }
 
-function normalizeClaudeCodeAuthToLegacyAuth(
-  auth: ClaudeCodeAuthOptions | undefined,
-): LegacyClaudeCodeAuthOptions | undefined {
-  if (auth == null || auth === 'auto') {
-    return undefined;
-  }
-  if (typeof auth === 'string') {
-    switch (auth) {
-      case 'direct':
-        return { anthropic: {} };
-      case 'ai-gateway':
-        return { gateway: {} };
-      default:
-        return undefined;
-    }
-  }
-
-  console.warn(
-    '[claude-code] Passing an object to auth options is deprecated. Use a string mode ("auto" | "direct" | "ai-gateway") instead, and pass credentials via environment variables.',
-  );
-  return auth;
-}
-
 function pickAnthropic({
-  explicit,
   processEnv,
   readApiKey,
 }: {
-  explicit?: NonNullable<LegacyClaudeCodeAuthOptions['anthropic']>;
   processEnv: Record<string, string | undefined>;
   readApiKey: () => string | undefined;
 }): Record<string, string> {
   const env: Record<string, string> = {};
-  const helperKey = explicit ? undefined : readApiKey();
-  const apiKey = explicit?.apiKey ?? processEnv.ANTHROPIC_API_KEY ?? helperKey;
-  const authToken =
-    explicit?.authToken ?? processEnv.ANTHROPIC_AUTH_TOKEN ?? helperKey;
+  const helperKey = readApiKey();
+  const apiKey = processEnv.ANTHROPIC_API_KEY ?? helperKey;
+  const authToken = processEnv.ANTHROPIC_AUTH_TOKEN ?? helperKey;
   if (apiKey) env.ANTHROPIC_API_KEY = apiKey;
   if (authToken) env.ANTHROPIC_AUTH_TOKEN = authToken;
-  const baseUrl = explicit?.baseUrl ?? processEnv.ANTHROPIC_BASE_URL;
+  const baseUrl = processEnv.ANTHROPIC_BASE_URL;
   if (baseUrl) env.ANTHROPIC_BASE_URL = baseUrl;
   return env;
 }
@@ -240,14 +198,12 @@ function readApiKeyHelper(): string | undefined {
 }
 
 function pickGateway({
-  explicit,
   gatewayAuthFromEnv,
 }: {
-  explicit: NonNullable<LegacyClaudeCodeAuthOptions['gateway']>;
   gatewayAuthFromEnv: ReturnType<typeof getAiGatewayAuthFromEnv>;
 }): Record<string, string> {
-  const apiKey = explicit.apiKey ?? gatewayAuthFromEnv.apiKey;
-  const baseUrl = explicit.baseUrl ?? gatewayAuthFromEnv.baseUrl;
+  const apiKey = gatewayAuthFromEnv.apiKey;
+  const baseUrl = gatewayAuthFromEnv.baseUrl;
   const env: Record<string, string> = {};
   if (apiKey) {
     env.AI_GATEWAY_API_KEY = apiKey;

package/src/claude-code-harness.ts

@@ -56,7 +56,7 @@ import {
   createClaudeCodeRequestTransformations,
   resolveClaudeCodeAuthenticationMode,
   resolveClaudeCodeEnv,
-  type ClaudeCodeAuthOptions,
+  type ClaudeCodeAuthenticationMode,
 } from './claude-code-auth';
 import {
   outboundMessageSchema,
@@ -75,7 +75,7 @@ type ClaudeCodeRespawnStrategy = 'replay' | 'rerun';
 const CLAUDE_CODE_CLIENT_APP = `ai-sdk/harness-claude-code/${VERSION}`;
 
 export type ClaudeCodeHarnessSettings = {
-  readonly auth?: ClaudeCodeAuthOptions;
+  readonly auth?: ClaudeCodeAuthenticationMode;
   /**
    * Customizes each credential value before it is forwarded into a sandbox
    * process. This does not restrict which credentials the harness adapter can
@@ -90,6 +90,8 @@ export type ClaudeCodeHarnessSettings = {
   /**
    * Anthropic model id the underlying `claude` CLI should use. Leaving this
    * unset defers to the CLI's default.
+   *
+   * @deprecated Use `model` on `HarnessAgent` instead.
    */
   readonly model?: string;
   /**
@@ -829,6 +831,7 @@ export function createClaudeCode(
     lifecycleStateSchema: claudeCodeResumeStateSchema,
     getBootstrap: getClaudeCodeBootstrap,
     doStart: async startOpts => {
+      const model = startOpts.model ?? settings.model;
       const sandboxSession = startOpts.sandboxSession;
       const toolSafeSandboxSession =
         getRestrictedSandboxSession(sandboxSession);
@@ -920,6 +923,10 @@ export function createClaudeCode(
       );
 
       const workDir = startOpts.sessionWorkDir;
+      const sandboxHomeDir = await resolveSandboxHomeDir({
+        sandbox: toolSafeSandboxSession,
+        abortSignal: startOpts.abortSignal,
+      });
       const sessionDataDir = `${defaultWorkingDirectory}/.agent-runs/${startOpts.sessionId}`;
       const bridgeStateDir = `${sessionDataDir}/bridge`;
       const timeoutMs = settings.startupTimeoutMs ?? 120_000;
@@ -991,7 +998,7 @@ export function createClaudeCode(
             // process handle. The session lifecycle method decides whether the
             // sandbox is left running, stopped, or destroyed.
             proc: undefined,
-            model: settings.model,
+            model,
             maxTurns: settings.maxTurns,
             env: sandboxClaudeEnvironment,
             thinking,
@@ -1006,7 +1013,8 @@ export function createClaudeCode(
             debug: startOpts.observability?.debug,
             permissionMode: startOpts.permissionMode,
             builtinToolFiltering: startOpts.builtinToolFiltering,
-            skills: startOpts.skills ?? [],
+            sandbox: toolSafeSandboxSession,
+            sandboxHomeDir,
             mcpServers: settings.mcpServers,
             supportsUserMessageResponses: () => supportsUserMessageResponses,
           });
@@ -1039,13 +1047,6 @@ export function createClaudeCode(
         }
       }
 
-      const sandboxHomeDir =
-        startOpts.skills && startOpts.skills.length > 0
-          ? await resolveSandboxHomeDir({
-              sandbox: toolSafeSandboxSession,
-              abortSignal: startOpts.abortSignal,
-            })
-          : undefined;
       const port = resolveBridgePort({
         sandboxSession,
         override: settings.port,
@@ -1057,35 +1058,21 @@ export function createClaudeCode(
       const env = {
         BRIDGE_CHANNEL_TOKEN: token,
         BRIDGE_WS_PORT: String(port),
-        ...(sandboxHomeDir ? { HOME: sandboxHomeDir } : {}),
         ...(respawnStrategy === 'replay'
           ? { BRIDGE_REPLAY_FROM_DISK: '1' }
           : {}),
       };
 
       /*
-       * On a fresh start the workdir, skill files, and bridge-state directory
-       * must be created. On any resume they already exist in the
-       * sandbox snapshot, so skip the rewrite. The env is sent fresh on every
-       * spawn — `BRIDGE_CHANNEL_TOKEN` rotates per start.
+       * On a fresh start the workdir and bridge-state directory must be
+       * created. The env is sent fresh on every spawn —
+       * `BRIDGE_CHANNEL_TOKEN` rotates per start.
        */
       if (respawnStrategy === undefined) {
         await toolSafeSandboxSession.run({
           command: `mkdir -p ${shellQuote(workDir)} ${shellQuote(bridgeStateDir)}`,
           abortSignal: startOpts.abortSignal,
         });
-
-        if (startOpts.skills && startOpts.skills.length > 0) {
-          if (!sandboxHomeDir) {
-            throw new Error('Unable to resolve sandbox HOME directory.');
-          }
-          await writeClaudeCodeSkills({
-            sandbox: toolSafeSandboxSession,
-            homeDir: sandboxHomeDir,
-            skills: startOpts.skills,
-            abortSignal: startOpts.abortSignal,
-          });
-        }
       }
 
       await markBridgeStarting({
@@ -1162,7 +1149,7 @@ export function createClaudeCode(
         sessionId: startOpts.sessionId,
         channel,
         proc,
-        model: settings.model,
+        model,
         maxTurns: settings.maxTurns,
         env: sandboxClaudeEnvironment,
         thinking,
@@ -1177,7 +1164,8 @@ export function createClaudeCode(
         debug: startOpts.observability?.debug,
         permissionMode: startOpts.permissionMode,
         builtinToolFiltering: startOpts.builtinToolFiltering,
-        skills: startOpts.skills ?? [],
+        sandbox: toolSafeSandboxSession,
+        sandboxHomeDir,
         mcpServers: settings.mcpServers,
         supportsUserMessageResponses: () => supportsUserMessageResponses,
       });
@@ -1506,7 +1494,8 @@ function createSession({
   debug,
   permissionMode,
   builtinToolFiltering,
-  skills,
+  sandbox,
+  sandboxHomeDir,
   mcpServers,
   supportsUserMessageResponses,
 }: {
@@ -1529,7 +1518,8 @@ function createSession({
   debug: HarnessV1DebugConfig | undefined;
   permissionMode: HarnessV1PermissionMode | undefined;
   builtinToolFiltering: HarnessV1BuiltinToolFiltering | undefined;
-  skills: ReadonlyArray<HarnessV1Skill>;
+  sandbox: SandboxSession;
+  sandboxHomeDir: string;
   mcpServers: Record<string, unknown> | undefined;
   supportsUserMessageResponses: () => boolean;
 }): HarnessV1Session {
@@ -1705,11 +1695,27 @@ function createSession({
           harnessId: 'claude-code',
         });
       }
+      await writeClaudeCodeSkills({
+        sandbox,
+        homeDir: sandboxHomeDir,
+        skills: promptOpts.skills,
+        abortSignal: promptOpts.abortSignal,
+      });
       const control = wireTurn({
         emit: promptOpts.emit,
         abortSignal: promptOpts.abortSignal,
       });
 
+      /*
+       * A signal that was already aborted has settled the turn inside
+       * `wireTurn`. Sending `start` anyway would run a full unattended turn
+       * in the bridge — consuming tokens and possibly acting on the
+       * workspace — after the caller has already observed the abort.
+       */
+      if (promptOpts.abortSignal?.aborted) {
+        return control;
+      }
+
       const startMessage = {
         type: 'start' as const,
         prompt: extractUserText(promptOpts.prompt),
@@ -1729,8 +1735,8 @@ function createSession({
         ...(env !== undefined ? { env } : {}),
         thinking,
         ...(effort !== undefined ? { effort } : {}),
-        ...(skills.length > 0
-          ? { skills: skills.map(skill => skill.name) }
+        ...(promptOpts.skills.length > 0
+          ? { skills: promptOpts.skills.map(skill => skill.name) }
           : {}),
         ...(mcpServers == null ? {} : { mcpServers }),
         ...(permissionMode ? { permissionMode } : {}),
@@ -1754,6 +1760,12 @@ function createSession({
           harnessId: 'claude-code',
         });
       }
+      await writeClaudeCodeSkills({
+        sandbox,
+        homeDir: sandboxHomeDir,
+        skills: continueOpts.skills,
+        abortSignal: continueOpts.abortSignal,
+      });
       const control = wireTurn({
         emit: continueOpts.emit,
         abortSignal: continueOpts.abortSignal,
@@ -1772,7 +1784,9 @@ function createSession({
        * recomputed. This is the rare bridge-died fallback; the common slice path
        * is `attach`.
        */
-      if (rerunContinue) {
+      // Same as `doPromptTurn`: an already-aborted signal settled the turn in
+      // `wireTurn`, so don't re-drive the thread nobody is waiting on.
+      if (rerunContinue && !continueOpts.abortSignal?.aborted) {
         pendingResumeFlag = false;
         channel.send({
           type: 'start' as const,
@@ -1800,8 +1814,8 @@ function createSession({
           ...(env !== undefined ? { env } : {}),
           thinking,
           ...(effort !== undefined ? { effort } : {}),
-          ...(skills.length > 0
-            ? { skills: skills.map(skill => skill.name) }
+          ...(continueOpts.skills.length > 0
+            ? { skills: continueOpts.skills.map(skill => skill.name) }
             : {}),
           ...(mcpServers == null ? {} : { mcpServers }),
           ...(permissionMode ? { permissionMode } : {}),

package/src/index.ts

@@ -10,8 +10,5 @@ export const claudeCode = createClaudeCode();
 export { createClaudeCode } from './claude-code-harness';
 export { VERSION } from './version';
 export type { ClaudeCodeHarnessSettings } from './claude-code-harness';
-export type {
-  ClaudeCodeAuthenticationMode,
-  ClaudeCodeAuthOptions,
-} from './claude-code-auth';
+export type { ClaudeCodeAuthenticationMode } from './claude-code-auth';
 export type { ClaudeCodeThinkingConfig } from './claude-code-thinking';