@aitne/daemon 0.1.2 → 0.1.4

package/dist/core/backends/claude-auth.js

@@ -0,0 +1,198 @@
+/**
+ * Claude-backend auth probe + error-introspection helpers — pure module split
+ * out of `claude-code-core.ts` as part of the file-split plan (Tier 2, §8).
+ *
+ * Two responsibilities, both stateless:
+ *
+ *  1. **Error introspection** (pattern A in the split plan) — pure helpers
+ *     over `error: unknown` used by the SDK error-mapping paths in
+ *     `ClaudeCodeCore`. Each helper narrows the structural shape captured by
+ *     `ErrorLike` in `claude-errors.ts`. No instance state.
+ *
+ *  2. **Auth probes** (pattern B) — `checkAuth` is the cheap presence check
+ *     used by the reactive execute path; `checkAuthDetailed` is the deeper
+ *     probe consumed by `AuthHealthMonitor` and the setup wizard. Both are
+ *     standalone async functions taking a `ClaudeAuthDeps` record holding
+ *     the small subset of state they need (`cliPath` + `AgentConfig`).
+ *     The deps record is a deliberate seam so the functions can be unit
+ *     tested without spinning up a `ClaudeCodeCore` instance.
+ *
+ * The thin `checkAuth` / `checkAuthDetailed` / `isAuthError` / `getError*`
+ * methods on `ClaudeCodeCore` remain as transitional shims (file-split-plan
+ * §15) — they forward to the functions here so that test files which call
+ * `(core as any).isAuthError(...)` keep working without modification.
+ */
+import { probeApiKeyServerSide } from "./api-key-probe.js";
+import { readClaudeCredentials } from "./claude-credentials-store.js";
+import { isPlausibleAnthropicApiKey } from "./cli-utils.js";
+import { detectCloudProviderEnv } from "./claude-probe.js";
+// ---------- Pattern A: error introspection helpers ----------
+export function getErrorStatus(error) {
+    return typeof error === "object" && error !== null && "status" in error
+        ? error.status
+        : undefined;
+}
+export function getErrorCode(error) {
+    return typeof error === "object" && error !== null && typeof error.code === "string"
+        ? error.code
+        : undefined;
+}
+export function getErrorType(error) {
+    return typeof error === "object" && error !== null && typeof error.type === "string"
+        ? error.type
+        : undefined;
+}
+export function getErrorMessage(error) {
+    if (error instanceof Error) {
+        return error.message;
+    }
+    if (typeof error === "string") {
+        return error;
+    }
+    return "Claude backend execution failed";
+}
+export function isAuthError(error) {
+    const status = getErrorStatus(error);
+    if (status === 401 || status === 403) {
+        return true;
+    }
+    const code = getErrorCode(error)?.toLowerCase() ?? "";
+    const type = getErrorType(error)?.toLowerCase() ?? "";
+    if (code.includes("auth") ||
+        code.includes("forbidden") ||
+        code.includes("unauthorized") ||
+        type.includes("auth") ||
+        type.includes("forbidden") ||
+        type.includes("unauthorized")) {
+        return true;
+    }
+    return /unauthorized|forbidden|authentication|invalid api key|login required/i.test(getErrorMessage(error));
+}
+// ---------- Pattern B: auth probes ----------
+/**
+ * Cheap presence check used by the reactive execute path. Returns a
+ * narrowed `method` so the dispatcher can include it in error telemetry,
+ * but never makes a network call.
+ */
+export async function checkAuth(deps) {
+    const cloud = detectCloudProviderEnv();
+    if (cloud) {
+        if (cloud.missing.length > 0) {
+            return {
+                ok: false,
+                reason: `${cloud.flagEnvVar}=1 but missing required env vars: ${cloud.missing.join(", ")}`,
+            };
+        }
+        return { ok: true, method: cloud.method };
+    }
+    const rawApiKey = process.env.ANTHROPIC_API_KEY?.trim();
+    if (rawApiKey) {
+        if (!isPlausibleAnthropicApiKey(rawApiKey)) {
+            return {
+                ok: false,
+                reason: "ANTHROPIC_API_KEY is set but does not look like an Anthropic key (expected `sk-ant-…`).",
+            };
+        }
+        return { ok: true, method: "api_key" };
+    }
+    if (!deps.cliPath) {
+        return {
+            ok: false,
+            reason: "Claude Code CLI is not installed or not on PATH. Run `npm install -g @anthropic-ai/claude-code`.",
+        };
+    }
+    return { ok: true, method: "cli_login" };
+}
+/**
+ * Detailed auth probe used by AuthHealthMonitor and the dashboard setup
+ * wizard. Two modes:
+ *  - **API key** (`ANTHROPIC_API_KEY`): format check + server-side probe
+ *    via `probeApiKeyServerSide("anthropic", ...)` (roadmap §9.1).
+ *    Throws on network/timeout so `checkAll()` records `probe_network_error`.
+ *  - **CLI login**: reads `~/.claude/credentials.json` for `refreshToken`.
+ *    Never writes to the Keychain or credentials file — refresh is left
+ *    to the CLI (Phase 0 confirmed rotating refresh_tokens; daemon-driven
+ *    refresh would race and corrupt state).
+ */
+export async function checkAuthDetailed(deps) {
+    const cloud = detectCloudProviderEnv();
+    if (cloud) {
+        if (cloud.missing.length > 0) {
+            return {
+                ok: false,
+                status: "missing",
+                method: cloud.method,
+                detail: `${cloud.flagEnvVar}=1 but missing: ${cloud.missing.join(", ")}`,
+                recoveryCommand: `Set the missing env vars or unset ${cloud.flagEnvVar}`,
+            };
+        }
+        // Real auth happens inside the SDK against AWS / GCP / Azure. The
+        // daemon does not run a server-side probe for cloud providers — the
+        // first execution will surface any credential failure. Mark the
+        // status as `ok` here so the dashboard reports "Configured (cloud)";
+        // AuthHealthMonitor still re-runs this check hourly so a malformed
+        // env (env vars cleared after launch) flips the cache to `missing`.
+        return {
+            ok: true,
+            status: "ok",
+            method: cloud.method,
+            detail: `Configured via ${cloud.label} — runtime auth verified by Claude Code SDK`,
+        };
+    }
+    const rawApiKey = process.env.ANTHROPIC_API_KEY?.trim();
+    if (rawApiKey) {
+        if (!isPlausibleAnthropicApiKey(rawApiKey)) {
+            return {
+                ok: false,
+                status: "expired",
+                method: "api_key",
+                detail: "ANTHROPIC_API_KEY does not match Anthropic key format (expected `sk-ant-…`).",
+                recoveryCommand: "Unset ANTHROPIC_API_KEY or replace it with a valid Anthropic API key",
+            };
+        }
+        // Format is plausible — attempt a server-side probe to detect
+        // revoked keys within 1 hourly cycle (roadmap §9.1). On network
+        // failure, the probe throws and the caller (checkAll or check-auth
+        // route) records `probe_network_error` without flipping DB cache.
+        const probe = await probeApiKeyServerSide("anthropic", rawApiKey);
+        return {
+            ok: probe.ok,
+            status: probe.ok ? "ok" : "expired",
+            method: "api_key",
+            detail: probe.detail,
+            ...(!probe.ok && {
+                recoveryCommand: "Unset ANTHROPIC_API_KEY or replace it with a valid Anthropic API key",
+            }),
+        };
+    }
+    if (!deps.cliPath) {
+        return {
+            ok: false,
+            status: "missing",
+            method: "cli_login",
+            detail: "Claude Code CLI not found on PATH",
+            recoveryCommand: "npm install -g @anthropic-ai/claude-code",
+        };
+    }
+    const bundle = await readClaudeCredentials();
+    if (!bundle) {
+        return {
+            ok: false,
+            status: "expired",
+            method: "cli_login",
+            detail: "No Claude credentials found",
+            recoveryCommand: "claude auth login",
+        };
+    }
+    if (!bundle.refreshToken) {
+        return {
+            ok: false,
+            status: "expired",
+            method: "cli_login",
+            detail: "Credentials lack refresh_token — run `claude auth login`",
+            recoveryCommand: "claude auth login",
+        };
+    }
+    return { ok: true, status: "ok", method: "oauth" };
+}
+//# sourceMappingURL=claude-auth.js.map

package/dist/core/backends/claude-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-auth.js","sourceRoot":"","sources":["../../../src/core/backends/claude-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAmB3D,+DAA+D;AAE/D,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK;QACrE,CAAC,CAAE,KAAmB,CAAC,MAAM;QAC7B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAAmB,CAAC,IAAI,KAAK,QAAQ;QACjG,CAAC,CAAE,KAAmB,CAAC,IAAI;QAC3B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAAmB,CAAC,IAAI,KAAK,QAAQ;QACjG,CAAC,CAAE,KAAmB,CAAC,IAAI;QAC3B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,iCAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,IACE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,uEAAuE,CAAC,IAAI,CACjF,eAAe,CAAC,KAAK,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,+CAA+C;AAE/C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAoB;IAalD,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,qCAAqC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC3F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yFAAyF;aAClG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kGAAkG;SAC3G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAoB;IAEpB,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,mBAAmB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACxE,eAAe,EAAE,qCAAqC,KAAK,CAAC,UAAU,EAAE;aACzE,CAAC;QACJ,CAAC;QACD,kEAAkE;QAClE,oEAAoE;QACpE,gEAAgE;QAChE,qEAAqE;QACrE,mEAAmE;QACnE,oEAAoE;QACpE,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,kBAAkB,KAAK,CAAC,KAAK,6CAA6C;SACnF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,8EAA8E;gBACtF,eAAe,EAAE,sEAAsE;aACxF,CAAC;QACJ,CAAC;QACD,8DAA8D;QAC9D,gEAAgE;QAChE,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClE,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACnC,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI;gBACf,eAAe,EAAE,sEAAsE;aACxF,CAAC;SACH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,mCAAmC;YAC3C,eAAe,EAAE,0CAA0C;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,6BAA6B;YACrC,eAAe,EAAE,mBAAmB;SACrC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,0DAA0D;YAClE,eAAe,EAAE,mBAAmB;SACrC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC"}

package/dist/core/backends/claude-code-core.d.ts

@@ -1,42 +1,12 @@
-import { type AgentResult, type BackendModel, type IntegrationKey, type IntegrationState } from "@aitne/shared";
+import { type AgentResult, type BackendModel } from "@aitne/shared";
 import type { AgentConfig } from "../../config.js";
 import type { AgentExecuteParams, AgentResumeParams, AuthCheckResult, DelegatedTaskInvokeParams, DelegatedTaskResultRaw, DelegatedToolInvokeParams, DelegatedToolResult, IAgentCore, McpSessionContext, ReadSensitiveTokenManager, StreamCallbacks } from "../agent-core.js";
 import { BackendQuotaError, BackendDecisiveFailure } from "../agent-core.js";
 import type { AgentWriteTracker } from "../../safety/agent-write-tracker.js";
-export declare const CLAUDE_PROBE_TOOLS_PROMPT: string;
-/**
- * Registry-driven allowlist entries for integrations currently delegated to
- * Claude. Under `permissionMode: "dontAsk"`, any tool not in the SDK's
- * `allowedTools` is silently denied — so a delegated Gmail / Calendar
- * integration whose skill instructs the agent to call
- * `mcp__claude_ai_Gmail__search_threads` will fail with "permission denied"
- * unless that exact tool name is pre-authorized here.
- *
- * Pure over `(integrations)` — callers pass the record read from
- * `db/integrations-store.ts#readIntegrations`. The SDK's MCP tool matcher is
- * literal (`mcp__<server>__<tool>` — see `services/mcp/risk.ts`), so we
- * enumerate every capability tool the registry declares rather than using a
- * wildcard. This guarantees the allowlist only widens by what the registry
- * explicitly advertises; adding a new connector tool demands a registry
- * update first.
- *
- * Only integrations whose `delegatedBackend === "claude"` contribute — a
- * Codex-delegated Gmail integration must not widen Claude's surface.
- */
-export declare function computeDelegatedClaudeTools(integrations: Partial<Record<IntegrationKey, IntegrationState>>): readonly string[];
-export declare class AgentTimeoutError extends Error {
-    readonly timeoutMs: number;
-    constructor(timeoutMs: number);
-}
-export interface ClaudeCodeQuotaResetHint {
-    hour: number;
-    minute: number;
-    timeZone?: string;
-    rawLabel: string;
-}
-export declare function isClaudeCodeQuotaError(error: unknown): boolean;
-export declare function isClaudeCodeMaxBudgetError(error: unknown): boolean;
-export declare function extractClaudeCodeQuotaResetHint(error: unknown): ClaudeCodeQuotaResetHint | null;
+import { CLAUDE_PROBE_TOOLS_PROMPT, computeDelegatedClaudeTools, computeNativeClaudeTools } from "./claude-probe.js";
+import { AgentTimeoutError, extractClaudeCodeQuotaResetHint, isClaudeCodeQuotaError } from "./claude-errors.js";
+import { checkAuth as checkAuthFn } from "./claude-auth.js";
+export { AgentTimeoutError, CLAUDE_PROBE_TOOLS_PROMPT, computeDelegatedClaudeTools, computeNativeClaudeTools, extractClaudeCodeQuotaResetHint, isClaudeCodeQuotaError, };
 /**
  * ClaudeCodeCore intentionally does NOT run a pre-flight `checkAuth()`
  * gate inside `execute()` / `runTurn()`. Codex and Gemini each call
@@ -155,23 +125,18 @@ export declare class ClaudeCodeCore implements IAgentCore {
     private getErrorMessage;
     private sleep;
     summarize(conversationText: string): Promise<string>;
-    checkAuth(): Promise<{
-        ok: true;
-        method: "cli_login" | "api_key" | "oauth" | "vertex" | "bedrock" | "foundry";
-    } | {
-        ok: false;
-        reason: string;
-    }>;
     /**
-     * Detailed auth probe used by AuthHealthMonitor and the dashboard setup
-     * wizard. Two modes:
-     *  - **API key** (`ANTHROPIC_API_KEY`): format check + server-side probe
-     *    via `probeApiKeyServerSide("anthropic", ...)` (roadmap §9.1).
-     *    Throws on network/timeout so `checkAll()` records `probe_network_error`.
-     *  - **CLI login**: reads `~/.claude/credentials.json` for `refreshToken`.
-     *    Never writes to the Keychain or credentials file — refresh is left
-     *    to the CLI (Phase 0 confirmed rotating refresh_tokens; daemon-driven
-     *    refresh would race and corrupt state).
+     * Cheap presence check used by the reactive execute path. Detailed probe
+     * lives in `checkAuthDetailed`. Implementation moved to `./claude-auth.ts`
+     * (file-split-plan §8, Tier 2); this stays as a thin forwarder so the
+     * `IAgentCore` interface contract is unchanged and existing call sites in
+     * `BackendRouter` / `AuthHealthMonitor` continue to work.
+     */
+    checkAuth(): ReturnType<typeof checkAuthFn>;
+    /**
+     * Detailed auth probe used by `AuthHealthMonitor` and the dashboard setup
+     * wizard. Implementation moved to `./claude-auth.ts`; see the comment on
+     * `checkAuth` above.
      */
     checkAuthDetailed(): Promise<AuthCheckResult>;
     /**
@@ -215,84 +180,47 @@ export declare class ClaudeCodeCore implements IAgentCore {
      * whatever the registry already advertised.
      */
     private getAllowedTools;
-    /**
-     * Thin wrapper around the pure `computeDelegatedClaudeTools` helper that
-     * pulls the integrations record from the wired mcp context. Returns `[]`
-     * when the context is not yet wired (tests, startup ordering) — which
-     * matches the pre-fix behavior for sessions that ran before the daemon
-     * finished composing. A one-shot warning is emitted in `setMcpContext`
-     * confirming wiring.
-     */
     private getDelegatedClaudeTools;
-    /**
-     * DELEGATED-MODE-V2-DESIGN.md §4.3.3 — same-backend deny enforcement at
-     * the SDK boundary. For every integration whose `delegatedBackend === "claude"`,
-     * expand `state.deniedTools` against the connector's known tools and emit
-     * the namespaced names (`mcp__claude_ai_<X>__<tool>`). The SDK refuses any
-     * tool listed in `disallowedTools` regardless of `allowedTools` — hard
-     * enforcement.
-     *
-     * Returns `[]` when context isn't wired (tests / pre-startup) and on read
-     * failures, matching the conservative pattern used by
-     * `getDelegatedClaudeTools`.
-     */
+    private getNativeClaudeTools;
     private getSessionDeniedTools;
     /**
-     * Security hooks:
-     *   1. Bash(curl *) — restrict to localhost Daemon API, block connection-override flags. (strict only)
-     *   2. Bash(jq *)  — block file-access flags and the `env` filter (process env exfiltration). (strict only)
-     *   3. Write/Edit  — block writes into the session helper dir and context dir, mark vault writes.
-     *
-     * In allow mode the curl and jq hooks are dropped, but the Write/Edit hook
-     * stays: the context-dir chokepoint exists for memory integrity (today-write
-     * lock, md_file_snapshots, CONTEXT_WRITE_PERMISSIONS), not permissions.
+     * Security hooks — thin shim that forwards to `buildSecurityHooks` in
+     * `./claude-tool-collection.ts`. The implementation lives there as a
+     * pure factory consuming a `SecurityHooksDeps` record. See that module
+     * for hook semantics; see `file-split-plan.md` §8 + §15 for why the
+     * shim stays here.
      */
     private getSecurityHooks;
     /**
-     * Delegated proxy invocation — Claude SDK path.
-     *
-     * Spawns a one-shot SDK `query()` constrained to a single `allowedTools`
-     * entry (the requested connector tool), parses the structured stream
-     * for the matching `tool_use` → `tool_result` pair, and returns the raw
-     * tool result. The model's surrounding text is discarded — the route
-     * handler only sees the connector's structured payload.
+     * Delegated-execution deps bundle. Built fresh per call so the captured
+     * `readTokenManager` / `readToken` reflect the latest state of the core's
+     * mutable fields (both can be re-wired post-construction via
+     * `setReadToken` / `setReadTokenManager`).
      *
-     * Error classes (DelegatedToolErrorClass):
-     *   - `wrong_tool`     — model called a tool we did not request (anti-prompt-injection).
-     *   - `no_tool_call`   — model never invoked the tool within `maxTurns`.
-     *   - `tool_error`     — connector returned `is_error: true`.
-     *   - `parse_error`    — stream produced no terminal `result` event.
-     *   - `auth_error`     — SDK reported `authentication_failed`.
-     *   - `timeout`        — invoker's wall-clock signal aborted the stream.
-     *   - `subprocess_crashed` — exception thrown out of the iterator.
-     *
-     * Cost is captured from the terminal `SDKResultMessage` regardless of
-     * subtype so the invoker can attribute partial spend on the failure
-     * paths (no_tool_call, wrong_tool, tool_error).
+     * Snapshot semantics — once handed to `runDelegated{Tool,Task}Fn`, the
+     * deps record is treated as immutable for the duration of the call. This
+     * is a deliberate, narrow strengthening of the pre-split behavior: the
+     * original re-read `this.readTokenManager` at revoke time, so a
+     * (hypothetical) mid-call replacement would revoke on the *new* manager
+     * — leaving a scope leak on the manager that issued the token.
+     * Production never replaces the manager after boot (`index.ts` wires it
+     * exactly once via `setReadTokenManager?`), so the two behaviors converge
+     * in practice; the new shape is simply more robust by construction.
+     */
+    private delegatedDeps;
+    /**
+     * Delegated proxy invocation — DELEGATED-PROXY-API-DESIGN.md §4.5.
+     * Implementation moved to `./claude-delegated.ts` (file-split-plan §8,
+     * Tier 2); this stays as a thin forwarder so the `IAgentCore` interface
+     * contract and existing call sites in `BackendRouter` /
+     * `DelegatedBackendInvoker` continue to dispatch through
+     * `core.runDelegatedTool`.
      */
     runDelegatedTool(params: DelegatedToolInvokeParams): Promise<DelegatedToolResult>;
     /**
-     * DELEGATED-TASK-MODE-DESIGN.md §9.1 — Claude SDK task mode. The
-     * subprocess plans + executes 1..N MCP calls within `allowedTools` and
-     * emits a final assistant message that the runtime helper validates
-     * against the caller's `outputSchema`.
-     *
-     * Stream parsing differences from `runDelegatedTool`:
-     *   - We accept multiple `tool_use` blocks (counted against `maxToolCalls`).
-     *   - We track per-tool durations to feed `onToolStep`.
-     *   - We capture the *final* assistant text (after the last tool turn)
-     *     as the validation target, not a single tool's `tool_result`.
-     *
-     * Safety:
-     *   - `allowedTools` already excludes the destructive set when
-     *     `allowDestructive: false`; the SDK will not surface those tools.
-     *   - `disallowedTools` is the absolute-block layer + the destructive
-     *     set as defense-in-depth (so a future relaxation of allowedTools
-     *     can't accidentally widen the surface).
-     *
-     * The §6.2 "no retry after write" rule is enforced at the invoker
-     * layer; this method just signals via `writeClassToolFired` whether
-     * any destructive tool ran during the task.
+     * Delegated task-mode invocation — DELEGATED-TASK-MODE-DESIGN.md §9.1.
+     * Implementation moved to `./claude-delegated.ts`; see the comment on
+     * `runDelegatedTool` above.
      */
     runDelegatedTask(params: DelegatedTaskInvokeParams): Promise<DelegatedTaskResultRaw>;
 }

package/dist/core/backends/claude-code-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code-core.d.ts","sourceRoot":"","sources":["../../../src/core/backends/claude-code-core.ts"],"names":[],"mappings":"AAWA,OAAO,EAML,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAQvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EAEtB,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EAEV,iBAAiB,EACjB,yBAAyB,EACzB,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EAGvB,MAAM,kBAAkB,CAAC;AAU1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAoN7E,eAAO,MAAM,yBAAyB,QAA2B,CAAC;AAiBlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,GAC9D,SAAS,MAAM,EAAE,CAenB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;aACd,SAAS,EAAE,MAAM;gBAAjB,SAAS,EAAE,MAAM;CAI9C;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAUD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAyB9D;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAkBlE;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb,wBAAwB,GAAG,IAAI,CAyBjC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,cAAe,YAAW,UAAU;IAsB7C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IA7BhC,QAAQ,CAAC,SAAS,EAAG,QAAQ,CAAU;IACvC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAiB;IACvD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAK;IAKxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,wEAAwE;IACxE,OAAO,CAAC,SAAS,CAAqB;IACtC,wEAAwE;IACxE,OAAO,CAAC,gBAAgB,CAAwC;IAChE,2EAA2E;IAC3E,OAAO,CAAC,UAAU,CAAgC;IAElD,gFAAgF;IAChF,OAAO,KAAK,OAAO,GAElB;gBAGkB,MAAM,EAAE,WAAW;IACpC;;;;;;OAMG;IACc,YAAY,CAAC,EAAE,iBAAiB,YAAA;IAMnD,+EAA+E;IAC/E,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIjC,mBAAmB,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI;IAI7D,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;IAQ/C;;;;OAIG;YACW,cAAc;IA6B5B;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,mCAAoC;IAE3E;;;;OAIG;IACH,+BAA+B,IAAI,SAAS,MAAM,EAAE;IAQpD;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAW5B,OAAO,CAAC,iBAAiB;IAgCzB;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;IAUtB,OAAO,CACX,MAAM,EAAE,kBAAkB,EAC1B,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,WAAW,CAAC;YAOT,WAAW;IAmKnB,aAAa,CACjB,MAAM,EAAE,iBAAiB,EACzB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,WAAW,CAAC;YAOT,iBAAiB;YAkGjB,YAAY;IAkC1B,OAAO,CAAC,yBAAyB;IAiCjC,2BAA2B;IAC3B,sBAAsB,CACpB,KAAK,EAAE,OAAO,GACb,iBAAiB,GAAG,sBAAsB;IAyB7C,OAAO,CAAC,mBAAmB;IAuB3B,OAAO,CAAC,uBAAuB;IAW/B,OAAO,CAAC,WAAW;IAwBnB,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,eAAe;YAUT,KAAK;IAOb,SAAS,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA0CpD,SAAS,IAAI,OAAO,CACtB;QACE,EAAE,EAAE,IAAI,CAAC;QACT,MAAM,EACF,WAAW,GACX,SAAS,GACT,OAAO,GACP,QAAQ,GACR,SAAS,GACT,SAAS,CAAC;KACf,GACD;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAChC;IAiCD;;;;;;;;;;OAUG;IACG,iBAAiB,IAAI,OAAO,CAAC,eAAe,CAAC;IAuFnD;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAuErC,UAAU,IAAI,aAAa,CAAC,YAAY,CAAC;YA+B3B,aAAa;IA2P3B;;;;;;;OAOG;YACW,WAAW;IA8CzB;;;OAGG;IACH,MAAM,CAAC,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAkBvD;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,eAAe;IAuBvB;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB;IAmB7B;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IA6SxB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,gBAAgB,CACpB,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAqV/B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,gBAAgB,CACpB,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,sBAAsB,CAAC;CA+YnC"}
+{"version":3,"file":"claude-code-core.d.ts","sourceRoot":"","sources":["../../../src/core/backends/claude-code-core.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAKvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EAEV,iBAAiB,EACjB,yBAAyB,EACzB,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAO1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAgB7E,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EAGzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAE/B,sBAAsB,EAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,SAAS,IAAI,WAAW,EAOzB,MAAM,kBAAkB,CAAC;AAgB1B,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,GACvB,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,cAAe,YAAW,UAAU;IAsB7C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IA7BhC,QAAQ,CAAC,SAAS,EAAG,QAAQ,CAAU;IACvC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAiB;IACvD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAK;IAKxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,wEAAwE;IACxE,OAAO,CAAC,SAAS,CAAqB;IACtC,wEAAwE;IACxE,OAAO,CAAC,gBAAgB,CAAwC;IAChE,2EAA2E;IAC3E,OAAO,CAAC,UAAU,CAAgC;IAElD,gFAAgF;IAChF,OAAO,KAAK,OAAO,GAElB;gBAGkB,MAAM,EAAE,WAAW;IACpC;;;;;;OAMG;IACc,YAAY,CAAC,EAAE,iBAAiB,YAAA;IAMnD,+EAA+E;IAC/E,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIjC,mBAAmB,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI;IAI7D,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;IAQ/C;;;;OAIG;YACW,cAAc;IA6B5B;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,CAAC,uBAAuB,mCAAoC;IAE3E;;;;OAIG;IACH,+BAA+B,IAAI,SAAS,MAAM,EAAE;IAQpD;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAW5B,OAAO,CAAC,iBAAiB;IAgCzB;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;IAUtB,OAAO,CACX,MAAM,EAAE,kBAAkB,EAC1B,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,WAAW,CAAC;YAOT,WAAW;IA+KnB,aAAa,CACjB,MAAM,EAAE,iBAAiB,EACzB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,WAAW,CAAC;YAOT,iBAAiB;YAwGjB,YAAY;IAkC1B,OAAO,CAAC,yBAAyB;IAiCjC,2BAA2B;IAC3B,sBAAsB,CACpB,KAAK,EAAE,OAAO,GACb,iBAAiB,GAAG,sBAAsB;IAyB7C,OAAO,CAAC,mBAAmB;IAuB3B,OAAO,CAAC,uBAAuB;IAiB/B,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,eAAe;YAIT,KAAK;IAOb,SAAS,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA0C1D;;;;;;OAMG;IACG,SAAS,IAAI,UAAU,CAAC,OAAO,WAAW,CAAC;IAIjD;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,eAAe,CAAC;IAInD;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAuErC,UAAU,IAAI,aAAa,CAAC,YAAY,CAAC;YA+B3B,aAAa;IA2P3B;;;;;;;OAOG;YACW,WAAW;IA8CzB;;;OAGG;IACH,MAAM,CAAC,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAkBvD;;;;;;;;;;;;;;OAcG;IAMH,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,uBAAuB;IAI/B,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,qBAAqB;IAI7B;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,aAAa;IAQrB;;;;;;;OAOG;IACG,gBAAgB,CACpB,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAI/B;;;;OAIG;IACG,gBAAgB,CACpB,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,sBAAsB,CAAC;CAGnC"}