@bivy/bivy 0.0.0 → 0.1.0-staging.2

package/dist/runtime/claude-code.js

@@ -0,0 +1,1364 @@
+// SPDX-License-Identifier: FSL-1.1-ALv2
+// Copyright (c) 2026 Petter André Sjulstad
+// Claude Code (Claude Agent SDK) adapter — a second concrete AgentRuntime.
+//
+// Maps Anthropic's `@anthropic-ai/claude-agent-sdk` onto the runtime-agnostic
+// interface in ./types.ts so the daemon never sees an SDK type. Like pi.ts, this
+// is the only place that touches the Claude Agent SDK.
+//
+// Design notes:
+//   * One long-lived `query()` per session, driven by a streaming-input async
+//     iterable (an AsyncQueue) so a session can take many prompts (multi-turn)
+//     instead of spawning a fresh agent per prompt the way the generic CLI does.
+//   * The guardian/approval hook is wired through the SDK's `canUseTool`
+//     permission callback, which maps cleanly onto our generic `toolInterceptor`.
+//   * The SDK is loaded with a dynamic import so it stays an *optional*
+//     dependency: a Bivy install only needs it when this runtime is selected.
+import { createRequire } from "node:module";
+import { randomUUID } from "node:crypto";
+import { EventEmitter } from "node:events";
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import { depCacheEnv } from "../harness/dep-cache.js";
+import os from "node:os";
+import path from "node:path";
+import { sandboxTier, claudePermissionModeFor } from "../harness/sandbox.js";
+import { anthropicCredentialPreflight, describeAnthropicError, isAnthropicAuthError } from "./anthropic-preflight.js";
+import { toModelInfo as sharedToModelInfo } from "./normalize.js";
+import { hasLiveProcessForCwd } from "./native-process-scan.js";
+/** Binary names a live Claude Code process could be running under (see
+ *  native-process-scan.ts's best-effort cwd match). */
+const CLAUDE_BIN_NAMES = ["claude"];
+/** Whether the standalone `claude` CLI (the TUI) is on PATH on this node. */
+export function claudeCliAvailable() {
+    const result = spawnSync(process.platform === "win32" ? "where" : "command", process.platform === "win32" ? ["claude"] : ["-v", "claude"], {
+        shell: process.platform !== "win32",
+        stdio: "ignore",
+    });
+    return result.status === 0;
+}
+// Kept as a variable (not a string literal) so `tsc` treats the dynamic import
+// as `any` and does not require the optional SDK to be installed to typecheck.
+const SDK_PACKAGE = "@anthropic-ai/claude-agent-sdk";
+// AskUserQuestion is NOT handled here: it's a Bivy-owned feature that lives in
+// the guardian tool-interceptor (see src/question.ts), so it works for every
+// runtime with capabilities.toolInterception rather than being reimplemented per
+// SDK. The interceptor is invoked from canUseTool below like any other tool.
+// Fallback model list for the picker before the agent subprocess is up.
+// getModels() is called to render the model picker (e.g. right after an
+// OAuth sign-in, before the user sends anything), but the SDK's
+// supportedModels() only runs once ensureStarted() has spawned the query on
+// the first prompt. Until then this.models is empty and the picker would show
+// nothing. These are the models a Claude Pro/Max subscription exposes; once
+// the query is up, supportedModels() replaces them with the authoritative set.
+const FALLBACK_MODELS = [
+    { provider: "anthropic", id: "claude-opus-4-8", name: "Claude Opus 4.8", reasoning: true },
+    { provider: "anthropic", id: "claude-sonnet-5", name: "Claude Sonnet 5", reasoning: true },
+    { provider: "anthropic", id: "claude-haiku-4-5-20251001", name: "Claude Haiku 4.5", reasoning: true },
+];
+export function claudeRuntimeFromEnv() {
+    return {
+        defaultModel: process.env.BIVY_CLAUDE_MODEL?.trim() || undefined,
+        sessionsDir: process.env.BIVY_CLAUDE_SESSIONS_DIR?.trim() || undefined,
+    };
+}
+/** True when `@anthropic-ai/claude-agent-sdk` is resolvable in this install. */
+export function claudeSdkInstalled() {
+    try {
+        createRequire(import.meta.url).resolve(SDK_PACKAGE);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function loadSdk() {
+    try {
+        return await import(SDK_PACKAGE);
+    }
+    catch {
+        throw new Error(`The claude-code-sdk runtime requires the "${SDK_PACKAGE}" package. Install it with: npm install ${SDK_PACKAGE}`);
+    }
+}
+/**
+ * Single-producer async queue used as the SDK's streaming prompt input. Pushing a
+ * message either satisfies a pending `next()` or buffers it; closing ends the
+ * iterator so the underlying `query()` shuts down cleanly.
+ */
+class AsyncQueue {
+    values = [];
+    resolvers = [];
+    done = false;
+    push(value) {
+        if (this.done)
+            return;
+        const resolve = this.resolvers.shift();
+        if (resolve)
+            resolve({ value, done: false });
+        else
+            this.values.push(value);
+    }
+    close() {
+        if (this.done)
+            return;
+        this.done = true;
+        let resolve;
+        while ((resolve = this.resolvers.shift()))
+            resolve({ value: undefined, done: true });
+    }
+    [Symbol.asyncIterator]() {
+        return {
+            next: () => {
+                const value = this.values.shift();
+                if (value !== undefined)
+                    return Promise.resolve({ value, done: false });
+                if (this.done)
+                    return Promise.resolve({ value: undefined, done: true });
+                return new Promise((resolve) => this.resolvers.push(resolve));
+            },
+        };
+    }
+}
+/**
+ * Build the composer's slash-command list from the SDK's system/init message.
+ * `slash_commands` are the built-in + custom (.claude/commands) + plugin
+ * commands; `skills` are exposed as "/name" too (the SDK runs a skill from a
+ * matching slash). Names arrive without a leading slash, so we normalize to
+ * "/name", drop blanks, and dedupe (slash_commands win over a same-named skill).
+ * Exported for unit testing. Descriptions aren't in init, so names stand alone.
+ */
+export function claudeCommandsFromInit(message) {
+    const seen = new Set();
+    const out = [];
+    const add = (raw) => {
+        const base = typeof raw === "string" ? raw.trim().replace(/^\/+/, "") : "";
+        if (!base)
+            return;
+        const name = `/${base}`;
+        if (seen.has(name))
+            return;
+        seen.add(name);
+        out.push({ name });
+    };
+    const slash = message?.slash_commands;
+    if (Array.isArray(slash))
+        for (const c of slash)
+            add(c);
+    const skills = message?.skills;
+    if (Array.isArray(skills))
+        for (const s of skills)
+            add(s);
+    return out;
+}
+/** Order-insensitive equality on command names — so we only re-advertise (and
+ *  re-render the composer menu) when the set actually changed. */
+function sameCommands(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const names = new Set(b.map((c) => c.name));
+    return a.every((c) => names.has(c.name));
+}
+function extractText(message) {
+    const content = message?.content;
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .filter((block) => block?.type === "text" && typeof block.text === "string")
+        .map((block) => block.text)
+        .join("");
+}
+/** Model-only "meta" turns the CLI injects for its *own* benefit — task-completion
+ *  notifications and injected `<system-reminder>` blocks. These are pure noise in
+ *  a human transcript and must never render as chat. Kept a deliberately narrow
+ *  known-tag allowlist (not "any leading <tag>") so a real user prompt that
+ *  happens to start with e.g. "<div>" is never dropped. Interrupt markers are
+ *  handled separately (see INTERRUPT_MARKER) because — unlike these — they carry
+ *  meaning a human wants to see. */
+const DROP_META_TEXT = /^\s*<(?:task-notification|system-reminder)[\s>/]/;
+/** The CLI writes this synthetic user-role marker whenever a turn is aborted —
+ *  by a real user Stop OR by any teardown of the streaming query (our shutdown,
+ *  a mid-flight credential reload, a TUI refresh). We don't drop it: we surface
+ *  it as a system notice, labeled by cause (see interruptNoticeText). */
+const INTERRUPT_MARKER = /^\s*\[Request interrupted by user/;
+function hasMetaFlag(entry) {
+    return entry?.isMeta === true || entry?.isCompactSummary === true || entry?.isSynthetic === true;
+}
+/** True when a role:"user" turn is a model-only meta injection (see
+ *  DROP_META_TEXT) rather than a real human prompt. Callers must exclude
+ *  tool_result-bearing turns first — those carry real tool output, never meta. */
+function isDropMetaText(content) {
+    return DROP_META_TEXT.test(extractText({ content }));
+}
+/** True when a turn's text is the CLI's "[Request interrupted by user]" marker. */
+function isInterruptText(content) {
+    return INTERRUPT_MARKER.test(extractText({ content }));
+}
+/** Human-facing label for an interrupt marker, classified by cause so we never
+ *  blame a redeploy or a credential refresh on the user. The CLI tags any
+ *  interrupt caused by tearing the process/query down (our shutdown, a
+ *  credential-reload `query.close()`, a TUI refresh) with a top-level
+ *  `interruptedByShutdown: true` on the transcript entry; a cooperative user
+ *  Stop (`query.interrupt()`) is written without it. `forceUserStop` lets the
+ *  live path assert certainty when *we* just called abort() for a real Stop.
+ *  NOTE: the `interruptedByShutdown` semantics are inferred from on-disk
+ *  evidence, not the (unvendored) CLI source — worth a one-time empirical check. */
+function interruptNoticeText(entry, forceUserStop = false) {
+    if (!forceUserStop && entry?.interruptedByShutdown === true) {
+        return "Interrupted — the session was restarted.";
+    }
+    return "Stopped by user.";
+}
+/** Plain text out of a `tool_result` content block's own `content` (a string or
+ *  an array of text/image blocks) — mirrors `extractText`'s shape-handling. */
+function toolResultText(block) {
+    const content = block?.content;
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .filter((part) => part?.type === "text" && typeof part.text === "string")
+        .map((part) => part.text)
+        .join("");
+}
+/** Sums per-model token usage (SDK's ModelUsage) into a single totals object. */
+export function sumModelUsage(modelUsage) {
+    let input = 0, output = 0, cacheRead = 0, cacheWrite = 0;
+    for (const u of Object.values(modelUsage)) {
+        input += u.inputTokens ?? 0;
+        output += u.outputTokens ?? 0;
+        cacheRead += u.cacheReadInputTokens ?? 0;
+        cacheWrite += u.cacheCreationInputTokens ?? 0;
+    }
+    return { input, output, cacheRead, cacheWrite, total: input + output + cacheRead + cacheWrite };
+}
+/**
+ * Pure mapping from the SDK's (experimental, unstable) get-usage response
+ * shape into our runtime-agnostic UsageSnapshot. Kept separate from
+ * ClaudeCodeSession.getUsage() so the mapping itself is unit-testable without
+ * spinning up a real SDK query.
+ */
+export function mapUsageResponse(data) {
+    const session = data?.session;
+    const windows = [];
+    const rl = data?.rate_limits;
+    if (rl) {
+        const push = (label, w) => {
+            if (w)
+                windows.push({ label, utilizationPct: w.utilization ?? null, resetsAt: w.resets_at ?? null });
+        };
+        push("5-hour", rl.five_hour);
+        push("7-day", rl.seven_day);
+        push("7-day (OAuth apps)", rl.seven_day_oauth_apps);
+        push("7-day (Opus)", rl.seven_day_opus);
+        push("7-day (Sonnet)", rl.seven_day_sonnet);
+        for (const m of rl.model_scoped ?? [])
+            push(m.display_name, m);
+    }
+    return {
+        costUsd: session?.total_cost_usd,
+        tokens: session?.model_usage ? sumModelUsage(session.model_usage) : undefined,
+        plan: {
+            subscriptionType: data?.subscription_type ?? null,
+            windows,
+        },
+    };
+}
+function toModelInfo(model) {
+    // Shared mapping (src/runtime/normalize.ts); Claude models default to the
+    // anthropic provider when the record carries none.
+    return sharedToModelInfo(model, { defaultProvider: "anthropic" });
+}
+function cleanSessionName(value) {
+    return value
+        .replace(/[\r\n"'`]/g, " ")
+        .replace(/[\p{Control}]/gu, "")
+        .replace(/\s+/g, " ")
+        .trim()
+        .replace(/[.?!,:;\-–—]+$/g, "")
+        .slice(0, 60)
+        .trim();
+}
+/** The bearer we handed the SDK: the OAuth subscription token if present, else
+ *  the API key. Used to tell whether the vault has rotated the credential since
+ *  a query was spawned (the query's env is fixed at spawn — see spawnQuery). */
+function authTokenFromEnv(env) {
+    return env.CLAUDE_CODE_OAUTH_TOKEN?.trim() || env.ANTHROPIC_API_KEY?.trim() || undefined;
+}
+function claudeUserContent(text, options) {
+    const images = options?.images ?? [];
+    if (!images.length)
+        return text;
+    return [
+        ...(text ? [{ type: "text", text }] : []),
+        ...images.map((image) => ({
+            type: "image",
+            source: {
+                type: "base64",
+                media_type: image.mimeType || "image/png",
+                data: image.data,
+            },
+        })),
+    ];
+}
+function claudeProjectDirs() {
+    return [
+        process.env.CLAUDE_CONFIG_DIR,
+        path.join(os.homedir(), ".claude"),
+    ].filter((value) => Boolean(value));
+}
+/**
+ * Root(s) to BULK-SCAN for native session discovery (issue #156) — narrower
+ * than claudeProjectDirs() above. That helper searches both CLAUDE_CONFIG_DIR
+ * and the default `~/.claude` when locating one already-known session id by
+ * name, which is harmless (a wrong root just doesn't have the file). Bulk
+ * discovery is different: unconditionally also listing `~/.claude` would leak
+ * unrelated sessions from the default store onto a node that was deliberately
+ * pointed at a non-default config dir. The real `claude` CLI's own
+ * CLAUDE_CONFIG_DIR handling is exclusive (it replaces the default, not adds
+ * to it), so discovery mirrors that: CLAUDE_CONFIG_DIR when set, else the
+ * default `~/.claude` — never both.
+ */
+function claudeDiscoveryRoots() {
+    const custom = process.env.CLAUDE_CONFIG_DIR?.trim();
+    return [custom || path.join(os.homedir(), ".claude")];
+}
+function findClaudeTranscript(sessionId) {
+    const fileName = `${sessionId}.jsonl`;
+    for (const root of claudeProjectDirs()) {
+        const projects = path.join(root, "projects");
+        try {
+            for (const project of fs.readdirSync(projects, { withFileTypes: true })) {
+                if (!project.isDirectory())
+                    continue;
+                const candidate = path.join(projects, project.name, fileName);
+                if (fs.existsSync(candidate))
+                    return candidate;
+            }
+        }
+        catch {
+            // ignore missing/unreadable Claude stores
+        }
+    }
+    return undefined;
+}
+function loadClaudeTranscript(sessionId) {
+    const file = findClaudeTranscript(sessionId);
+    if (!file)
+        return [];
+    const messages = [];
+    // Indices of "the session was restarted" notices (interruptedByShutdown). A
+    // restart the session *continued past* was recovered (a credential-reload
+    // re-drive, or a session the user resumed), so it's noise — we keep only a
+    // trailing one, where the session actually ended interrupted. See below.
+    const restartNoticeIdx = [];
+    try {
+        for (const line of fs.readFileSync(file, "utf8").split(/\r?\n/)) {
+            if (!line.trim())
+                continue;
+            const entry = JSON.parse(line);
+            const rawRole = entry?.message?.role ?? entry?.role;
+            const rawContent = entry?.message?.content ?? entry?.content;
+            // Interrupt markers aren't dropped — surface them as a system notice,
+            // labeled by cause (a real Stop vs. a teardown/restart) so history shows
+            // *why* a turn ended instead of a bare, confusing user bubble. This is the
+            // one place that survives a redeploy: interruptedByShutdown rides the
+            // on-disk entry, so even a new process can label it correctly.
+            if (rawRole === "user" && isInterruptText(rawContent)) {
+                messages.push({ role: "system", content: interruptNoticeText(entry), timestamp: new Date(entry?.timestamp ?? entry?.createdAt ?? Date.now()).getTime() });
+                if (entry?.interruptedByShutdown === true)
+                    restartNoticeIdx.push(messages.length - 1);
+                continue;
+            }
+            // Drop model-only meta the CLI writes for itself (task-notifications,
+            // injected reminders, compaction summaries). Flags ride the entry; the
+            // text net catches the code paths that omit them. See DROP_META_TEXT.
+            if (hasMetaFlag(entry))
+                continue;
+            const role = rawRole;
+            if (role !== "user" && role !== "assistant")
+                continue;
+            const content = rawContent;
+            if (role === "user" && Array.isArray(content) && !content.some((block) => block?.type === "text" || block?.type === "tool_result"))
+                continue;
+            if (role === "user" && !(Array.isArray(content) && content.some((block) => block?.type === "tool_result")) && isDropMetaText(content))
+                continue;
+            if (role === "assistant" && Array.isArray(content) && !content.some((block) => block?.type === "text" || block?.type === "tool_use" || block?.type === "thinking"))
+                continue;
+            if (typeof content !== "string" && !Array.isArray(content))
+                continue;
+            messages.push({ role, content, timestamp: new Date(entry?.timestamp ?? entry?.createdAt ?? Date.now()).getTime() });
+        }
+    }
+    catch {
+        return dropRecoveredRestartNotices(messages, restartNoticeIdx);
+    }
+    return dropRecoveredRestartNotices(messages, restartNoticeIdx);
+}
+/** Drop "session was restarted" notices the transcript continued past (they were
+ *  recovered — a credential-reload re-drive or a resumed session), keeping only a
+ *  trailing one where the session actually ended interrupted. Genuine user Stops
+ *  are never in `restartNoticeIdx`, so they're always kept. */
+function dropRecoveredRestartNotices(messages, restartNoticeIdx) {
+    if (!restartNoticeIdx.length)
+        return messages;
+    const lastIdx = messages.length - 1;
+    const drop = new Set(restartNoticeIdx.filter((i) => i !== lastIdx));
+    return drop.size ? messages.filter((_, i) => !drop.has(i)) : messages;
+}
+/**
+ * Cheap, bounded per-file scan for native discovery (issue #156) — deliberately
+ * NOT loadClaudeTranscript: that reconstructs the full conversation, which is
+ * exactly the transcript CONTENT discovery must never carry. This reads only
+ * the first recorded `cwd` and a truncated first user prompt, stopping the
+ * moment both are found, plus the file's mtime as a last-activity proxy.
+ * Best-effort: any read/parse failure yields whatever was found so far (or
+ * undefined if the file itself is unreadable).
+ */
+function scanClaudeSessionForDiscovery(file) {
+    let updatedAt;
+    try {
+        updatedAt = fs.statSync(file).mtimeMs;
+    }
+    catch {
+        return undefined;
+    }
+    let cwd;
+    let title;
+    try {
+        for (const line of fs.readFileSync(file, "utf8").split(/\r?\n/)) {
+            if (!line.trim())
+                continue;
+            if (cwd && title)
+                break;
+            let entry;
+            try {
+                entry = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (!cwd && typeof entry?.cwd === "string")
+                cwd = entry.cwd;
+            if (!title) {
+                const role = entry?.message?.role ?? entry?.role;
+                const content = entry?.message?.content ?? entry?.content;
+                if (role === "user" && !hasMetaFlag(entry) && !isInterruptText(content)) {
+                    const text = typeof content === "string"
+                        ? content
+                        : Array.isArray(content)
+                            ? content.find((b) => b?.type === "text")?.text
+                            : undefined;
+                    if (text?.trim())
+                        title = text.trim().slice(0, 200);
+                }
+            }
+        }
+    }
+    catch {
+        // best-effort — whatever cwd/title were found before the failure still stand
+    }
+    return { cwd, updatedAt, title };
+}
+/**
+ * Enumerate Claude Code's on-disk sessions — from claudeDiscoveryRoots()
+ * (CLAUDE_CONFIG_DIR when set, else `~/.claude`, so a non-default provider
+ * home is honored and never mixed with the default store) — as bounded
+ * discovery metadata. Every session on disk has a stable id (the jsonl
+ * filename) Claude resumes by, so `resumable` is always true; `active` is a
+ * best-effort live-process check scoped to the session's own cwd. Best-effort
+ * throughout: an unreadable store yields fewer results, never a throw.
+ */
+export function discoverNativeClaudeSessions(hasLiveProcess = (cwd) => hasLiveProcessForCwd(cwd, CLAUDE_BIN_NAMES)) {
+    const out = [];
+    const seenIds = new Set();
+    for (const root of claudeDiscoveryRoots()) {
+        const projectsDir = path.join(root, "projects");
+        let projectEntries;
+        try {
+            projectEntries = fs.readdirSync(projectsDir, { withFileTypes: true });
+        }
+        catch {
+            continue; // no store at this root — best-effort, try the next one
+        }
+        for (const project of projectEntries) {
+            if (!project.isDirectory())
+                continue;
+            const projectDir = path.join(projectsDir, project.name);
+            let files;
+            try {
+                files = fs.readdirSync(projectDir).filter((name) => name.endsWith(".jsonl"));
+            }
+            catch {
+                continue;
+            }
+            for (const fileName of files) {
+                const sessionId = fileName.slice(0, -".jsonl".length);
+                if (!sessionId || seenIds.has(sessionId))
+                    continue;
+                seenIds.add(sessionId);
+                const meta = scanClaudeSessionForDiscovery(path.join(projectDir, fileName));
+                if (!meta)
+                    continue;
+                out.push({
+                    runtimeId: "claude-code-sdk",
+                    ref: sessionId,
+                    file: path.join(projectDir, fileName),
+                    cwd: meta.cwd,
+                    updatedAt: meta.updatedAt,
+                    title: meta.title,
+                    active: Boolean(meta.cwd) && hasLiveProcess(meta.cwd),
+                    resumable: true,
+                });
+            }
+        }
+    }
+    return out.sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0));
+}
+class ClaudeSession {
+    runtimeOptions;
+    cwd;
+    toolInterceptor;
+    query;
+    // Re-created on every spawnQuery: the previous SDK query owns the old queue, so
+    // a re-spawn (credential reload) must not share it. Not readonly for that reason.
+    input = new AsyncQueue();
+    emitter = new EventEmitter();
+    messages = [];
+    streaming = false;
+    name;
+    models = [];
+    currentModel;
+    desiredModel;
+    /** Token used to `resume` an existing session; undefined for a fresh one. */
+    resumeId;
+    /** The id we report; for new sessions we pin it via the SDK `sessionId` option. */
+    id;
+    currentText = "";
+    startedMessage = false;
+    runningTools = new Set();
+    /** The bearer baked into the *currently running* query's env at spawn. A turn
+     *  compares this against a freshly-resolved vault token to decide whether a
+     *  credential reload is worth it (see restartWithFreshCredential). */
+    spawnedToken;
+    /** The user content of the in-flight turn, kept so a mid-flight credential
+     *  reload can re-drive the interrupted prompt into the re-spawned query (the
+     *  failed turn never reached disk, so resume alone wouldn't replay it). */
+    inFlightPrompt;
+    /** One reactive credential reload per turn — a second 401 after a refresh means
+     *  the fresh token was also rejected, so surface it instead of looping. */
+    reloadedThisTurn = false;
+    /** Guards restartWithFreshCredential against re-entrancy. */
+    reloading = false;
+    /** Set when *we* call abort() for a genuine user Stop, so the resulting
+     *  "[Request interrupted by user]" marker is labeled "Stopped by user" with
+     *  certainty rather than relying on the CLI's interruptedByShutdown flag.
+     *  Cleared once the marker is consumed or the turn otherwise ends. */
+    userAbortPending = false;
+    /** Set when we tear the query down for a *credential reload*, which the CLI
+     *  records as an interrupt even though the turn transparently re-drives and
+     *  completes. Suppresses the resulting marker so it never flashes an
+     *  "interrupted" notice. One-shot; cleared when consumed, on the next result,
+     *  and on a real abort() (a user Stop must never be silenced by a stale flag). */
+    suppressNextInterrupt = false;
+    /** The agent's own slash commands for this session, learned from the SDK's
+     *  system/init message (slash_commands + skills). Empty until the first turn's
+     *  init arrives; getCommands() exposes them and a `runtime.commands` event lets
+     *  the daemon re-advertise once they're known. */
+    commands = [];
+    constructor(runtimeOptions, cwd, toolInterceptor, resumeId) {
+        this.runtimeOptions = runtimeOptions;
+        this.cwd = cwd;
+        this.toolInterceptor = toolInterceptor;
+        this.resumeId = resumeId;
+        this.id = resumeId ?? randomUUID();
+        this.desiredModel = runtimeOptions.defaultModel;
+        if (resumeId)
+            this.messages = loadClaudeTranscript(resumeId);
+    }
+    /** Resume token handed back to the daemon; the session id doubles as the file. */
+    get sessionFile() {
+        return this.id;
+    }
+    get isStreaming() {
+        return this.streaming;
+    }
+    /**
+     * Resume this session in the `claude` CLI's interactive TUI. The SDK and CLI
+     * share one on-disk store (~/.claude/projects/<cwd>/<sessionId>.jsonl) and our
+     * session id *is* that sessionId, so `claude --resume <id>` in this worktree
+     * reopens the exact conversation. Returns null if the CLI is not installed.
+     * (Vault credentials are injected so the TUI uses the same auth as chat.)
+     */
+    async interactiveTuiCommand() {
+        if (!claudeCliAvailable())
+            return null;
+        const env = await this.resolveCredentialEnv().catch(() => ({}));
+        return { command: "claude", args: ["--resume", this.sessionFile], env };
+    }
+    getMessages() {
+        return this.messages;
+    }
+    getCommands() {
+        return this.commands;
+    }
+    subscribe(listener) {
+        this.emitter.on("event", listener);
+        return () => this.emitter.off("event", listener);
+    }
+    emit(event) {
+        this.emitter.emit("event", event);
+    }
+    async ensureStarted() {
+        if (this.query)
+            return;
+        // First open resumes the stored token (undefined for a brand-new session);
+        // a later credential reload resumes this.id (the conversation is on disk).
+        await this.spawnQuery(this.resumeId);
+    }
+    /**
+     * Spawn the SDK `query()` for this session and start consuming it. The vault
+     * credential is resolved *here*, not once ahead of time, and baked into the
+     * subprocess env; the bearer it produced is remembered on `spawnedToken` so a
+     * later turn can tell whether the vault has since rotated it. `resumeId` is the
+     * session to continue from: the stored resume token on a first open, or — when
+     * re-spawning after a credential refresh — this session's own id, since the
+     * conversation is already on disk by then.
+     *
+     * A fresh input queue is created on every spawn: the previous SDK query owns
+     * (and may hold a pending read on) the old one, so reusing it would let a
+     * re-driven prompt satisfy the dead query instead of the new one.
+     */
+    async spawnQuery(resumeId) {
+        const sdk = await (this.runtimeOptions.sdkLoader ?? loadSdk)();
+        this.input = new AsyncQueue();
+        // The SDK's "bypassPermissions" mode (what danger-full-access natively maps
+        // to) auto-approves every tool call *before* the canUseTool callback runs —
+        // so canUseTool never fires and the tool interceptor is skipped entirely,
+        // which silently disables Bivy's governance AND its AskUserQuestion question
+        // card (both ride the interceptor). Run those sessions in "default" mode and
+        // blanket-allow tools in canUseTool instead: identical unrestricted access,
+        // but the interceptor stays live.
+        const nativeMode = claudePermissionModeFor(sandboxTier(this.runtimeOptions.sandbox));
+        const fullAccess = nativeMode === "bypassPermissions";
+        const permissionMode = fullAccess ? "default" : nativeMode;
+        // Always defined (not gated on toolInterceptor): Bivy's interceptor may need
+        // to service a tool (e.g. answer an AskUserQuestion), so this hook must exist
+        // even when no other tools are gated.
+        const canUseTool = async (toolName, input, opts) => {
+            if (this.toolInterceptor) {
+                const decision = await this.toolInterceptor({ sessionId: this.id, toolName, input, signal: opts.signal });
+                // Bivy answered/serviced the call itself — feed the result back without
+                // running the tool. canUseTool has no success-result channel, so this
+                // rides the deny message (the SDK returns it as the tool result); the
+                // interceptor formats `result` as a plain statement, not an error.
+                if (decision && decision.handled) {
+                    return { behavior: "deny", message: decision.result ?? "" };
+                }
+                if (decision && decision.block) {
+                    return { behavior: "deny", message: decision.reason ?? `Blocked ${toolName}` };
+                }
+            }
+            // danger-full-access: no gating, just approve. Kept in "default" mode (not
+            // via bypassPermissions) so canUseTool still runs the interceptor above.
+            return { behavior: "allow", updatedInput: input };
+        };
+        // Start from the process env (the SDK's `env` replaces, not merges), layer in
+        // any configured extras, then the shared-vault credential so one login at the
+        // Bivy level serves this agent too. The vault wins over an ambient key.
+        const env = { ...process.env, ...depCacheEnv(), ...this.runtimeOptions.env };
+        const credEnv = await this.resolveCredentialEnv();
+        Object.assign(env, credEnv);
+        this.spawnedToken = authTokenFromEnv(credEnv);
+        const options = {
+            cwd: this.cwd,
+            includePartialMessages: true,
+            // Native exec sandbox: map the node's tier to the SDK permission mode.
+            // "default" keeps canUseTool gating risky tools (and, for danger-full-
+            // access, blanket-allowing them — see fullAccess above); "plan" makes a
+            // read-only session. We never pass "bypassPermissions": it would skip
+            // canUseTool and silently break AskUserQuestion.
+            permissionMode,
+            canUseTool,
+            env,
+        };
+        if (resumeId)
+            options.resume = resumeId;
+        else
+            options.sessionId = this.id;
+        if (this.desiredModel)
+            options.model = this.desiredModel;
+        const q = sdk.query({ prompt: this.input, options });
+        this.query = q;
+        void this.consume(q);
+        // Best-effort: populate the model picker once the agent is up.
+        if (typeof q.supportedModels === "function") {
+            q.supportedModels()
+                .then((models) => {
+                this.models = (models ?? []).map(toModelInfo);
+            })
+                .catch(() => { });
+        }
+    }
+    /**
+     * Tear down the running query and re-spawn it resuming the same session, using
+     * a freshly-resolved vault credential (Pi's AuthStorage auto-refreshes an
+     * expired OAuth token, so re-resolving yields a live bearer). A long-lived
+     * query bakes its token in at spawn and cannot pick up a rotated one any other
+     * way, so restarting is the reload.
+     *
+     * Returns true when the vault produced a *different* token (the restart is
+     * worth it), false when it produced the same token or none — in which case the
+     * caller should surface the auth error rather than loop, since another attempt
+     * would fail identically (e.g. a revoked login, or a rotated refresh token this
+     * node lost the race for — the same cross-consumer race codex-auth.ts notes).
+     * Emits a "Refreshing credentials…" notice only when it actually restarts.
+     */
+    async restartWithFreshCredential() {
+        if (this.reloading)
+            return false;
+        this.reloading = true;
+        try {
+            const credEnv = await this.resolveCredentialEnv().catch(() => ({}));
+            const nextToken = authTokenFromEnv(credEnv);
+            if (!nextToken || nextToken === this.spawnedToken)
+                return false;
+            this.emit({ type: "session.notice", level: "info", message: "Refreshing credentials…" });
+            // This teardown makes the CLI write an interrupt marker, but the turn is
+            // re-driven and completes — so suppress that marker rather than blaming a
+            // phantom interrupt on the user (the "Refreshing credentials…" notice above
+            // already tells the human what happened).
+            this.suppressNextInterrupt = true;
+            this.teardownQuery();
+            await this.spawnQuery(this.resumeId ?? this.id);
+            return true;
+        }
+        finally {
+            this.reloading = false;
+        }
+    }
+    /** Close the current query and its input queue so a re-spawn resuming the same
+     *  id can replace them. Unlike dispose() this leaves the session live (emitter,
+     *  pending questions, message history intact) — only the transport is swapped. */
+    teardownQuery() {
+        const q = this.query;
+        this.query = undefined;
+        this.input.close();
+        if (q?.close) {
+            try {
+                q.close();
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+    /**
+     * Resolve the shared Anthropic credential (if any) and map it to the env vars
+     * the Claude Agent SDK accepts: ANTHROPIC_API_KEY for an API key, or
+     * CLAUDE_CODE_OAUTH_TOKEN for a Claude Pro/Max subscription token. Returns an
+     * empty object when no vault is wired or no credential is configured, so the
+     * SDK falls back to its own auth (ambient env / `claude` CLI login).
+     */
+    async resolveCredentialEnv() {
+        const store = this.runtimeOptions.credentials;
+        if (!store)
+            return {};
+        const provider = this.runtimeOptions.credentialProvider?.trim() || "anthropic";
+        let cred;
+        try {
+            cred = await store.getCredential(provider);
+        }
+        catch {
+            return {};
+        }
+        if (!cred)
+            return {};
+        const out = { ...(cred.env ?? {}) };
+        if (cred.kind === "oauth")
+            out.CLAUDE_CODE_OAUTH_TOKEN = cred.token;
+        else
+            out.ANTHROPIC_API_KEY = cred.token;
+        return out;
+    }
+    async consume(q) {
+        try {
+            for await (const message of q)
+                this.handle(message);
+        }
+        catch (error) {
+            this.streaming = false;
+            const raw = error instanceof Error ? error.message : String(error);
+            // Mid-flight credential reload: a long-lived query bakes its OAuth token in
+            // at spawn, so a turn that outlives the token fails here with a 401 even
+            // though the vault holds a freshly-refreshed one. Re-spawn once with the
+            // fresh credential and re-drive the interrupted prompt so the turn continues
+            // instead of dying. Bounded to one attempt per turn (reloadedThisTurn), only
+            // when a prompt is actually in flight, and only when the vault produced a
+            // *different* token (else restartWithFreshCredential returns false and we
+            // fall through to surfacing the error — no retry loop on a dead credential).
+            if (isAnthropicAuthError(raw) && !this.reloadedThisTurn && this.inFlightPrompt !== undefined) {
+                this.reloadedThisTurn = true;
+                if (await this.restartWithFreshCredential()) {
+                    this.streaming = true;
+                    this.input.push({ type: "user", message: { role: "user", content: this.inFlightPrompt }, parent_tool_use_id: null });
+                    return; // the re-spawned query's consume() now drives the turn to completion.
+                }
+            }
+            // Emit session.error (the toast path) — agent_end's `error` field is not
+            // surfaced by the client, so without this a thrown SDK error (e.g. a 401)
+            // stopped the turn silently. Auth failures get sign-in guidance appended.
+            this.emit({ type: "session.error", error: describeAnthropicError(raw) });
+            this.emit({ type: "turn_end" });
+            this.emit({ type: "agent_end", error: raw });
+        }
+    }
+    beginMessage() {
+        if (this.startedMessage)
+            return;
+        this.startedMessage = true;
+        this.emit({ type: "message_start", message: { role: "assistant", content: "" } });
+    }
+    handle(message) {
+        switch (message?.type) {
+            case "stream_event": {
+                const event = message.event;
+                if (event?.type === "content_block_delta" &&
+                    event.delta?.type === "text_delta" &&
+                    typeof event.delta.text === "string") {
+                    this.beginMessage();
+                    this.currentText += event.delta.text;
+                    this.emit({ type: "message_update", message: { role: "assistant", content: this.currentText } });
+                }
+                break;
+            }
+            case "partial_assistant": {
+                const text = extractText(message.message);
+                if (text) {
+                    this.beginMessage();
+                    this.currentText = text;
+                    this.emit({ type: "message_update", message: { role: "assistant", content: text } });
+                }
+                break;
+            }
+            case "assistant": {
+                // Compaction summaries and other meta assistant turns are for the model,
+                // not the human — never persist or surface them as chat.
+                if (hasMetaFlag(message))
+                    break;
+                const model = message.message?.model;
+                if (model)
+                    this.currentModel = toModelInfo({ id: model });
+                const content = Array.isArray(message.message?.content) ? message.message.content : [];
+                for (const block of content) {
+                    if (block?.type === "tool_use") {
+                        this.emit({ type: "tool_call", toolName: block.name, input: block.input, toolUseId: block.id });
+                    }
+                }
+                const text = extractText(message.message);
+                // Persist the full assistant turn — text, reasoning, and tool_use blocks —
+                // so re-opening a session shows what led to the answer, not just the final
+                // prose. Keep the content array intact when present so the client can pair
+                // tool_use blocks with the tool_result messages below; otherwise the plain
+                // text is enough. The live stream still surfaces text via message_end.
+                if (content.length || text) {
+                    this.messages.push({ role: "assistant", content: content.length ? content : text, timestamp: Date.now() });
+                }
+                if (text) {
+                    this.beginMessage();
+                    const finalized = { role: "assistant", content: text, timestamp: Date.now() };
+                    this.emit({ type: "message_update", message: finalized });
+                    this.emit({ type: "message_end", message: finalized });
+                }
+                this.startedMessage = false;
+                this.currentText = "";
+                break;
+            }
+            case "user": {
+                // The SDK echoes tool results back as user-role messages holding
+                // tool_result blocks. Persist those (matched to the tool_use blocks above
+                // by tool_use_id) so a re-opened transcript can show each call's output.
+                // Guard on tool_result so we never double-store the user's own prompt,
+                // which prompt() already appended.
+                const userContent = message.message?.content;
+                const toolResults = Array.isArray(userContent) ? userContent.filter((b) => b?.type === "tool_result") : [];
+                if (toolResults.length) {
+                    this.messages.push({ role: "user", content: userContent, timestamp: Date.now() });
+                    // Without this, a tool call's activity card in the transcript never
+                    // learns its call finished — nothing else translates this message
+                    // into a "result"-kind event, so `applyStreamEvent` (packages/core/
+                    // src/store.ts) falls through its default case and the card's status
+                    // stays "running" (spinner) for the rest of the session. `tool_progress`
+                    // pings cover *some* long-running tools but every tool completes via
+                    // this echo, so it's the one path that must flip every card to "done".
+                    for (const block of toolResults) {
+                        this.runningTools.delete(String(block.tool_use_id));
+                        this.emit({ type: "tool_result", toolUseId: block.tool_use_id, result: toolResultText(block), isError: Boolean(block.is_error) });
+                    }
+                    this.emit({ type: "user", raw: message });
+                    break;
+                }
+                // Interrupt marker: surface a system notice (never a user bubble),
+                // labeled by cause. If *we* just called abort() for a real user Stop
+                // (userAbortPending), that's authoritative; otherwise fall back to the
+                // CLI's interruptedByShutdown flag to tell a teardown/restart apart from
+                // a genuine Stop. Persist it (role:"system") so it survives reopen, and
+                // emit a live notice so it shows immediately.
+                if (isInterruptText(userContent)) {
+                    // A credential-reload teardown produced this marker; the turn re-drives
+                    // and completes transparently, so a notice would just be noise.
+                    if (this.suppressNextInterrupt) {
+                        this.suppressNextInterrupt = false;
+                        break;
+                    }
+                    const notice = interruptNoticeText(message, this.userAbortPending);
+                    this.userAbortPending = false;
+                    this.messages.push({ role: "system", content: notice, timestamp: Date.now() });
+                    this.emit({ type: "session.notice", level: "info", message: notice });
+                    break;
+                }
+                // Otherwise: the human's own prompt echo, or a model-only meta turn
+                // (injected reminder / task-notification). Drop meta so it never renders
+                // as a chat bubble; forward a real prompt echo unchanged.
+                if (hasMetaFlag(message) || isDropMetaText(userContent))
+                    break;
+                this.emit({ type: "user", raw: message });
+                break;
+            }
+            case "tool_progress": {
+                // The SDK's SDKToolProgressMessage carries no `status`/`output` field —
+                // it's purely a still-running elapsed-time ping for long-lived tools
+                // (the previous `message.status === "running"` check always read
+                // `undefined`, so every ping was mis-treated as completion, prematurely
+                // flipping the activity card to "done" mid-tool). Completion is now
+                // reported once, reliably, by the tool_result echo in `case "user"`
+                // above — this case only ever means "still running".
+                const toolUseId = message.tool_use_id;
+                const type = this.runningTools.has(toolUseId) ? "tool_execution_update" : "tool_execution_start";
+                this.runningTools.add(toolUseId);
+                this.emit({ type, toolName: message.tool_name, toolUseId, input: { elapsedSeconds: message.elapsed_time_seconds } });
+                break;
+            }
+            case "result": {
+                this.streaming = false;
+                this.startedMessage = false;
+                this.currentText = "";
+                // The turn ended; clear both interrupt flags so a stale one can't
+                // mislabel or wrongly suppress a later interrupt.
+                this.userAbortPending = false;
+                this.suppressNextInterrupt = false;
+                // Turn completed — the prompt is on disk now, so drop the copy kept for a
+                // mid-flight reload re-drive (see inFlightPrompt / consume's catch).
+                this.inFlightPrompt = undefined;
+                if (message.subtype && message.subtype !== "success") {
+                    this.emit({ type: "tool_result", error: message.subtype, message: message.result });
+                }
+                this.emit({ type: "turn_end" });
+                // Cost/token/plan-quota totals are read via getUsage() (backed by the
+                // SDK's usage_EXPERIMENTAL... control request), not forwarded here.
+                this.emit({ type: "agent_end", subtype: message.subtype });
+                break;
+            }
+            case "system": {
+                // The SDK's system/init reports this session's available slash commands
+                // (built-ins, custom .claude/commands, plugins) and skills. Capture them
+                // so getCommands() can offer them in the composer; the SDK interprets a
+                // leading-slash prompt itself, so forwarding "/name" from chat runs it.
+                // They're only known once init arrives (after the first turn starts), so
+                // emit `runtime.commands` to let the daemon re-advertise capabilities.
+                if (message?.subtype === "init") {
+                    const next = claudeCommandsFromInit(message);
+                    if (next.length && !sameCommands(next, this.commands)) {
+                        this.commands = next;
+                        this.emit({ type: "runtime.commands", commands: next });
+                    }
+                }
+                // Task-completion notifications and compaction boundaries are injected
+                // for the model, not the human — don't forward them as chat. (init still
+                // falls through so its capabilities/commands reach the client.)
+                if (message?.subtype === "task_notification" || message?.subtype === "compact_boundary")
+                    break;
+                this.emit({ type: String(message?.type ?? "unknown"), raw: message });
+                break;
+            }
+            default:
+                // user/tool-result echoes, status, etc. — forwarded for debugging but
+                // not part of busy/idle tracking.
+                this.emit({ type: String(message?.type ?? "unknown"), raw: message });
+        }
+    }
+    async prompt(text, options) {
+        const prompt = text.trim();
+        const content = claudeUserContent(prompt, options);
+        const hasImages = Boolean(options?.images?.length);
+        if (!prompt && !hasImages)
+            return;
+        // Credential preflight (first turn only): if no Anthropic credential will
+        // reach the SDK, surface an actionable message instead of letting it spawn
+        // and fail its first request with an opaque `401 Unauthorized`.
+        if (!this.query) {
+            const env = { ...process.env, ...depCacheEnv(), ...this.runtimeOptions.env, ...(await this.resolveCredentialEnv().catch(() => ({}))) };
+            const preflightError = anthropicCredentialPreflight(env);
+            if (preflightError) {
+                this.messages.push({ role: "user", content: hasImages ? content : prompt, timestamp: Date.now() });
+                this.emit({ type: "agent_start" });
+                this.emit({ type: "turn_start" });
+                this.emit({ type: "session.error", error: preflightError });
+                this.emit({ type: "turn_end" });
+                this.emit({ type: "agent_end" });
+                return;
+            }
+        }
+        await this.ensureStarted();
+        // Proactive reload at the turn boundary: the query's bearer is fixed at spawn,
+        // so if the vault has rotated it since (commonly: a parallel session refreshed
+        // the shared OAuth token, or it simply expired while this session sat idle),
+        // restart now with the fresh one instead of spending a stale token and 401ing.
+        // Only between turns (never mid-stream — that would drop an in-flight turn),
+        // and a no-op unless the token actually changed (see restartWithFreshCredential).
+        if (this.query && !this.streaming)
+            await this.restartWithFreshCredential();
+        this.messages.push({ role: "user", content: hasImages ? content : prompt, timestamp: Date.now() });
+        this.reloadedThisTurn = false;
+        this.inFlightPrompt = content;
+        this.streaming = true;
+        this.emit({ type: "agent_start" });
+        this.emit({ type: "turn_start" });
+        this.input.push({ type: "user", message: { role: "user", content }, parent_tool_use_id: null });
+    }
+    async abort() {
+        // Mark this as a genuine, user-initiated Stop so the interrupt marker the
+        // CLI is about to write is labeled with certainty (not via the shutdown
+        // flag). Clear any stale credential-reload suppression — a user Stop must
+        // always be shown, never silenced.
+        this.userAbortPending = true;
+        this.suppressNextInterrupt = false;
+        if (this.query?.interrupt) {
+            try {
+                await this.query.interrupt();
+            }
+            catch {
+                // Best-effort; the stream may already be idle.
+            }
+        }
+        this.streaming = false;
+    }
+    dispose() {
+        // query.close() aborts the SDK's in-flight canUseTool control requests,
+        // whose AbortSignal is forwarded to Bivy's tool interceptor — so a pending
+        // AskUserQuestion (owned by the daemon's QuestionManager) settles via that
+        // abort. The daemon also cancels a session's questions on teardown as a
+        // belt-and-suspenders (see server.ts), so nothing depends on this alone.
+        this.input.close();
+        if (this.query?.close) {
+            try {
+                this.query.close();
+            }
+            catch {
+                // ignore
+            }
+        }
+        this.emitter.removeAllListeners();
+    }
+    getModels() {
+        // Before the query is up (or if supportedModels() failed/returned nothing)
+        // fall back to the known lineup so the picker is never empty.
+        return this.models.length ? this.models : FALLBACK_MODELS;
+    }
+    getCurrentModel() {
+        if (this.currentModel)
+            return this.currentModel;
+        if (this.desiredModel)
+            return toModelInfo({ id: this.desiredModel });
+        return undefined;
+    }
+    async setModel(provider, id) {
+        this.desiredModel = id;
+        this.currentModel = toModelInfo({ provider, id });
+        if (this.query?.setModel)
+            await this.query.setModel(id);
+    }
+    /**
+     * Cost/token totals plus, for a claude.ai OAuth session, plan rate-limit
+     * utilization (how much of the 5-hour/7-day window is used). Backed by the
+     * SDK's `usage_EXPERIMENTAL_MAY_CHANGE_DO_NOT_RELY_ON_THIS_API_YET()` —
+     * explicitly unstable, so this fails soft (returns undefined) rather than
+     * ever breaking the session if the shape changes or the call throws.
+     */
+    async getUsage() {
+        const fn = this.query?.usage_EXPERIMENTAL_MAY_CHANGE_DO_NOT_RELY_ON_THIS_API_YET;
+        if (typeof fn !== "function")
+            return undefined;
+        try {
+            return mapUsageResponse(await fn.call(this.query));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    getName() {
+        return this.name;
+    }
+    setName(name) {
+        this.name = name;
+    }
+    async suggestName(firstPrompt) {
+        const prompt = firstPrompt.trim();
+        if (!prompt)
+            return undefined;
+        const env = { ...process.env, ...depCacheEnv(), ...this.runtimeOptions.env, ...(await this.resolveCredentialEnv()) };
+        const apiKey = env.ANTHROPIC_API_KEY || env.CLAUDE_CODE_OAUTH_TOKEN;
+        if (!apiKey)
+            return undefined;
+        // Claude Pro/Max OAuth tokens are only authorized for Claude Code: a raw
+        // /v1/messages call whose first system block isn't the Claude Code identity
+        // is rejected (non-200), which silently dropped session naming back to the
+        // first-line fallback. API keys have no such restriction. Send the identity
+        // as the first system block for OAuth so the naming instruction survives.
+        const useOAuth = !env.ANTHROPIC_API_KEY;
+        const namingInstruction = "Name chat sessions from the user's entire first message, not just its first line. Return only a concise title, 2-6 words. No quotes, punctuation, prefixes, or explanations.";
+        const response = await fetch("https://api.anthropic.com/v1/messages", {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "anthropic-version": "2023-06-01",
+                ...(useOAuth
+                    ? { authorization: `Bearer ${apiKey}`, "anthropic-beta": "oauth-2025-04-20" }
+                    : { "x-api-key": apiKey }),
+            },
+            body: JSON.stringify({
+                model: this.desiredModel || "claude-3-5-haiku-latest",
+                max_tokens: 24,
+                temperature: 0.2,
+                system: useOAuth
+                    ? [
+                        { type: "text", text: "You are Claude Code, Anthropic's official CLI for Claude." },
+                        { type: "text", text: namingInstruction },
+                    ]
+                    : namingInstruction,
+                messages: [{ role: "user", content: `Create a short title for this coding-agent session using the full first message below:\n\n${prompt.slice(0, 4000)}` }],
+            }),
+        });
+        if (!response.ok)
+            return undefined;
+        const json = (await response.json());
+        const text = (json.content ?? []).filter((part) => part.type === "text").map((part) => part.text ?? "").join(" ");
+        return cleanSessionName(text) || undefined;
+    }
+}
+export class ClaudeCodeRuntime {
+    options;
+    id = "claude-code-sdk";
+    displayName = "Claude Code SDK";
+    capabilities = {
+        toolInterception: true,
+        modelSelection: true,
+        packages: false,
+        resume: true,
+        fork: true,
+        // Only offer the chat<->TUI hand-off when the `claude` CLI is on PATH.
+        interactiveTui: claudeCliAvailable(),
+        usageReporting: true,
+        // The on-disk jsonl transcript can be exported and re-materialised on another
+        // node under a fresh session id, so a claude->claude fork is full fidelity.
+        forkTransport: true,
+        // Claude Code ignores the streamingBehavior hint entirely — a mid-turn
+        // prompt always re-enters the live input queue and behaves like an
+        // immediate steer, regardless of what's asked for. There is no real
+        // "followUp" (defer until the turn ends) here, so only advertise steer.
+        streamingBehaviors: ["steer"],
+        // Claude sessions started outside Bivy (a bare `claude` in a terminal) are
+        // discoverable across claudeProjectDirs() and every discovered session can
+        // be adopted with a true native resume (see discoverNativeSessions below).
+        nativeSessionDiscovery: true,
+        nativeSessionAdoption: true,
+    };
+    sessions = [];
+    constructor(options = {}) {
+        this.options = options;
+    }
+    /** Claude Code runs Anthropic models; the authoritative list comes from the
+     *  live query per session, so the session-less catalog is the known lineup. */
+    listCatalog() {
+        return [{ id: "anthropic", name: "Anthropic", oauth: true, models: FALLBACK_MODELS }];
+    }
+    async createSession(options) {
+        const session = new ClaudeSession(this.options, options.workspace, options.toolInterceptor);
+        this.sessions.push(session);
+        return { session };
+    }
+    async openSession(options) {
+        const session = new ClaudeSession(this.options, options.workspace, options.toolInterceptor, options.sessionFile);
+        this.sessions.push(session);
+        return {
+            session,
+            warning: "Resumed Claude Code session history is replayed by the agent on the next turn; prior messages are not preloaded.",
+        };
+    }
+    /**
+     * Read a session's transcript from Claude's on-disk store without constructing
+     * a live session. `sessionFile` is the resume token — a Claude session id (the
+     * runtime resumes by id, not path). This is exactly the read a resumed
+     * ClaudeSession does in its constructor (`this.messages = loadClaudeTranscript`),
+     * so the fast open path renders identically to the eventual live session. Empty
+     * when the transcript isn't on disk (e.g. BIVY_CLAUDE_SESSIONS_DIR unset), which
+     * the caller treats as "nothing to fast-paint" and falls back to a full open.
+     */
+    readMessages(sessionFile) {
+        try {
+            return loadClaudeTranscript(sessionFile);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** See discoverNativeClaudeSessions — enumerates Claude sessions on this node
+     *  that Bivy didn't start, as bounded metadata (issue #156). */
+    discoverNativeSessions() {
+        try {
+            return discoverNativeClaudeSessions();
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Export a claude session for a same-runtime fork: the raw jsonl transcript
+     * (Claude's own on-disk format), located by session id across the project
+     * stores. Undefined when the transcript isn't on disk. Reconstructed by
+     * `importForFork` on the destination node.
+     */
+    exportForFork(sessionFile) {
+        const file = findClaudeTranscript(sessionFile);
+        if (!file)
+            return undefined;
+        try {
+            const jsonl = fs.readFileSync(file, "utf8");
+            return { runtimeId: this.id, kind: "claude-jsonl", data: { jsonl, sourceId: sessionFile } };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Materialise an exported claude transcript into a fresh session on this node.
+     * Writes the jsonl under the destination cwd's project dir with a NEW session
+     * id (rewriting each entry's `sessionId`/`cwd` so `--resume <id>` and the SDK's
+     * store both see a self-consistent conversation), and returns that id as the
+     * resume ref. The source session is never touched.
+     */
+    async importForFork(payload, ctx) {
+        if (payload.runtimeId !== this.id || payload.kind !== "claude-jsonl") {
+            throw new Error(`claude.importForFork: unexpected payload ${payload.runtimeId}/${payload.kind}`);
+        }
+        const jsonl = String(payload.data?.jsonl ?? "");
+        const newId = randomUUID();
+        const cwd = ctx.cwd || ctx.workspace;
+        // Claude encodes the cwd into the project-dir name by replacing every
+        // non-alphanumeric char with "-", e.g. "/home/u/p" -> "-home-u-p".
+        const projectSlug = cwd.replace(/[^a-zA-Z0-9]/g, "-");
+        const root = claudeProjectDirs()[0] ?? path.join(os.homedir(), ".claude");
+        const projectDir = path.join(root, "projects", projectSlug);
+        fs.mkdirSync(projectDir, { recursive: true });
+        const rewritten = jsonl
+            .split(/\r?\n/)
+            .filter((line) => line.trim())
+            .map((line) => {
+            try {
+                const entry = JSON.parse(line);
+                entry.sessionId = newId;
+                if (entry.cwd)
+                    entry.cwd = cwd;
+                return JSON.stringify(entry);
+            }
+            catch {
+                return line; // preserve any line we can't parse rather than dropping it
+            }
+        })
+            .join("\n");
+        fs.writeFileSync(path.join(projectDir, `${newId}.jsonl`), rewritten ? `${rewritten}\n` : "");
+        return { sessionFile: newId, id: newId };
+    }
+    async listSessions() {
+        const dir = this.options.sessionsDir;
+        if (dir) {
+            try {
+                const sdk = await loadSdk();
+                if (typeof sdk.listSessions === "function") {
+                    const sessions = await sdk.listSessions({ dir });
+                    return (sessions ?? []).map((s) => {
+                        const id = s.sessionId ?? s.id;
+                        const open = this.sessions.find((session) => session.id === id || session.sessionFile === s.path);
+                        return {
+                            id,
+                            path: s.path,
+                            cwd: s.cwd ?? dir,
+                            name: open?.getName() ?? s.name ?? s.title,
+                            created: s.created ?? s.createdAt,
+                            modified: s.modified ?? s.updatedAt,
+                            messageCount: s.messageCount,
+                            firstMessage: s.firstMessage ?? s.summary,
+                        };
+                    });
+                }
+            }
+            catch {
+                // Fall through to in-memory sessions if the SDK can't list from disk.
+            }
+        }
+        return this.sessions.map((session) => ({
+            id: session.id,
+            cwd: session.cwd,
+            name: session.getName(),
+            messageCount: session.getMessages().length,
+        }));
+    }
+    /**
+     * Delete a session from Claude's own on-disk store. Without this, deleting a
+     * Claude session in the app only clears Bivy's metadata + its sessionsDir file
+     * — the transcript still sits in Claude's store (BIVY_CLAUDE_SESSIONS_DIR /
+     * `~/.claude/projects/<cwd>/<id>.jsonl`), so the next listSessions re-surfaces
+     * it and the sidebar row reappears. We remove the exact `.jsonl` the SDK lists
+     * from so the delete finally sticks.
+     */
+    async deleteSession(sessionId, sessionFile) {
+        // Drop (and tear down) any in-memory handle so the fallback branch of
+        // listSessions (used when no sessionsDir is set) can't re-advertise it, and a
+        // still-live child doesn't outlive the delete.
+        for (let i = this.sessions.length - 1; i >= 0; i--) {
+            const s = this.sessions[i];
+            if (s.id === sessionId || (sessionFile && s.sessionFile === sessionFile)) {
+                try {
+                    s.dispose();
+                }
+                catch { /* already disposed by the caller's close */ }
+                this.sessions.splice(i, 1);
+            }
+        }
+        // Prefer the exact path the SDK reports (that's the file it would re-read on
+        // the next list); fall back to locating the transcript by id across Claude's
+        // project stores. `sessionFile` is Claude's resume token (an id), not a path,
+        // so it can't be unlinked directly.
+        let file;
+        try {
+            file = (await this.listSessions()).find((s) => s.id === sessionId)?.path;
+        }
+        catch {
+            // SDK list failed — fall through to the on-disk id lookup below.
+        }
+        file ??= findClaudeTranscript(sessionId);
+        if (!file)
+            return false;
+        try {
+            await fs.promises.unlink(file);
+            return true;
+        }
+        catch (error) {
+            if (error?.code === "ENOENT")
+                return false;
+            throw error;
+        }
+    }
+}