@bjoernrochel/sevro 1.0.0 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CONTRIBUTING.md +34 -4
- package/README.md +7 -6
- package/dist/examples/basic/graded.json +13 -0
- package/dist/examples/basic/host.js +9 -0
- package/dist/examples/basic/host.js.map +1 -0
- package/dist/examples/basic/prompt-only.json +7 -0
- package/dist/examples/recipes/candidate.js +23 -0
- package/dist/examples/recipes/candidate.js.map +1 -0
- package/dist/examples/recipes/cases/coding-change.json +21 -0
- package/dist/examples/recipes/cases/host-tools.json +21 -0
- package/dist/examples/recipes/cases/mise.json +21 -0
- package/dist/examples/recipes/cases/node.json +21 -0
- package/dist/examples/recipes/cases/python-uv.json +21 -0
- package/dist/examples/recipes/cases/semantic.json +17 -0
- package/dist/examples/recipes/coding-change/check.js +16 -0
- package/dist/examples/recipes/coding-change/check.js.map +1 -0
- package/dist/examples/recipes/executable.js +20 -0
- package/dist/examples/recipes/executable.js.map +1 -0
- package/dist/examples/recipes/extension-artifacts.js +56 -0
- package/dist/examples/recipes/extension-artifacts.js.map +1 -0
- package/dist/examples/recipes/extension-methods.js +167 -0
- package/dist/examples/recipes/extension-methods.js.map +1 -0
- package/dist/examples/recipes/extension.js +28 -0
- package/dist/examples/recipes/extension.js.map +1 -0
- package/dist/examples/recipes/modules.js +9 -0
- package/dist/examples/recipes/modules.js.map +1 -0
- package/dist/examples/recipes/repository-skill/.agents/skills/startup-guide/SKILL.md +7 -0
- package/dist/examples/recipes/repository-skill/.claude/skills/startup-guide/SKILL.md +7 -0
- package/dist/examples/recipes/repository-skill/README.md +3 -0
- package/dist/examples/recipes/run-inputs.js +144 -0
- package/dist/examples/recipes/run-inputs.js.map +1 -0
- package/dist/examples/recipes/run-options.js +103 -0
- package/dist/examples/recipes/run-options.js.map +1 -0
- package/dist/examples/recipes/run.js +62 -0
- package/dist/examples/recipes/run.js.map +1 -0
- package/dist/examples/recipes/runtime/empty.json +1 -0
- package/dist/examples/recipes/runtime/goals.json +1 -0
- package/dist/examples/recipes/runtime/mise.json +6 -0
- package/dist/examples/recipes/runtime/path.json +1 -0
- package/dist/examples/recipes/runtime/plugins.json +4 -0
- package/dist/examples/recipes/runtime/python-uv.json +10 -0
- package/dist/examples/recipes/semantic-judge.js +27 -0
- package/dist/examples/recipes/semantic-judge.js.map +1 -0
- package/dist/examples/templates/coding/adapter.js +14 -0
- package/dist/examples/templates/coding/adapter.js.map +1 -0
- package/dist/examples/templates/coding/case.json +15 -0
- package/dist/examples/templates/repository-skill/.agents/skills/startup-guide/SKILL.md +6 -0
- package/dist/examples/templates/repository-skill/extension-data.js +61 -0
- package/dist/examples/templates/repository-skill/extension-data.js.map +1 -0
- package/dist/examples/templates/repository-skill/extension.js +29 -0
- package/dist/examples/templates/repository-skill/extension.js.map +1 -0
- package/dist/examples/templates/response/adapter.js +13 -0
- package/dist/examples/templates/response/adapter.js.map +1 -0
- package/dist/examples/templates/response/case.json +13 -0
- package/dist/src/advisory.js +86 -0
- package/dist/src/advisory.js.map +1 -0
- package/dist/src/candidate-artifacts.js +139 -0
- package/dist/src/candidate-artifacts.js.map +1 -0
- package/dist/src/candidate-codex-state.js +110 -0
- package/dist/src/candidate-codex-state.js.map +1 -0
- package/dist/src/case-validation.js +92 -0
- package/dist/src/case-validation.js.map +1 -0
- package/dist/src/cli/cancellation.js +21 -0
- package/dist/src/cli/cancellation.js.map +1 -0
- package/dist/src/cli/command.js +60 -0
- package/dist/src/cli/command.js.map +1 -0
- package/dist/src/cli/completion.js +14 -0
- package/dist/src/cli/completion.js.map +1 -0
- package/dist/src/cli/demo.js +45 -0
- package/dist/src/cli/demo.js.map +1 -0
- package/dist/src/cli/evaluation.js +40 -0
- package/dist/src/cli/evaluation.js.map +1 -0
- package/dist/src/cli/extension.js +54 -0
- package/dist/src/cli/extension.js.map +1 -0
- package/dist/src/cli/help.js +190 -0
- package/dist/src/cli/help.js.map +1 -0
- package/dist/src/cli/hosts.js +33 -0
- package/dist/src/cli/hosts.js.map +1 -0
- package/dist/src/cli/init-settings.js +29 -0
- package/dist/src/cli/init-settings.js.map +1 -0
- package/dist/src/cli/init.js +82 -0
- package/dist/src/cli/init.js.map +1 -0
- package/dist/src/cli/invocation.js +431 -0
- package/dist/src/cli/invocation.js.map +1 -0
- package/dist/src/cli/loading.js +110 -0
- package/dist/src/cli/loading.js.map +1 -0
- package/dist/src/cli/preparation.js +88 -0
- package/dist/src/cli/preparation.js.map +1 -0
- package/dist/src/cli/presentation.js +61 -0
- package/dist/src/cli/presentation.js.map +1 -0
- package/dist/src/cli/progress.js +5 -0
- package/dist/src/cli/progress.js.map +1 -0
- package/dist/src/cli/run-manifest.js +108 -0
- package/dist/src/cli/run-manifest.js.map +1 -0
- package/dist/src/cli/run-options.js +367 -0
- package/dist/src/cli/run-options.js.map +1 -0
- package/dist/src/cli/run-overrides.js +51 -0
- package/dist/src/cli/run-overrides.js.map +1 -0
- package/dist/src/cli/settings.js +127 -0
- package/dist/src/cli/settings.js.map +1 -0
- package/dist/src/cli/summary.js +28 -0
- package/dist/src/cli/summary.js.map +1 -0
- package/dist/src/cli.js +20 -0
- package/dist/src/cli.js.map +1 -0
- package/dist/src/contract-types.js +2 -0
- package/dist/src/contract-types.js.map +1 -0
- package/dist/src/engine.js +4 -0
- package/dist/src/engine.js.map +1 -0
- package/dist/src/evaluation/advisory.js +85 -0
- package/dist/src/evaluation/advisory.js.map +1 -0
- package/dist/src/evaluation/check-plan.js +292 -0
- package/dist/src/evaluation/check-plan.js.map +1 -0
- package/dist/src/evaluation/collection.js +61 -0
- package/dist/src/evaluation/collection.js.map +1 -0
- package/dist/src/evaluation/context.js +2 -0
- package/dist/src/evaluation/context.js.map +1 -0
- package/dist/src/evaluation/grading-host.js +28 -0
- package/dist/src/evaluation/grading-host.js.map +1 -0
- package/dist/src/evaluation/grading.js +154 -0
- package/dist/src/evaluation/grading.js.map +1 -0
- package/dist/src/evaluation/invocation-plan.js +312 -0
- package/dist/src/evaluation/invocation-plan.js.map +1 -0
- package/dist/src/evaluation/plan.js +376 -0
- package/dist/src/evaluation/plan.js.map +1 -0
- package/dist/src/evaluation/progress.js +14 -0
- package/dist/src/evaluation/progress.js.map +1 -0
- package/dist/src/evaluation/resources.js +159 -0
- package/dist/src/evaluation/resources.js.map +1 -0
- package/dist/src/evaluation/run.js +148 -0
- package/dist/src/evaluation/run.js.map +1 -0
- package/dist/src/evaluation/scheduler.js +27 -0
- package/dist/src/evaluation/scheduler.js.map +1 -0
- package/dist/src/evaluation/semantic.js +183 -0
- package/dist/src/evaluation/semantic.js.map +1 -0
- package/dist/src/evaluation/trial.js +593 -0
- package/dist/src/evaluation/trial.js.map +1 -0
- package/dist/src/evaluation/types.js +20 -0
- package/dist/src/evaluation/types.js.map +1 -0
- package/dist/src/evidence/host-results.js +67 -0
- package/dist/src/evidence/host-results.js.map +1 -0
- package/dist/src/evidence/retained-artifacts.js +17 -0
- package/dist/src/evidence/retained-artifacts.js.map +1 -0
- package/dist/src/evidence/trial-writer.js +131 -0
- package/dist/src/evidence/trial-writer.js.map +1 -0
- package/dist/src/evidence/usage.js +14 -0
- package/dist/src/evidence/usage.js.map +1 -0
- package/dist/src/executable.js +20 -0
- package/dist/src/executable.js.map +1 -0
- package/dist/src/extension-client.js +212 -0
- package/dist/src/extension-client.js.map +1 -0
- package/dist/src/extension-session.js +236 -0
- package/dist/src/extension-session.js.map +1 -0
- package/dist/src/fixtures/advisory.js +206 -0
- package/dist/src/fixtures/advisory.js.map +1 -0
- package/dist/src/fixtures/bin.js +41 -0
- package/dist/src/fixtures/bin.js.map +1 -0
- package/dist/src/fixtures/cleanup.js +43 -0
- package/dist/src/fixtures/cleanup.js.map +1 -0
- package/dist/src/fixtures/create.js +94 -0
- package/dist/src/fixtures/create.js.map +1 -0
- package/dist/src/fixtures/generated.js +181 -0
- package/dist/src/fixtures/generated.js.map +1 -0
- package/dist/src/fixtures/git-hooks.js +16 -0
- package/dist/src/fixtures/git-hooks.js.map +1 -0
- package/dist/src/fixtures/preparation.js +201 -0
- package/dist/src/fixtures/preparation.js.map +1 -0
- package/dist/src/fixtures/repository.js +255 -0
- package/dist/src/fixtures/repository.js.map +1 -0
- package/dist/src/fixtures/setup.js +175 -0
- package/dist/src/fixtures/setup.js.map +1 -0
- package/dist/src/fixtures/tools.js +57 -0
- package/dist/src/fixtures/tools.js.map +1 -0
- package/dist/src/fixtures/workspace-state.js +155 -0
- package/dist/src/fixtures/workspace-state.js.map +1 -0
- package/dist/src/generated/cli-result.cjs +2 -0
- package/dist/src/generated/extension.cjs +2 -0
- package/dist/src/generated/report.cjs +2 -0
- package/dist/src/generated/run-evidence.cjs +2 -0
- package/dist/src/generated/runtime.cjs +2 -0
- package/dist/src/git.js +72 -0
- package/dist/src/git.js.map +1 -0
- package/dist/src/graders/artifact.js +68 -0
- package/dist/src/graders/artifact.js.map +1 -0
- package/dist/src/graders/git-head.js +112 -0
- package/dist/src/graders/git-head.js.map +1 -0
- package/dist/src/graders/output.js +345 -0
- package/dist/src/graders/output.js.map +1 -0
- package/dist/src/graders/semantic.js +132 -0
- package/dist/src/graders/semantic.js.map +1 -0
- package/dist/src/graders/shell.js +321 -0
- package/dist/src/graders/shell.js.map +1 -0
- package/dist/src/host-diagnostic-redaction.js +52 -0
- package/dist/src/host-diagnostic-redaction.js.map +1 -0
- package/dist/src/host-diagnostics.js +248 -0
- package/dist/src/host-diagnostics.js.map +1 -0
- package/dist/src/hosts/claude-continuation.js +89 -0
- package/dist/src/hosts/claude-continuation.js.map +1 -0
- package/dist/src/hosts/claude-credential.js +121 -0
- package/dist/src/hosts/claude-credential.js.map +1 -0
- package/dist/src/hosts/claude-events.js +136 -0
- package/dist/src/hosts/claude-events.js.map +1 -0
- package/dist/src/hosts/claude-keychain.js +100 -0
- package/dist/src/hosts/claude-keychain.js.map +1 -0
- package/dist/src/hosts/claude-login-recovery.js +67 -0
- package/dist/src/hosts/claude-login-recovery.js.map +1 -0
- package/dist/src/hosts/claude-login-refresh.js +146 -0
- package/dist/src/hosts/claude-login-refresh.js.map +1 -0
- package/dist/src/hosts/claude-login-store.js +124 -0
- package/dist/src/hosts/claude-login-store.js.map +1 -0
- package/dist/src/hosts/claude-login.js +74 -0
- package/dist/src/hosts/claude-login.js.map +1 -0
- package/dist/src/hosts/claude-native-goal.js +138 -0
- package/dist/src/hosts/claude-native-goal.js.map +1 -0
- package/dist/src/hosts/claude-process.js +10 -0
- package/dist/src/hosts/claude-process.js.map +1 -0
- package/dist/src/hosts/claude-refresh-lock.js +76 -0
- package/dist/src/hosts/claude-refresh-lock.js.map +1 -0
- package/dist/src/hosts/claude-repository-invocation.js +229 -0
- package/dist/src/hosts/claude-repository-invocation.js.map +1 -0
- package/dist/src/hosts/claude-settings.js +156 -0
- package/dist/src/hosts/claude-settings.js.map +1 -0
- package/dist/src/hosts/claude-skill-activations.js +131 -0
- package/dist/src/hosts/claude-skill-activations.js.map +1 -0
- package/dist/src/hosts/claude-state.js +237 -0
- package/dist/src/hosts/claude-state.js.map +1 -0
- package/dist/src/hosts/claude-tool-calls.js +150 -0
- package/dist/src/hosts/claude-tool-calls.js.map +1 -0
- package/dist/src/hosts/claude.js +373 -0
- package/dist/src/hosts/claude.js.map +1 -0
- package/dist/src/hosts/codex-app-server.js +764 -0
- package/dist/src/hosts/codex-app-server.js.map +1 -0
- package/dist/src/hosts/codex-configuration.js +91 -0
- package/dist/src/hosts/codex-configuration.js.map +1 -0
- package/dist/src/hosts/codex-events.js +104 -0
- package/dist/src/hosts/codex-events.js.map +1 -0
- package/dist/src/hosts/codex-exec-controls.js +434 -0
- package/dist/src/hosts/codex-exec-controls.js.map +1 -0
- package/dist/src/hosts/codex-invocation.js +54 -0
- package/dist/src/hosts/codex-invocation.js.map +1 -0
- package/dist/src/hosts/codex-marketplace.js +185 -0
- package/dist/src/hosts/codex-marketplace.js.map +1 -0
- package/dist/src/hosts/codex-native-calls.js +516 -0
- package/dist/src/hosts/codex-native-calls.js.map +1 -0
- package/dist/src/hosts/codex-process.js +10 -0
- package/dist/src/hosts/codex-process.js.map +1 -0
- package/dist/src/hosts/codex-profile.js +206 -0
- package/dist/src/hosts/codex-profile.js.map +1 -0
- package/dist/src/hosts/codex-session-files.js +89 -0
- package/dist/src/hosts/codex-session-files.js.map +1 -0
- package/dist/src/hosts/codex-state.js +310 -0
- package/dist/src/hosts/codex-state.js.map +1 -0
- package/dist/src/hosts/codex.js +527 -0
- package/dist/src/hosts/codex.js.map +1 -0
- package/dist/src/hosts/isolation-common.js +43 -0
- package/dist/src/hosts/isolation-common.js.map +1 -0
- package/dist/src/hosts/isolation-roots.js +64 -0
- package/dist/src/hosts/isolation-roots.js.map +1 -0
- package/dist/src/hosts/isolation.js +12 -0
- package/dist/src/hosts/isolation.js.map +1 -0
- package/dist/src/hosts/linux-sandbox.js +127 -0
- package/dist/src/hosts/linux-sandbox.js.map +1 -0
- package/dist/src/hosts/mac-sandbox.js +137 -0
- package/dist/src/hosts/mac-sandbox.js.map +1 -0
- package/dist/src/hosts/native-controls.js +151 -0
- package/dist/src/hosts/native-controls.js.map +1 -0
- package/dist/src/hosts/native-request.js +33 -0
- package/dist/src/hosts/native-request.js.map +1 -0
- package/dist/src/hosts/process-lifecycle.js +167 -0
- package/dist/src/hosts/process-lifecycle.js.map +1 -0
- package/dist/src/hosts/protected-worktrees.js +81 -0
- package/dist/src/hosts/protected-worktrees.js.map +1 -0
- package/dist/src/hosts/skill-hook-catalog.js +100 -0
- package/dist/src/hosts/skill-hook-catalog.js.map +1 -0
- package/dist/src/hosts/skill-hook-handler.js +228 -0
- package/dist/src/hosts/skill-hook-handler.js.map +1 -0
- package/dist/src/hosts/skill-hooks.js +423 -0
- package/dist/src/hosts/skill-hooks.js.map +1 -0
- package/dist/src/hosts/workspace-fingerprint.js +72 -0
- package/dist/src/hosts/workspace-fingerprint.js.map +1 -0
- package/dist/src/identity.js +167 -0
- package/dist/src/identity.js.map +1 -0
- package/dist/src/instrumentation.js +83 -0
- package/dist/src/instrumentation.js.map +1 -0
- package/dist/src/native-transcript-state.js +85 -0
- package/dist/src/native-transcript-state.js.map +1 -0
- package/dist/src/native-transcript-view.js +65 -0
- package/dist/src/native-transcript-view.js.map +1 -0
- package/dist/src/native-transcripts.js +208 -0
- package/dist/src/native-transcripts.js.map +1 -0
- package/dist/src/paths.js +13 -0
- package/dist/src/paths.js.map +1 -0
- package/dist/src/process-lifecycle.js +101 -0
- package/dist/src/process-lifecycle.js.map +1 -0
- package/dist/src/provenance.js +263 -0
- package/dist/src/provenance.js.map +1 -0
- package/dist/src/prune.js +228 -0
- package/dist/src/prune.js.map +1 -0
- package/dist/src/report.js +276 -0
- package/dist/src/report.js.map +1 -0
- package/dist/src/resolved-case.js +29 -0
- package/dist/src/resolved-case.js.map +1 -0
- package/dist/src/results-lock.js +40 -0
- package/dist/src/results-lock.js.map +1 -0
- package/dist/src/results.js +127 -0
- package/dist/src/results.js.map +1 -0
- package/dist/src/run-owner.js +283 -0
- package/dist/src/run-owner.js.map +1 -0
- package/dist/src/runner-paths.js +11 -0
- package/dist/src/runner-paths.js.map +1 -0
- package/dist/src/runtime/config.js +323 -0
- package/dist/src/runtime/config.js.map +1 -0
- package/dist/src/runtime/discovery-apple.js +65 -0
- package/dist/src/runtime/discovery-apple.js.map +1 -0
- package/dist/src/runtime/discovery-providers.js +37 -0
- package/dist/src/runtime/discovery-providers.js.map +1 -0
- package/dist/src/runtime/discovery.js +40 -0
- package/dist/src/runtime/discovery.js.map +1 -0
- package/dist/src/runtime/hook-processes.js +81 -0
- package/dist/src/runtime/hook-processes.js.map +1 -0
- package/dist/src/runtime/hooks.js +304 -0
- package/dist/src/runtime/hooks.js.map +1 -0
- package/dist/src/runtime/paths.js +244 -0
- package/dist/src/runtime/paths.js.map +1 -0
- package/dist/src/runtime/query.js +76 -0
- package/dist/src/runtime/query.js.map +1 -0
- package/dist/src/runtime/seeds.js +98 -0
- package/dist/src/runtime/seeds.js.map +1 -0
- package/dist/src/runtime/shared-cache.js +81 -0
- package/dist/src/runtime/shared-cache.js.map +1 -0
- package/dist/src/runtime/state.js +106 -0
- package/dist/src/runtime/state.js.map +1 -0
- package/dist/src/runtime-process.js +148 -0
- package/dist/src/runtime-process.js.map +1 -0
- package/dist/src/schema-types.js +2 -0
- package/dist/src/schema-types.js.map +1 -0
- package/dist/src/schema.js +16 -0
- package/dist/src/schema.js.map +1 -0
- package/dist/src/shell.js +5 -0
- package/dist/src/shell.js.map +1 -0
- package/dist/src/sqlite-lock.js +18 -0
- package/dist/src/sqlite-lock.js.map +1 -0
- package/dist/src/storage.js +21 -0
- package/dist/src/storage.js.map +1 -0
- package/dist/src/transcript-retention.js +109 -0
- package/dist/src/transcript-retention.js.map +1 -0
- package/dist/src/value-guards.js +26 -0
- package/dist/src/value-guards.js.map +1 -0
- package/docs/architecture.md +5 -2
- package/docs/creating-cases.md +2 -3
- package/docs/development-cli.md +12 -7
- package/docs/documentation-quality.md +4 -3
- package/docs/evaluation-workflow.md +8 -8
- package/docs/getting-started.md +7 -6
- package/docs/guide-evaluation.md +1 -1
- package/docs/identity-v1.md +4 -1
- package/docs/installing.md +31 -13
- package/docs/licensing.md +2 -2
- package/docs/native-hosts.md +1 -1
- package/docs/recipes.md +41 -40
- package/docs/releases.md +20 -4
- package/docs/run-settings-v1.md +3 -3
- package/docs/specs/repository-guide.md +1 -1
- package/docs/troubleshooting.md +1 -1
- package/docs/typescript-quality.md +18 -1
- package/examples/recipes/executable.ts +19 -0
- package/examples/recipes/extension-artifacts.ts +1 -1
- package/examples/recipes/extension.ts +2 -1
- package/examples/recipes/modules.ts +9 -0
- package/examples/recipes/run-inputs.ts +14 -19
- package/examples/recipes/run-options.ts +9 -8
- package/examples/recipes/run.ts +21 -7
- package/examples/templates/repository-skill/extension-data.ts +1 -1
- package/examples/templates/repository-skill/extension.ts +2 -1
- package/package.json +14 -6
- package/src/cli/demo.ts +3 -2
- package/src/cli/help.ts +4 -3
- package/src/cli/init-settings.ts +5 -4
- package/src/cli/init.ts +9 -8
- package/src/cli/invocation.ts +2 -1
- package/src/cli/preparation.ts +2 -2
- package/src/cli.ts +1 -1
- package/src/executable.ts +19 -0
- package/src/extension-client.ts +6 -12
- package/src/fixtures/setup.ts +3 -2
- package/src/git.ts +2 -1
- package/src/graders/git-head.ts +3 -2
- package/src/graders/shell.ts +4 -3
- package/src/hosts/claude-keychain.ts +3 -2
- package/src/hosts/claude-login-refresh.ts +3 -2
- package/src/hosts/claude-refresh-lock.ts +2 -1
- package/src/hosts/isolation-roots.ts +3 -2
- package/src/hosts/process-lifecycle.ts +4 -6
- package/src/hosts/protected-worktrees.ts +2 -1
- package/src/hosts/skill-hook-handler.ts +1 -1
- package/src/hosts/skill-hooks.ts +10 -2
- package/src/provenance.ts +7 -6
- package/src/results-lock.ts +4 -4
- package/src/run-owner.ts +15 -9
- package/src/runner-paths.ts +21 -0
- package/src/runtime/hook-processes.ts +2 -1
- package/src/runtime/hooks.ts +9 -7
- package/src/runtime-process.ts +194 -0
- package/src/sqlite-lock.ts +25 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"claude-state.js","sourceRoot":"","sources":["claude-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,6BAA0B;AACvD,OAAO,EAAE,YAAY,EAAE,oBAAiB;AACxC,OAAO,EAAE,UAAU,EAAE,oBAAiB;AACtC,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,kCAA+B;AAChC,OAAO,EACL,EAAE,EACF,KAAK,EACL,QAAQ,EACR,IAAI,EACJ,OAAO,EACP,SAAS,GACV,yBAAyB;AAC1B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB;AAErD,OAAO,EAAE,iBAAiB,EAAE,sCAAmC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,GACnB,uCAAoC;AACrC,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GACzB,iCAA8B;AAC/B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,4BAAyB;AAC1E,OAAO,EACL,iBAAiB,IAAI,MAAM,EAC3B,2BAA2B,GAC5B,4BAAyB;AAC1B,OAAO,EAAE,mBAAmB,EAAE,4BAAyB;AACvD,OAAO,EACL,oBAAoB,EACpB,gBAAgB,GACjB,mCAAgC;AACjC,OAAO,EAAE,yBAAyB,EAAE,+BAA4B;AAChE,OAAO,EAAE,kBAAkB,EAAE,6BAA0B;AACvD,OAAO,EAAE,wBAAwB,EAAE,6BAA0B;AAiB7D,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,SAAiB,EACjB,OAA0B,EAC1B,eAAuB;IAEvB,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAClC,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,cAAc,GAAG,MAAM,yBAAyB,CACpD,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAC3B,OAAO,CAAC,cAAc,EACtB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,CACxD,CAAC;IACF,OAAO;QACL,WAAW;QACX,IAAI;QACJ,IAAI;QACJ,cAAc;QACd,UAAU,EAAE,cAAc,CAAC,cAAc;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAA0B,EAC1B,UAAkB;IAElB,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QAChD,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACrD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,eAAe,EAAE;YACf,GAAG,OAAO,CAAC,wBAAwB;YACnC,GAAG,iBAAiB,CAAC,OAAO,CAAC;SAC9B;KACF,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,eAAe,GAAG,2BAA2B,CACjD,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EACjB,KAAK,EACL,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAC/B,CAAC;IACF,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,OAA0B,EAC1B,KAAe;IAEf,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe;QACvC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC;IACT,IACE,SAAS;QACT,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC5C,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAEzC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAA0B,EAC1B,KAAe,EACf,SAAiB;IAEjB,IAAI,CAAC,OAAO,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IACE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE;QAElC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE;QAC7C,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,KAAK;QACZ,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA2D,EAC3D,OAAgB,EAChB,SAAwB,EACxB,OAAsB;IAEtB,OAAO;QACL,GAAG,KAAK,CAAC,cAAc,CAAC,WAAW;QACnC,GAAG,OAAO,CAAC,aAAa,EAAE,WAAW;QACrC,gCAAgC,EAAE,GAAG;QACrC,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC;QACpC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG;QAC7B,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;QACvD,MAAM,EAAE,KAAK,CAAC,IAAI;QAClB,iBAAiB,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;QAC5C,QAAQ,EAAE,GAAG;QACb,GAAG,wBAAwB,CAAC,OAAO,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,SAAwB;IAC5D,MAAM,IAAI,GACR,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,IAAI;QACvC,OAAO,CAAC,GAAG,CAAC,IAAI;QAChB,eAAe,CAAC;IAClB,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC;SAC5C,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAsB;IAEtB,OAAO,OAAO;QACZ,CAAC,CAAC;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC;YACvC,sBAAsB,EAAE,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC;YAC5D,UAAU,EAAE,GAAG;YACf,uBAAuB,EAAE,GAAG;SAC7B;QACH,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,OAA0B,EAC1B,OAAgB,EAChB,UAAoB,EACpB,UAAkB;IAElB,MAAM,6BAA6B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,SAAS,EACT,KAAK,CAAC,UAAU,EAChB,OAAO,CACR,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,OAAO,EACP,SAAS,EACT,KAAK,CAAC,WAAW,EACjB,UAAU,EACV,KAAK,CACN,CAAC;IACF,MAAM,gBAAgB,GAAG,KAAK,EAAE,WAAW,IAAI,UAAU,CAAC;IAC1D,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,MAAM,6BAA6B,CAC1D,OAAO,EACP,GAAG,EACH,OAAO,EACP,SAAS,CACV,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,gBAAgB,CACvC,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,WAAW,EACnB,KAAK,CACN,CAAC;IACF,MAAM,SAAS,CACb,YAAY,EACZ,IAAI,CAAC,SAAS,CACZ,kBAAkB,CAChB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,UAAU,EAChB,CAAC,GAAG,UAAU,EAAE,GAAG,gBAAgB,CAAC,EACpC;QACE,GAAG,KAAK;QACR,GAAG,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC;KACpE,EACD,WAAW,CAAC,MAAM,EAClB;QACE,GAAG,WAAW,CAAC,SAAS;QACxB,GAAG,wBAAwB,CAAC,OAAO,CAAC,uBAAuB,CAAC;QAC5D,GAAG,0BAA0B,CAAC,OAAO,CAAC,sBAAsB,CAAC;KAC9D,EACD,gBAAgB;QACd,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE;QACtE,CAAC,CAAC,SAAS,EACb,OAAO,CAAC,SAAS,CAClB,CACF,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAC5B,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,CAAC,MAAM,CACX,GAAG,EACH,8BAA8B,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAC/D,4BAA4B,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAC7D,CAAC;IACF,IAAI,OAAO;QAAE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY;QACZ,GAAG;QACH,KAAK;QACL,UAAU,EAAE,gBAAgB;KAC7B,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,6BAA6B,CAC1C,OAAgB,EAChB,SAAiB;IAEjB,IACE,CAAC,OAAO,CAAC,aAAa;QACtB,CAAC,0BAA0B,CAAC,kBAAkB,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM;QAE3E,OAAO;IACT,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CACrC,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CACrE,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,IACE,aAAa;SACV,IAAI,EAAE;SACN,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAErE,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;AACN,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,IAAY;IAClD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YACpD,MAAM,IAAI,KAAK,CAAC,oDAAoD,EAAE;gBACpE,KAAK;aACN,CAAC,CAAC;QACL,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,SAAiB,EACjB,UAAkB,EAClB,OAAgB;IAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,iBAAiB;QAC5B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,MAAM,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,4BAA4B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;IAChE,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,OAAO;QACL,MAAM;QACN,SAAS,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC3B,WAAW,EAAE;YACX,4BAA4B,EAAE,QAAQ;YACtC,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;SACd;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,SAAiB,EACjB,WAAmB,EACnB,UAAoB,EACpB,KAAe;IAEf,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,iBAAiB,CAAC;QACvB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS;QACT,WAAW;QACX,WAAW,EAAE,UAAU;QACvB,cAAc,EAAE,CAAC,WAAW,EAAE,GAAG,KAAK,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,OAAgB,EAChB,GAA2B,EAC3B,OAAsB,EACtB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,OAAO,CAAC,SAAS,EACjB,mBAAmB,CAAC,OAAO,CAAC,EAC5B,OAAO,CAAC,WAAW,IAAI,WAAW,EAClC,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAC3C,CAAC;IACF,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;aACtE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,SAAS,CAAC,CAAC;QACnB,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,mCAAmC,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgB,EAAE,SAAiB;IACjE,OAAO,OAAO,CAAC,aAAa;QAC1B,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,mCAAmC,CAC1C,GAA2B,EAC3B,QAAyD,EACzD,OAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IACvC,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,OAAO,CACL,OAAO,CAAC,aAAa,IAAI;QACvB,MAAM,EAAE,kBAA2B;QACnC,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE;KAClB,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { runtimeSeedSources } from \"../runtime/config\";\nimport { minimalRoots } from \"../paths\";\nimport { shellQuote } from \"../shell\";\nimport {\n candidateArtifactEnvironment,\n candidateArtifactReadRoots,\n} from \"../candidate-artifacts\";\nimport {\n cp,\n mkdir,\n realpath,\n stat,\n symlink,\n writeFile,\n} from \"node:fs/promises\";\nimport { delimiter, dirname, join } from \"node:path\";\nimport type { HostAdapter } from \"../engine\";\nimport { nativeStateParent } from \"../native-transcript-state\";\nimport {\n workspaceBoundaryException,\n workspaceStatePath,\n} from \"../fixtures/workspace-state\";\nimport {\n candidateTranscriptEnvironment,\n candidateTranscriptRoots,\n} from \"../native-transcripts\";\nimport { prepareHookMounts, runtimeHooksEnabled } from \"../runtime/hooks\";\nimport {\n insideRuntimeRoot as inside,\n runtimeExecutableProtection,\n} from \"../runtime/paths\";\nimport { prepareRuntimeState } from \"../runtime/state\";\nimport {\n sharedCacheDenyRoots,\n sharedCacheRoots,\n} from \"../runtime/shared-cache\";\nimport { stageClaudeAuthentication } from \"./claude-credential\";\nimport { claudeHostSettings } from \"./claude-settings\";\nimport { evaluationProtectedRoots } from \"./isolation-roots\";\ntype Request = Parameters<HostAdapter[\"run\"]>[0];\nexport interface ClaudeHostOptions {\n binary: string;\n model: string;\n effort: string;\n projectRoot: string;\n resultsRoot: string;\n additionalProtectedRoots: string[];\n credentialFile?: string;\n uvCacheDir?: string;\n toolchainBinDir?: string;\n projectSettings?: boolean;\n timeoutMs?: number;\n retainHostDiagnostics?: boolean;\n}\n\nfunction claudeSeedSources(request: Request): string[] {\n return runtimeSeedSources(request.runtimePolicy);\n}\n\nasync function createClaudePrivateState(\n stateRoot: string,\n options: ClaudeHostOptions,\n loginLifetimeMs: number,\n) {\n await mkdir(join(stateRoot, \"private\"), { mode: 0o700 });\n const privateRoot = await realpath(join(stateRoot, \"private\"));\n const home = join(stateRoot, \"home\"),\n temp = join(stateRoot, \"tmp\");\n await Promise.all([home, temp].map((path) => mkdir(path, { mode: 0o700 })));\n const authentication = await stageClaudeAuthentication(\n join(privateRoot, \"config\"),\n options.credentialFile,\n { binary: options.binary, lifetimeMs: loginLifetimeMs },\n );\n return {\n privateRoot,\n home,\n temp,\n authentication,\n credential: authentication.credentialFile,\n };\n}\n\nasync function protectedClaudeRoots(\n request: Request,\n options: ClaudeHostOptions,\n credential: string,\n) {\n const candidates = await evaluationProtectedRoots({\n ownedStateRoot: dirname(dirname(dirname(credential))),\n workspace: request.workspace,\n projectRoot: options.projectRoot,\n resultsRoot: options.resultsRoot,\n additionalRoots: [\n ...options.additionalProtectedRoots,\n ...claudeSeedSources(request),\n ],\n });\n const roots = request.runtimePolicy ? candidates : minimalRoots(candidates);\n const namespace = await nativeStateParent();\n if (roots.some((root) => root !== namespace && inside(root, credential)))\n throw new Error(\"Claude private state overlaps a protected root\");\n const binary = await realpath(options.binary);\n const executableRoots = runtimeExecutableProtection(\n [dirname(binary)],\n roots,\n Boolean(request.runtimePolicy),\n );\n if (executableRoots.some((root) => inside(root, binary)))\n throw new Error(\"Claude executable resides inside a protected root\");\n return roots;\n}\n\nasync function claudeToolchainDirectory(\n options: ClaudeHostOptions,\n roots: string[],\n): Promise<string | null> {\n const directory = options.toolchainBinDir\n ? await realpath(options.toolchainBinDir)\n : null;\n if (\n directory &&\n (roots.some((root) => inside(root, directory)) ||\n !(await stat(directory)).isDirectory())\n )\n throw new Error(\"Claude toolchain directory is unavailable or protected\");\n return directory;\n}\n\nasync function prepareClaudeRuntime(\n options: ClaudeHostOptions,\n roots: string[],\n workspace: string,\n): Promise<string | null> {\n if (!options.uvCacheDir) return null;\n const cache = await realpath(options.uvCacheDir);\n if (\n roots.some((root) => inside(root, cache)) ||\n !(await stat(cache)).isDirectory()\n )\n throw new Error(\"Claude UV cache is unavailable or protected\");\n const runtimeRoot = join(workspace, \".git\", \"sevro-runtime\");\n await mkdir(runtimeRoot, { recursive: true, mode: 0o700 });\n await cp(cache, join(runtimeRoot, \"uv-cache\"), {\n recursive: true,\n force: false,\n errorOnExist: true,\n });\n return runtimeRoot;\n}\n\nfunction claudeEnvironment(\n state: Awaited<ReturnType<typeof createClaudePrivateState>>,\n request: Request,\n toolchain: string | null,\n runtime: string | null,\n): Record<string, string> {\n return {\n ...state.authentication.environment,\n ...request.runtimePolicy?.environment,\n CLAUDE_CODE_SUBPROCESS_ENV_SCRUB: \"1\",\n PATH: claudePath(request, toolchain),\n LANG: process.env.LANG ?? \"C\",\n HOME: runtime ? join(runtime, \"host-home\") : state.home,\n TMPDIR: state.temp,\n CLAUDE_CONFIG_DIR: dirname(state.credential),\n NO_COLOR: \"1\",\n ...claudeRuntimeEnvironment(runtime),\n };\n}\n\nfunction claudePath(request: Request, toolchain: string | null): string {\n const path =\n request.runtimePolicy?.environment.PATH ??\n process.env.PATH ??\n \"/usr/bin:/bin\";\n return [request.fixtureBinDir, toolchain, path]\n .filter(Boolean)\n .join(delimiter);\n}\n\nfunction claudeRuntimeEnvironment(\n runtime: string | null,\n): Record<string, string> {\n return runtime\n ? {\n UV_CACHE_DIR: join(runtime, \"uv-cache\"),\n UV_PROJECT_ENVIRONMENT: join(runtime, \"project-environment\"),\n UV_OFFLINE: \"1\",\n PYTHONDONTWRITEBYTECODE: \"1\",\n }\n : {};\n}\n\n/** `lifetimeMs` is the access-token lifetime the complete execution needs. */\nexport async function prepareClaudeState(\n stateRoot: string,\n options: ClaudeHostOptions,\n request: Request,\n pluginDirs: string[],\n lifetimeMs: number,\n) {\n await requireClaudeRuntimeNamespace(request, stateRoot);\n const state = await createClaudePrivateState(stateRoot, options, lifetimeMs);\n const transcripts = await claudeTranscriptAccess(\n stateRoot,\n state.credential,\n request,\n );\n const roots = await protectedClaudeRoots(request, options, state.credential);\n const toolchain = await claudeToolchainDirectory(options, roots);\n const runtime = await prepareClaudeRuntime(options, roots, request.workspace);\n const settingsPath = join(state.privateRoot, \"settings.json\");\n const hooks = await claudeHookMounts(\n request,\n stateRoot,\n state.privateRoot,\n pluginDirs,\n roots,\n );\n const effectivePlugins = hooks?.directories ?? pluginDirs;\n const env = claudeEnvironment(state, request, toolchain, runtime);\n const runtimeWriteRoot = await applyClaudeRuntimeEnvironment(\n request,\n env,\n runtime,\n stateRoot,\n );\n const cacheRoots = await sharedCacheRoots(\n request.runtimePolicy,\n request.runtimeRole,\n roots,\n );\n await writeFile(\n settingsPath,\n JSON.stringify(\n claudeHostSettings(\n state.privateRoot,\n state.credential,\n [...pluginDirs, ...effectivePlugins],\n [\n ...roots,\n ...sharedCacheDenyRoots(request.runtimePolicy, request.runtimeRole),\n ],\n transcripts.policy,\n [\n ...transcripts.readRoots,\n ...candidateTranscriptRoots(request.candidateTranscriptRoot),\n ...candidateArtifactReadRoots(request.candidateArtifactRoots),\n ],\n runtimeWriteRoot\n ? { root: runtimeWriteRoot, workspace: request.workspace, cacheRoots }\n : undefined,\n request.workspace,\n ),\n ),\n { flag: \"wx\", mode: 0o600 },\n );\n Object.assign(env, transcripts.environment);\n Object.assign(\n env,\n candidateTranscriptEnvironment(request.candidateTranscriptRoot),\n candidateArtifactEnvironment(request.candidateArtifactRoots),\n );\n if (runtime) await mkdir(join(runtime, \"host-home\"), { mode: 0o700 });\n return {\n credential: state.credential,\n settingsPath,\n env,\n hooks,\n pluginDirs: effectivePlugins,\n };\n}\n\n/** Claude's implicit /tmp/claude writes cannot contain the read-denied peer namespace. */\nasync function requireClaudeRuntimeNamespace(\n request: Request,\n stateRoot: string,\n) {\n if (\n !request.runtimePolicy &&\n !workspaceBoundaryException(workspaceStatePath(), request.workspace).length\n )\n return;\n const implicitRoots = await Promise.all(\n [\"/tmp/claude\", \"/private/tmp/claude\"].map(implicitClaudeWritePaths),\n );\n const namespace = dirname(stateRoot);\n if (\n implicitRoots\n .flat()\n .some((root) => inside(root, namespace) || inside(namespace, root))\n )\n throw new Error(\n \"Claude namespace overlaps an implicit native writable root\",\n );\n}\n\nasync function implicitClaudeWritePaths(root: string): Promise<string[]> {\n try {\n return [root, await realpath(root)];\n } catch (cause) {\n if ((cause as NodeJS.ErrnoException).code !== \"ENOENT\")\n throw new Error(\"Claude implicit native writable root is unreadable\", {\n cause,\n });\n return [root];\n }\n}\n\nasync function claudeTranscriptAccess(\n stateRoot: string,\n credential: string,\n request: Request,\n) {\n const policy = request.runtimePolicy;\n if (!policy?.nativeTranscripts)\n return { policy, environment: {}, readRoots: [] };\n const view = join(stateRoot, \"native-home\");\n const projects = join(view, \"projects\");\n await mkdir(projects, { recursive: true, mode: 0o700 });\n await symlink(projects, join(dirname(credential), \"projects\"));\n const startup = join(view, \"shell-env\");\n const script = `export CLAUDE_CONFIG_DIR=${shellQuote(view)}\\n`;\n await writeFile(startup, script, { flag: \"wx\", mode: 0o600 });\n await writeFile(join(view, \".zshenv\"), script, { flag: \"wx\", mode: 0o600 });\n return {\n policy,\n readRoots: [projects, view],\n environment: {\n SEVRO_NATIVE_TRANSCRIPT_ROOT: projects,\n BASH_ENV: startup,\n ZDOTDIR: view,\n },\n };\n}\n\nasync function claudeHookMounts(\n request: Request,\n stateRoot: string,\n privateRoot: string,\n pluginDirs: string[],\n roots: string[],\n) {\n const policy = request.runtimePolicy;\n if (!policy || !runtimeHooksEnabled(policy)) return undefined;\n return prepareHookMounts({\n workspace: request.workspace,\n stateRoot,\n privateRoot,\n pluginRoots: pluginDirs,\n protectedRoots: [privateRoot, ...roots, ...runtimeSeedSources(policy)],\n policy,\n });\n}\n\nasync function applyClaudeRuntimeEnvironment(\n request: Request,\n env: Record<string, string>,\n runtime: string | null,\n stateRoot: string,\n): Promise<string | undefined> {\n const isolated = await prepareRuntimeState(\n request.workspace,\n claudeCommandPolicy(request),\n request.runtimeRole ?? \"candidate\",\n claudeRuntimeDirectory(request, stateRoot),\n );\n if (request.runtimePolicy) {\n Object.assign(env, isolated.environment);\n env.PATH = [request.fixtureBinDir, isolated.environment.PATH ?? env.PATH]\n .filter(Boolean)\n .join(delimiter);\n return isolated.root;\n }\n applyLegacyClaudeCommandEnvironment(env, isolated, runtime);\n return undefined;\n}\n\nfunction claudeRuntimeDirectory(request: Request, stateRoot: string) {\n return request.runtimePolicy\n ? (request.candidateRuntimeRoot ?? join(stateRoot, \"runtime\"))\n : undefined;\n}\n\nfunction applyLegacyClaudeCommandEnvironment(\n env: Record<string, string>,\n isolated: Awaited<ReturnType<typeof prepareRuntimeState>>,\n runtime: string | null,\n): void {\n if (!runtime) env.HOME = isolated.home;\n env.TMPDIR = isolated.temp;\n}\n\nfunction claudeCommandPolicy(request: Request) {\n return (\n request.runtimePolicy ?? {\n format: \"sevro.runtime.v1\" as const,\n environment: {},\n readOnlyRoots: [],\n }\n );\n}\n"]}
|
|
@@ -0,0 +1,150 @@
|
|
|
1
|
+
import { sha256 } from "../identity.js";
|
|
2
|
+
import { isRecord } from "../value-guards.js";
|
|
3
|
+
import { summarizeClaudeEvents, parseClaudeEvents, } from "./claude-events.js";
|
|
4
|
+
const MAX_RETAINED_CALLS = 128;
|
|
5
|
+
function label(value, max = 256) {
|
|
6
|
+
return typeof value === "string" && boundedLabel(value, max) ? value : null;
|
|
7
|
+
}
|
|
8
|
+
/** Retain ordered host call metadata, never tool prompts or results. */
|
|
9
|
+
export function claudeToolCallsObservation(stream, exitCode) {
|
|
10
|
+
const events = parseClaudeEvents(stream);
|
|
11
|
+
const summary = summarizeClaudeEvents(events, exitCode);
|
|
12
|
+
const state = {
|
|
13
|
+
calls: [],
|
|
14
|
+
malformed: false,
|
|
15
|
+
truncated: false,
|
|
16
|
+
ordinal: 0,
|
|
17
|
+
};
|
|
18
|
+
for (const line of events.lines) {
|
|
19
|
+
collectEvent(line, state);
|
|
20
|
+
if (state.truncated)
|
|
21
|
+
break;
|
|
22
|
+
}
|
|
23
|
+
return {
|
|
24
|
+
id: "sevro.claude.tool-calls",
|
|
25
|
+
completeness: callCompleteness(summary.complete, state),
|
|
26
|
+
data: {
|
|
27
|
+
method: "stream_tool_calls",
|
|
28
|
+
calls: state.calls,
|
|
29
|
+
truncated: state.truncated,
|
|
30
|
+
},
|
|
31
|
+
};
|
|
32
|
+
}
|
|
33
|
+
function callCompleteness(complete, state) {
|
|
34
|
+
return complete && !state.malformed && !state.truncated
|
|
35
|
+
? "complete"
|
|
36
|
+
: "partial";
|
|
37
|
+
}
|
|
38
|
+
function collectEvent(line, state) {
|
|
39
|
+
if (!line.parsed) {
|
|
40
|
+
state.malformed = true;
|
|
41
|
+
return;
|
|
42
|
+
}
|
|
43
|
+
const event = line.value;
|
|
44
|
+
if (!isRecord(event) || event.type !== "assistant")
|
|
45
|
+
return;
|
|
46
|
+
collectAssistant(event, state);
|
|
47
|
+
}
|
|
48
|
+
function collectAssistant(event, state) {
|
|
49
|
+
const blocks = isRecord(event.message)
|
|
50
|
+
? event.message.content
|
|
51
|
+
: null;
|
|
52
|
+
if (!Array.isArray(blocks)) {
|
|
53
|
+
state.malformed = true;
|
|
54
|
+
return;
|
|
55
|
+
}
|
|
56
|
+
const actor = actorContext(event, state);
|
|
57
|
+
for (const block of blocks) {
|
|
58
|
+
collectBlock(block, actor, state);
|
|
59
|
+
if (state.truncated)
|
|
60
|
+
break;
|
|
61
|
+
}
|
|
62
|
+
}
|
|
63
|
+
function actorContext(event, state) {
|
|
64
|
+
const parentToolUseId = label(event.parent_tool_use_id, 128);
|
|
65
|
+
const actor = parentToolUseId ? "nested" : "parent";
|
|
66
|
+
if (event.parent_tool_use_id !== undefined &&
|
|
67
|
+
event.parent_tool_use_id !== null &&
|
|
68
|
+
actor === "parent")
|
|
69
|
+
state.malformed = true;
|
|
70
|
+
return { actor, parentToolUseId };
|
|
71
|
+
}
|
|
72
|
+
function collectBlock(value, actor, state) {
|
|
73
|
+
if (!isRecord(value) || value.type !== "tool_use")
|
|
74
|
+
return;
|
|
75
|
+
state.ordinal++;
|
|
76
|
+
if (!["Skill", "Agent", "Task"].includes(String(value.name)))
|
|
77
|
+
return;
|
|
78
|
+
if (state.calls.length >= MAX_RETAINED_CALLS) {
|
|
79
|
+
state.truncated = true;
|
|
80
|
+
return;
|
|
81
|
+
}
|
|
82
|
+
collectSupportedCall(value, actor, state);
|
|
83
|
+
}
|
|
84
|
+
function collectSupportedCall(value, actor, state) {
|
|
85
|
+
const input = isRecord(value.input) ? value.input : {};
|
|
86
|
+
if (value.name === "Skill") {
|
|
87
|
+
collectSkill(input, actor, state);
|
|
88
|
+
return;
|
|
89
|
+
}
|
|
90
|
+
const call = agentCall(value, input, actor, state.ordinal);
|
|
91
|
+
if (!validAgentCall(call, input))
|
|
92
|
+
state.malformed = true;
|
|
93
|
+
state.calls.push(call);
|
|
94
|
+
}
|
|
95
|
+
function collectSkill(input, actor, state) {
|
|
96
|
+
const invocation = label(input.skill);
|
|
97
|
+
if (!invocation) {
|
|
98
|
+
state.malformed = true;
|
|
99
|
+
return;
|
|
100
|
+
}
|
|
101
|
+
state.calls.push({
|
|
102
|
+
ordinal: state.ordinal,
|
|
103
|
+
...actor,
|
|
104
|
+
name: "Skill",
|
|
105
|
+
skill: invocation.slice(invocation.lastIndexOf(":") + 1),
|
|
106
|
+
invocation,
|
|
107
|
+
});
|
|
108
|
+
}
|
|
109
|
+
function boundedPrompt(input) {
|
|
110
|
+
if (typeof input.prompt !== "string")
|
|
111
|
+
return null;
|
|
112
|
+
return Buffer.byteLength(input.prompt, "utf8") <= 1024 * 1024
|
|
113
|
+
? input.prompt
|
|
114
|
+
: null;
|
|
115
|
+
}
|
|
116
|
+
function promptDigest(prompt) {
|
|
117
|
+
return prompt ? sha256(prompt) : null;
|
|
118
|
+
}
|
|
119
|
+
function firstLineDigest(prompt) {
|
|
120
|
+
return prompt ? sha256(prompt.split(/\r?\n/, 1).join("")) : null;
|
|
121
|
+
}
|
|
122
|
+
function agentCall(value, input, actor, ordinal) {
|
|
123
|
+
const prompt = boundedPrompt(input);
|
|
124
|
+
return {
|
|
125
|
+
ordinal,
|
|
126
|
+
...actor,
|
|
127
|
+
name: "Agent",
|
|
128
|
+
toolUseId: label(value.id, 128),
|
|
129
|
+
subagentType: label(input.subagent_type ?? input.subagentType),
|
|
130
|
+
runInBackground: typeof input.run_in_background === "boolean"
|
|
131
|
+
? input.run_in_background
|
|
132
|
+
: null,
|
|
133
|
+
model: input.model === undefined ? null : label(input.model, 128),
|
|
134
|
+
promptSha256: promptDigest(prompt),
|
|
135
|
+
promptFirstLineSha256: firstLineDigest(prompt),
|
|
136
|
+
};
|
|
137
|
+
}
|
|
138
|
+
function validAgentCall(call, input) {
|
|
139
|
+
const required = [call.toolUseId, call.subagentType, call.promptSha256];
|
|
140
|
+
return (required.every(Boolean) &&
|
|
141
|
+
call.runInBackground !== null &&
|
|
142
|
+
validAgentModel(input, call.model));
|
|
143
|
+
}
|
|
144
|
+
function validAgentModel(input, model) {
|
|
145
|
+
return input.model === undefined || model !== null;
|
|
146
|
+
}
|
|
147
|
+
function boundedLabel(value, max) {
|
|
148
|
+
return (value.length >= 1 && value.length <= max && /^[A-Za-z0-9_.:-]+$/.test(value));
|
|
149
|
+
}
|
|
150
|
+
//# sourceMappingURL=claude-tool-calls.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"claude-tool-calls.js","sourceRoot":"","sources":["claude-tool-calls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,uBAAoB;AACrC,OAAO,EAAE,QAAQ,EAAE,2BAAwB;AAC3C,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAGlB,2BAAwB;AAEzB,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAG/B,SAAS,KAAK,CAAC,KAAc,EAAE,GAAG,GAAG,GAAG;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AA0CD,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CACxC,MAA6B,EAC7B,QAAgB;IAEhB,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,KAAK,GAAc;QACvB,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,CAAC;KACX,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1B,IAAI,KAAK,CAAC,SAAS;YAAE,MAAM;IAC7B,CAAC;IACD,OAAO;QACL,EAAE,EAAE,yBAAyB;QAC7B,YAAY,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;QACvD,IAAI,EAAE;YACJ,MAAM,EAAE,mBAAmB;YAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAiB,EACjB,KAAgB;IAEhB,OAAO,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS;QACrD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,IAAqB,EAAE,KAAgB;IAC3D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO;IAC3D,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAY,EAAE,KAAgB;IACtD,MAAM,MAAM,GAAY,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO;QACvB,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,SAAS;YAAE,MAAM;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAY,EAAE,KAAgB;IAClD,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpD,IACE,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtC,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,KAAK,KAAK,QAAQ;QAElB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAY,EAAE,KAAgB;IAClE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO;IAC1D,KAAK,CAAC,OAAO,EAAE,CAAC;IAChB,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO;IACrE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;QAC7C,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,OAAO;IACT,CAAC;IACD,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAY,EACZ,KAAY,EACZ,KAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACzD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,KAAY,EAAE,KAAY,EAAE,KAAgB;IAChE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,OAAO;IACT,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,KAAK;QACR,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxD,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAY;IACjC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG,IAAI;QAC3D,CAAC,CAAC,KAAK,CAAC,MAAM;QACd,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB;IACzC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,eAAe,CAAC,MAAqB;IAC5C,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAChB,KAAY,EACZ,KAAY,EACZ,KAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO;QACL,OAAO;QACP,GAAG,KAAK;QACR,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC;QAC/B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,YAAY,CAAC;QAC9D,eAAe,EACb,OAAO,KAAK,CAAC,iBAAiB,KAAK,SAAS;YAC1C,CAAC,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,IAAI;QACV,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;QACjE,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,eAAe,CAAC,MAAM,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAe,EAAE,KAAY;IACnD,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxE,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACvB,IAAI,CAAC,eAAe,KAAK,IAAI;QAC7B,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAY,EAAE,KAAoB;IACzD,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,GAAW;IAC9C,OAAO,CACL,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["import { sha256 } from \"../identity\";\nimport { isRecord } from \"../value-guards\";\nimport {\n summarizeClaudeEvents,\n parseClaudeEvents,\n type ClaudeEvents,\n type ClaudeEventLine,\n} from \"./claude-events\";\n\nconst MAX_RETAINED_CALLS = 128;\ntype Entry = Record<string, unknown>;\n\nfunction label(value: unknown, max = 256): string | null {\n return typeof value === \"string\" && boundedLabel(value, max) ? value : null;\n}\n\ninterface SkillCall {\n ordinal: number;\n actor: \"parent\" | \"nested\";\n parentToolUseId: string | null;\n name: \"Skill\";\n skill: string;\n invocation: string;\n}\n\ninterface AgentCall {\n ordinal: number;\n actor: \"parent\" | \"nested\";\n parentToolUseId: string | null;\n name: \"Agent\";\n toolUseId: string | null;\n subagentType: string | null;\n runInBackground: boolean | null;\n model: string | null;\n promptSha256: string | null;\n promptFirstLineSha256: string | null;\n}\n\nexport interface ClaudeToolCallsObservation {\n id: \"sevro.claude.tool-calls\";\n completeness: \"complete\" | \"partial\";\n data: {\n method: \"stream_tool_calls\";\n calls: Array<SkillCall | AgentCall>;\n truncated: boolean;\n };\n}\n\ninterface CallState {\n calls: Array<SkillCall | AgentCall>;\n malformed: boolean;\n truncated: boolean;\n ordinal: number;\n}\ntype Actor = { actor: \"parent\" | \"nested\"; parentToolUseId: string | null };\n\n/** Retain ordered host call metadata, never tool prompts or results. */\nexport function claudeToolCallsObservation(\n stream: string | ClaudeEvents,\n exitCode: number,\n): ClaudeToolCallsObservation {\n const events = parseClaudeEvents(stream);\n const summary = summarizeClaudeEvents(events, exitCode);\n const state: CallState = {\n calls: [],\n malformed: false,\n truncated: false,\n ordinal: 0,\n };\n for (const line of events.lines) {\n collectEvent(line, state);\n if (state.truncated) break;\n }\n return {\n id: \"sevro.claude.tool-calls\",\n completeness: callCompleteness(summary.complete, state),\n data: {\n method: \"stream_tool_calls\",\n calls: state.calls,\n truncated: state.truncated,\n },\n };\n}\n\nfunction callCompleteness(\n complete: boolean,\n state: CallState,\n): \"complete\" | \"partial\" {\n return complete && !state.malformed && !state.truncated\n ? \"complete\"\n : \"partial\";\n}\n\nfunction collectEvent(line: ClaudeEventLine, state: CallState): void {\n if (!line.parsed) {\n state.malformed = true;\n return;\n }\n const event = line.value;\n if (!isRecord(event) || event.type !== \"assistant\") return;\n collectAssistant(event, state);\n}\n\nfunction collectAssistant(event: Entry, state: CallState): void {\n const blocks: unknown = isRecord(event.message)\n ? event.message.content\n : null;\n if (!Array.isArray(blocks)) {\n state.malformed = true;\n return;\n }\n const actor = actorContext(event, state);\n for (const block of blocks) {\n collectBlock(block, actor, state);\n if (state.truncated) break;\n }\n}\n\nfunction actorContext(event: Entry, state: CallState): Actor {\n const parentToolUseId = label(event.parent_tool_use_id, 128);\n const actor = parentToolUseId ? \"nested\" : \"parent\";\n if (\n event.parent_tool_use_id !== undefined &&\n event.parent_tool_use_id !== null &&\n actor === \"parent\"\n )\n state.malformed = true;\n return { actor, parentToolUseId };\n}\n\nfunction collectBlock(value: unknown, actor: Actor, state: CallState): void {\n if (!isRecord(value) || value.type !== \"tool_use\") return;\n state.ordinal++;\n if (![\"Skill\", \"Agent\", \"Task\"].includes(String(value.name))) return;\n if (state.calls.length >= MAX_RETAINED_CALLS) {\n state.truncated = true;\n return;\n }\n collectSupportedCall(value, actor, state);\n}\n\nfunction collectSupportedCall(\n value: Entry,\n actor: Actor,\n state: CallState,\n): void {\n const input = isRecord(value.input) ? value.input : {};\n if (value.name === \"Skill\") {\n collectSkill(input, actor, state);\n return;\n }\n const call = agentCall(value, input, actor, state.ordinal);\n if (!validAgentCall(call, input)) state.malformed = true;\n state.calls.push(call);\n}\n\nfunction collectSkill(input: Entry, actor: Actor, state: CallState): void {\n const invocation = label(input.skill);\n if (!invocation) {\n state.malformed = true;\n return;\n }\n state.calls.push({\n ordinal: state.ordinal,\n ...actor,\n name: \"Skill\",\n skill: invocation.slice(invocation.lastIndexOf(\":\") + 1),\n invocation,\n });\n}\n\nfunction boundedPrompt(input: Entry): string | null {\n if (typeof input.prompt !== \"string\") return null;\n return Buffer.byteLength(input.prompt, \"utf8\") <= 1024 * 1024\n ? input.prompt\n : null;\n}\n\nfunction promptDigest(prompt: string | null): string | null {\n return prompt ? sha256(prompt) : null;\n}\n\nfunction firstLineDigest(prompt: string | null): string | null {\n return prompt ? sha256(prompt.split(/\\r?\\n/, 1).join(\"\")) : null;\n}\n\nfunction agentCall(\n value: Entry,\n input: Entry,\n actor: Actor,\n ordinal: number,\n): AgentCall {\n const prompt = boundedPrompt(input);\n return {\n ordinal,\n ...actor,\n name: \"Agent\",\n toolUseId: label(value.id, 128),\n subagentType: label(input.subagent_type ?? input.subagentType),\n runInBackground:\n typeof input.run_in_background === \"boolean\"\n ? input.run_in_background\n : null,\n model: input.model === undefined ? null : label(input.model, 128),\n promptSha256: promptDigest(prompt),\n promptFirstLineSha256: firstLineDigest(prompt),\n };\n}\n\nfunction validAgentCall(call: AgentCall, input: Entry): boolean {\n const required = [call.toolUseId, call.subagentType, call.promptSha256];\n return (\n required.every(Boolean) &&\n call.runInBackground !== null &&\n validAgentModel(input, call.model)\n );\n}\n\nfunction validAgentModel(input: Entry, model: string | null): boolean {\n return input.model === undefined || model !== null;\n}\n\nfunction boundedLabel(value: string, max: number): boolean {\n return (\n value.length >= 1 && value.length <= max && /^[A-Za-z0-9_.:-]+$/.test(value)\n );\n}\n"]}
|
|
@@ -0,0 +1,373 @@
|
|
|
1
|
+
import { existsSync } from "node:fs";
|
|
2
|
+
import { readFile, realpath, rm, stat } from "node:fs/promises";
|
|
3
|
+
import { dirname, isAbsolute, join } from "node:path";
|
|
4
|
+
import { allocateNativeState } from "../native-transcript-state.js";
|
|
5
|
+
import { failedNativeTranscripts, retainEnabledNativeTranscripts, } from "../native-transcripts.js";
|
|
6
|
+
import { fixtureParts } from "../fixtures/preparation.js";
|
|
7
|
+
import { releaseRuntimeHooks, runtimeHookObservation, runtimeHooksEnabled, } from "../runtime/hooks.js";
|
|
8
|
+
import { insideRuntimeRoot as inside } from "../runtime/paths.js";
|
|
9
|
+
import { runtimeObservations } from "../runtime/state.js";
|
|
10
|
+
import { isRecord } from "../value-guards.js";
|
|
11
|
+
import { runClaudeTurns } from "./claude-continuation.js";
|
|
12
|
+
import { validateNativeHostRequest, validHostTimeout } from "./native-request.js";
|
|
13
|
+
import { summarizeClaudeEvents } from "./claude-events.js";
|
|
14
|
+
import { observeClaudeNativeGoal } from "./claude-native-goal.js";
|
|
15
|
+
import { runClaudeProcess } from "./claude-process.js";
|
|
16
|
+
import { claudeRepositoryInvocationObservation, verifyClaudeRepositoryInvocation, } from "./claude-repository-invocation.js";
|
|
17
|
+
import { prepareClaudeState } from "./claude-state.js";
|
|
18
|
+
import { cleanupNativeState, createHostDiagnostics, diagnoseHostRequest, diagnosticConfiguration, } from "../host-diagnostics.js";
|
|
19
|
+
import { CLAUDE_AUTH_VARIABLES, CLAUDE_LOGIN_MARGIN_MS, } from "./claude-credential.js";
|
|
20
|
+
import { claudeToolCallsObservation } from "./claude-tool-calls.js";
|
|
21
|
+
import { claudeSkillActivationsObservation } from "./claude-skill-activations.js";
|
|
22
|
+
import { claudeNativeControls } from "./native-controls.js";
|
|
23
|
+
const DEFAULT_TIMEOUT_MS = 10 * 60_000;
|
|
24
|
+
async function pluginDirectories(workspace, declaration) {
|
|
25
|
+
const root = await realpath(workspace);
|
|
26
|
+
requireUniquePluginDeclaration(declaration);
|
|
27
|
+
const paths = new Set(declaration.artifactPaths);
|
|
28
|
+
const directories = [];
|
|
29
|
+
for (const relativeRoot of declaration.artifactRoots)
|
|
30
|
+
directories.push(await declaredPluginDirectory(root, relativeRoot, paths));
|
|
31
|
+
requireDisjointPluginDirectories(directories);
|
|
32
|
+
for (const artifactPath of paths)
|
|
33
|
+
await verifyPluginArtifact(root, artifactPath, declaration, directories);
|
|
34
|
+
return directories;
|
|
35
|
+
}
|
|
36
|
+
function requireUniquePluginDeclaration(declaration) {
|
|
37
|
+
if (new Set(declaration.artifactRoots).size !==
|
|
38
|
+
declaration.artifactRoots.length ||
|
|
39
|
+
new Set(declaration.artifactPaths).size !== declaration.artifactPaths.length)
|
|
40
|
+
throw new Error("Claude plugin declaration contains duplicates");
|
|
41
|
+
}
|
|
42
|
+
async function declaredPluginDirectory(root, relativeRoot, paths) {
|
|
43
|
+
fixtureParts(relativeRoot);
|
|
44
|
+
if (!paths.has(`${relativeRoot}/.claude-plugin/plugin.json`))
|
|
45
|
+
throw new Error("Claude plugin manifest is undeclared");
|
|
46
|
+
const actual = await realpath(join(root, relativeRoot));
|
|
47
|
+
if (!inside(root, actual))
|
|
48
|
+
throw new Error("Claude plugin directory escapes workspace");
|
|
49
|
+
if (!(await stat(join(actual, ".claude-plugin", "plugin.json"))).isFile())
|
|
50
|
+
throw new Error("Claude plugin manifest is missing");
|
|
51
|
+
return actual;
|
|
52
|
+
}
|
|
53
|
+
function requireDisjointPluginDirectories(directories) {
|
|
54
|
+
if (new Set(directories).size !== directories.length)
|
|
55
|
+
throw new Error("Claude plugin directories overlap");
|
|
56
|
+
if (directories.some((item) => directories.some((other) => item !== other && inside(other, item))))
|
|
57
|
+
throw new Error("Claude plugin directories overlap");
|
|
58
|
+
}
|
|
59
|
+
async function verifyPluginArtifact(root, artifactPath, declaration, directories) {
|
|
60
|
+
fixtureParts(artifactPath);
|
|
61
|
+
const index = declaration.artifactRoots.findIndex((item) => artifactPath.startsWith(`${item}/`));
|
|
62
|
+
const directory = directories.at(index);
|
|
63
|
+
if (index < 0 || directory === undefined)
|
|
64
|
+
throw new Error("Claude plugin artifact is outside a declared directory");
|
|
65
|
+
if (!inside(directory, await realpath(join(root, artifactPath))))
|
|
66
|
+
throw new Error("Claude plugin artifact escapes workspace");
|
|
67
|
+
}
|
|
68
|
+
function pluginSelection(request) {
|
|
69
|
+
const selected = request.explicitSkillInvocation;
|
|
70
|
+
if (!selected || selected.scope === "repository")
|
|
71
|
+
return null;
|
|
72
|
+
return selected;
|
|
73
|
+
}
|
|
74
|
+
function requirePluginInvocation(selected, prompt) {
|
|
75
|
+
const { token, pluginName, skillName } = selected;
|
|
76
|
+
if (token !== `/${pluginName}:${skillName}` ||
|
|
77
|
+
prompt.split(token).length - 1 !== 1 ||
|
|
78
|
+
!/^[a-z][a-z0-9-]*$/.test(pluginName) ||
|
|
79
|
+
!/^[A-Za-z0-9._-]+$/.test(skillName))
|
|
80
|
+
throw new Error("invalid Claude explicit skill invocation");
|
|
81
|
+
}
|
|
82
|
+
function skillPathDeclared(request, index, skillName) {
|
|
83
|
+
const relativeRoot = request.claudePluginDirs?.artifactRoots[index];
|
|
84
|
+
return !!request.claudePluginDirs?.artifactPaths.includes(`${relativeRoot}/skills/${skillName}/SKILL.md`);
|
|
85
|
+
}
|
|
86
|
+
async function verifyInvocation(request, directories) {
|
|
87
|
+
const selected = pluginSelection(request);
|
|
88
|
+
if (!selected)
|
|
89
|
+
return;
|
|
90
|
+
requirePluginInvocation(selected, request.prompt);
|
|
91
|
+
for (const [index, root] of directories.entries()) {
|
|
92
|
+
if (!skillPathDeclared(request, index, selected.skillName))
|
|
93
|
+
continue;
|
|
94
|
+
if (await mountedPluginSkill(root, selected))
|
|
95
|
+
return;
|
|
96
|
+
}
|
|
97
|
+
throw new Error("invoked Claude skill is absent from the package");
|
|
98
|
+
}
|
|
99
|
+
async function mountedPluginSkill(root, selected) {
|
|
100
|
+
let manifest;
|
|
101
|
+
try {
|
|
102
|
+
manifest = JSON.parse(await readFile(join(root, ".claude-plugin", "plugin.json"), "utf8"));
|
|
103
|
+
}
|
|
104
|
+
catch (error) {
|
|
105
|
+
throw new Error("invalid Claude plugin manifest", { cause: error });
|
|
106
|
+
}
|
|
107
|
+
if (!isRecord(manifest) || manifest.name !== selected.pluginName)
|
|
108
|
+
return false;
|
|
109
|
+
const skill = await stat(join(root, "skills", selected.skillName, "SKILL.md")).catch(() => null);
|
|
110
|
+
return !!skill?.isFile();
|
|
111
|
+
}
|
|
112
|
+
function validClaudeOptions(options, timeoutMs) {
|
|
113
|
+
return (availableClaudeSandbox() &&
|
|
114
|
+
requiredClaudePaths(options) &&
|
|
115
|
+
optionalClaudePaths(options) &&
|
|
116
|
+
!!options.model &&
|
|
117
|
+
validClaudeEffortTimeout(options.effort, timeoutMs));
|
|
118
|
+
}
|
|
119
|
+
function availableClaudeSandbox() {
|
|
120
|
+
if (process.platform === "darwin")
|
|
121
|
+
return existsSync("/usr/bin/sandbox-exec");
|
|
122
|
+
return (process.platform === "linux" &&
|
|
123
|
+
existsSync("/usr/bin/bwrap") &&
|
|
124
|
+
existsSync("/usr/bin/socat"));
|
|
125
|
+
}
|
|
126
|
+
function requiredClaudePaths(options) {
|
|
127
|
+
return [
|
|
128
|
+
options.binary,
|
|
129
|
+
options.projectRoot,
|
|
130
|
+
options.resultsRoot,
|
|
131
|
+
...options.additionalProtectedRoots,
|
|
132
|
+
].every(isAbsolute);
|
|
133
|
+
}
|
|
134
|
+
function optionalClaudePaths(options) {
|
|
135
|
+
return [
|
|
136
|
+
options.credentialFile,
|
|
137
|
+
options.uvCacheDir,
|
|
138
|
+
options.toolchainBinDir,
|
|
139
|
+
].every((path) => path === undefined || isAbsolute(path));
|
|
140
|
+
}
|
|
141
|
+
function validClaudeEffortTimeout(effort, timeoutMs) {
|
|
142
|
+
return !!effort && validHostTimeout(timeoutMs);
|
|
143
|
+
}
|
|
144
|
+
/** Run Claude with explicit plugins and its native tool sandbox. */
|
|
145
|
+
export function createClaudeHost(options) {
|
|
146
|
+
const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
|
|
147
|
+
if (!validClaudeOptions(options, timeoutMs))
|
|
148
|
+
throw new Error("invalid Claude host configuration");
|
|
149
|
+
return {
|
|
150
|
+
id: "sevro.host.claude",
|
|
151
|
+
model: options.model,
|
|
152
|
+
effort: options.effort,
|
|
153
|
+
...(options.retainHostDiagnostics
|
|
154
|
+
? {
|
|
155
|
+
configuration: diagnosticConfiguration(options.retainHostDiagnostics),
|
|
156
|
+
}
|
|
157
|
+
: {}),
|
|
158
|
+
hostCapabilities: [
|
|
159
|
+
"sevro.host.native-goal",
|
|
160
|
+
"sevro.host.runtime",
|
|
161
|
+
"sevro.host.native-transcripts",
|
|
162
|
+
"sevro.host.hooks",
|
|
163
|
+
"sevro.host.skill-activations",
|
|
164
|
+
"sevro.claude.plugin-dirs",
|
|
165
|
+
"sevro.claude.explicit-invocation",
|
|
166
|
+
...(options.projectSettings
|
|
167
|
+
? ["sevro.claude.repository-invocation"]
|
|
168
|
+
: []),
|
|
169
|
+
"sevro.claude.tool-calls",
|
|
170
|
+
"sevro.host.native-controls",
|
|
171
|
+
"sevro.host.continuation",
|
|
172
|
+
"sevro.claude.continuation",
|
|
173
|
+
],
|
|
174
|
+
run(request) {
|
|
175
|
+
return runClaudeRequest(options, timeoutMs, request);
|
|
176
|
+
},
|
|
177
|
+
};
|
|
178
|
+
}
|
|
179
|
+
async function repositoryMount(request, options) {
|
|
180
|
+
if (request.explicitSkillInvocation?.scope !== "repository")
|
|
181
|
+
return null;
|
|
182
|
+
if (!options.projectSettings)
|
|
183
|
+
throw new Error("Claude repository invocation requires project setting sources");
|
|
184
|
+
return verifyClaudeRepositoryInvocation(request);
|
|
185
|
+
}
|
|
186
|
+
async function runClaudeRequest(options, timeoutMs, request) {
|
|
187
|
+
const diagnostics = createHostDiagnostics("claude", options.retainHostDiagnostics, request);
|
|
188
|
+
return diagnoseHostRequest(diagnostics, async () => {
|
|
189
|
+
diagnostics.stage = "request-validation";
|
|
190
|
+
await diagnostics.readCredentials(options.credentialFile);
|
|
191
|
+
return executeClaudeRequest(options, timeoutMs, request, diagnostics);
|
|
192
|
+
});
|
|
193
|
+
}
|
|
194
|
+
/** Every turn shares one access token, so it must outlive all of them. */
|
|
195
|
+
function claudeLoginLifetime(timeoutMs, request) {
|
|
196
|
+
const turns = request.followUpPrompt === undefined ? 1 : 2;
|
|
197
|
+
return timeoutMs * turns + CLAUDE_LOGIN_MARGIN_MS;
|
|
198
|
+
}
|
|
199
|
+
async function executeClaudeRequest(options, timeoutMs, request, diagnostics) {
|
|
200
|
+
const { pluginDirs, repositoryInvocation } = await validateClaudeRequest(options, request);
|
|
201
|
+
diagnostics.stage = "state-allocation";
|
|
202
|
+
const stateRoot = await allocateNativeState("claude-", request.runtimePolicy ? request.workspace : undefined);
|
|
203
|
+
let hooks;
|
|
204
|
+
try {
|
|
205
|
+
diagnostics.stage = "state-preparation";
|
|
206
|
+
const state = await prepareClaudeState(stateRoot, options, request, pluginDirs, claudeLoginLifetime(timeoutMs, request));
|
|
207
|
+
diagnostics.registerCredentials(state.env, CLAUDE_AUTH_VARIABLES);
|
|
208
|
+
hooks = state.hooks;
|
|
209
|
+
const run = claudeProcessRunner(options, timeoutMs, request, state, diagnostics);
|
|
210
|
+
const execution = await runClaudeTurns({
|
|
211
|
+
prompt: request.prompt,
|
|
212
|
+
followUpPrompt: request.followUpPrompt,
|
|
213
|
+
workspace: request.workspace,
|
|
214
|
+
run,
|
|
215
|
+
});
|
|
216
|
+
const result = await claudeResult(execution, claudeObservationRoot(stateRoot, state.credential, request), request, repositoryInvocation);
|
|
217
|
+
await diagnostics.retainFailure(result, "Claude host execution did not complete");
|
|
218
|
+
await addHookObservation(result, state.hooks);
|
|
219
|
+
await retainEnabledNativeTranscripts(result, request.runtimePolicy, join(stateRoot, "native-home", "projects"), "claude", request.runtimeRole);
|
|
220
|
+
return result;
|
|
221
|
+
}
|
|
222
|
+
catch (cause) {
|
|
223
|
+
return await failedNativeTranscripts(cause, request.runtimePolicy, join(stateRoot, "native-home", "projects"), "claude", request.runtimeRole, diagnostics);
|
|
224
|
+
}
|
|
225
|
+
finally {
|
|
226
|
+
await cleanupNativeState(diagnostics, async () => {
|
|
227
|
+
await releaseRuntimeHooks(hooks);
|
|
228
|
+
await rm(stateRoot, { recursive: true, force: true });
|
|
229
|
+
});
|
|
230
|
+
}
|
|
231
|
+
}
|
|
232
|
+
function claudeProcessRunner(options, timeoutMs, request, state, diagnostics) {
|
|
233
|
+
return (prompt, session) => {
|
|
234
|
+
diagnostics.stage = "claude-execution";
|
|
235
|
+
return runClaudeProcess({
|
|
236
|
+
diagnostics,
|
|
237
|
+
argv: claudeTurnArgs(options, prompt, session, state.settingsPath, state.pluginDirs),
|
|
238
|
+
cwd: request.workspace,
|
|
239
|
+
env: state.env,
|
|
240
|
+
timeoutMs,
|
|
241
|
+
signal: request.signal,
|
|
242
|
+
});
|
|
243
|
+
};
|
|
244
|
+
}
|
|
245
|
+
async function validateClaudeRequest(options, request) {
|
|
246
|
+
await validateNativeHostRequest(request, "Claude");
|
|
247
|
+
const pluginDirs = request.claudePluginDirs
|
|
248
|
+
? await pluginDirectories(request.workspace, request.claudePluginDirs)
|
|
249
|
+
: [];
|
|
250
|
+
await verifyInvocation(request, pluginDirs);
|
|
251
|
+
requireIsolatedHookSources(request, options);
|
|
252
|
+
const repositoryInvocation = await repositoryMount(request, options);
|
|
253
|
+
return { pluginDirs, repositoryInvocation };
|
|
254
|
+
}
|
|
255
|
+
function requireIsolatedHookSources(request, options) {
|
|
256
|
+
if (runtimeHooksEnabled(request.runtimePolicy) && options.projectSettings)
|
|
257
|
+
throw new Error("native goals require isolated hook sources");
|
|
258
|
+
}
|
|
259
|
+
async function addHookObservation(result, hooks) {
|
|
260
|
+
if (!hooks)
|
|
261
|
+
return;
|
|
262
|
+
result.observations?.push(await runtimeHookObservation(hooks));
|
|
263
|
+
}
|
|
264
|
+
function claudeTurnArgs(options, prompt, session, settingsPath, pluginDirs) {
|
|
265
|
+
return [
|
|
266
|
+
options.binary,
|
|
267
|
+
"-p",
|
|
268
|
+
prompt,
|
|
269
|
+
"--output-format",
|
|
270
|
+
"stream-json",
|
|
271
|
+
"--verbose",
|
|
272
|
+
"--model",
|
|
273
|
+
options.model,
|
|
274
|
+
"--effort",
|
|
275
|
+
options.effort,
|
|
276
|
+
"--permission-mode",
|
|
277
|
+
"dontAsk",
|
|
278
|
+
"--tools",
|
|
279
|
+
"Bash,Read,Edit,Skill,Agent",
|
|
280
|
+
"--setting-sources",
|
|
281
|
+
options.projectSettings ? "project" : "",
|
|
282
|
+
"--settings",
|
|
283
|
+
settingsPath,
|
|
284
|
+
"--strict-mcp-config",
|
|
285
|
+
"--mcp-config",
|
|
286
|
+
'{"mcpServers":{}}',
|
|
287
|
+
"--no-chrome",
|
|
288
|
+
...(session ? [session.option, session.id] : []),
|
|
289
|
+
...pluginDirs.flatMap((path) => ["--plugin-dir", path]),
|
|
290
|
+
];
|
|
291
|
+
}
|
|
292
|
+
function claudeObservationRoot(stateRoot, credential, request) {
|
|
293
|
+
return request.runtimePolicy?.nativeTranscripts === true
|
|
294
|
+
? join(stateRoot, "native-home")
|
|
295
|
+
: dirname(credential);
|
|
296
|
+
}
|
|
297
|
+
async function repositoryObservation(execution, configRoot, request, invocation, tools) {
|
|
298
|
+
if (!invocation)
|
|
299
|
+
return null;
|
|
300
|
+
return claudeRepositoryInvocationObservation({
|
|
301
|
+
invocation,
|
|
302
|
+
stream: execution.initialEvents ?? execution.events,
|
|
303
|
+
configRoot: configRoot,
|
|
304
|
+
workspace: request.workspace,
|
|
305
|
+
tools: execution.initialEvents
|
|
306
|
+
? claudeToolCallsObservation(execution.initialEvents, 0)
|
|
307
|
+
: tools,
|
|
308
|
+
});
|
|
309
|
+
}
|
|
310
|
+
async function claudeObservations(execution, configRoot, request, invocation) {
|
|
311
|
+
const tools = claudeToolCallsObservation(execution.events, execution.code);
|
|
312
|
+
const repository = await repositoryObservation(execution, configRoot, request, invocation, tools);
|
|
313
|
+
return [
|
|
314
|
+
tools,
|
|
315
|
+
...runtimeObservations(request.runtimePolicy, request.runtimeRole),
|
|
316
|
+
await observeClaudeNativeGoal(configRoot, execution.followUpEvents ?? execution.events),
|
|
317
|
+
claudeNativeControls(execution.events, execution.code),
|
|
318
|
+
...(repository ? [repository] : []),
|
|
319
|
+
...(execution.continuation ? [execution.continuation] : []),
|
|
320
|
+
claudeSkillActivationsObservation(execution.events, execution.code),
|
|
321
|
+
];
|
|
322
|
+
}
|
|
323
|
+
function claudeArtifacts(execution) {
|
|
324
|
+
return [
|
|
325
|
+
{ id: "sevro.claude.events", bytes: Buffer.from(execution.out, "utf8") },
|
|
326
|
+
...(execution.initialOut !== undefined
|
|
327
|
+
? [
|
|
328
|
+
{
|
|
329
|
+
id: "sevro.claude.initial-events",
|
|
330
|
+
bytes: Buffer.from(execution.initialOut, "utf8"),
|
|
331
|
+
},
|
|
332
|
+
]
|
|
333
|
+
: []),
|
|
334
|
+
...(execution.followUpOut !== undefined
|
|
335
|
+
? [
|
|
336
|
+
{
|
|
337
|
+
id: "sevro.claude.follow-up-events",
|
|
338
|
+
bytes: Buffer.from(execution.followUpOut, "utf8"),
|
|
339
|
+
},
|
|
340
|
+
]
|
|
341
|
+
: []),
|
|
342
|
+
...(execution.err
|
|
343
|
+
? [
|
|
344
|
+
{
|
|
345
|
+
id: "sevro.claude.stderr",
|
|
346
|
+
bytes: Buffer.from(execution.err, "utf8"),
|
|
347
|
+
},
|
|
348
|
+
]
|
|
349
|
+
: []),
|
|
350
|
+
];
|
|
351
|
+
}
|
|
352
|
+
function measuredClaudeUsage(summary, execution) {
|
|
353
|
+
return {
|
|
354
|
+
inputTokens: execution.sessionResultsBound === false ? null : summary.inputTokens,
|
|
355
|
+
outputTokens: execution.sessionResultsBound === false ? null : summary.outputTokens,
|
|
356
|
+
costUsd: execution.sessionResultsBound === false ? null : summary.costUsd,
|
|
357
|
+
usageComplete: execution.sessionResultsBound !== false && summary.usageComplete,
|
|
358
|
+
};
|
|
359
|
+
}
|
|
360
|
+
async function claudeResult(execution, configRoot, request, invocation) {
|
|
361
|
+
const summary = summarizeClaudeEvents(execution.events, execution.code);
|
|
362
|
+
const observations = await claudeObservations(execution, configRoot, request, invocation);
|
|
363
|
+
return {
|
|
364
|
+
finalMessage: summary.finalMessage,
|
|
365
|
+
complete: summary.complete,
|
|
366
|
+
executionFailed: !summary.complete,
|
|
367
|
+
observations,
|
|
368
|
+
artifacts: claudeArtifacts(execution),
|
|
369
|
+
actualCondition: "passive",
|
|
370
|
+
...measuredClaudeUsage(summary, execution),
|
|
371
|
+
};
|
|
372
|
+
}
|
|
373
|
+
//# sourceMappingURL=claude.js.map
|