@cargo-ai/cli 1.0.78 → 1.0.80

package/build/commands/ask/localHarness.js

@@ -0,0 +1,1074 @@
+import { accessSync, constants } from "node:fs";
+import { basename, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { HarnessAgent } from "@ai-sdk/harness/agent";
+import { createClaudeCode } from "@ai-sdk/harness-claude-code";
+import { cdkProjectRoot } from "@cargo-ai/cdk/cli";
+import { createLocalSandbox } from "ai-sdk-sandbox-local";
+import { pruneHarnessArtifacts } from "./artifacts.js";
+import { askClaudeConfigDir } from "./claudeConfig.js";
+import { ensureHarnessPnpmOnPath } from "./pnpmShim.js";
+/**
+ * A local turn spends far longer getting the prompt into Claude Code than it
+ * spends generating the answer, and none of that is visible from the tree or
+ * from Claude Code's own transcript. `CARGO_ASK_TIMING=1` writes the phase
+ * boundaries — and the harness's own diagnostics — to stderr. Unset, every
+ * call below is a no-op and nothing is added to the stream.
+ */
+const ASK_TIMING_ENABLED = process.env["CARGO_ASK_TIMING"] === "1";
+function createPhaseLog(label) {
+    if (ASK_TIMING_ENABLED === false) {
+        return () => undefined;
+    }
+    const start = Date.now();
+    let previous = start;
+    return (phase) => {
+        const now = Date.now();
+        const total = ((now - start) / 1000).toFixed(2).padStart(6);
+        const step = ((now - previous) / 1000).toFixed(2).padStart(5);
+        previous = now;
+        process.stderr.write(`[ask:timing] ${label} ${total}s (+${step}s) ${phase}\n`);
+    };
+}
+/**
+ * The harness prints its own diagnostics without a clock, which is what the
+ * gap needs. Reprint them relative to process start instead.
+ */
+function reportHarnessDiagnostic(event) {
+    const elapsed = process.uptime().toFixed(2).padStart(6);
+    process.stderr.write(`[ask:timing] harness ${elapsed}s ${event.level} ${event.subsystem ?? "-"} ${event.message}\n`);
+}
+/** Marks when each part of a turn's stream arrives, and when it ends. */
+function timeStreamParts(stream, phase) {
+    if (ASK_TIMING_ENABLED === false) {
+        return stream;
+    }
+    return { text: stream.text, fullStream: timeParts(stream.fullStream, phase) };
+}
+async function* timeParts(parts, phase) {
+    let seen = 0;
+    for await (const part of parts) {
+        seen += 1;
+        const type = typeof part === "object" && part !== null && "type" in part
+            ? String(part.type)
+            : "unknown";
+        // Text arrives one delta per token, which would bury everything else.
+        if (type.startsWith("text-delta") === false) {
+            phase(`part ${String(seen)}: ${type}`);
+        }
+        yield part;
+    }
+    phase(`stream ended after ${String(seen)} parts`);
+}
+const LOCAL_WORKING_COPY_INSTRUCTIONS = `You are working in the user's local working copy, not a sandbox. Prefer plan over deploy.
+
+The user confirms each Bash, Write, Edit and NotebookEdit call, and can only answer one at a time. Ask for a single one of those per step and wait for its result before asking for the next; two in one step leaves the second waiting on a confirmation it will never be offered. Reads (Read, Glob, Grep) and the Cargo \`mcp__cargo__*\` tools need no confirmation — batch those freely.
+
+Prefer minimal, focused diffs; match the existing code style; run the project's own checks when they exist. End each task with a short summary of what changed and how it was validated.`;
+const CDK_RAILS_INSTRUCTIONS = `This directory is a Cargo CDK project.
+- Never edit cargo.state.json, cargo.state.lock, or .cargo-ai/ by hand — they are generated.
+- Validate your changes before declaring them done: run \`npx tsc --noEmit\` and \`npx cargo-cdk plan\` (plan is offline and safe).
+- Never run \`cargo-cdk deploy\`, \`destroy\`, \`import\`, or \`rollback\` unless the user explicitly asked.`;
+const LOCAL_CDK_RAILS_SKILL = {
+    name: "cdk-rails",
+    description: "Rails for working on a Cargo CDK project on this machine.",
+    content: CDK_RAILS_INSTRUCTIONS,
+};
+/**
+ * Always-on local-copy rails, plus CDK rails only when `dir` is a CDK project.
+ * Exported for tests.
+ */
+export function localHarnessInstructions(dir) {
+    if (cdkProjectRoot(dir) !== undefined) {
+        return `${LOCAL_WORKING_COPY_INSTRUCTIONS}\n\n${CDK_RAILS_INSTRUCTIONS}`;
+    }
+    return LOCAL_WORKING_COPY_INSTRUCTIONS;
+}
+/** Exported for tests. */
+export function localHarnessSkills(dir) {
+    if (cdkProjectRoot(dir) !== undefined) {
+        return [LOCAL_CDK_RAILS_SKILL];
+    }
+    return [];
+}
+/** Exported for tests. */
+export function createTurnAccumulator() {
+    return {
+        chunks: [],
+        usage: {
+            costUsd: 0,
+            totalTokens: 0,
+            inputTokens: 0,
+            outputTokens: 0,
+            cacheReadTokens: 0,
+            cacheWriteTokens: 0,
+            reasoningTokens: 0,
+        },
+    };
+}
+/**
+ * `ai-sdk-sandbox-local@0.1.2` still ships deprecated `getPortUrl` only.
+ * Claude Code's harness treats a session without `getPortEndpoint` as a basic
+ * sandbox and then demands an explicit port — wrap until the local provider
+ * catches up.
+ */
+function withGetPortEndpoint(provider) {
+    const resumeSession = provider.resumeSession;
+    return {
+        specificationVersion: provider.specificationVersion,
+        providerId: provider.providerId,
+        createSession: async (options) => ensureGetPortEndpoint(await provider.createSession(options)),
+        resumeSession: resumeSession === undefined
+            ? undefined
+            : async (options) => ensureGetPortEndpoint(await resumeSession(options)),
+    };
+}
+function ensureGetPortEndpoint(session) {
+    if ("getPortEndpoint" in session) {
+        return session;
+    }
+    const getPortEndpoint = async (options) => ({
+        url: await session.getPortUrl(options),
+    });
+    Object.assign(session, { getPortEndpoint });
+    return session;
+}
+/**
+ * The workspace half of local Ask: the hosted Cargo MCP server, reached
+ * through this CLI's own `mcp` bridge.
+ *
+ * Going through the bridge rather than configuring the HTTP endpoint directly
+ * is what keeps a long chat working — the bridge rebuilds the `Authorization`
+ * header per request from the same credentials every other command uses, so an
+ * OAuth session that expires mid-session renews instead of 401ing. `CARGO_BASE_URL`
+ * is pinned so the bridge cannot end up on a different API than this session.
+ *
+ * Everything the workspace can do arrives this way: actions, runs, models and
+ * SQL, the context, usage. That includes `execute_action`, which spends credits
+ * and writes to connected systems — see the approval note on
+ * `isAutoApproved`.
+ */
+/**
+ * What Claude Code mounts this server as, and so the `mcp__<server>__` prefix
+ * its tools carry. Read by `isAutoApproved`, which trusts this server and no
+ * other — see the note there.
+ *
+ * Exported for tests.
+ */
+export const CARGO_MCP_SERVER_NAME = "cargo";
+function cargoMcpServer(apiBaseUrl) {
+    return {
+        type: "stdio",
+        command: process.execPath,
+        args: [...loaderArgs(), cliEntryPath(), "mcp"],
+        env: { CARGO_BASE_URL: apiBaseUrl },
+    };
+}
+/**
+ * This CLI's own entry, so the bridge is the same code and version as the
+ * session that spawned it — not whatever `cargo-ai` happens to be on PATH.
+ */
+function cliEntryPath() {
+    const entry = process.argv[1];
+    return entry !== undefined && entry.length > 0
+        ? entry
+        : fileURLToPath(new URL("../../index.js", import.meta.url));
+}
+/**
+ * Loader flags only. A dev run under `tsx` starts from a `.ts` entry that bare
+ * node cannot execute, so the child needs the same loader; the rest of
+ * `execArgv` (`--inspect` above all, which would fight over a port) must not
+ * be inherited.
+ */
+function loaderArgs() {
+    const flags = ["--import", "--loader", "--require"];
+    const args = [];
+    for (let index = 0; index < process.execArgv.length; index += 1) {
+        const arg = process.execArgv[index];
+        if (arg === undefined) {
+            continue;
+        }
+        // `--import=tsx` carries its value; `--import tsx` is two entries and the
+        // second one has to come along.
+        if (flags.some((flag) => arg.startsWith(`${flag}=`)) === true) {
+            args.push(arg);
+            continue;
+        }
+        if (flags.includes(arg) === true) {
+            const value = process.execArgv[index + 1];
+            if (value !== undefined) {
+                args.push(arg, value);
+                index += 1;
+            }
+        }
+    }
+    return args;
+}
+/**
+ * Where to root the sandbox, and which directory inside it the session works in.
+ *
+ * The harness gives every session a work directory under the sandbox root and
+ * starts Claude Code there — `cwd: workdir` in the bridge — and it refuses to
+ * use the root itself. Rooted at the project, that means the agent begins in an
+ * empty `claude-code-<sessionId>` directory one level below the working copy it
+ * was asked about. Rooting at the project's parent instead makes the session
+ * work directory *be* the project, so the agent starts where the user is, and
+ * the harness's own artifacts land beside the project rather than in it.
+ *
+ * Falls back to the project when the parent cannot serve — a project at a
+ * filesystem root has no usable name, and a parent we cannot write to would
+ * fail the session at startup. The per-session directory returns in that case,
+ * and `pruneHarnessArtifacts` sweeps it once it is cold.
+ */
+export function resolveWorkspaceLayout(dir) {
+    const parent = dirname(dir);
+    const name = basename(dir);
+    if (parent === dir || name.length === 0) {
+        return { sandboxCwd: dir, workDir: undefined };
+    }
+    try {
+        accessSync(parent, constants.W_OK);
+    }
+    catch {
+        return { sandboxCwd: dir, workDir: undefined };
+    }
+    return { sandboxCwd: parent, workDir: name };
+}
+export async function createLocalHarness(input) {
+    const setupPhase = createPhaseLog("setup");
+    // Claude Code bootstrap shells out to `pnpm`; Volta often has a dead shim
+    // and pnpm 9 refuses this npm packageManager root — put pnpm@10 first.
+    ensureHarnessPnpmOnPath();
+    setupPhase("pnpm shim written to PATH");
+    const workspace = resolveWorkspaceLayout(input.dir);
+    pruneHarnessArtifacts(workspace.sandboxCwd);
+    // Earlier versions rooted the sandbox at the project, so its artifacts are
+    // still in there to collect.
+    if (workspace.sandboxCwd !== input.dir) {
+        pruneHarnessArtifacts(input.dir);
+    }
+    setupPhase("stale harness artifacts pruned");
+    const anthropicBaseUrl = `${input.apiBaseUrl.replace(/\/$/, "")}/sandbox/anthropic`;
+    const harnessAgent = new HarnessAgent({
+        // Pin auth the same way the backend harness stream does. Credentials go
+        // through `auth`, not `env`: passing them via `env` alone lets
+        // createClaudeCode auto-detect AI Gateway from the host process and ignore
+        // the Cargo proxy.
+        harness: createClaudeCode({
+            auth: {
+                ANTHROPIC_BASE_URL: anthropicBaseUrl,
+                ANTHROPIC_API_KEY: input.proxyToken,
+            },
+            env: { CLAUDE_CONFIG_DIR: askClaudeConfigDir() },
+            mcpServers: {
+                [CARGO_MCP_SERVER_NAME]: cargoMcpServer(input.apiBaseUrl),
+            },
+        }),
+        id: "cargo-ai-ask",
+        sandbox: withGetPortEndpoint(createLocalSandbox({ cwd: workspace.sandboxCwd })),
+        sandboxConfig: workspace.workDir === undefined ? {} : { workDir: workspace.workDir },
+        instructions: localHarnessInstructions(input.dir),
+        skills: localHarnessSkills(input.dir),
+        permissionMode: "allow-reads",
+        ...(ASK_TIMING_ENABLED === false
+            ? {}
+            : { debug: { enabled: true }, onLog: reportHarnessDiagnostic }),
+    });
+    setupPhase("harness agent constructed");
+    // Local sandbox cannot broker credentials via request transforms; the
+    // harness always warns. Keep that off the Ask tree (stderr mid-reply).
+    const session = await withMutedCredentialBrokerWarning(() => harnessAgent.createSession());
+    setupPhase("harness session created");
+    // Consumed by the first prompt: this session has never seen the chat, so it
+    // is told the story once rather than on every question.
+    let pendingHistory = input.history;
+    let proxyLastUsedAtMs;
+    // Approvals the previous turn asked about and never answered — a turn
+    // cancelled at the confirmation prompt leaves one here.
+    const unanswered = [];
+    return {
+        streamPrompt: async (question, options) => {
+            const turnPhase = createPhaseLog("turn ");
+            turnPhase("prompt submitted");
+            const abortSignal = options === undefined ? undefined : options.abortSignal;
+            // The turn is stored and shown as the user wrote it; only what Claude
+            // Code is asked carries the replayed history.
+            const prompt = pendingHistory === undefined
+                ? question
+                : `${pendingHistory}\n\n${question}`;
+            // A cancelled turn stays unfinished, and the harness refuses a new
+            // prompt until it is drained. Do that here rather than making the next
+            // question fail with "must be continued before accepting a new prompt".
+            if (session.hasUnfinishedTurn() === true) {
+                // Anything the last turn asked about and never got an answer for is
+                // denied. Draining with no continuations leaves the runtime waiting
+                // on a response that is never coming, and the honest reading of a
+                // user who walked away from the prompt is "no" — carrying the
+                // question into a turn they did not ask for would be worse.
+                const denials = unanswered.map((approval) => ({
+                    approvalResponse: {
+                        type: "tool-approval-response",
+                        approvalId: approval.approvalId,
+                        approved: false,
+                    },
+                    toolCall: {
+                        type: "tool-call",
+                        toolCallId: approval.toolCallId,
+                        toolName: approval.toolName,
+                        input: approval.input,
+                    },
+                }));
+                unanswered.length = 0;
+                // The drain gets its own controller so the timeout can stop it rather
+                // than walk away from it. Nothing watches this call the way the stall
+                // watchdog watches a turn's stream, so a runtime that never settles
+                // would otherwise hang the question just asked — but abandoning the
+                // promise and carrying on is no better: `continueGenerate` keeps
+                // running, and submitting the new prompt to the same session races the
+                // turn we failed to wind down. Chained to the turn's signal so ctrl-c
+                // still gets out of it.
+                const drain = new AbortController();
+                const abortDrain = () => drain.abort();
+                if (abortSignal !== undefined) {
+                    if (abortSignal.aborted === true) {
+                        drain.abort();
+                    }
+                    else {
+                        abortSignal.addEventListener("abort", abortDrain, { once: true });
+                    }
+                }
+                const drainTimer = setTimeout(abortDrain, TURN_DRAIN_TIMEOUT_MS);
+                try {
+                    await harnessAgent.continueGenerate({
+                        session,
+                        toolApprovalContinuations: denials,
+                        abortSignal: drain.signal,
+                    });
+                }
+                catch {
+                    // Whether it failed or was cut off, the session itself is the only
+                    // thing that can say if a new prompt is allowed.
+                }
+                finally {
+                    clearTimeout(drainTimer);
+                    if (abortSignal !== undefined) {
+                        abortSignal.removeEventListener("abort", abortDrain);
+                    }
+                }
+                if (session.hasUnfinishedTurn() === true) {
+                    throw new HarnessTurnStuck();
+                }
+                turnPhase("unfinished previous turn drained");
+            }
+            const accumulator = createTurnAccumulator();
+            let answer;
+            try {
+                answer = await runPromptTurn({
+                    driver: {
+                        start: async () => {
+                            turnPhase("harness stream() called");
+                            const stream = (await harnessAgent.stream({
+                                prompt,
+                                session,
+                                abortSignal,
+                            }));
+                            turnPhase("harness stream() returned");
+                            // The prompt is in the session now, so the replayed history has
+                            // been told. Cleared here rather than before submitting: a turn
+                            // that never reached the harness must keep it for the retry, or
+                            // a cancelled first question would leave every later one in this
+                            // process without the earlier conversation.
+                            pendingHistory = undefined;
+                            return timeStreamParts(stream, turnPhase);
+                        },
+                        continueWithApprovals: async (continuations) => {
+                            turnPhase("harness continueStream() called");
+                            const stream = (await harnessAgent.continueStream({
+                                session,
+                                toolApprovalContinuations: continuations,
+                                abortSignal,
+                            }));
+                            turnPhase("harness continueStream() returned");
+                            return timeStreamParts(stream, turnPhase);
+                        },
+                    },
+                    handlers: options,
+                    accumulator,
+                    unanswered,
+                });
+            }
+            catch (error) {
+                // Cancelled or failed after Claude Code already spent tokens. Record
+                // what it spent, then let the caller handle the failure.
+                if (didReachAnthropic(accumulator.usage) === true) {
+                    proxyLastUsedAtMs = Date.now();
+                }
+                await ingestTurn({
+                    api: input.api,
+                    chatUuid: input.chatUuid,
+                    agentUuid: input.agentUuid,
+                    question,
+                    answer: accumulator.chunks.join(""),
+                    usage: accumulator.usage,
+                    // Whatever it managed to say is a fragment, not the answer. Stored
+                    // as cancelled so a later session does not replay it as work done.
+                    cancelled: true,
+                    turnOwnerId: input.turnOwnerId,
+                    onNotice: options === undefined ? undefined : options.onNotice,
+                });
+                throw error;
+            }
+            if (didReachAnthropic(accumulator.usage) === true) {
+                proxyLastUsedAtMs = Date.now();
+            }
+            // A turn that spent tokens or edited files is recorded even when it
+            // produced no prose, so history and billing match what actually ran.
+            await ingestTurn({
+                api: input.api,
+                chatUuid: input.chatUuid,
+                agentUuid: input.agentUuid,
+                question,
+                answer,
+                usage: accumulator.usage,
+                turnOwnerId: input.turnOwnerId,
+                onNotice: options === undefined ? undefined : options.onNotice,
+            });
+            // Nothing said and nothing spent means the harness never reached
+            // Anthropic — a misconfigured proxy rather than a quiet tool-only turn.
+            // Same predicate `ingestTurn` uses, so a turn that was billed is never
+            // also reported as unreachable.
+            if (answer.length === 0 &&
+                didReachAnthropic(accumulator.usage) === false) {
+                throw new Error(`Local Claude Code returned no text. The harness called ${anthropicBaseUrl} with the minted proxy token — confirm CARGO_BASE_URL points at your API and that /sandbox/anthropic is reachable.`);
+            }
+            return answer;
+        },
+        proxyLastUsedAtMs: () => proxyLastUsedAtMs,
+        close: async () => {
+            // `detach` would leave the bridge and Claude Code running for a resume
+            // that never comes, which is how orphaned bridges piled up. Nothing here
+            // is resumable by design, so take the runtime down with the session.
+            //
+            // Bounded, because Ctrl-C at the prompt now unwinds through here: a
+            // destroy that never settles would turn "stop" into a hang, which is
+            // what pressing it was meant to escape. Giving up can leave the orphan
+            // this call exists to prevent, but a teardown already stuck is no more
+            // likely to finish while the user waits on it.
+            await settleWithin(session.destroy().catch(() => undefined), SESSION_DESTROY_TIMEOUT_MS);
+        },
+    };
+}
+/**
+ * Persist the turn and what it spent. Local Ask runs on the platform
+ * Anthropic key through the proxy, so this call is the only thing that makes
+ * the turn billable — the mint-time credit check gates the session, not the
+ * spend. Sending `costUsd` rather than a credit count keeps pricing on the
+ * server.
+ *
+ * History is best effort: a failed ingest is reported but never turns a reply
+ * the user already read into a failed turn.
+ */
+/**
+ * Whether the turn got as far as Anthropic. `costUsd` and `totalTokens` are
+ * reported independently by the harness, so either alone means it did.
+ */
+function didReachAnthropic(usage) {
+    return usage.costUsd > 0 || usage.totalTokens > 0;
+}
+async function ingestTurn(input) {
+    if (input.answer.length === 0 && didReachAnthropic(input.usage) === false) {
+        return;
+    }
+    try {
+        await input.api.ai.message.ingest({
+            chatUuid: input.chatUuid,
+            agentUuid: input.agentUuid,
+            userParts: [{ type: "text", text: input.question }],
+            // A turn cancelled before it said anything is recorded for its usage
+            // alone, so it has no text part rather than an empty one.
+            assistantParts: input.answer.length === 0 ? [] : [{ type: "text", text: input.answer }],
+            usage: didReachAnthropic(input.usage) === true ? input.usage : undefined,
+            cancelled: input.cancelled,
+            turnOwnerId: input.turnOwnerId,
+        });
+    }
+    catch (error) {
+        if (input.onNotice !== undefined) {
+            input.onNotice(`Could not save this turn to the chat history: ${error instanceof Error ? error.message : "unknown error"}`);
+        }
+    }
+}
+/**
+ * How many times one turn may suspend for approvals. Each round trip is a
+ * decision the user made, so this is only a stop for a harness that keeps
+ * re-asking for a tool it was already refused.
+ */
+const MAX_APPROVAL_ROUNDS = 64;
+/**
+ * Run one turn to completion, answering approval requests along the way.
+ *
+ * A turn suspends whenever Claude Code wants a tool `permissionMode` does not
+ * cover: the stream ends with the approvals still pending, and the turn only
+ * finishes once decisions are fed back in. Exported for tests.
+ */
+export async function runPromptTurn(input) {
+    const handlers = input.handlers === undefined ? {} : input.handlers;
+    const onApproval = handlers.onApproval;
+    const accumulator = input.accumulator === undefined
+        ? createTurnAccumulator()
+        : input.accumulator;
+    const stallTimeoutMs = input.stallTimeoutMs === undefined
+        ? TURN_STALL_TIMEOUT_MS
+        : input.stallTimeoutMs;
+    const assistantChunks = accumulator.chunks;
+    const toolCalls = new Map();
+    const turnState = {
+        toolRanSinceText: false,
+        inFlightToolCallIds: new Set(),
+    };
+    let stream = await input.driver.start();
+    let round = 0;
+    for (;;) {
+        const approvals = await consumeTurn({
+            stream,
+            handlers,
+            assistantChunks,
+            toolCalls,
+            usage: accumulator.usage,
+            turnState,
+            stallTimeoutMs,
+        });
+        if (approvals.length === 0) {
+            break;
+        }
+        if (input.unanswered !== undefined) {
+            input.unanswered.push(...approvals);
+        }
+        round += 1;
+        if (round > MAX_APPROVAL_ROUNDS) {
+            throw new Error(`Local Claude Code asked for tool approval ${String(MAX_APPROVAL_ROUNDS)} times in one turn without finishing. Stopping the turn.`);
+        }
+        const continuations = [];
+        const approvedToolCallIds = [];
+        for (const approval of approvals) {
+            // Refused before the user is asked: not their call to make, and a
+            // prompt for it could not say what it was granting.
+            const denied = isAlwaysDenied(approval.toolName);
+            const approved = denied === true
+                ? false
+                : isAutoApproved(approval.toolName) === true
+                    ? true
+                    : onApproval === undefined
+                        ? false
+                        : await onApproval(approval);
+            if (approved === true) {
+                approvedToolCallIds.push(approval.toolCallId);
+            }
+            // Answered, so the drain on a later turn must not deny it again.
+            if (input.unanswered !== undefined) {
+                const at = input.unanswered.indexOf(approval);
+                if (at !== -1) {
+                    input.unanswered.splice(at, 1);
+                }
+            }
+            continuations.push({
+                approvalResponse: {
+                    type: "tool-approval-response",
+                    approvalId: approval.approvalId,
+                    approved,
+                    // Told why, so it does something else rather than asking again
+                    // until the approval-round cap ends the turn.
+                    reason: denied === true ? DENIED_TOOL_REASON : undefined,
+                },
+                toolCall: {
+                    type: "tool-call",
+                    toolCallId: approval.toolCallId,
+                    toolName: approval.toolName,
+                    input: approval.input,
+                },
+            });
+        }
+        // Only the tools just approved are actually going to run. The harness
+        // surfaces one approval per stream, so a sibling the model announced in
+        // the same stream was never asked about and will never report a result —
+        // left in the set it would tell the stall watchdog a tool is in flight
+        // for the rest of the turn, turning a silent stream into a hang.
+        turnState.inFlightToolCallIds.clear();
+        for (const toolCallId of approvedToolCallIds) {
+            turnState.inFlightToolCallIds.add(toolCallId);
+        }
+        stream = await input.driver.continueWithApprovals(continuations);
+    }
+    const streamed = assistantChunks.join("");
+    if (streamed.length > 0) {
+        return streamed;
+    }
+    const fallback = await stream.text;
+    if (typeof fallback !== "string" || fallback.length === 0) {
+        return "";
+    }
+    if (handlers.onTextDelta !== undefined) {
+        handlers.onTextDelta(fallback);
+    }
+    return fallback;
+}
+/**
+ * How long a turn may produce nothing at all while no tool is running.
+ *
+ * Generous on purpose: this is a deadlock detector, not a latency budget. The
+ * clock only runs when nothing is in flight, so the wait is over a turn that
+ * is neither working nor talking.
+ */
+const TURN_STALL_TIMEOUT_MS = 120_000;
+/**
+ * How long teardown may take before the session is abandoned. Short, because
+ * the caller is usually someone who just pressed Ctrl-C.
+ */
+const SESSION_DESTROY_TIMEOUT_MS = 5_000;
+/**
+ * How long winding down a previous unfinished turn may take before it is cut
+ * off and the question refused.
+ */
+const TURN_DRAIN_TIMEOUT_MS = 30_000;
+/**
+ * The previous turn could not be wound down, so this session cannot take
+ * another prompt. Raised rather than pressed on with: the harness would either
+ * refuse the prompt itself or run it alongside the turn we failed to finish.
+ *
+ * The caller's recovery is to replace the session — nothing about a wedged
+ * runtime gets better by asking it again.
+ */
+export class HarnessTurnStuck extends Error {
+    constructor() {
+        super("The previous turn could not be wound down, so this coding session cannot take another question.");
+        this.name = "HarnessTurnStuck";
+    }
+}
+/**
+ * Fail a turn that has gone silent with no tool running, instead of hanging.
+ *
+ * `@ai-sdk/harness` surfaces one approval per stream and ends the stream
+ * there, so a step that asks to run two tools at once loses the second
+ * request: Claude Code keeps waiting for a decision that is never offered,
+ * while we keep waiting for output that never comes. Both sides wait forever.
+ * `LOCAL_WORKING_COPY_INSTRUCTIONS` asks for one confirmable tool per step to
+ * avoid it; this is the backstop for when the model does it anyway.
+ *
+ * The timer is armed only while no tool is in flight — a ten-minute test run
+ * is silent too, and must not be cut off.
+ */
+async function* withStallTimeout(stream, timeoutMs, isToolInFlight) {
+    if (Number.isFinite(timeoutMs) === false) {
+        for await (const part of stream) {
+            yield part;
+        }
+        return;
+    }
+    const iterator = stream[Symbol.asyncIterator]();
+    for (;;) {
+        const next = iterator.next();
+        const result = await (isToolInFlight() === true
+            ? next
+            : rejectIfIdle(next, timeoutMs));
+        if (result.done === true) {
+            return;
+        }
+        yield result.value;
+    }
+}
+/**
+ * Wait for `work`, but give up after `timeoutMs` rather than blocking a
+ * teardown forever. Resolves either way; the caller has already decided that
+ * an unfinished result is better than waiting.
+ *
+ * Exported for tests.
+ */
+export async function settleWithin(work, timeoutMs) {
+    let timer;
+    try {
+        await Promise.race([
+            work,
+            new Promise((resolve) => {
+                timer = setTimeout(resolve, timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+        }
+    }
+}
+async function rejectIfIdle(next, timeoutMs) {
+    let timer;
+    try {
+        return await Promise.race([
+            next,
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => {
+                    reject(new Error(`Local Claude Code went quiet for ${String(Math.round(timeoutMs / 1000))}s with no tool running. A single step that asks to run several tools needing confirmation ends up here: only the first can be answered, and the rest leave the turn waiting. Ask again, or in smaller steps.`));
+                }, timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+        }
+        // On a stall we walk away from `next`; a later failure has no other
+        // handler and would come back as an unhandled rejection.
+        next.catch(() => undefined);
+    }
+}
+/**
+ * Claude Code's own bookkeeping. `allow-reads` classifies these as edits
+ * because they call a write-shaped tool, but they touch nothing outside the
+ * session — prompting for a todo-list update is noise, and Claude Code
+ * rewrites its list on every step of any multi-step task.
+ */
+const AUTO_APPROVED_TOOL_NAMES = new Set([
+    "TodoWrite",
+    "EnterPlanMode",
+    "ExitPlanMode",
+    "TaskCreate",
+    "TaskUpdate",
+    "TaskStop",
+    "AskUserQuestion",
+]);
+/**
+ * Cargo's MCP tools run unattended, `execute_action` included: a turn can
+ * spend credits and write to a connected system on its own. That is the
+ * deliberate trade for a chat that answers without being nursed, and it is
+ * defensible only because this server reaches the workspace with the user's
+ * own credentials — it can do nothing they could not do from the CLI.
+ *
+ * Only this server's tools. Claude Code names them `mcp__<server>__<tool>`,
+ * and matching the bare `mcp__` was safe only while Ask owned the config
+ * directory: `CLAUDE_CONFIG_DIR` reinstates the user's own MCP servers, whose
+ * tools write and shell out with none of the above reasoning behind them.
+ * Those go through approval like anything else that touches the machine.
+ *
+ * Built from the mount key so renaming the server cannot silently widen this.
+ */
+const CARGO_MCP_TOOL_PREFIX = `mcp__${CARGO_MCP_SERVER_NAME}__`;
+/** Exported for tests. */
+export function isAutoApproved(toolName) {
+    if (toolName.startsWith(CARGO_MCP_TOOL_PREFIX) === true) {
+        return true;
+    }
+    return AUTO_APPROVED_TOOL_NAMES.has(toolName);
+}
+/**
+ * `Agent` spawns a subagent to run a task of its own. It does reach the
+ * approval prompt — the bridge defaults an unlisted tool to `edit`, which
+ * `allow-reads` asks about — but approving it is a different kind of decision
+ * from approving a `Bash`: the subagent runs its own tools, can be asked for
+ * with `mode: "bypassPermissions"`, and whether its calls come back here for
+ * individual approval is not something we control or currently know.
+ *
+ * Until that is established, refuse it. A prompt that cannot describe what it
+ * is granting is worse than not offering the capability, and nothing in the
+ * adapter settings or the harness's `inactiveTools` can withhold this tool at
+ * source — the approval is the only lever there is.
+ */
+const DENIED_TOOL_NAMES = new Set(["Agent"]);
+const DENIED_TOOL_REASON = "Spawning a subagent is not available in this session. Do the work in this turn instead, asking for each tool you need.";
+/** Exported for tests. */
+export function isAlwaysDenied(toolName) {
+    return DENIED_TOOL_NAMES.has(toolName);
+}
+/** Tool inputs that name a file the turn is about to change. */
+const FILE_WRITING_TOOLS = new Set([
+    "write",
+    "edit",
+    "Write",
+    "Edit",
+    "NotebookEdit",
+]);
+/**
+ * Drain one turn: text deltas go to the caller, tool calls are remembered so
+ * an approval request can be matched back to its call, and pending approvals
+ * are returned so the caller can decide and continue the turn.
+ */
+async function consumeTurn(input) {
+    const approvals = [];
+    const { handlers } = input;
+    const pendingFiles = new Map();
+    const parts = withStallTimeout(input.stream.fullStream, input.stallTimeoutMs, () => input.turnState.inFlightToolCallIds.size > 0);
+    for await (const rawPart of parts) {
+        if (typeof rawPart !== "object" || rawPart === null) {
+            continue;
+        }
+        const part = rawPart;
+        if (part["type"] === "error") {
+            const error = part["error"];
+            throw new Error(error instanceof Error
+                ? error.message
+                : typeof error === "string"
+                    ? error
+                    : "Local Claude Code turn failed.");
+        }
+        if (part["type"] === "tool-call") {
+            const toolCallId = part["toolCallId"];
+            const toolName = part["toolName"];
+            if (typeof toolCallId === "string" && typeof toolName === "string") {
+                input.toolCalls.set(toolCallId, {
+                    toolName,
+                    input: part["input"],
+                });
+                input.turnState.toolRanSinceText = true;
+                input.turnState.inFlightToolCallIds.add(toolCallId);
+                if (handlers.onActivity !== undefined) {
+                    handlers.onActivity({
+                        kind: "start",
+                        toolName,
+                        summary: summarizeToolInput(part["input"]),
+                    });
+                }
+                const touched = FILE_WRITING_TOOLS.has(toolName) === true
+                    ? readFilePath(part["input"])
+                    : undefined;
+                // Held until the result says the write happened: a denied or failed
+                // edit must not show up under "files changed".
+                if (touched !== undefined) {
+                    pendingFiles.set(toolCallId, touched);
+                }
+            }
+            continue;
+        }
+        if (part["type"] === "tool-result" || part["type"] === "tool-error") {
+            const toolCallId = part["toolCallId"];
+            const recorded = typeof toolCallId === "string"
+                ? input.toolCalls.get(toolCallId)
+                : undefined;
+            const isError = part["type"] === "tool-error";
+            if (handlers.onActivity !== undefined) {
+                handlers.onActivity({
+                    kind: "end",
+                    toolName: recorded === undefined ? "tool" : recorded.toolName,
+                    isError,
+                });
+            }
+            if (typeof toolCallId === "string") {
+                // A preliminary result is progress from a tool that is still running,
+                // so it must not tell the stall watchdog the tool is done.
+                if (part["preliminary"] !== true) {
+                    input.turnState.inFlightToolCallIds.delete(toolCallId);
+                }
+                const touched = pendingFiles.get(toolCallId);
+                pendingFiles.delete(toolCallId);
+                if (touched !== undefined &&
+                    isError === false &&
+                    handlers.onFileTouched !== undefined) {
+                    handlers.onFileTouched(touched);
+                }
+            }
+            continue;
+        }
+        if (part["type"] === "finish") {
+            // One suspended turn is several streams, each ending with its own
+            // `finish` and its own totals — sum them. Per-step parts are ignored
+            // so the same tokens are not counted twice.
+            addTurnUsage(input.usage, part);
+            continue;
+        }
+        if (part["type"] === "tool-approval-request") {
+            const approval = readApprovalRequest(part, input.toolCalls);
+            if (approval !== undefined) {
+                approvals.push(approval);
+            }
+            continue;
+        }
+        if (part["type"] === "text-delta") {
+            const text = typeof part["text"] === "string"
+                ? part["text"]
+                : typeof part["delta"] === "string"
+                    ? part["delta"]
+                    : undefined;
+            if (text === undefined || text.length === 0) {
+                continue;
+            }
+            // Claude Code narrates, runs tools, then narrates again. Without a
+            // break the two sides of a tool call run into one another mid-sentence.
+            const previous = input.assistantChunks.join("");
+            if (input.turnState.toolRanSinceText === true &&
+                previous.length > 0 &&
+                previous.endsWith("\n") === false) {
+                input.assistantChunks.push("\n\n");
+                if (handlers.onTextDelta !== undefined) {
+                    handlers.onTextDelta("\n\n");
+                }
+            }
+            input.turnState.toolRanSinceText = false;
+            input.assistantChunks.push(text);
+            if (handlers.onTextDelta !== undefined) {
+                handlers.onTextDelta(text);
+            }
+        }
+    }
+    return approvals;
+}
+/**
+ * Add one stream's `finish` totals to the turn. `totalUsage` is the AI SDK
+ * shape; `costUsd` is what Claude Code reports for the same stream under
+ * `harnessMetadata`, and is what the API prices into credits.
+ */
+function addTurnUsage(usage, part) {
+    const costUsd = readClaudeCodeCostUsd(part);
+    if (costUsd !== undefined) {
+        usage.costUsd += costUsd;
+    }
+    const totalUsage = part["totalUsage"];
+    if (typeof totalUsage !== "object" || totalUsage === null) {
+        return;
+    }
+    const totals = totalUsage;
+    usage.totalTokens += readCount(totals["totalTokens"]);
+    usage.inputTokens += readCount(totals["inputTokens"]);
+    usage.outputTokens += readCount(totals["outputTokens"]);
+    const inputDetails = totals["inputTokenDetails"];
+    if (typeof inputDetails === "object" && inputDetails !== null) {
+        const details = inputDetails;
+        usage.cacheReadTokens += readCount(details["cacheReadTokens"]);
+        usage.cacheWriteTokens += readCount(details["cacheWriteTokens"]);
+    }
+    const outputDetails = totals["outputTokenDetails"];
+    if (typeof outputDetails === "object" && outputDetails !== null) {
+        const details = outputDetails;
+        usage.reasoningTokens += readCount(details["reasoningTokens"]);
+    }
+}
+function readCount(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0
+        ? value
+        : 0;
+}
+function readClaudeCodeCostUsd(part) {
+    const harnessMetadata = part["harnessMetadata"];
+    if (typeof harnessMetadata !== "object" || harnessMetadata === null) {
+        return undefined;
+    }
+    const claudeCode = harnessMetadata["claude-code"];
+    if (typeof claudeCode !== "object" || claudeCode === null) {
+        return undefined;
+    }
+    const costUsd = claudeCode["costUsd"];
+    return typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd > 0
+        ? costUsd
+        : undefined;
+}
+/**
+ * The AI SDK part nests the whole `toolCall`; the harness bridge part carries
+ * only `toolCallId`. Accept both and fall back to the recorded call.
+ */
+function readApprovalRequest(part, toolCalls) {
+    const approvalId = part["approvalId"];
+    if (typeof approvalId !== "string") {
+        return undefined;
+    }
+    const nested = part["toolCall"];
+    const toolCall = typeof nested === "object" && nested !== null
+        ? nested
+        : undefined;
+    const toolCallId = toolCall !== undefined && typeof toolCall["toolCallId"] === "string"
+        ? toolCall["toolCallId"]
+        : typeof part["toolCallId"] === "string"
+            ? part["toolCallId"]
+            : undefined;
+    if (toolCallId === undefined) {
+        return undefined;
+    }
+    const recorded = toolCalls.get(toolCallId);
+    const toolName = toolCall !== undefined && typeof toolCall["toolName"] === "string"
+        ? toolCall["toolName"]
+        : recorded !== undefined
+            ? recorded.toolName
+            : "tool";
+    const toolInput = toolCall !== undefined && "input" in toolCall
+        ? toolCall["input"]
+        : recorded !== undefined
+            ? recorded.input
+            : undefined;
+    return {
+        approvalId,
+        toolCallId,
+        toolName,
+        summary: summarizeToolInput(toolInput),
+        input: toolInput,
+    };
+}
+/** Fields worth showing first when asking to run a tool. */
+const TOOL_INPUT_PREVIEW_KEYS = [
+    "command",
+    "file_path",
+    "path",
+    "pattern",
+    "url",
+];
+const TOOL_SUMMARY_MAX_LENGTH = 160;
+/**
+ * The bridge sends tool input as a JSON string, while the AI SDK part carries
+ * the parsed object. Normalize to a record when the shape allows it.
+ */
+function readToolInputRecord(toolInput) {
+    if (typeof toolInput === "string") {
+        try {
+            const parsed = JSON.parse(toolInput);
+            return typeof parsed === "object" && parsed !== null
+                ? parsed
+                : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return typeof toolInput === "object" && toolInput !== null
+        ? toolInput
+        : undefined;
+}
+function readFilePath(toolInput) {
+    const record = readToolInputRecord(toolInput);
+    if (record === undefined) {
+        return undefined;
+    }
+    const filePath = record["file_path"];
+    return typeof filePath === "string" && filePath.length > 0
+        ? filePath
+        : undefined;
+}
+function summarizeToolInput(toolInput) {
+    const record = readToolInputRecord(toolInput);
+    if (record === undefined) {
+        return typeof toolInput === "string" ? truncate(toolInput) : "";
+    }
+    for (const key of TOOL_INPUT_PREVIEW_KEYS) {
+        const value = record[key];
+        if (typeof value === "string" && value.length > 0) {
+            return truncate(value);
+        }
+    }
+    return truncate(JSON.stringify(record));
+}
+function truncate(value) {
+    const flat = value.replace(/\s+/g, " ").trim();
+    return flat.length > TOOL_SUMMARY_MAX_LENGTH
+        ? `${flat.slice(0, TOOL_SUMMARY_MAX_LENGTH - 1)}…`
+        : flat;
+}
+async function withMutedCredentialBrokerWarning(run) {
+    const originalWarn = console.warn;
+    console.warn = (...args) => {
+        const first = args[0];
+        if (typeof first === "string" &&
+            first.includes("credential brokering does not work")) {
+            return;
+        }
+        originalWarn.apply(console, args);
+    };
+    try {
+        return await run();
+    }
+    finally {
+        console.warn = originalWarn;
+    }
+}