@clanker-cleanroom/claude 0.2.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Eric Siebeneich
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,40 @@
+# @clanker-cleanroom/claude
+
+Claude Code binding and Docker image for [`clanker-cleanroom`](../clanker-cleanroom).
+
+## Install
+
+```bash
+pnpm add -D clanker-cleanroom @clanker-cleanroom/claude
+```
+
+## Usage
+
+```ts
+import "@clanker-cleanroom/claude/register";
+import { Agent, buildImages } from "clanker-cleanroom";
+import { DOCKER_DIR as claudeDocker, claudeAgent } from "@clanker-cleanroom/claude";
+
+await buildImages();
+await buildImages({ dir: claudeDocker });
+
+await new Agent("claude").run({ workspace, prompt, model: "sonnet" });
+// or without registration:
+await claudeAgent.run({ workspace, prompt, model: "sonnet" });
+```
+
+## Prerequisites
+
+Set `CLAUDE_CODE_OAUTH_TOKEN` (from `claude setup-token`) **or** `ANTHROPIC_API_KEY` **or** provide a Linux host's `~/.claude/.credentials.json` (checked in that order). macOS keeps Claude login in the Keychain — set a token or API key on a Mac.
+
+## Exports
+
+| Export | Role |
+| --- | --- |
+| `claudeBinding` | Command, prepare, parseResult, adaptEvents |
+| `claudeAgent` | `Agent.fromBinding(claudeBinding)` |
+| `resolveClaudeCredentials` / `credentialsEnv` | Host credential resolution |
+| `CLAUDE_IMAGE` / credential env constants | Image tag and env names |
+| `adaptClaudeEvents` | Trajectory adapter |
+| `DOCKER_DIR` / `PACKAGE_ROOT` | Dockerfile folder for `buildImages({ dir })` |
+| `@clanker-cleanroom/claude/register` | Side-effect: `registerBinding("claude", claudeBinding)` |

package/docker/claude.Dockerfile

@@ -0,0 +1,32 @@
+# clanker-cleanroom/claude
+FROM clanker-cleanroom/base
+
+# Never self-update or phone home from inside the container — build steps included.
+ENV DISABLE_AUTOUPDATER=1
+ENV DISABLE_TELEMETRY=1
+ENV DISABLE_ERROR_REPORTING=1
+
+# Official native installer drops a single self-contained binary under
+# ~/.local/share/claude/versions/<version>. Relocate it to a world-readable
+# path so arbitrary host UIDs (docker --user) can run claude.
+RUN curl -fsSL https://claude.ai/install.sh | bash \
+  && VERSION_BIN="$(find /root/.local/share/claude/versions -mindepth 1 -maxdepth 1 -type f | sort -V | tail -1)" \
+  && test -n "$VERSION_BIN" \
+  && install -m 0755 "$VERSION_BIN" /usr/local/bin/claude \
+  && rm -rf /root/.local/share/claude /root/.local/bin/claude \
+  && claude --version
+
+# Empty home for arbitrary host UIDs. ~/.claude is pre-created so a read-only
+# .credentials.json bind mount does not leave the directory root-owned.
+RUN mkdir -p /home/agent/.claude \
+  && chmod -R 0777 /home/agent
+
+ENV HOME=/home/agent
+ENV PATH="/usr/local/bin:${PATH}"
+
+WORKDIR /workspace
+
+# Runtime identity is set via --user <host-uid>:<host-gid>.
+# Credentials arrive as env (CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_API_KEY) or a
+# read-only ~/.claude/.credentials.json mount.
+# No ENTRYPOINT — the library passes `claude ...` as the container command.

package/lib/binding-C2kSQy-B.cjs

@@ -0,0 +1,279 @@
+let clanker_cleanroom = require("clanker-cleanroom");
+let node_fs_promises = require("node:fs/promises");
+let node_fs = require("node:fs");
+let node_os = require("node:os");
+//#region src/constants.ts
+const CLAUDE_IMAGE = "clanker-cleanroom/claude";
+const CLAUDE_CONTAINER_CREDENTIALS_PATH = `${clanker_cleanroom.CONTAINER_HOME}/.claude/.credentials.json`;
+/** Long-lived OAuth token from `claude setup-token` (Claude subscription). */
+const CLAUDE_OAUTH_TOKEN_ENV = "CLAUDE_CODE_OAUTH_TOKEN";
+/** Anthropic API key (pay-as-you-go). */
+const CLAUDE_API_KEY_ENV = "ANTHROPIC_API_KEY";
+/** Linux hosts persist OAuth credentials here; macOS uses the Keychain instead. */
+const defaultClaudeHostCredentialsFile = (home) => `${home}/.claude/.credentials.json`;
+//#endregion
+//#region src/credentials.ts
+/** Env OAuth token, then env API key, then a readable host credentials file. */
+async function resolveClaudeCredentials(options = {}) {
+	const env = options.env ?? process.env;
+	const home = options.home ?? (0, node_os.homedir)();
+	const token = env[CLAUDE_OAUTH_TOKEN_ENV];
+	if (token !== void 0 && token !== "") return {
+		kind: "oauth-token",
+		token
+	};
+	const apiKey = env[CLAUDE_API_KEY_ENV];
+	if (apiKey !== void 0 && apiKey !== "") return {
+		kind: "api-key",
+		apiKey
+	};
+	const file = defaultClaudeHostCredentialsFile(home);
+	try {
+		await (0, node_fs_promises.access)(file, node_fs.constants.R_OK);
+	} catch {
+		throw new Error(`Claude Code credentials not found. Set ${CLAUDE_OAUTH_TOKEN_ENV} (run \`claude setup-token\` on the host) or ${CLAUDE_API_KEY_ENV}, or provide ${file} (Linux hosts; macOS keeps credentials in the Keychain).`);
+	}
+	return {
+		kind: "credentials-file",
+		file
+	};
+}
+/** Secret values for the docker CLI process, keyed by env names forwarded via envPassthrough. */
+function credentialsEnv(credentials) {
+	switch (credentials.kind) {
+		case "oauth-token": return { [CLAUDE_OAUTH_TOKEN_ENV]: credentials.token };
+		case "api-key": return { [CLAUDE_API_KEY_ENV]: credentials.apiKey };
+		case "credentials-file": return {};
+	}
+}
+//#endregion
+//#region src/trajectory.ts
+function adaptClaudeEvents(rawEvents) {
+	const events = [];
+	for (const raw of rawEvents) {
+		const record = (0, clanker_cleanroom.asRecord)(raw);
+		if (record === void 0) {
+			events.push({
+				kind: "other",
+				type: "unknown",
+				raw
+			});
+			continue;
+		}
+		const type = (0, clanker_cleanroom.readString)(record.type) ?? "unknown";
+		switch (type) {
+			case "system":
+				events.push({
+					kind: "system",
+					sessionId: (0, clanker_cleanroom.readString)(record.session_id),
+					model: (0, clanker_cleanroom.readString)(record.model),
+					raw
+				});
+				break;
+			case "user":
+				events.push(...adaptClaudeUser(record, raw));
+				break;
+			case "assistant":
+				events.push(...adaptClaudeAssistant(record, raw));
+				break;
+			case "result":
+				events.push({
+					kind: "result",
+					text: (0, clanker_cleanroom.readString)(record.result) ?? "",
+					isError: record.is_error === true,
+					durationMs: (0, clanker_cleanroom.readTokenCount)(record.duration_ms),
+					costUsd: (0, clanker_cleanroom.readTokenCount)(record.total_cost_usd),
+					raw
+				});
+				break;
+			default: events.push({
+				kind: "other",
+				type,
+				raw
+			});
+		}
+	}
+	return events;
+}
+function adaptClaudeAssistant(record, raw) {
+	const events = [];
+	const text = (0, clanker_cleanroom.extractTextContent)(record.message);
+	if (text !== "") events.push({
+		kind: "assistant",
+		text,
+		raw
+	});
+	for (const block of contentBlocks(record.message)) {
+		if (block.type !== "tool_use") continue;
+		events.push({
+			kind: "tool",
+			phase: "started",
+			callId: (0, clanker_cleanroom.readString)(block.id) ?? "",
+			name: (0, clanker_cleanroom.readString)(block.name) ?? "unknown",
+			args: block.input ?? null,
+			result: null,
+			raw
+		});
+	}
+	if (events.length === 0) events.push({
+		kind: "assistant",
+		text: "",
+		raw
+	});
+	return events;
+}
+function adaptClaudeUser(record, raw) {
+	const events = [];
+	const text = (0, clanker_cleanroom.extractTextContent)(record.message);
+	const toolResults = [];
+	for (const block of contentBlocks(record.message)) {
+		if (block.type !== "tool_result") continue;
+		toolResults.push({
+			kind: "tool",
+			phase: "completed",
+			callId: (0, clanker_cleanroom.readString)(block.tool_use_id) ?? "",
+			name: "tool_result",
+			args: null,
+			result: block.content ?? null,
+			raw
+		});
+	}
+	if (text !== "" || toolResults.length === 0) events.push({
+		kind: "user",
+		text,
+		raw
+	});
+	events.push(...toolResults);
+	return events;
+}
+function contentBlocks(message) {
+	const content = (0, clanker_cleanroom.asRecord)(message)?.content;
+	if (!Array.isArray(content)) return [];
+	return content.map((block) => (0, clanker_cleanroom.asRecord)(block)).filter((block) => block !== void 0);
+}
+//#endregion
+//#region src/binding.ts
+const claudeBinding = {
+	image: CLAUDE_IMAGE,
+	displayName: "Claude",
+	trajectoryKind: "claude",
+	adaptEvents: adaptClaudeEvents,
+	command: ({ prompt, model }) => {
+		const claudeArgs = [
+			"claude",
+			"-p",
+			"--output-format",
+			"stream-json",
+			"--verbose",
+			"--dangerously-skip-permissions"
+		];
+		if (model !== void 0 && model !== "") claudeArgs.push("--model", model);
+		claudeArgs.push("--", prompt);
+		return claudeArgs;
+	},
+	prepare: async () => {
+		const credentials = await resolveClaudeCredentials();
+		const volumes = [];
+		if (credentials.kind === "credentials-file") volumes.push({
+			host: credentials.file,
+			container: CLAUDE_CONTAINER_CREDENTIALS_PATH,
+			mode: "ro"
+		});
+		return {
+			volumes,
+			env: credentialsEnv(credentials)
+		};
+	},
+	parseResult: parseClaudeResult,
+	describeFailure: describeClaudeFailure
+};
+function parseClaudeResult(trajectory) {
+	const parsed = (0, clanker_cleanroom.parseAgentJsonOutput)(trajectory);
+	if (isErrorResult(parsed)) throw new Error(`Claude agent reported an error: ${describeErrorResult(parsed)}`);
+	const record = (0, clanker_cleanroom.asRecord)(parsed);
+	const usage = (0, clanker_cleanroom.asRecord)(record?.usage);
+	return {
+		durationMs: (0, clanker_cleanroom.readTokenCount)(record?.duration_ms),
+		costUsd: (0, clanker_cleanroom.readTokenCount)(record?.total_cost_usd),
+		usage: {
+			inputTokens: (0, clanker_cleanroom.readTokenCount)(usage?.input_tokens ?? usage?.inputTokens),
+			outputTokens: (0, clanker_cleanroom.readTokenCount)(usage?.output_tokens ?? usage?.outputTokens),
+			cacheReadTokens: (0, clanker_cleanroom.readTokenCount)(usage?.cache_read_input_tokens ?? usage?.cacheReadTokens),
+			cacheWriteTokens: (0, clanker_cleanroom.readTokenCount)(usage?.cache_creation_input_tokens ?? usage?.cacheWriteTokens)
+		}
+	};
+}
+function describeClaudeFailure(trajectory) {
+	try {
+		const parsed = (0, clanker_cleanroom.parseAgentJsonOutput)(trajectory);
+		return isErrorResult(parsed) ? describeErrorResult(parsed) : void 0;
+	} catch {
+		return;
+	}
+}
+function isErrorResult(value) {
+	return typeof value === "object" && value !== null && value.is_error === true;
+}
+function describeErrorResult(result) {
+	const message = String(result.result);
+	if (result.terminal_reason !== void 0 && result.terminal_reason !== "completed") return `${result.terminal_reason}: ${message}`;
+	if (result.subtype !== void 0 && result.subtype !== "success") return `${result.subtype}: ${message}`;
+	return message;
+}
+//#endregion
+Object.defineProperty(exports, "CLAUDE_API_KEY_ENV", {
+	enumerable: true,
+	get: function() {
+		return CLAUDE_API_KEY_ENV;
+	}
+});
+Object.defineProperty(exports, "CLAUDE_CONTAINER_CREDENTIALS_PATH", {
+	enumerable: true,
+	get: function() {
+		return CLAUDE_CONTAINER_CREDENTIALS_PATH;
+	}
+});
+Object.defineProperty(exports, "CLAUDE_IMAGE", {
+	enumerable: true,
+	get: function() {
+		return CLAUDE_IMAGE;
+	}
+});
+Object.defineProperty(exports, "CLAUDE_OAUTH_TOKEN_ENV", {
+	enumerable: true,
+	get: function() {
+		return CLAUDE_OAUTH_TOKEN_ENV;
+	}
+});
+Object.defineProperty(exports, "adaptClaudeEvents", {
+	enumerable: true,
+	get: function() {
+		return adaptClaudeEvents;
+	}
+});
+Object.defineProperty(exports, "claudeBinding", {
+	enumerable: true,
+	get: function() {
+		return claudeBinding;
+	}
+});
+Object.defineProperty(exports, "credentialsEnv", {
+	enumerable: true,
+	get: function() {
+		return credentialsEnv;
+	}
+});
+Object.defineProperty(exports, "defaultClaudeHostCredentialsFile", {
+	enumerable: true,
+	get: function() {
+		return defaultClaudeHostCredentialsFile;
+	}
+});
+Object.defineProperty(exports, "resolveClaudeCredentials", {
+	enumerable: true,
+	get: function() {
+		return resolveClaudeCredentials;
+	}
+});
+
+//# sourceMappingURL=binding-C2kSQy-B.cjs.map

package/lib/binding-C2kSQy-B.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-C2kSQy-B.cjs","names":["CONTAINER_HOME","homedir","access","fsConstants","asRecord","readString","readTokenCount","extractTextContent","parseAgentJsonOutput","asRecord","readTokenCount"],"sources":["../src/constants.ts","../src/credentials.ts","../src/trajectory.ts","../src/binding.ts"],"sourcesContent":["import { CONTAINER_HOME } from \"clanker-cleanroom\";\n\nexport const CLAUDE_IMAGE = \"clanker-cleanroom/claude\";\nexport const CLAUDE_CONTAINER_CREDENTIALS_PATH = `${CONTAINER_HOME}/.claude/.credentials.json`;\n\n/** Long-lived OAuth token from `claude setup-token` (Claude subscription). */\nexport const CLAUDE_OAUTH_TOKEN_ENV = \"CLAUDE_CODE_OAUTH_TOKEN\";\n/** Anthropic API key (pay-as-you-go). */\nexport const CLAUDE_API_KEY_ENV = \"ANTHROPIC_API_KEY\";\n\n/** Linux hosts persist OAuth credentials here; macOS uses the Keychain instead. */\nexport const defaultClaudeHostCredentialsFile = (home: string): string =>\n  `${home}/.claude/.credentials.json`;\n","import { access } from \"node:fs/promises\";\nimport { constants as fsConstants } from \"node:fs\";\nimport { homedir } from \"node:os\";\n\nimport {\n  CLAUDE_API_KEY_ENV,\n  CLAUDE_OAUTH_TOKEN_ENV,\n  defaultClaudeHostCredentialsFile,\n} from \"./constants.js\";\n\n/**\n * How Claude Code authenticates inside the container. Env-backed kinds are forwarded\n * to `docker run` by name (never on argv); the file kind is bind-mounted read-only.\n * See `constants.ts` for which host setups produce each.\n */\nexport type ClaudeCredentials =\n  | { kind: \"oauth-token\"; token: string }\n  | { kind: \"api-key\"; apiKey: string }\n  | { kind: \"credentials-file\"; file: string };\n\n/** Env OAuth token, then env API key, then a readable host credentials file. */\nexport async function resolveClaudeCredentials(\n  options: { env?: NodeJS.ProcessEnv; home?: string } = {},\n): Promise<ClaudeCredentials> {\n  const env = options.env ?? process.env;\n  const home = options.home ?? homedir();\n\n  const token = env[CLAUDE_OAUTH_TOKEN_ENV];\n  if (token !== undefined && token !== \"\") {\n    return { kind: \"oauth-token\", token };\n  }\n\n  const apiKey = env[CLAUDE_API_KEY_ENV];\n  if (apiKey !== undefined && apiKey !== \"\") {\n    return { kind: \"api-key\", apiKey };\n  }\n\n  const file = defaultClaudeHostCredentialsFile(home);\n  try {\n    await access(file, fsConstants.R_OK);\n  } catch {\n    throw new Error(\n      `Claude Code credentials not found. Set ${CLAUDE_OAUTH_TOKEN_ENV} (run \\`claude setup-token\\` on the host) ` +\n        `or ${CLAUDE_API_KEY_ENV}, or provide ${file} (Linux hosts; macOS keeps credentials in the Keychain).`,\n    );\n  }\n\n  return { kind: \"credentials-file\", file };\n}\n\n/** Secret values for the docker CLI process, keyed by env names forwarded via envPassthrough. */\nexport function credentialsEnv(credentials: ClaudeCredentials): Record<string, string> {\n  switch (credentials.kind) {\n    case \"oauth-token\":\n      return { [CLAUDE_OAUTH_TOKEN_ENV]: credentials.token };\n    case \"api-key\":\n      return { [CLAUDE_API_KEY_ENV]: credentials.apiKey };\n    case \"credentials-file\":\n      return {};\n  }\n}\n","import {\n  asRecord,\n  extractTextContent,\n  readString,\n  readTokenCount,\n  type TrajectoryEvent,\n} from \"clanker-cleanroom\";\n\nexport function adaptClaudeEvents(rawEvents: readonly unknown[]): TrajectoryEvent[] {\n  const events: TrajectoryEvent[] = [];\n\n  for (const raw of rawEvents) {\n    const record = asRecord(raw);\n    if (record === undefined) {\n      events.push({ kind: \"other\", type: \"unknown\", raw });\n      continue;\n    }\n\n    const type = readString(record.type) ?? \"unknown\";\n\n    switch (type) {\n      case \"system\":\n        events.push({\n          kind: \"system\",\n          sessionId: readString(record.session_id),\n          model: readString(record.model),\n          raw,\n        });\n        break;\n      case \"user\":\n        events.push(...adaptClaudeUser(record, raw));\n        break;\n      case \"assistant\":\n        events.push(...adaptClaudeAssistant(record, raw));\n        break;\n      case \"result\":\n        events.push({\n          kind: \"result\",\n          text: readString(record.result) ?? \"\",\n          isError: record.is_error === true,\n          durationMs: readTokenCount(record.duration_ms),\n          costUsd: readTokenCount(record.total_cost_usd),\n          raw,\n        });\n        break;\n      default:\n        events.push({ kind: \"other\", type, raw });\n    }\n  }\n\n  return events;\n}\n\nfunction adaptClaudeAssistant(\n  record: Record<string, unknown>,\n  raw: unknown,\n): TrajectoryEvent[] {\n  const events: TrajectoryEvent[] = [];\n  const text = extractTextContent(record.message);\n  if (text !== \"\") {\n    events.push({ kind: \"assistant\", text, raw });\n  }\n\n  for (const block of contentBlocks(record.message)) {\n    if (block.type !== \"tool_use\") {\n      continue;\n    }\n    events.push({\n      kind: \"tool\",\n      phase: \"started\",\n      callId: readString(block.id) ?? \"\",\n      name: readString(block.name) ?? \"unknown\",\n      args: block.input ?? null,\n      result: null,\n      raw,\n    });\n  }\n\n  if (events.length === 0) {\n    events.push({ kind: \"assistant\", text: \"\", raw });\n  }\n\n  return events;\n}\n\nfunction adaptClaudeUser(record: Record<string, unknown>, raw: unknown): TrajectoryEvent[] {\n  const events: TrajectoryEvent[] = [];\n  const text = extractTextContent(record.message);\n  const toolResults: TrajectoryEvent[] = [];\n\n  for (const block of contentBlocks(record.message)) {\n    if (block.type !== \"tool_result\") {\n      continue;\n    }\n    toolResults.push({\n      kind: \"tool\",\n      phase: \"completed\",\n      callId: readString(block.tool_use_id) ?? \"\",\n      name: \"tool_result\",\n      args: null,\n      result: block.content ?? null,\n      raw,\n    });\n  }\n\n  if (text !== \"\" || toolResults.length === 0) {\n    events.push({ kind: \"user\", text, raw });\n  }\n  events.push(...toolResults);\n  return events;\n}\n\nfunction contentBlocks(message: unknown): Record<string, unknown>[] {\n  const content = asRecord(message)?.content;\n  if (!Array.isArray(content)) {\n    return [];\n  }\n  return content.map((block) => asRecord(block)).filter((block) => block !== undefined);\n}\n","import {\n  asRecord,\n  parseAgentJsonOutput,\n  readTokenCount,\n  type AgentBinding,\n  type AgentRunResult,\n  type DockerVolumeMount,\n} from \"clanker-cleanroom\";\n\nimport { CLAUDE_CONTAINER_CREDENTIALS_PATH, CLAUDE_IMAGE } from \"./constants.js\";\nimport { credentialsEnv, resolveClaudeCredentials } from \"./credentials.js\";\nimport { adaptClaudeEvents } from \"./trajectory.js\";\n\nexport const claudeBinding: AgentBinding = {\n  image: CLAUDE_IMAGE,\n  displayName: \"Claude\",\n  trajectoryKind: \"claude\",\n  adaptEvents: adaptClaudeEvents,\n  command: ({ prompt, model }) => {\n    const claudeArgs = [\n      \"claude\",\n      \"-p\",\n      \"--output-format\",\n      \"stream-json\",\n      \"--verbose\",\n      \"--dangerously-skip-permissions\",\n    ];\n    if (model !== undefined && model !== \"\") {\n      claudeArgs.push(\"--model\", model);\n    }\n    claudeArgs.push(\"--\", prompt);\n    return claudeArgs;\n  },\n  prepare: async () => {\n    const credentials = await resolveClaudeCredentials();\n    const volumes: DockerVolumeMount[] = [];\n    if (credentials.kind === \"credentials-file\") {\n      volumes.push({\n        host: credentials.file,\n        container: CLAUDE_CONTAINER_CREDENTIALS_PATH,\n        mode: \"ro\",\n      });\n    }\n    return {\n      volumes,\n      env: credentialsEnv(credentials),\n    };\n  },\n  parseResult: parseClaudeResult,\n  describeFailure: describeClaudeFailure,\n};\n\nfunction parseClaudeResult(trajectory: string): AgentRunResult {\n  const parsed = parseAgentJsonOutput(trajectory);\n  if (isErrorResult(parsed)) {\n    throw new Error(`Claude agent reported an error: ${describeErrorResult(parsed)}`);\n  }\n\n  const record = asRecord(parsed);\n  const usage = asRecord(record?.usage);\n\n  return {\n    durationMs: readTokenCount(record?.duration_ms),\n    costUsd: readTokenCount(record?.total_cost_usd),\n    usage: {\n      inputTokens: readTokenCount(usage?.input_tokens ?? usage?.inputTokens),\n      outputTokens: readTokenCount(usage?.output_tokens ?? usage?.outputTokens),\n      cacheReadTokens: readTokenCount(usage?.cache_read_input_tokens ?? usage?.cacheReadTokens),\n      cacheWriteTokens: readTokenCount(\n        usage?.cache_creation_input_tokens ?? usage?.cacheWriteTokens,\n      ),\n    },\n  };\n}\n\nfunction describeClaudeFailure(trajectory: string): string | undefined {\n  try {\n    const parsed = parseAgentJsonOutput(trajectory);\n    return isErrorResult(parsed) ? describeErrorResult(parsed) : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\ntype ClaudeErrorResult = {\n  is_error: true;\n  result: string;\n  subtype?: string;\n  terminal_reason?: string;\n};\n\nfunction isErrorResult(value: unknown): value is ClaudeErrorResult {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    (value as { is_error?: unknown }).is_error === true\n  );\n}\n\nfunction describeErrorResult(result: ClaudeErrorResult): string {\n  const message = String(result.result);\n\n  if (result.terminal_reason !== undefined && result.terminal_reason !== \"completed\") {\n    return `${result.terminal_reason}: ${message}`;\n  }\n\n  if (result.subtype !== undefined && result.subtype !== \"success\") {\n    return `${result.subtype}: ${message}`;\n  }\n\n  return message;\n}\n"],"mappings":";;;;;AAEA,MAAa,eAAe;AAC5B,MAAa,oCAAoC,GAAGA,kBAAAA,eAAe;;AAGnE,MAAa,yBAAyB;;AAEtC,MAAa,qBAAqB;;AAGlC,MAAa,oCAAoC,SAC/C,GAAG,KAAK;;;;ACSV,eAAsB,yBACpB,UAAsD,CAAC,GAC3B;CAC5B,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,OAAO,QAAQ,SAAA,GAAQC,QAAAA,QAAAA,CAAQ;CAErC,MAAM,QAAQ,IAAI;CAClB,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC,OAAO;EAAE,MAAM;EAAe;CAAM;CAGtC,MAAM,SAAS,IAAI;CACnB,IAAI,WAAW,KAAA,KAAa,WAAW,IACrC,OAAO;EAAE,MAAM;EAAW;CAAO;CAGnC,MAAM,OAAO,iCAAiC,IAAI;CAClD,IAAI;EACF,OAAA,GAAMC,iBAAAA,OAAAA,CAAO,MAAMC,QAAAA,UAAY,IAAI;CACrC,QAAQ;EACN,MAAM,IAAI,MACR,0CAA0C,uBAAuB,+CACzD,mBAAmB,eAAe,KAAK,yDACjD;CACF;CAEA,OAAO;EAAE,MAAM;EAAoB;CAAK;AAC1C;;AAGA,SAAgB,eAAe,aAAwD;CACrF,QAAQ,YAAY,MAApB;EACE,KAAK,eACH,OAAO,GAAG,yBAAyB,YAAY,MAAM;EACvD,KAAK,WACH,OAAO,GAAG,qBAAqB,YAAY,OAAO;EACpD,KAAK,oBACH,OAAO,CAAC;CACZ;AACF;;;ACpDA,SAAgB,kBAAkB,WAAkD;CAClF,MAAM,SAA4B,CAAC;CAEnC,KAAK,MAAM,OAAO,WAAW;EAC3B,MAAM,UAAA,GAASC,kBAAAA,SAAAA,CAAS,GAAG;EAC3B,IAAI,WAAW,KAAA,GAAW;GACxB,OAAO,KAAK;IAAE,MAAM;IAAS,MAAM;IAAW;GAAI,CAAC;GACnD;EACF;EAEA,MAAM,QAAA,GAAOC,kBAAAA,WAAAA,CAAW,OAAO,IAAI,KAAK;EAExC,QAAQ,MAAR;GACE,KAAK;IACH,OAAO,KAAK;KACV,MAAM;KACN,YAAA,GAAWA,kBAAAA,WAAAA,CAAW,OAAO,UAAU;KACvC,QAAA,GAAOA,kBAAAA,WAAAA,CAAW,OAAO,KAAK;KAC9B;IACF,CAAC;IACD;GACF,KAAK;IACH,OAAO,KAAK,GAAG,gBAAgB,QAAQ,GAAG,CAAC;IAC3C;GACF,KAAK;IACH,OAAO,KAAK,GAAG,qBAAqB,QAAQ,GAAG,CAAC;IAChD;GACF,KAAK;IACH,OAAO,KAAK;KACV,MAAM;KACN,OAAA,GAAMA,kBAAAA,WAAAA,CAAW,OAAO,MAAM,KAAK;KACnC,SAAS,OAAO,aAAa;KAC7B,aAAA,GAAYC,kBAAAA,eAAAA,CAAe,OAAO,WAAW;KAC7C,UAAA,GAASA,kBAAAA,eAAAA,CAAe,OAAO,cAAc;KAC7C;IACF,CAAC;IACD;GACF,SACE,OAAO,KAAK;IAAE,MAAM;IAAS;IAAM;GAAI,CAAC;EAC5C;CACF;CAEA,OAAO;AACT;AAEA,SAAS,qBACP,QACA,KACmB;CACnB,MAAM,SAA4B,CAAC;CACnC,MAAM,QAAA,GAAOC,kBAAAA,mBAAAA,CAAmB,OAAO,OAAO;CAC9C,IAAI,SAAS,IACX,OAAO,KAAK;EAAE,MAAM;EAAa;EAAM;CAAI,CAAC;CAG9C,KAAK,MAAM,SAAS,cAAc,OAAO,OAAO,GAAG;EACjD,IAAI,MAAM,SAAS,YACjB;EAEF,OAAO,KAAK;GACV,MAAM;GACN,OAAO;GACP,SAAA,GAAQF,kBAAAA,WAAAA,CAAW,MAAM,EAAE,KAAK;GAChC,OAAA,GAAMA,kBAAAA,WAAAA,CAAW,MAAM,IAAI,KAAK;GAChC,MAAM,MAAM,SAAS;GACrB,QAAQ;GACR;EACF,CAAC;CACH;CAEA,IAAI,OAAO,WAAW,GACpB,OAAO,KAAK;EAAE,MAAM;EAAa,MAAM;EAAI;CAAI,CAAC;CAGlD,OAAO;AACT;AAEA,SAAS,gBAAgB,QAAiC,KAAiC;CACzF,MAAM,SAA4B,CAAC;CACnC,MAAM,QAAA,GAAOE,kBAAAA,mBAAAA,CAAmB,OAAO,OAAO;CAC9C,MAAM,cAAiC,CAAC;CAExC,KAAK,MAAM,SAAS,cAAc,OAAO,OAAO,GAAG;EACjD,IAAI,MAAM,SAAS,eACjB;EAEF,YAAY,KAAK;GACf,MAAM;GACN,OAAO;GACP,SAAA,GAAQF,kBAAAA,WAAAA,CAAW,MAAM,WAAW,KAAK;GACzC,MAAM;GACN,MAAM;GACN,QAAQ,MAAM,WAAW;GACzB;EACF,CAAC;CACH;CAEA,IAAI,SAAS,MAAM,YAAY,WAAW,GACxC,OAAO,KAAK;EAAE,MAAM;EAAQ;EAAM;CAAI,CAAC;CAEzC,OAAO,KAAK,GAAG,WAAW;CAC1B,OAAO;AACT;AAEA,SAAS,cAAc,SAA6C;CAClE,MAAM,WAAA,GAAUD,kBAAAA,SAAAA,CAAS,OAAO,CAAC,EAAE;CACnC,IAAI,CAAC,MAAM,QAAQ,OAAO,GACxB,OAAO,CAAC;CAEV,OAAO,QAAQ,KAAK,WAAA,GAAUA,kBAAAA,SAAAA,CAAS,KAAK,CAAC,CAAC,CAAC,QAAQ,UAAU,UAAU,KAAA,CAAS;AACtF;;;ACzGA,MAAa,gBAA8B;CACzC,OAAO;CACP,aAAa;CACb,gBAAgB;CAChB,aAAa;CACb,UAAU,EAAE,QAAQ,YAAY;EAC9B,MAAM,aAAa;GACjB;GACA;GACA;GACA;GACA;GACA;EACF;EACA,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC,WAAW,KAAK,WAAW,KAAK;EAElC,WAAW,KAAK,MAAM,MAAM;EAC5B,OAAO;CACT;CACA,SAAS,YAAY;EACnB,MAAM,cAAc,MAAM,yBAAyB;EACnD,MAAM,UAA+B,CAAC;EACtC,IAAI,YAAY,SAAS,oBACvB,QAAQ,KAAK;GACX,MAAM,YAAY;GAClB,WAAW;GACX,MAAM;EACR,CAAC;EAEH,OAAO;GACL;GACA,KAAK,eAAe,WAAW;EACjC;CACF;CACA,aAAa;CACb,iBAAiB;AACnB;AAEA,SAAS,kBAAkB,YAAoC;CAC7D,MAAM,UAAA,GAASI,kBAAAA,qBAAAA,CAAqB,UAAU;CAC9C,IAAI,cAAc,MAAM,GACtB,MAAM,IAAI,MAAM,mCAAmC,oBAAoB,MAAM,GAAG;CAGlF,MAAM,UAAA,GAASC,kBAAAA,SAAAA,CAAS,MAAM;CAC9B,MAAM,SAAA,GAAQA,kBAAAA,SAAAA,CAAS,QAAQ,KAAK;CAEpC,OAAO;EACL,aAAA,GAAYC,kBAAAA,eAAAA,CAAe,QAAQ,WAAW;EAC9C,UAAA,GAASA,kBAAAA,eAAAA,CAAe,QAAQ,cAAc;EAC9C,OAAO;GACL,cAAA,GAAaA,kBAAAA,eAAAA,CAAe,OAAO,gBAAgB,OAAO,WAAW;GACrE,eAAA,GAAcA,kBAAAA,eAAAA,CAAe,OAAO,iBAAiB,OAAO,YAAY;GACxE,kBAAA,GAAiBA,kBAAAA,eAAAA,CAAe,OAAO,2BAA2B,OAAO,eAAe;GACxF,mBAAA,GAAkBA,kBAAAA,eAAAA,CAChB,OAAO,+BAA+B,OAAO,gBAC/C;EACF;CACF;AACF;AAEA,SAAS,sBAAsB,YAAwC;CACrE,IAAI;EACF,MAAM,UAAA,GAASF,kBAAAA,qBAAAA,CAAqB,UAAU;EAC9C,OAAO,cAAc,MAAM,IAAI,oBAAoB,MAAM,IAAI,KAAA;CAC/D,QAAQ;EACN;CACF;AACF;AASA,SAAS,cAAc,OAA4C;CACjE,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAAiC,aAAa;AAEnD;AAEA,SAAS,oBAAoB,QAAmC;CAC9D,MAAM,UAAU,OAAO,OAAO,MAAM;CAEpC,IAAI,OAAO,oBAAoB,KAAA,KAAa,OAAO,oBAAoB,aACrE,OAAO,GAAG,OAAO,gBAAgB,IAAI;CAGvC,IAAI,OAAO,YAAY,KAAA,KAAa,OAAO,YAAY,WACrD,OAAO,GAAG,OAAO,QAAQ,IAAI;CAG/B,OAAO;AACT"}

package/lib/binding-DAPBfelH.mjs

@@ -0,0 +1,226 @@
+import { CONTAINER_HOME, asRecord, extractTextContent, parseAgentJsonOutput, readString, readTokenCount } from "clanker-cleanroom";
+import { access } from "node:fs/promises";
+import { constants } from "node:fs";
+import { homedir } from "node:os";
+//#region src/constants.ts
+const CLAUDE_IMAGE = "clanker-cleanroom/claude";
+const CLAUDE_CONTAINER_CREDENTIALS_PATH = `${CONTAINER_HOME}/.claude/.credentials.json`;
+/** Long-lived OAuth token from `claude setup-token` (Claude subscription). */
+const CLAUDE_OAUTH_TOKEN_ENV = "CLAUDE_CODE_OAUTH_TOKEN";
+/** Anthropic API key (pay-as-you-go). */
+const CLAUDE_API_KEY_ENV = "ANTHROPIC_API_KEY";
+/** Linux hosts persist OAuth credentials here; macOS uses the Keychain instead. */
+const defaultClaudeHostCredentialsFile = (home) => `${home}/.claude/.credentials.json`;
+//#endregion
+//#region src/credentials.ts
+/** Env OAuth token, then env API key, then a readable host credentials file. */
+async function resolveClaudeCredentials(options = {}) {
+	const env = options.env ?? process.env;
+	const home = options.home ?? homedir();
+	const token = env[CLAUDE_OAUTH_TOKEN_ENV];
+	if (token !== void 0 && token !== "") return {
+		kind: "oauth-token",
+		token
+	};
+	const apiKey = env[CLAUDE_API_KEY_ENV];
+	if (apiKey !== void 0 && apiKey !== "") return {
+		kind: "api-key",
+		apiKey
+	};
+	const file = defaultClaudeHostCredentialsFile(home);
+	try {
+		await access(file, constants.R_OK);
+	} catch {
+		throw new Error(`Claude Code credentials not found. Set ${CLAUDE_OAUTH_TOKEN_ENV} (run \`claude setup-token\` on the host) or ${CLAUDE_API_KEY_ENV}, or provide ${file} (Linux hosts; macOS keeps credentials in the Keychain).`);
+	}
+	return {
+		kind: "credentials-file",
+		file
+	};
+}
+/** Secret values for the docker CLI process, keyed by env names forwarded via envPassthrough. */
+function credentialsEnv(credentials) {
+	switch (credentials.kind) {
+		case "oauth-token": return { [CLAUDE_OAUTH_TOKEN_ENV]: credentials.token };
+		case "api-key": return { [CLAUDE_API_KEY_ENV]: credentials.apiKey };
+		case "credentials-file": return {};
+	}
+}
+//#endregion
+//#region src/trajectory.ts
+function adaptClaudeEvents(rawEvents) {
+	const events = [];
+	for (const raw of rawEvents) {
+		const record = asRecord(raw);
+		if (record === void 0) {
+			events.push({
+				kind: "other",
+				type: "unknown",
+				raw
+			});
+			continue;
+		}
+		const type = readString(record.type) ?? "unknown";
+		switch (type) {
+			case "system":
+				events.push({
+					kind: "system",
+					sessionId: readString(record.session_id),
+					model: readString(record.model),
+					raw
+				});
+				break;
+			case "user":
+				events.push(...adaptClaudeUser(record, raw));
+				break;
+			case "assistant":
+				events.push(...adaptClaudeAssistant(record, raw));
+				break;
+			case "result":
+				events.push({
+					kind: "result",
+					text: readString(record.result) ?? "",
+					isError: record.is_error === true,
+					durationMs: readTokenCount(record.duration_ms),
+					costUsd: readTokenCount(record.total_cost_usd),
+					raw
+				});
+				break;
+			default: events.push({
+				kind: "other",
+				type,
+				raw
+			});
+		}
+	}
+	return events;
+}
+function adaptClaudeAssistant(record, raw) {
+	const events = [];
+	const text = extractTextContent(record.message);
+	if (text !== "") events.push({
+		kind: "assistant",
+		text,
+		raw
+	});
+	for (const block of contentBlocks(record.message)) {
+		if (block.type !== "tool_use") continue;
+		events.push({
+			kind: "tool",
+			phase: "started",
+			callId: readString(block.id) ?? "",
+			name: readString(block.name) ?? "unknown",
+			args: block.input ?? null,
+			result: null,
+			raw
+		});
+	}
+	if (events.length === 0) events.push({
+		kind: "assistant",
+		text: "",
+		raw
+	});
+	return events;
+}
+function adaptClaudeUser(record, raw) {
+	const events = [];
+	const text = extractTextContent(record.message);
+	const toolResults = [];
+	for (const block of contentBlocks(record.message)) {
+		if (block.type !== "tool_result") continue;
+		toolResults.push({
+			kind: "tool",
+			phase: "completed",
+			callId: readString(block.tool_use_id) ?? "",
+			name: "tool_result",
+			args: null,
+			result: block.content ?? null,
+			raw
+		});
+	}
+	if (text !== "" || toolResults.length === 0) events.push({
+		kind: "user",
+		text,
+		raw
+	});
+	events.push(...toolResults);
+	return events;
+}
+function contentBlocks(message) {
+	const content = asRecord(message)?.content;
+	if (!Array.isArray(content)) return [];
+	return content.map((block) => asRecord(block)).filter((block) => block !== void 0);
+}
+//#endregion
+//#region src/binding.ts
+const claudeBinding = {
+	image: CLAUDE_IMAGE,
+	displayName: "Claude",
+	trajectoryKind: "claude",
+	adaptEvents: adaptClaudeEvents,
+	command: ({ prompt, model }) => {
+		const claudeArgs = [
+			"claude",
+			"-p",
+			"--output-format",
+			"stream-json",
+			"--verbose",
+			"--dangerously-skip-permissions"
+		];
+		if (model !== void 0 && model !== "") claudeArgs.push("--model", model);
+		claudeArgs.push("--", prompt);
+		return claudeArgs;
+	},
+	prepare: async () => {
+		const credentials = await resolveClaudeCredentials();
+		const volumes = [];
+		if (credentials.kind === "credentials-file") volumes.push({
+			host: credentials.file,
+			container: CLAUDE_CONTAINER_CREDENTIALS_PATH,
+			mode: "ro"
+		});
+		return {
+			volumes,
+			env: credentialsEnv(credentials)
+		};
+	},
+	parseResult: parseClaudeResult,
+	describeFailure: describeClaudeFailure
+};
+function parseClaudeResult(trajectory) {
+	const parsed = parseAgentJsonOutput(trajectory);
+	if (isErrorResult(parsed)) throw new Error(`Claude agent reported an error: ${describeErrorResult(parsed)}`);
+	const record = asRecord(parsed);
+	const usage = asRecord(record?.usage);
+	return {
+		durationMs: readTokenCount(record?.duration_ms),
+		costUsd: readTokenCount(record?.total_cost_usd),
+		usage: {
+			inputTokens: readTokenCount(usage?.input_tokens ?? usage?.inputTokens),
+			outputTokens: readTokenCount(usage?.output_tokens ?? usage?.outputTokens),
+			cacheReadTokens: readTokenCount(usage?.cache_read_input_tokens ?? usage?.cacheReadTokens),
+			cacheWriteTokens: readTokenCount(usage?.cache_creation_input_tokens ?? usage?.cacheWriteTokens)
+		}
+	};
+}
+function describeClaudeFailure(trajectory) {
+	try {
+		const parsed = parseAgentJsonOutput(trajectory);
+		return isErrorResult(parsed) ? describeErrorResult(parsed) : void 0;
+	} catch {
+		return;
+	}
+}
+function isErrorResult(value) {
+	return typeof value === "object" && value !== null && value.is_error === true;
+}
+function describeErrorResult(result) {
+	const message = String(result.result);
+	if (result.terminal_reason !== void 0 && result.terminal_reason !== "completed") return `${result.terminal_reason}: ${message}`;
+	if (result.subtype !== void 0 && result.subtype !== "success") return `${result.subtype}: ${message}`;
+	return message;
+}
+//#endregion
+export { CLAUDE_API_KEY_ENV as a, CLAUDE_OAUTH_TOKEN_ENV as c, resolveClaudeCredentials as i, defaultClaudeHostCredentialsFile as l, adaptClaudeEvents as n, CLAUDE_CONTAINER_CREDENTIALS_PATH as o, credentialsEnv as r, CLAUDE_IMAGE as s, claudeBinding as t };
+
+//# sourceMappingURL=binding-DAPBfelH.mjs.map

package/lib/binding-DAPBfelH.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-DAPBfelH.mjs","names":["fsConstants"],"sources":["../src/constants.ts","../src/credentials.ts","../src/trajectory.ts","../src/binding.ts"],"sourcesContent":["import { CONTAINER_HOME } from \"clanker-cleanroom\";\n\nexport const CLAUDE_IMAGE = \"clanker-cleanroom/claude\";\nexport const CLAUDE_CONTAINER_CREDENTIALS_PATH = `${CONTAINER_HOME}/.claude/.credentials.json`;\n\n/** Long-lived OAuth token from `claude setup-token` (Claude subscription). */\nexport const CLAUDE_OAUTH_TOKEN_ENV = \"CLAUDE_CODE_OAUTH_TOKEN\";\n/** Anthropic API key (pay-as-you-go). */\nexport const CLAUDE_API_KEY_ENV = \"ANTHROPIC_API_KEY\";\n\n/** Linux hosts persist OAuth credentials here; macOS uses the Keychain instead. */\nexport const defaultClaudeHostCredentialsFile = (home: string): string =>\n  `${home}/.claude/.credentials.json`;\n","import { access } from \"node:fs/promises\";\nimport { constants as fsConstants } from \"node:fs\";\nimport { homedir } from \"node:os\";\n\nimport {\n  CLAUDE_API_KEY_ENV,\n  CLAUDE_OAUTH_TOKEN_ENV,\n  defaultClaudeHostCredentialsFile,\n} from \"./constants.js\";\n\n/**\n * How Claude Code authenticates inside the container. Env-backed kinds are forwarded\n * to `docker run` by name (never on argv); the file kind is bind-mounted read-only.\n * See `constants.ts` for which host setups produce each.\n */\nexport type ClaudeCredentials =\n  | { kind: \"oauth-token\"; token: string }\n  | { kind: \"api-key\"; apiKey: string }\n  | { kind: \"credentials-file\"; file: string };\n\n/** Env OAuth token, then env API key, then a readable host credentials file. */\nexport async function resolveClaudeCredentials(\n  options: { env?: NodeJS.ProcessEnv; home?: string } = {},\n): Promise<ClaudeCredentials> {\n  const env = options.env ?? process.env;\n  const home = options.home ?? homedir();\n\n  const token = env[CLAUDE_OAUTH_TOKEN_ENV];\n  if (token !== undefined && token !== \"\") {\n    return { kind: \"oauth-token\", token };\n  }\n\n  const apiKey = env[CLAUDE_API_KEY_ENV];\n  if (apiKey !== undefined && apiKey !== \"\") {\n    return { kind: \"api-key\", apiKey };\n  }\n\n  const file = defaultClaudeHostCredentialsFile(home);\n  try {\n    await access(file, fsConstants.R_OK);\n  } catch {\n    throw new Error(\n      `Claude Code credentials not found. Set ${CLAUDE_OAUTH_TOKEN_ENV} (run \\`claude setup-token\\` on the host) ` +\n        `or ${CLAUDE_API_KEY_ENV}, or provide ${file} (Linux hosts; macOS keeps credentials in the Keychain).`,\n    );\n  }\n\n  return { kind: \"credentials-file\", file };\n}\n\n/** Secret values for the docker CLI process, keyed by env names forwarded via envPassthrough. */\nexport function credentialsEnv(credentials: ClaudeCredentials): Record<string, string> {\n  switch (credentials.kind) {\n    case \"oauth-token\":\n      return { [CLAUDE_OAUTH_TOKEN_ENV]: credentials.token };\n    case \"api-key\":\n      return { [CLAUDE_API_KEY_ENV]: credentials.apiKey };\n    case \"credentials-file\":\n      return {};\n  }\n}\n","import {\n  asRecord,\n  extractTextContent,\n  readString,\n  readTokenCount,\n  type TrajectoryEvent,\n} from \"clanker-cleanroom\";\n\nexport function adaptClaudeEvents(rawEvents: readonly unknown[]): TrajectoryEvent[] {\n  const events: TrajectoryEvent[] = [];\n\n  for (const raw of rawEvents) {\n    const record = asRecord(raw);\n    if (record === undefined) {\n      events.push({ kind: \"other\", type: \"unknown\", raw });\n      continue;\n    }\n\n    const type = readString(record.type) ?? \"unknown\";\n\n    switch (type) {\n      case \"system\":\n        events.push({\n          kind: \"system\",\n          sessionId: readString(record.session_id),\n          model: readString(record.model),\n          raw,\n        });\n        break;\n      case \"user\":\n        events.push(...adaptClaudeUser(record, raw));\n        break;\n      case \"assistant\":\n        events.push(...adaptClaudeAssistant(record, raw));\n        break;\n      case \"result\":\n        events.push({\n          kind: \"result\",\n          text: readString(record.result) ?? \"\",\n          isError: record.is_error === true,\n          durationMs: readTokenCount(record.duration_ms),\n          costUsd: readTokenCount(record.total_cost_usd),\n          raw,\n        });\n        break;\n      default:\n        events.push({ kind: \"other\", type, raw });\n    }\n  }\n\n  return events;\n}\n\nfunction adaptClaudeAssistant(\n  record: Record<string, unknown>,\n  raw: unknown,\n): TrajectoryEvent[] {\n  const events: TrajectoryEvent[] = [];\n  const text = extractTextContent(record.message);\n  if (text !== \"\") {\n    events.push({ kind: \"assistant\", text, raw });\n  }\n\n  for (const block of contentBlocks(record.message)) {\n    if (block.type !== \"tool_use\") {\n      continue;\n    }\n    events.push({\n      kind: \"tool\",\n      phase: \"started\",\n      callId: readString(block.id) ?? \"\",\n      name: readString(block.name) ?? \"unknown\",\n      args: block.input ?? null,\n      result: null,\n      raw,\n    });\n  }\n\n  if (events.length === 0) {\n    events.push({ kind: \"assistant\", text: \"\", raw });\n  }\n\n  return events;\n}\n\nfunction adaptClaudeUser(record: Record<string, unknown>, raw: unknown): TrajectoryEvent[] {\n  const events: TrajectoryEvent[] = [];\n  const text = extractTextContent(record.message);\n  const toolResults: TrajectoryEvent[] = [];\n\n  for (const block of contentBlocks(record.message)) {\n    if (block.type !== \"tool_result\") {\n      continue;\n    }\n    toolResults.push({\n      kind: \"tool\",\n      phase: \"completed\",\n      callId: readString(block.tool_use_id) ?? \"\",\n      name: \"tool_result\",\n      args: null,\n      result: block.content ?? null,\n      raw,\n    });\n  }\n\n  if (text !== \"\" || toolResults.length === 0) {\n    events.push({ kind: \"user\", text, raw });\n  }\n  events.push(...toolResults);\n  return events;\n}\n\nfunction contentBlocks(message: unknown): Record<string, unknown>[] {\n  const content = asRecord(message)?.content;\n  if (!Array.isArray(content)) {\n    return [];\n  }\n  return content.map((block) => asRecord(block)).filter((block) => block !== undefined);\n}\n","import {\n  asRecord,\n  parseAgentJsonOutput,\n  readTokenCount,\n  type AgentBinding,\n  type AgentRunResult,\n  type DockerVolumeMount,\n} from \"clanker-cleanroom\";\n\nimport { CLAUDE_CONTAINER_CREDENTIALS_PATH, CLAUDE_IMAGE } from \"./constants.js\";\nimport { credentialsEnv, resolveClaudeCredentials } from \"./credentials.js\";\nimport { adaptClaudeEvents } from \"./trajectory.js\";\n\nexport const claudeBinding: AgentBinding = {\n  image: CLAUDE_IMAGE,\n  displayName: \"Claude\",\n  trajectoryKind: \"claude\",\n  adaptEvents: adaptClaudeEvents,\n  command: ({ prompt, model }) => {\n    const claudeArgs = [\n      \"claude\",\n      \"-p\",\n      \"--output-format\",\n      \"stream-json\",\n      \"--verbose\",\n      \"--dangerously-skip-permissions\",\n    ];\n    if (model !== undefined && model !== \"\") {\n      claudeArgs.push(\"--model\", model);\n    }\n    claudeArgs.push(\"--\", prompt);\n    return claudeArgs;\n  },\n  prepare: async () => {\n    const credentials = await resolveClaudeCredentials();\n    const volumes: DockerVolumeMount[] = [];\n    if (credentials.kind === \"credentials-file\") {\n      volumes.push({\n        host: credentials.file,\n        container: CLAUDE_CONTAINER_CREDENTIALS_PATH,\n        mode: \"ro\",\n      });\n    }\n    return {\n      volumes,\n      env: credentialsEnv(credentials),\n    };\n  },\n  parseResult: parseClaudeResult,\n  describeFailure: describeClaudeFailure,\n};\n\nfunction parseClaudeResult(trajectory: string): AgentRunResult {\n  const parsed = parseAgentJsonOutput(trajectory);\n  if (isErrorResult(parsed)) {\n    throw new Error(`Claude agent reported an error: ${describeErrorResult(parsed)}`);\n  }\n\n  const record = asRecord(parsed);\n  const usage = asRecord(record?.usage);\n\n  return {\n    durationMs: readTokenCount(record?.duration_ms),\n    costUsd: readTokenCount(record?.total_cost_usd),\n    usage: {\n      inputTokens: readTokenCount(usage?.input_tokens ?? usage?.inputTokens),\n      outputTokens: readTokenCount(usage?.output_tokens ?? usage?.outputTokens),\n      cacheReadTokens: readTokenCount(usage?.cache_read_input_tokens ?? usage?.cacheReadTokens),\n      cacheWriteTokens: readTokenCount(\n        usage?.cache_creation_input_tokens ?? usage?.cacheWriteTokens,\n      ),\n    },\n  };\n}\n\nfunction describeClaudeFailure(trajectory: string): string | undefined {\n  try {\n    const parsed = parseAgentJsonOutput(trajectory);\n    return isErrorResult(parsed) ? describeErrorResult(parsed) : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\ntype ClaudeErrorResult = {\n  is_error: true;\n  result: string;\n  subtype?: string;\n  terminal_reason?: string;\n};\n\nfunction isErrorResult(value: unknown): value is ClaudeErrorResult {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    (value as { is_error?: unknown }).is_error === true\n  );\n}\n\nfunction describeErrorResult(result: ClaudeErrorResult): string {\n  const message = String(result.result);\n\n  if (result.terminal_reason !== undefined && result.terminal_reason !== \"completed\") {\n    return `${result.terminal_reason}: ${message}`;\n  }\n\n  if (result.subtype !== undefined && result.subtype !== \"success\") {\n    return `${result.subtype}: ${message}`;\n  }\n\n  return message;\n}\n"],"mappings":";;;;;AAEA,MAAa,eAAe;AAC5B,MAAa,oCAAoC,GAAG,eAAe;;AAGnE,MAAa,yBAAyB;;AAEtC,MAAa,qBAAqB;;AAGlC,MAAa,oCAAoC,SAC/C,GAAG,KAAK;;;;ACSV,eAAsB,yBACpB,UAAsD,CAAC,GAC3B;CAC5B,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,OAAO,QAAQ,QAAQ,QAAQ;CAErC,MAAM,QAAQ,IAAI;CAClB,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC,OAAO;EAAE,MAAM;EAAe;CAAM;CAGtC,MAAM,SAAS,IAAI;CACnB,IAAI,WAAW,KAAA,KAAa,WAAW,IACrC,OAAO;EAAE,MAAM;EAAW;CAAO;CAGnC,MAAM,OAAO,iCAAiC,IAAI;CAClD,IAAI;EACF,MAAM,OAAO,MAAMA,UAAY,IAAI;CACrC,QAAQ;EACN,MAAM,IAAI,MACR,0CAA0C,uBAAuB,+CACzD,mBAAmB,eAAe,KAAK,yDACjD;CACF;CAEA,OAAO;EAAE,MAAM;EAAoB;CAAK;AAC1C;;AAGA,SAAgB,eAAe,aAAwD;CACrF,QAAQ,YAAY,MAApB;EACE,KAAK,eACH,OAAO,GAAG,yBAAyB,YAAY,MAAM;EACvD,KAAK,WACH,OAAO,GAAG,qBAAqB,YAAY,OAAO;EACpD,KAAK,oBACH,OAAO,CAAC;CACZ;AACF;;;ACpDA,SAAgB,kBAAkB,WAAkD;CAClF,MAAM,SAA4B,CAAC;CAEnC,KAAK,MAAM,OAAO,WAAW;EAC3B,MAAM,SAAS,SAAS,GAAG;EAC3B,IAAI,WAAW,KAAA,GAAW;GACxB,OAAO,KAAK;IAAE,MAAM;IAAS,MAAM;IAAW;GAAI,CAAC;GACnD;EACF;EAEA,MAAM,OAAO,WAAW,OAAO,IAAI,KAAK;EAExC,QAAQ,MAAR;GACE,KAAK;IACH,OAAO,KAAK;KACV,MAAM;KACN,WAAW,WAAW,OAAO,UAAU;KACvC,OAAO,WAAW,OAAO,KAAK;KAC9B;IACF,CAAC;IACD;GACF,KAAK;IACH,OAAO,KAAK,GAAG,gBAAgB,QAAQ,GAAG,CAAC;IAC3C;GACF,KAAK;IACH,OAAO,KAAK,GAAG,qBAAqB,QAAQ,GAAG,CAAC;IAChD;GACF,KAAK;IACH,OAAO,KAAK;KACV,MAAM;KACN,MAAM,WAAW,OAAO,MAAM,KAAK;KACnC,SAAS,OAAO,aAAa;KAC7B,YAAY,eAAe,OAAO,WAAW;KAC7C,SAAS,eAAe,OAAO,cAAc;KAC7C;IACF,CAAC;IACD;GACF,SACE,OAAO,KAAK;IAAE,MAAM;IAAS;IAAM;GAAI,CAAC;EAC5C;CACF;CAEA,OAAO;AACT;AAEA,SAAS,qBACP,QACA,KACmB;CACnB,MAAM,SAA4B,CAAC;CACnC,MAAM,OAAO,mBAAmB,OAAO,OAAO;CAC9C,IAAI,SAAS,IACX,OAAO,KAAK;EAAE,MAAM;EAAa;EAAM;CAAI,CAAC;CAG9C,KAAK,MAAM,SAAS,cAAc,OAAO,OAAO,GAAG;EACjD,IAAI,MAAM,SAAS,YACjB;EAEF,OAAO,KAAK;GACV,MAAM;GACN,OAAO;GACP,QAAQ,WAAW,MAAM,EAAE,KAAK;GAChC,MAAM,WAAW,MAAM,IAAI,KAAK;GAChC,MAAM,MAAM,SAAS;GACrB,QAAQ;GACR;EACF,CAAC;CACH;CAEA,IAAI,OAAO,WAAW,GACpB,OAAO,KAAK;EAAE,MAAM;EAAa,MAAM;EAAI;CAAI,CAAC;CAGlD,OAAO;AACT;AAEA,SAAS,gBAAgB,QAAiC,KAAiC;CACzF,MAAM,SAA4B,CAAC;CACnC,MAAM,OAAO,mBAAmB,OAAO,OAAO;CAC9C,MAAM,cAAiC,CAAC;CAExC,KAAK,MAAM,SAAS,cAAc,OAAO,OAAO,GAAG;EACjD,IAAI,MAAM,SAAS,eACjB;EAEF,YAAY,KAAK;GACf,MAAM;GACN,OAAO;GACP,QAAQ,WAAW,MAAM,WAAW,KAAK;GACzC,MAAM;GACN,MAAM;GACN,QAAQ,MAAM,WAAW;GACzB;EACF,CAAC;CACH;CAEA,IAAI,SAAS,MAAM,YAAY,WAAW,GACxC,OAAO,KAAK;EAAE,MAAM;EAAQ;EAAM;CAAI,CAAC;CAEzC,OAAO,KAAK,GAAG,WAAW;CAC1B,OAAO;AACT;AAEA,SAAS,cAAc,SAA6C;CAClE,MAAM,UAAU,SAAS,OAAO,CAAC,EAAE;CACnC,IAAI,CAAC,MAAM,QAAQ,OAAO,GACxB,OAAO,CAAC;CAEV,OAAO,QAAQ,KAAK,UAAU,SAAS,KAAK,CAAC,CAAC,CAAC,QAAQ,UAAU,UAAU,KAAA,CAAS;AACtF;;;ACzGA,MAAa,gBAA8B;CACzC,OAAO;CACP,aAAa;CACb,gBAAgB;CAChB,aAAa;CACb,UAAU,EAAE,QAAQ,YAAY;EAC9B,MAAM,aAAa;GACjB;GACA;GACA;GACA;GACA;GACA;EACF;EACA,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC,WAAW,KAAK,WAAW,KAAK;EAElC,WAAW,KAAK,MAAM,MAAM;EAC5B,OAAO;CACT;CACA,SAAS,YAAY;EACnB,MAAM,cAAc,MAAM,yBAAyB;EACnD,MAAM,UAA+B,CAAC;EACtC,IAAI,YAAY,SAAS,oBACvB,QAAQ,KAAK;GACX,MAAM,YAAY;GAClB,WAAW;GACX,MAAM;EACR,CAAC;EAEH,OAAO;GACL;GACA,KAAK,eAAe,WAAW;EACjC;CACF;CACA,aAAa;CACb,iBAAiB;AACnB;AAEA,SAAS,kBAAkB,YAAoC;CAC7D,MAAM,SAAS,qBAAqB,UAAU;CAC9C,IAAI,cAAc,MAAM,GACtB,MAAM,IAAI,MAAM,mCAAmC,oBAAoB,MAAM,GAAG;CAGlF,MAAM,SAAS,SAAS,MAAM;CAC9B,MAAM,QAAQ,SAAS,QAAQ,KAAK;CAEpC,OAAO;EACL,YAAY,eAAe,QAAQ,WAAW;EAC9C,SAAS,eAAe,QAAQ,cAAc;EAC9C,OAAO;GACL,aAAa,eAAe,OAAO,gBAAgB,OAAO,WAAW;GACrE,cAAc,eAAe,OAAO,iBAAiB,OAAO,YAAY;GACxE,iBAAiB,eAAe,OAAO,2BAA2B,OAAO,eAAe;GACxF,kBAAkB,eAChB,OAAO,+BAA+B,OAAO,gBAC/C;EACF;CACF;AACF;AAEA,SAAS,sBAAsB,YAAwC;CACrE,IAAI;EACF,MAAM,SAAS,qBAAqB,UAAU;EAC9C,OAAO,cAAc,MAAM,IAAI,oBAAoB,MAAM,IAAI,KAAA;CAC/D,QAAQ;EACN;CACF;AACF;AASA,SAAS,cAAc,OAA4C;CACjE,OACE,OAAO,UAAU,YACjB,UAAU,QACT,MAAiC,aAAa;AAEnD;AAEA,SAAS,oBAAoB,QAAmC;CAC9D,MAAM,UAAU,OAAO,OAAO,MAAM;CAEpC,IAAI,OAAO,oBAAoB,KAAA,KAAa,OAAO,oBAAoB,aACrE,OAAO,GAAG,OAAO,gBAAgB,IAAI;CAGvC,IAAI,OAAO,YAAY,KAAA,KAAa,OAAO,YAAY,WACrD,OAAO,GAAG,OAAO,QAAQ,IAAI;CAG/B,OAAO;AACT"}