@claudexor/harness-claude 1.0.1 → 2.1.3

package/dist/capability-profile.d.ts

@@ -0,0 +1,3 @@
+import type { HarnessCapabilityProfile } from "@claudexor/schema";
+export declare const CLAUDE_CAPABILITY_PROFILE: HarnessCapabilityProfile;
+//# sourceMappingURL=capability-profile.d.ts.map

package/dist/capability-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-profile.d.ts","sourceRoot":"","sources":["../src/capability-profile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAGlE,eAAO,MAAM,yBAAyB,EAAE,wBAgCpC,CAAC"}

package/dist/capability-profile.js

@@ -0,0 +1,34 @@
+import { HarnessCapabilityProfile as HarnessCapabilityProfileSchema } from "@claudexor/schema";
+export const CLAUDE_CAPABILITY_PROFILE = HarnessCapabilityProfileSchema.parse({
+    auth: {
+        supported_sources: ["native_session", "oauth_token_env", "api_key_env"],
+        preferred_source: null,
+        credential_transports: [
+            { source: "native_session", kind: "config_file", relocatable_by: ["CONFIG_DIR"] },
+            { source: "native_session", kind: "os_keychain", relocatable_by: ["HOME"] },
+            { source: "oauth_token_env", kind: "oauth_token_env", relocatable_by: ["ENV"] },
+            { source: "api_key_env", kind: "env_var", relocatable_by: ["ENV"] },
+        ],
+    },
+    access_control: { readonly_mechanism: "tool_allowlist" },
+    isolation: {
+        supported_containment: ["scoped_home_keychain_bridge", "env_or_file_injection"],
+    },
+    attachment_inputs: [
+        {
+            kind: "image",
+            mime_types: ["image/png", "image/jpeg", "image/gif", "image/webp"],
+            max_bytes: 5 * 1024 * 1024,
+            max_count: 20,
+            transport: "base64_stream",
+        },
+        {
+            kind: "file",
+            mime_types: ["text/plain", "text/markdown", "application/json"],
+            max_bytes: 1 * 1024 * 1024,
+            max_count: 10,
+            transport: "text_inline",
+        },
+    ],
+});
+//# sourceMappingURL=capability-profile.js.map

package/dist/capability-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-profile.js","sourceRoot":"","sources":["../src/capability-profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,IAAI,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAE/F,MAAM,CAAC,MAAM,yBAAyB,GACpC,8BAA8B,CAAC,KAAK,CAAC;IACnC,IAAI,EAAE;QACJ,iBAAiB,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,CAAC;QACvE,gBAAgB,EAAE,IAAI;QACtB,qBAAqB,EAAE;YACrB,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,YAAY,CAAC,EAAE;YACjF,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE;YAC3E,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE;YAC/E,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE;SACpE;KACF;IACD,cAAc,EAAE,EAAE,kBAAkB,EAAE,gBAAgB,EAAE;IACxD,SAAS,EAAE;QACT,qBAAqB,EAAE,CAAC,6BAA6B,EAAE,uBAAuB,CAAC;KAChF;IACD,iBAAiB,EAAE;QACjB;YACE,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC;YAClE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1B,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,eAAe;SAC3B;QACD;YACE,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,kBAAkB,CAAC;YAC/D,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1B,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,aAAa;SACzB;KACF;CACF,CAAC,CAAC"}

package/dist/doctor-remedy.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The honest native-login remedy for Claude doctor reasons (INV-067).
+ *
+ * Native setup is the product path. Scoped macOS runs receive a Claude-only
+ * Keychain bridge; if that bridge cannot be prepared, disclose the
+ * infrastructure cause instead of claiming the user is logged out.
+ */
+export declare function claudeNativeLoginRemedy(env: Record<string, string | null | undefined> | undefined): string;
+//# sourceMappingURL=doctor-remedy.d.ts.map

package/dist/doctor-remedy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-remedy.d.ts","sourceRoot":"","sources":["../src/doctor-remedy.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,SAAS,GACzD,MAAM,CAKR"}

package/dist/doctor-remedy.js

@@ -0,0 +1,15 @@
+import { CLAUDE_KEYCHAIN_BRIDGE_ENV } from "./native-home.js";
+/**
+ * The honest native-login remedy for Claude doctor reasons (INV-067).
+ *
+ * Native setup is the product path. Scoped macOS runs receive a Claude-only
+ * Keychain bridge; if that bridge cannot be prepared, disclose the
+ * infrastructure cause instead of claiming the user is logged out.
+ */
+export function claudeNativeLoginRemedy(env) {
+    if (env?.[CLAUDE_KEYCHAIN_BRIDGE_ENV] === "unavailable") {
+        return "the scoped Claude process could not bridge the macOS login Keychain — reopen Claudexor and retry Native setup, or configure an API key fallback";
+    }
+    return "open Accounts → Claude → Login (or Settings → Harnesses → Claude → Manage), then complete Native setup; alternatively configure an API key fallback";
+}
+//# sourceMappingURL=doctor-remedy.js.map

package/dist/doctor-remedy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-remedy.js","sourceRoot":"","sources":["../src/doctor-remedy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAA0D;IAE1D,IAAI,GAAG,EAAE,CAAC,0BAA0B,CAAC,KAAK,aAAa,EAAE,CAAC;QACxD,OAAO,iJAAiJ,CAAC;IAC3J,CAAC;IACD,OAAO,qJAAqJ,CAAC;AAC/J,CAAC"}

package/dist/index.d.ts

@@ -1,19 +1,76 @@
-import type { HarnessRunSpec } from "@claudexor/schema";
+import type { AuthSourceReadiness, HarnessRunSpec } from "@claudexor/schema";
 import type { HarnessAdapter } from "@claudexor/core";
-/** The user's real Claude config dir (native subscription session lives here). */
-export declare function defaultNativeClaudeConfigDir(): string;
+import { runCapture, runCliHarness, selectStrictAuthRoute } from "@claudexor/core";
+export { defaultNativeClaudeConfigDir } from "./native-home.js";
+export { canonicalProfileConfigDir } from "./profile.js";
+import { smokeIsolatedApiKey, smokeIsolatedOAuthToken } from "./smoke.js";
+export declare const BIN: string;
+export declare const CLAUDE_PROVIDER_ENV_DENYLIST: string[];
+/** Exported for focused route-policy tests; runtime uses this exact selector. */
+export declare const selectClaudeRunAuthRoute: typeof selectStrictAuthRoute;
+export interface ClaudeReadonlyProfileProbe {
+    supported: boolean;
+    missingFlags: string[];
+    detail: string;
+}
+export declare function probeClaudeReadonlyProfile(abortSignal?: AbortSignal): Promise<ClaudeReadonlyProfileProbe>;
+declare function detectVersion(abortSignal?: AbortSignal): Promise<string | null>;
 /**
- * Seed the user's NATIVE Claude session (`.credentials.json`, subscription OAuth)
- * into an isolated CLAUDE_CONFIG_DIR so a Pro/Max subscriber with NO API key can
- * run inside a Claudexor envelope. Copies only if scoped creds are absent and a
- * native credentials file exists; never overwrites. Returns true when scoped
- * creds are present afterwards.
- *
- * Caveats encoded by the caller: `ANTHROPIC_API_KEY` takes precedence over the
- * OAuth session, and `--bare` disables it — so the subscription route must set
- * neither.
+ * Native-session probe with a distinct PROBE-FAILURE state (same contract as
+ * the codex adapter's probeLogin). `claude auth status` prints a typed JSON
+ * verdict `{loggedIn, authMethod, ...}` on stdout; the exit code alone is NOT
+ * the auth verdict. When the JSON is present we trust its `loggedIn` field;
+ * a probe that produces no parseable verdict is a probe error, never a silent
+ * "not logged in".
  */
-export declare function ensureClaudeNativeAuth(env?: Record<string, string>, nativeDir?: string): boolean;
-export declare function createClaudeAdapter(): HarnessAdapter;
+export interface ClaudeAuthStatusProbe {
+    loggedIn: boolean;
+    authed: boolean;
+    authMethod: string | null;
+    probeError: string | null;
+}
+export interface ClaudeAuthStatusProbeOptions {
+    env?: Record<string, string | null | undefined>;
+    /** Explicit CLAUDE_CONFIG_DIR for the probe (INV-135, release wave round-17
+     * BLOCK): without it the probe re-normalizes onto the DEFAULT native dir —
+     * a credential-profile probe must inspect ITS OWN store, never the
+     * default's. Callers without a profile omit it and keep the default. */
+    configDir?: string;
+    abortSignal?: AbortSignal;
+    runCapture?: typeof runCapture;
+}
+export declare function claudeNativeEnv(base?: Record<string, string | null | undefined>, configDir?: string): Record<string, string | null | undefined>;
+export declare function probeAuthStatus(bin?: string, options?: ClaudeAuthStatusProbeOptions): Promise<ClaudeAuthStatusProbe>;
+export declare function anthropicApiKey(): string | null;
+/** A stored/long-lived Claude Code OAuth (`claude setup-token`) for headless
+ * subscription auth. The hermetic kill switch is honored inside resolveSecret
+ * (single owner), so this reads env-only under CLAUDEXOR_DISABLE_STORED_SECRETS. */
+declare function claudeOAuthToken(): string | null;
+export declare function claudeAuthSourceReadiness(input: {
+    native: ClaudeAuthStatusProbe;
+    oauthAvailable: boolean;
+    oauthVerification: "passed" | "failed" | "not_run";
+    oauthDetail: string;
+    apiKeyAvailable: boolean;
+    apiKeyVerification: "passed" | "failed" | "not_run";
+    apiKeyDetail: string;
+}): AuthSourceReadiness[];
+export declare function redactClaudeDoctorDetail(text: string): string;
+/** The runtime surface the profile module needs (test-stubbable). */
+export type ClaudeProfileRuntimeDeps = Pick<ClaudeRuntimeDeps, "probeAuthStatus" | "resolveProfileSecret">;
+type ClaudeRuntimeDeps = {
+    detectVersion: typeof detectVersion;
+    probeAuthStatus: typeof probeAuthStatus;
+    anthropicApiKey: typeof anthropicApiKey;
+    claudeOAuthToken: typeof claudeOAuthToken;
+    /** Profile-scoped secret resolution (INV-135): reads exactly the profile's
+     * namespaced ref, never the engine-default ladder. */
+    resolveProfileSecret: (ref: string) => string | null;
+    smokeIsolatedApiKey: typeof smokeIsolatedApiKey;
+    smokeIsolatedOAuthToken: typeof smokeIsolatedOAuthToken;
+    probeReadonlyProfile: typeof probeClaudeReadonlyProfile;
+    runCliHarness: typeof runCliHarness;
+};
+export declare function createClaudeAdapter(deps?: Partial<ClaudeRuntimeDeps>): HarnessAdapter;
 export declare function claudeArgsForSpec(spec: HarnessRunSpec, interactive?: boolean, suppressBare?: boolean): string[];
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAyG,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE/J,OAAO,KAAK,EAAc,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AAmFtF,kFAAkF;AAClF,wBAAgB,4BAA4B,IAAI,MAAM,CAIrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,SAAS,GAAE,MAAuC,GACjD,OAAO,CAmBT;AAoCD,wBAAgB,mBAAmB,IAAI,cAAc,CA2HpD;AAOD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,UAAQ,EAAE,YAAY,UAAQ,GAAG,MAAM,EAAE,CA8B3G"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,mBAAmB,EAOnB,cAAc,EACf,MAAM,mBAAmB,CAAC;AAK3B,OAAO,KAAK,EAAc,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAUL,UAAU,EACV,aAAa,EAEb,qBAAqB,EAItB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAS1E,eAAO,MAAM,GAAG,QAA+C,CAAC;AAChE,eAAO,MAAM,4BAA4B,UAExC,CAAC;AAUF,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,8BAAwB,CAAC;AA2B9D,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAaD,wBAAgB,0BAA0B,CACxC,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,0BAA0B,CAAC,CAkCrC;AAED,iBAAe,aAAa,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAY9E;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD;;;4EAGwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,UAAU,CAAC;CAChC;AAED,wBAAgB,eAAe,CAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAChD,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAY3C;AAED,wBAAsB,eAAe,CACnC,GAAG,GAAE,MAAY,EACjB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,qBAAqB,CAAC,CAqChC;AAED,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAO/C;AAED;;oFAEoF;AACpF,iBAAS,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAEzC;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACpD,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,mBAAmB,EAAE,CAsCxB;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,qEAAqE;AACrE,MAAM,MAAM,wBAAwB,GAAG,IAAI,CACzC,iBAAiB,EACjB,iBAAiB,GAAG,sBAAsB,CAC3C,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,aAAa,EAAE,OAAO,aAAa,CAAC;IACpC,eAAe,EAAE,OAAO,eAAe,CAAC;IACxC,eAAe,EAAE,OAAO,eAAe,CAAC;IACxC,gBAAgB,EAAE,OAAO,gBAAgB,CAAC;IAC1C;0DACsD;IACtD,oBAAoB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACrD,mBAAmB,EAAE,OAAO,mBAAmB,CAAC;IAChD,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;IACxD,oBAAoB,EAAE,OAAO,0BAA0B,CAAC;IACxD,aAAa,EAAE,OAAO,aAAa,CAAC;CACrC,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,OAAO,CAAC,iBAAiB,CAAM,GAAG,cAAc,CA0TzF;AAgBD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,cAAc,EACpB,WAAW,UAAQ,EACnB,YAAY,UAAQ,GACnB,MAAM,EAAE,CAuDV"}