@claudexor/harness-claude 3.13.0 → 3.14.0

package/dist/model-probe.js

@@ -0,0 +1,396 @@
+/**
+ * Live Claude model inventory from the prompt-free `initialize` handshake.
+ *
+ * The installed `claude` CLI answers a bare `initialize` control_request on
+ * stdin with its model picker (`models[]`: the selectors `--model` accepts,
+ * what each resolves to, a display name) and exits 0 on stdin EOF, without a
+ * prompt, without a generation, and — with the flags below — without a login
+ * (live-measured 2.1.280: 0.2 s, one stdout line, zero stderr). That answer is
+ * the ONE producer behind the adapter's `models()`, so a model the vendor ships
+ * after this release is selectable without a Claudexor release per model.
+ *
+ * What the picker is and is not (INV-104): it proves PRESENCE — "this binary,
+ * on this route, offers these selectors" — never absence. It accepts ids it
+ * does not list (`claude-opus-5-5`, older exact ids), it is modulated by the
+ * account (an API key adds `sonnet[1m]`, a Max plan changes the Fable row),
+ * and it ECHOES local configuration as fabricated rows (`--model`,
+ * `ANTHROPIC_MODEL`, a settings.json `model`; live-measured). Hence:
+ * `CLAUDE_MODEL_INVENTORY` declares absence ADVISORY, the probe never passes
+ * `--model`, runs with `--setting-sources ""` (no hooks, no settings echo) and
+ * `--strict-mcp-config`, scrubs the model-override env, and every consumer
+ * gets the frozen `CLAUDE_KNOWN_MODELS` ids appended as `origin: "hint"` rows —
+ * presence never shrinks below today's manifest, even when the binary is gone.
+ *
+ * Scopes (owner decision 2026-09-24, Q5=A: an account view reads the account):
+ *  - PROFILE-BOUND, `config_dir_login`: the profile's own `CLAUDE_CONFIG_DIR`
+ *    and keychain bridge exactly as its runs use, bootstrap allowed, so the
+ *    account's own rows (server-provided options, org default, entitlement
+ *    filtering) appear in account views.
+ *  - PROFILE-BOUND, `api_key` / `oauth_token`: the profile's own credential in
+ *    the env var its runs use (`ANTHROPIC_API_KEY` / `CLAUDE_CODE_OAUTH_TOKEN`),
+ *    under a scratch `HOME` + `CLAUDE_CONFIG_DIR`, bootstrap allowed — the
+ *    picker an API-key account sees (`sonnet[1m]`, …) is not the logged-out
+ *    menu. The cache key is the profile id; no secret byte ever keys anything.
+ *  - BINARY-ONLY (no profile — the unscoped listing): a disposable scratch
+ *    `HOME` + `CLAUDE_CONFIG_DIR` under the Claudexor-owned state root and
+ *    `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1` — no credential is read,
+ *    nothing outside the scratch dir is written.
+ *
+ * One cached single-flight capture per (scope, binary identity): concurrent
+ * callers share one child, a caller's abort never reaches it, answers live for
+ * an hour, failures for a minute, and a binary that changes on disk is
+ * re-probed on the next call without a daemon restart.
+ */
+import { mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { composeBaseEnv, harnessBinaryIdentity, harnessBinaryIdentityOnPath, providerScrubEnv, runCapture, } from "@claudexor/core";
+import { resolveSecret } from "@claudexor/secrets";
+import { ensureDir, nativeHarnessStateRoot } from "@claudexor/util";
+import { CLAUDE_KNOWN_MODELS } from "./capability-profile.js";
+import { BIN } from "./effort-probe.js";
+import { claudeNativeEnv } from "./index.js";
+import { CLAUDE_INIT_REQUEST_ID } from "./interactive.js";
+import { canonicalProfileConfigDir } from "./profile.js";
+/**
+ * The manifest declaration of what `models()` proves — kept beside the
+ * producer so the two halves cannot drift apart (INV-104, codex precedent).
+ * `model_inventory_routes` is OMITTED on purpose: the picker answers on every
+ * route (logged out included), so the producer serves unscoped queries too.
+ */
+export const CLAUDE_MODEL_INVENTORY = {
+    model_inventory_absence: "advisory",
+};
+/** Exactly what the probe spawns. NEVER `--model`: the picker echoes it back
+ * as a fabricated row with an invented effort ladder. */
+export const CLAUDE_MODEL_PROBE_ARGS = [
+    "-p",
+    "--input-format",
+    "stream-json",
+    "--output-format",
+    "stream-json",
+    "--verbose",
+    "--setting-sources",
+    "",
+    "--strict-mcp-config",
+];
+export const CLAUDE_MODEL_PROBE_TIMEOUT_MS = 10_000;
+export const CLAUDE_MODEL_PROBE_TTL_MS = 60 * 60_000;
+export const CLAUDE_MODEL_PROBE_FAILURE_TTL_MS = 60_000;
+/** Same bound and eviction as the codex effort cache: expired first, then
+ * oldest-inserted. The population is tiny (one binary × one scope per
+ * profile), so eviction only ever bites a rotated binary's dead keys. */
+const CLAUDE_MODEL_PROBE_CACHE_MAX_ENTRIES = 64;
+/** The one stdin frame: the initialize handshake interactive runs also open with. */
+export function claudeInitializeFrame() {
+    return (JSON.stringify({
+        type: "control_request",
+        request_id: CLAUDE_INIT_REQUEST_ID,
+        request: { subtype: "initialize" },
+    }) + "\n");
+}
+/**
+ * Pure parse of the probe's stdout: the line whose `control_response` answers
+ * OUR request id with `subtype: "success"` and a `models` array. Hook frames
+ * (`system/hook_started`, …) may precede it, so the frame is selected by id,
+ * never by position. Anything else — no such frame, an error subtype, a
+ * non-array picker — is a probe failure (`null`), never "no models".
+ * `description`, effort fields and `supportsFastMode` are deliberately not
+ * read (no per-model effort harvesting in v1; no regex over model prose).
+ */
+export function parseClaudeInitialize(stdout, requestId) {
+    for (const line of stdout.split(/\r?\n/)) {
+        if (!line.trim())
+            continue;
+        let frame;
+        try {
+            frame = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (!isRecord(frame) || frame["type"] !== "control_response")
+            continue;
+        const response = frame["response"];
+        if (!isRecord(response) || response["request_id"] !== requestId)
+            continue;
+        if (response["subtype"] !== "success")
+            return null;
+        const body = response["response"];
+        const models = isRecord(body) ? body["models"] : undefined;
+        if (!Array.isArray(models))
+            return null;
+        const rows = [];
+        for (const row of models) {
+            if (!isRecord(row))
+                continue;
+            const value = row["value"];
+            if (typeof value !== "string" || !value.trim())
+                continue;
+            rows.push({
+                value,
+                displayName: nonBlank(row["displayName"]),
+                resolvedModel: nonBlank(row["resolvedModel"]),
+            });
+        }
+        return { models: rows };
+    }
+    return null;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonBlank(value) {
+    return typeof value === "string" && value.trim() ? value : null;
+}
+/**
+ * The rows every consumer sees, in this order and deduplicated by exact id:
+ *  1. each picker selector verbatim (`origin: "live"`, `resolved_model` = what
+ *     the vendor says it resolves to; the alias→resolution link stays on the
+ *     alias row);
+ *  2. each resolution not already a row of its own (`origin: "live"`) — a
+ *     vendor-endorsed exact id a dropdown can pin (owner Q7: no free text);
+ *  3. every frozen `CLAUDE_KNOWN_MODELS` id not already present
+ *     (`origin: "hint"`) — the presence floor, which is ALL of the answer when
+ *     the probe failed. `context_window: null` always (the only sources would
+ *     be the `[1m]` suffix or description prose); `routes: null` (the answer
+ *     already reflects the route it ran under).
+ */
+export function claudeModelRows(answer) {
+    const rows = [];
+    const seen = new Set();
+    const push = (id, label, origin, resolvedModel) => {
+        if (seen.has(id))
+            return;
+        seen.add(id);
+        rows.push({
+            id,
+            label,
+            context_window: null,
+            routes: null,
+            origin,
+            resolved_model: resolvedModel,
+        });
+    };
+    for (const row of answer?.models ?? [])
+        push(row.value, row.displayName, "live", row.resolvedModel);
+    for (const row of answer?.models ?? []) {
+        if (row.resolvedModel !== null)
+            push(row.resolvedModel, null, "live", null);
+    }
+    for (const id of CLAUDE_KNOWN_MODELS)
+        push(id, null, "hint", null);
+    return rows;
+}
+/**
+ * Which store the probe reads. A `config_dir_login` profile is probed under
+ * its OWN config dir; an `api_key` / `oauth_token` profile with its OWN
+ * credential in the env var its runs use; no profile (the unscoped listing)
+ * gets the credential-free binary probe. The scope key is the account half of
+ * the cache key; it never carries secret bytes (a config dir path or a profile
+ * id, not a token).
+ */
+export function claudeModelProbeScope(spec) {
+    const profile = spec?.credentialProfile;
+    if (profile?.credential_kind === "config_dir_login") {
+        const configDir = canonicalProfileConfigDir(profile.isolation_locator ?? "");
+        return { kind: "profile", key: `config:${configDir}`, configDir };
+    }
+    if (profile?.credential_kind === "api_key" || profile?.credential_kind === "oauth_token") {
+        return {
+            kind: "credential",
+            key: `credential:${profile.profile_id}`,
+            envKey: profile.credential_kind === "api_key" ? "ANTHROPIC_API_KEY" : "CLAUDE_CODE_OAUTH_TOKEN",
+            secretRef: profile.secret_ref ?? null,
+        };
+    }
+    return { kind: "binary", key: "binary" };
+}
+/**
+ * Env keys whose value the picker echoes as a fabricated row (`ANTHROPIC_MODEL`)
+ * or folds into `resolvedModel` (`ANTHROPIC_DEFAULT_<FAMILY>_MODEL`,
+ * live-measured). Matched on the KEY NAME so any future family is covered.
+ */
+function isModelOverrideEnvKey(key) {
+    return key === "ANTHROPIC_MODEL" || /^ANTHROPIC_DEFAULT_[A-Z0-9_]*MODEL$/.test(key);
+}
+/**
+ * The env PATCH the probe child spawns under (applied by `runCapture` over the
+ * normalized host env; `null` deletes). Provider secrets are scrubbed on every
+ * scope; the profile scope re-adds nothing (the keychain bridge IS the
+ * credential transport), the credential scope re-adds exactly the profile's
+ * own variable, and both credential-free scopes point HOME/config at the
+ * scratch dir. Every model-override key present anywhere in the effective env
+ * is deleted explicitly so the answer describes the binary, not this host.
+ */
+export function claudeModelProbeEnv(scope, base, scratchDir, secret = null) {
+    const patch = scope.kind === "profile"
+        ? { ...claudeNativeEnv(base, scope.configDir) }
+        : {
+            ...(base ?? {}),
+            ...providerScrubEnv(),
+            HOME: scratchDir,
+            USERPROFILE: scratchDir,
+            CLAUDE_CONFIG_DIR: scratchDir,
+            // A credential scope needs the bootstrap (its rows come from the
+            // account); the binary scope must not talk to anyone.
+            ...(scope.kind === "credential"
+                ? { [scope.envKey]: secret }
+                : { CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1" }),
+        };
+    for (const key of [...Object.keys(composeBaseEnv("mirror_native")), ...Object.keys(patch)]) {
+        if (isModelOverrideEnvKey(key))
+            patch[key] = null;
+    }
+    return patch;
+}
+/**
+ * Which bytes the probe will run, resolved exactly the way the spawn layer
+ * resolves a bare `claude`: the normalized host env, unless the caller's env
+ * patch carries a PATH — the spawn layer applies that patch verbatim over the
+ * normalized env, so such a child resolves on the patch PATH alone and the
+ * probe must not re-normalize it (it would key and capture the managed binary
+ * while the run executes the override). The probe's own HOME overrides are
+ * never applied here either.
+ */
+function probeBinaryIdentity(base, deps) {
+    const patchPath = base?.["PATH"];
+    if (typeof patchPath === "string") {
+        return (deps.binaryIdentityOnPath ?? harnessBinaryIdentityOnPath)(BIN, patchPath);
+    }
+    return (deps.binaryIdentity ?? harnessBinaryIdentity)(BIN, composeBaseEnv("mirror_native"));
+}
+const cache = new Map();
+const pending = new Map();
+/** Drop every cached answer and forget in-flight probes (tests). A login or
+ * logout changes the account half of a profile scope, and nothing calls this
+ * on that path today: such a profile can serve its previous rows for up to
+ * the hour-long TTL, and `fresh: true` on the query is the bypass. */
+export function clearClaudeModelProbeCache() {
+    cache.clear();
+    pending.clear();
+}
+function store(key, entry, nowMs) {
+    for (const [k, v] of cache)
+        if (v.expiresAtMs <= nowMs)
+            cache.delete(k);
+    cache.delete(key);
+    while (cache.size >= CLAUDE_MODEL_PROBE_CACHE_MAX_ENTRIES) {
+        const oldest = cache.keys().next();
+        if (oldest.done)
+            break;
+        cache.delete(oldest.value);
+    }
+    cache.set(key, entry);
+}
+function cacheKey(scope, identity) {
+    // A JSON array, never a joined string: two halves are paths.
+    return JSON.stringify([scope.key, identity.path, identity.ino, identity.size, identity.mtimeMs]);
+}
+/**
+ * One capture. Spawns the exact identity path (so the bytes probed are the
+ * bytes keyed), in a fresh scratch cwd that is never a repository (a `-p`
+ * start inside a repo would load its project hooks and `.mcp.json`), and
+ * removes the scratch dir afterwards whatever happened. Null = failure.
+ */
+async function captureOnce(scope, base, identity, capture, secret) {
+    const root = join(nativeHarnessStateRoot(), "claude", "model-probe");
+    ensureDir(root);
+    const scratch = mkdtempSync(join(root, "probe-"));
+    try {
+        const result = await capture(identity.path, [...CLAUDE_MODEL_PROBE_ARGS], {
+            env: claudeModelProbeEnv(scope, base, scratch, secret),
+            cwd: scratch,
+            input: claudeInitializeFrame(),
+            timeoutMs: CLAUDE_MODEL_PROBE_TIMEOUT_MS,
+            cancelSignal: "SIGTERM",
+            cancelKillDelayMs: 0,
+        });
+        // A killed or timed-out child may have flushed a complete-looking line
+        // before the signal landed; those bytes are not a fresh vendor answer.
+        if (result.signal !== null)
+            return null;
+        return parseClaudeInitialize(result.stdout, CLAUDE_INIT_REQUEST_ID);
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
+/**
+ * The adapter's `models()`: TOTAL and never empty. Any failure — the binary
+ * missing, a spawn error, a timeout/signal, an unparseable answer, an env
+ * derivation error (bad profile locator, keychain bridge) — yields the hint
+ * rows alone, so presence never shrinks below the manifest and a listing can
+ * never make a caller believe the account has no models.
+ */
+export async function probeClaudeModels(spec, deps = {}) {
+    const fallback = () => claudeModelRows(null);
+    if (spec?.abortSignal?.aborted)
+        return fallback();
+    const nowMs = deps.nowMs ?? Date.now;
+    let key;
+    let flight;
+    try {
+        const scope = claudeModelProbeScope(spec);
+        // A credential profile whose secret is not stored cannot be probed as that
+        // account (its runs refuse too): hints, no spawn, nothing cached.
+        const secret = scope.kind === "credential" && scope.secretRef
+            ? (deps.resolveProfileSecret ?? resolveSecret)(scope.secretRef)
+            : null;
+        if (scope.kind === "credential" && !secret)
+            return fallback();
+        const identity = probeBinaryIdentity(spec?.env, deps);
+        if (identity === null)
+            return fallback();
+        key = cacheKey(scope, identity);
+        if (!spec?.fresh) {
+            const hit = cache.get(key);
+            if (hit && hit.expiresAtMs > nowMs())
+                return [...hit.rows];
+        }
+        const inFlight = pending.get(key);
+        if (inFlight !== undefined)
+            return await awaitProbe(inFlight, spec?.abortSignal, fallback);
+        // The capture owns its own bound; no caller's signal reaches it, so one
+        // cancelled caller cannot hand every later caller a killed capture.
+        const started = nowMs();
+        flight = captureOnce(scope, spec?.env, identity, deps.runCapture ?? runCapture, secret)
+            .catch(() => null)
+            .then((answer) => {
+            const rows = claudeModelRows(answer);
+            // A probe superseded by a cache clear is not stored: its scope may no
+            // longer describe the store (login/logout changed it).
+            if (pending.get(key) === flight) {
+                const ttl = answer === null ? CLAUDE_MODEL_PROBE_FAILURE_TTL_MS : CLAUDE_MODEL_PROBE_TTL_MS;
+                store(key, { rows, expiresAtMs: started + ttl }, nowMs());
+            }
+            return rows;
+        })
+            .finally(() => {
+            if (pending.get(key) === flight)
+                pending.delete(key);
+        });
+        pending.set(key, flight);
+    }
+    catch {
+        return fallback();
+    }
+    return await awaitProbe(flight, spec?.abortSignal, fallback);
+}
+/** Bound only the CALLER's wait: an aborted caller reads the hint rows while
+ * the shared capture keeps running for everybody else. */
+function awaitProbe(flight, signal, fallback) {
+    const settle = flight.then((rows) => [...rows], () => fallback());
+    if (!signal)
+        return settle;
+    if (signal.aborted)
+        return Promise.resolve(fallback());
+    return new Promise((resolve) => {
+        const onAbort = () => resolve(fallback());
+        signal.addEventListener("abort", onAbort, { once: true });
+        void settle.then((rows) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(signal.aborted ? fallback() : rows);
+        });
+    });
+}
+//# sourceMappingURL=model-probe.js.map

package/dist/model-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-probe.js","sourceRoot":"","sources":["../src/model-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,UAAU,GAEX,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAIzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,uBAAuB,EAAE,UAAU;CAIpC,CAAC;AAEF;yDACyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,IAAI;IACJ,gBAAgB;IAChB,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,WAAW;IACX,mBAAmB;IACnB,EAAE;IACF,qBAAqB;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,MAAM,CAAC;AACrD,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC;AACxD;;yEAEyE;AACzE,MAAM,oCAAoC,GAAG,EAAE,CAAC;AAEhD,qFAAqF;AACrF,MAAM,UAAU,qBAAqB;IACnC,OAAO,CACL,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,sBAAsB;QAClC,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;KACnC,CAAC,GAAG,IAAI,CACV,CAAC;AACJ,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,SAAiB;IAEjB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,kBAAkB;YAAE,SAAS;QACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,SAAS;YAAE,SAAS;QAC1E,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,IAAI,GAAgC,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;gBAAE,SAAS;YACzD,IAAI,CAAC,IAAI,CAAC;gBACR,KAAK;gBACL,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACzC,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqC;IACnE,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CACX,EAAU,EACV,KAAoB,EACpB,MAAuB,EACvB,aAA4B,EACtB,EAAE;QACR,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QACzB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,IAAI,CAAC;YACR,EAAE;YACF,KAAK;YACL,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,IAAI;YACZ,MAAM;YACN,cAAc,EAAE,aAAa;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,MAAM,IAAI,EAAE;QACpC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,mBAAmB;QAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAuB;IAC3D,MAAM,OAAO,GAAG,IAAI,EAAE,iBAAiB,CAAC;IACxC,IAAI,OAAO,EAAE,eAAe,KAAK,kBAAkB,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,IAAI,OAAO,EAAE,eAAe,KAAK,aAAa,EAAE,CAAC;QACzF,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,GAAG,EAAE,cAAc,OAAO,CAAC,UAAU,EAAE;YACvC,MAAM,EACJ,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB;YACzF,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;SACtC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,OAAO,GAAG,KAAK,iBAAiB,IAAI,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA4B,EAC5B,IAAqB,EACrB,UAAkB,EAClB,MAAM,GAAkB,IAAI;IAE5B,MAAM,KAAK,GACT,KAAK,CAAC,IAAI,KAAK,SAAS;QACtB,CAAC,CAAC,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE;QAC/C,CAAC,CAAC;YACE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YACf,GAAG,gBAAgB,EAAE;YACrB,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,UAAU;YACvB,iBAAiB,EAAE,UAAU;YAC7B,iEAAiE;YACjE,sDAAsD;YACtD,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY;gBAC7B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE;gBAC5B,CAAC,CAAC,EAAE,wCAAwC,EAAE,GAAG,EAAE,CAAC;SACvD,CAAC;IACR,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3F,IAAI,qBAAqB,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,IAAqB,EACrB,IAA0B;IAE1B,MAAM,SAAS,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,oBAAoB,IAAI,2BAA2B,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,qBAAqB,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC;AAC9F,CAAC;AAgBD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;AAE3D;;;sEAGsE;AACtE,MAAM,UAAU,0BAA0B;IACxC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,KAAK,CAAC,GAAW,EAAE,KAAiB,EAAE,KAAa;IAC1D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK;YAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,OAAO,KAAK,CAAC,IAAI,IAAI,oCAAoC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM;QACvB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ,CAAC,KAA4B,EAAE,QAA+B;IAC7E,6DAA6D;IAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CACxB,KAA4B,EAC5B,IAAqB,EACrB,QAA+B,EAC/B,OAA0B,EAC1B,MAAqB;IAErB,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IACrE,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,uBAAuB,CAAC,EAAE;YACxE,GAAG,EAAE,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;YACtD,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,qBAAqB,EAAE;YAC9B,SAAS,EAAE,6BAA6B;YACxC,YAAY,EAAE,SAAS;YACvB,iBAAiB,EAAE,CAAC;SACrB,CAAC,CAAC;QACH,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB,EACvB,IAAI,GAAyB,EAAE;IAE/B,MAAM,QAAQ,GAAG,GAAmB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,IAAI,EAAE,WAAW,EAAE,OAAO;QAAE,OAAO,QAAQ,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,IAAI,GAAW,CAAC;IAChB,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC1C,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,SAAS;YAC5C,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,IAAI,aAAa,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,EAAE,CAAC;QACzC,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,GAAG,KAAK,EAAE;gBAAE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3F,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC;QACxB,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,IAAI,UAAU,EAAE,MAAM,CAAC;aACpF,KAAK,CAAC,GAAkC,EAAE,CAAC,IAAI,CAAC;aAChD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACrC,sEAAsE;YACtE,uDAAuD;YACvD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC;gBAChC,MAAM,GAAG,GACP,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,yBAAyB,CAAC;gBAClF,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,GAAG,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACL,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED;0DAC0D;AAC1D,SAAS,UAAU,CACjB,MAA+B,EAC/B,MAA+B,EAC/B,QAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CACxB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,EACnB,GAAG,EAAE,CAAC,QAAQ,EAAE,CACjB,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3B,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;QAC7C,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/vendor-cli-version.d.ts

@@ -1,14 +1,16 @@
 import type { PinnedVendorCliVersion } from "@claudexor/util";
 /**
  * The ONE Claude vendor-CLI version this Claudexor release is verified
- * against — the pinned-install SSOT (issue #89). Three readers alias it and
+ * against — the pinned-install SSOT (issue #89). Two readers alias it and
  * therefore can never drift apart:
- * - `CLAUDE_KNOWN_MODELS_VERIFIED_AGAINST` (model-truth freshness gate),
  * - `CLAUDE_EFFORT_SNAPSHOT_VERIFIED_AGAINST` (effort-snapshot trust gate),
  * - the remote harness installer's exact `@anthropic-ai/claude-code@<v>` pin.
- * Bump it ONLY while re-verifying the known-model list and re-recording the
- * effort snapshot against the same CLI build — the stamp is a verification
- * claim, not a wish.
+ * `CLAUDE_KNOWN_MODELS_VERIFIED_AGAINST` deliberately does NOT alias it: that
+ * stamp records when the hint list was last actually re-verified, and a pin
+ * bump never re-checks model ids.
+ * Bump it ONLY while re-recording the effort snapshot (`--help` capture) and
+ * the recordable fixtures against the same CLI build — the stamp is a
+ * verification claim, not a wish.
  */
 export declare const CLAUDE_VENDOR_CLI_VERSION: PinnedVendorCliVersion;
 //# sourceMappingURL=vendor-cli-version.d.ts.map

package/dist/vendor-cli-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vendor-cli-version.d.ts","sourceRoot":"","sources":["../src/vendor-cli-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAAkC,CAAC"}
+{"version":3,"file":"vendor-cli-version.d.ts","sourceRoot":"","sources":["../src/vendor-cli-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAAkC,CAAC"}

package/dist/vendor-cli-version.js

@@ -1,13 +1,15 @@
 /**
  * The ONE Claude vendor-CLI version this Claudexor release is verified
- * against — the pinned-install SSOT (issue #89). Three readers alias it and
+ * against — the pinned-install SSOT (issue #89). Two readers alias it and
  * therefore can never drift apart:
- * - `CLAUDE_KNOWN_MODELS_VERIFIED_AGAINST` (model-truth freshness gate),
  * - `CLAUDE_EFFORT_SNAPSHOT_VERIFIED_AGAINST` (effort-snapshot trust gate),
  * - the remote harness installer's exact `@anthropic-ai/claude-code@<v>` pin.
- * Bump it ONLY while re-verifying the known-model list and re-recording the
- * effort snapshot against the same CLI build — the stamp is a verification
- * claim, not a wish.
+ * `CLAUDE_KNOWN_MODELS_VERIFIED_AGAINST` deliberately does NOT alias it: that
+ * stamp records when the hint list was last actually re-verified, and a pin
+ * bump never re-checks model ids.
+ * Bump it ONLY while re-recording the effort snapshot (`--help` capture) and
+ * the recordable fixtures against the same CLI build — the stamp is a
+ * verification claim, not a wish.
  */
-export const CLAUDE_VENDOR_CLI_VERSION = "2.1.261";
+export const CLAUDE_VENDOR_CLI_VERSION = "2.1.281";
 //# sourceMappingURL=vendor-cli-version.js.map

package/dist/vendor-cli-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"vendor-cli-version.js","sourceRoot":"","sources":["../src/vendor-cli-version.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA2B,SAAS,CAAC"}
+{"version":3,"file":"vendor-cli-version.js","sourceRoot":"","sources":["../src/vendor-cli-version.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA2B,SAAS,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudexor/harness-claude",
-  "version": "3.13.0",
+  "version": "3.14.0",
   "license": "MIT",
   "description": "Claude Code adapter (claude -p --output-format stream-json).",
   "type": "module",
@@ -16,10 +16,10 @@
     "dist"
   ],
   "dependencies": {
-    "@claudexor/core": "3.13.0",
-    "@claudexor/secrets": "3.13.0",
-    "@claudexor/util": "3.13.0",
-    "@claudexor/schema": "3.13.0"
+    "@claudexor/core": "3.14.0",
+    "@claudexor/util": "3.14.0",
+    "@claudexor/schema": "3.14.0",
+    "@claudexor/secrets": "3.14.0"
   },
   "repository": {
     "type": "git",