@dynamicagents/plugins 0.12.0 → 0.14.0

package/dist/claude-code/events.js

@@ -1,3 +1,18 @@
+import { initCard, resultCard, thinkingCard, toolCallCard, toolResultCard } from "./cards.js";
+/**
+ * How far a thinking line's arrival may be from its own `timestamp` for the
+ * block to be timed.
+ *
+ * Both ends of a block are timed by when they arrive, which is only the truth
+ * while the drain reads live. A drain that re-attached after a cut is handed
+ * what was printed meanwhile in one burst, and its arrival times are the
+ * replay's — so a block whose line arrived far from when the CLI stamped it
+ * reads "Thought", with no time. Locally a line arrives 5–31 ms after its
+ * stamp; a re-attach has been measured at about a second. A container clock
+ * this far from the Worker's degrades every block to no time, rather than to a
+ * wrong one.
+ */
+export const LIVE_SLACK_MS = 5_000;
 const EMPTY_USAGE = {
     input: 0,
     output: 0,
@@ -27,29 +42,86 @@ function readUsage(raw) {
     };
 }
 /**
- * Flatten an `assistant` message into a line of prose and the tools it called.
+ * An `assistant` message as events, one per block, in the order it said them.
  *
- * `thinking` blocks are dropped. They are the model's private reasoning, they
- * are the largest thing in the stream by a wide margin, and the parent agent is
- * being shown progress rather than asked to review the subagent's deliberation.
+ * Per block rather than flattened, because the blocks are different things to
+ * a reader: prose, the model's reasoning, and each tool it called. A message
+ * that only calls tools is as much progress as one that narrates.
  */
-function readAssistant(message) {
+function readAssistant(message, thought) {
+    const messageId = str(message.id);
     const content = Array.isArray(message.content)
         ? message.content
         : [];
-    const text = [];
-    const tools = [];
+    const events = [];
     for (const block of content) {
         if (!asRecord(block))
             continue;
-        const blockText = str(block.text);
-        if (block.type === "text" && blockText)
-            text.push(blockText.trim());
-        const toolName = str(block.name);
-        if (block.type === "tool_use" && toolName)
-            tools.push(toolName);
+        if (block.type === "text") {
+            // Trimmed only to ask whether it is empty: indentation is a code block's
+            // and trailing spaces a hard break's, so the event keeps it verbatim.
+            const text = str(block.text);
+            if (text?.trim())
+                events.push({ kind: "text", text });
+        }
+        else if (block.type === "thinking") {
+            events.push({
+                kind: "thinking",
+                ...(messageId ? { messageId } : {}),
+                ...(thought === undefined ? {} : { durationMs: thought })
+            });
+        }
+        else if (block.type === "tool_use") {
+            const id = str(block.id);
+            const name = str(block.name);
+            if (id && name)
+                events.push({ kind: "toolUse", id, name, input: block.input });
+        }
+    }
+    return events;
+}
+/**
+ * A `user` line's tool results. Anything else a user line carries — the
+ * prompt echoed back, a hook's note — is not a tool's answer and says nothing.
+ */
+function readToolResults(event, message) {
+    const content = Array.isArray(message.content) ? message.content : [];
+    const results = content.filter((block) => asRecord(block)?.type === "tool_result");
+    const structured = results.length === 1 ? event.tool_use_result : undefined;
+    const events = [];
+    for (const block of results) {
+        const id = str(block.tool_use_id);
+        if (!id)
+            continue;
+        events.push({
+            kind: "toolResult",
+            id,
+            isError: block.is_error === true,
+            content: resultText(block.content),
+            ...(structured === undefined || structured === null ? {} : { structured })
+        });
     }
-    return { text: text.join(" ").replace(/\s+/g, " ").trim(), tools };
+    return events;
+}
+/**
+ * A `tool_result` block's content as text. It is a string, or a list of
+ * blocks of which only the text ones are readable here — an image a tool
+ * returned is named, not carried.
+ */
+function resultText(content) {
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .map((block) => {
+        const record = asRecord(block);
+        if (record?.type === "text")
+            return str(record.text) ?? "";
+        return record?.type ? `[${String(record.type)}]` : "";
+    })
+        .filter(Boolean)
+        .join("\n");
 }
 /**
  * Read a `system`/`permission_denied` line into something worth reporting.
@@ -87,8 +159,13 @@ function readDenial(event) {
  * the filter.
  *
  * `result` and `init` are never nested and are read unconditionally.
+ *
+ * `clock` is when this read arrived, and the pending thinking block's start
+ * from the previous read — see {@link ParsedStream.thinkingFrom}. Without it no
+ * block is timed.
  */
-export function parseStream(buffer) {
+export function parseStream(buffer, clock) {
+    let thinkingFrom = clock?.thinkingFrom;
     const events = [];
     let skipped = 0;
     let nested = 0;
@@ -131,6 +208,7 @@ export function parseStream(buffer) {
             nested++;
             continue;
         }
+        const at = readTime(event.timestamp);
         switch (event.type) {
             case "system": {
                 if (event.subtype === "init") {
@@ -140,10 +218,14 @@ export function parseStream(buffer) {
                         break;
                     }
                     const model = str(event.model);
+                    const cwd = str(event.cwd);
+                    const permissionMode = str(event.permissionMode);
                     events.push({
                         kind: "init",
                         sessionId,
-                        ...(model ? { model } : {})
+                        ...(model ? { model } : {}),
+                        ...(cwd ? { cwd } : {}),
+                        ...(permissionMode ? { permissionMode } : {})
                     });
                     break;
                 }
@@ -151,6 +233,11 @@ export function parseStream(buffer) {
                     events.push(readDenial(event));
                     break;
                 }
+                if (event.subtype === "thinking_tokens") {
+                    if (clock)
+                        thinkingFrom ??= clock.now;
+                    break;
+                }
                 if (event.subtype === "api_retry") {
                     events.push({
                         kind: "retry",
@@ -176,19 +263,25 @@ export function parseStream(buffer) {
                     skip(trimmed);
                     break;
                 }
-                const { text, tools } = readAssistant(message);
-                if (!text && tools.length === 0)
-                    break;
-                events.push({ kind: "assistant", text, tools });
+                // Ended by its own line's arrival, and trusted only on a live read.
+                const thought = clock !== undefined &&
+                    thinkingFrom !== undefined &&
+                    at !== undefined &&
+                    Math.abs(clock.now - at) <= LIVE_SLACK_MS
+                    ? clock.now - thinkingFrom
+                    : undefined;
+                events.push(...readAssistant(message, thought));
                 break;
             }
             // `user` messages on this stream are tool *results* being fed back to the
-            // model, not anything a human said. They are large, they are already
-            // summarised by the assistant turn that follows, and the un-nested ones
-            // belong to the outer run's own tools — so they are deliberately not
-            // surfaced as progress.
-            case "user":
+            // model, not anything a human said — each one completes the card its call
+            // opened.
+            case "user": {
+                const message = asRecord(event.message);
+                if (message)
+                    events.push(...readToolResults(event, message));
                 break;
+            }
             case "result": {
                 events.push({ kind: "result", result: readResult(event) });
                 break;
@@ -216,8 +309,17 @@ export function parseStream(buffer) {
             default:
                 skip(trimmed);
         }
+        if (at !== undefined)
+            thinkingFrom = undefined;
     }
-    return { events, carry, skipped, nested, ...(sample ? { sample } : {}) };
+    return {
+        events,
+        carry,
+        skipped,
+        nested,
+        ...(sample ? { sample } : {}),
+        ...(thinkingFrom === undefined ? {} : { thinkingFrom })
+    };
 }
 /**
  * Read a `rate_limit_event` line, or nothing when it carries no status.
@@ -255,6 +357,11 @@ function readRateLimit(event) {
             : {})
     };
 }
+/** A line's `timestamp`, in epoch milliseconds, or `undefined`. */
+function readTime(value) {
+    const ms = typeof value === "string" ? Date.parse(value) : NaN;
+    return Number.isFinite(ms) ? ms : undefined;
+}
 /** Whether a millisecond value is one `Date` can actually represent. */
 function isRealDate(ms) {
     return Number.isFinite(ms) && !Number.isNaN(new Date(ms).getTime());
@@ -279,6 +386,7 @@ function readResult(event) {
         : 0;
     const sessionId = str(event.session_id);
     const spawned = stats ? num(stats.spawned) : undefined;
+    const errors = readErrors(event.errors);
     return {
         subtype: str(event.subtype) ?? "unknown",
         isError: event.is_error === true,
@@ -290,9 +398,40 @@ function readResult(event) {
         costUsd: num(event.total_cost_usd),
         usage: readUsage(event.usage),
         ...(spawned === undefined ? {} : { subagentsSpawned: spawned }),
-        permissionDenials: denials
+        permissionDenials: denials,
+        ...(errors.length > 0 ? { errors } : {}),
+        ...(event.structured_output === undefined ||
+            event.structured_output === null
+            ? {}
+            : { structured: event.structured_output })
     };
 }
+/**
+ * A result line's `errors`, as sentences.
+ *
+ * **Anything that is not a string is stringified rather than dropped**, which is
+ * the whole of the care this needs: the field is a vendor's, an entry carrying a
+ * code and a message is a perfectly likely shape for it, and on the run this
+ * exists to explain — a resume with nowhere to resume from — it is the only
+ * account of what happened. Dropping an unexpected entry would report that run
+ * as having failed for no stated reason.
+ */
+function readErrors(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw
+        .map((entry) => (typeof entry === "string" ? entry : safeJson(entry)))
+        .filter((entry) => entry.length > 0);
+}
+/** `value` as JSON, or as whatever `String` makes of it when it has no JSON. */
+function safeJson(value) {
+    try {
+        return JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        return String(value);
+    }
+}
 /**
  * How much of an unrecognised line is kept for the logs.
  *
@@ -301,14 +440,15 @@ function readResult(event) {
  */
 const SAMPLE_MAX_CHARS = 200;
 /**
- * Turn events into progress notes the parent can post.
+ * Turn events into progress notes for the parent's transcript.
  *
  * **`from` is the number of notes already emitted for this run, and the key is
  * derived from it.** Not from the note's content, not from a clock, and not from
  * the Claude Code `uuid` — from position alone.
  *
- * The reason is replay. A chunk that dies mid-drain is retried by the Workflow,
- * the re-attach replays the tail, and the same assistant turn is parsed twice. A
+ * The reason is replay. A drain that dies mid-stream is resumed from the last
+ * stored sequence, whatever arrived after it is read again, and the same
+ * assistant turn is parsed twice. A
  * content-derived key would make two identical notes collide *by luck* (and two
  * genuinely repeated notes — "Running tests" twice — collide wrongly). A
  * clock-derived key would never collide, so every replay would re-post
@@ -319,31 +459,30 @@ export function toProgress(events, from) {
     const out = [];
     let n = from;
     for (const event of events) {
-        const text = describe(event);
-        if (!text)
+        const note = describe(event);
+        if (!note)
             continue;
-        out.push({ key: `claude:${n}`, text });
+        out.push({ key: `claude:${n}`, ...note });
         n++;
     }
     return out;
 }
-/** One line of progress, or nothing when the event is not worth a note. */
+/** One note, or nothing when the event is not worth one. */
 function describe(event) {
     switch (event.kind) {
-        // Tool calls are not narration. A turn that only called tools said nothing
-        // the reader can act on, and it cost one Slack message per Bash/Read/Edit —
-        // nine of them for a one-line README edit. The tool names added nothing to
-        // the turns that *did* have text either, so the prefix goes with them.
-        //
-        // Same policy the in-process agents already apply in the gatekeeper
-        // (src/agents/shared/loop.ts: "Tool-only steps stay silent in Slack").
-        // Deliberately narrower than silencing the whole channel: `denied` and
-        // `retry` below stay, because they are the only evidence of a session that
-        // is being refused or throttled.
-        //
         // Never clipped. A plan or a report cut mid-sentence reads as complete.
-        case "assistant":
-            return event.text || undefined;
+        case "text":
+            return { text: event.text };
+        // Tool activity is a card, and a card never reaches the thread — core's
+        // `transcribeNote` keeps it on the transcript — so a session's every Bash,
+        // Read and Edit is shown without one message each in front of the person.
+        // `./cards.ts` holds how each tool reads.
+        case "toolUse":
+            return toolCallCard(event.id, event.name, event.input);
+        case "toolResult":
+            return toolResultCard(event);
+        case "thinking":
+            return thinkingCard(event.durationMs, event.messageId);
         case "denied":
             // The one progress note that is more useful than the session's own
             // account of itself. A refused tool call is invisible in the transcript —
@@ -351,12 +490,14 @@ function describe(event) {
             // parent sees a subagent being resourceful and never learns it was fenced
             // in. Named tool first, because that is what distinguishes a broken
             // configuration from a deny rule doing its job.
-            return `permission denied${event.tool ? ` for ${event.tool}` : ""}: ${event.reason}`;
+            return {
+                text: `permission denied${event.tool ? ` for ${event.tool}` : ""}: ${event.reason}`
+            };
         case "retry":
             // Surfaced deliberately. This is what a budget refusal from the egress
             // gateway looks like from inside the container, and a run that ends
             // shortly afterwards is explained by it.
-            return `retrying the model call: ${event.detail}`;
+            return { text: `retrying the model call: ${event.detail}` };
         case "rateLimit":
             /**
              * Silent while the bucket is fine, which is every line of a healthy
@@ -370,15 +511,19 @@ function describe(event) {
              */
             return event.info.status === RATE_LIMIT_OK
                 ? undefined
-                : `the ${event.info.rateLimitType ?? "subscription"} limit reports "${event.info.status}"` +
-                    (event.info.resetsAt === undefined
-                        ? ""
-                        : ` until ${new Date(event.info.resetsAt * 1000).toISOString()}`);
-        // `init` names a session id nobody outside this package can use, and
-        // `result` is the terminal outcome the caller reports itself.
+                : {
+                    text: `the ${event.info.rateLimitType ?? "subscription"} limit reports "${event.info.status}"` +
+                        (event.info.resetsAt === undefined
+                            ? ""
+                            : ` until ${new Date(event.info.resetsAt * 1000).toISOString()}`)
+                };
+        // `init`'s session id is a handle as well as news: it reaches the host on
+        // the drain's cursor — see `DrainCursor.sessionId` in ./run.ts — where
+        // something can record it and resume with it.
         case "init":
+            return initCard(event);
         case "result":
-            return undefined;
+            return resultCard(event.result);
     }
 }
 function clip(text, max) {

package/dist/claude-code/github.d.ts

@@ -0,0 +1,39 @@
+/**
+ * GitHub access for a session, with the token on the Worker side.
+ *
+ * The session is launched with {@link GITHUB_TOKEN_PLACEHOLDER} as `GH_TOKEN`,
+ * and git is given a credential helper that answers with it. The egress gateway swaps
+ * the placeholder for the real token on {@link GITHUB_HOSTS} only, so a process
+ * in the container can *use* GitHub as the deployment's account and can never
+ * *read* the token — the same containment as the Anthropic credential.
+ *
+ * Keyed on the placeholder, unlike the Anthropic swap: a GitHub request that
+ * did not ask for a credential stays anonymous, as it would be anywhere else.
+ */
+/** The hosts the token is ever sent to: git over HTTPS, and the API. */
+export declare const GITHUB_HOSTS: ReadonlySet<string>;
+/**
+ * What `GH_TOKEN` and git's credential helper hold. Shaped like a classic
+ * token, so nothing that checks the shape refuses it before sending it.
+ */
+export declare const GITHUB_TOKEN_PLACEHOLDER: string;
+/**
+ * The session's GitHub environment. A credential helper for `https://github.com`
+ * rather than a token in the remote URL, so the checkout's `.git/config` holds
+ * nothing and every git the session starts presents the placeholder.
+ */
+export declare function githubEnv(): Record<string, string>;
+/** The keys {@link githubEnv} owns, which a host's `env` may not set beside it. */
+export declare const GITHUB_ENV_KEYS: readonly string[];
+/** How an authorization header carried the placeholder, if it did. */
+type Presented = "bearer" | "basic";
+/**
+ * Whether `value` presents the placeholder: `Bearer`/`token` as `gh` sends it,
+ * or Basic `user:placeholder` as git does after a `401`.
+ */
+export declare function presentsPlaceholder(value: string | null): Presented | undefined;
+/** The real credential, in the scheme the placeholder came in. */
+export declare function githubAuthorization(presented: Presented, token: string): string;
+/** A refusal in GitHub's error shape, which `gh` and git both print. */
+export declare function githubError(message: string, status: number): Response;
+export {};

package/dist/claude-code/github.js

@@ -0,0 +1,82 @@
+/**
+ * GitHub access for a session, with the token on the Worker side.
+ *
+ * The session is launched with {@link GITHUB_TOKEN_PLACEHOLDER} as `GH_TOKEN`,
+ * and git is given a credential helper that answers with it. The egress gateway swaps
+ * the placeholder for the real token on {@link GITHUB_HOSTS} only, so a process
+ * in the container can *use* GitHub as the deployment's account and can never
+ * *read* the token — the same containment as the Anthropic credential.
+ *
+ * Keyed on the placeholder, unlike the Anthropic swap: a GitHub request that
+ * did not ask for a credential stays anonymous, as it would be anywhere else.
+ */
+/** The hosts the token is ever sent to: git over HTTPS, and the API. */
+export const GITHUB_HOSTS = new Set([
+    "github.com",
+    "api.github.com"
+]);
+/**
+ * What `GH_TOKEN` and git's credential helper hold. Shaped like a classic
+ * token, so nothing that checks the shape refuses it before sending it.
+ */
+export const GITHUB_TOKEN_PLACEHOLDER = "ghp_" + "0".repeat(36);
+/** The username GitHub expects beside a token in git's Basic auth. */
+const GIT_USER = "x-access-token";
+/**
+ * The session's GitHub environment. A credential helper for `https://github.com`
+ * rather than a token in the remote URL, so the checkout's `.git/config` holds
+ * nothing and every git the session starts presents the placeholder.
+ */
+export function githubEnv() {
+    return {
+        GH_TOKEN: GITHUB_TOKEN_PLACEHOLDER,
+        GIT_CONFIG_COUNT: "1",
+        GIT_CONFIG_KEY_0: "credential.https://github.com.helper",
+        // Answers `get` only; `store` and `erase` are no-ops that still exit 0.
+        GIT_CONFIG_VALUE_0: `!f() { if test "$1" = get; then printf 'username=${GIT_USER}\\npassword=%s\\n' "$GH_TOKEN"; fi; }; f`
+    };
+}
+/** The keys {@link githubEnv} owns, which a host's `env` may not set beside it. */
+export const GITHUB_ENV_KEYS = Object.keys(githubEnv());
+/**
+ * Whether `value` presents the placeholder: `Bearer`/`token` as `gh` sends it,
+ * or Basic `user:placeholder` as git does after a `401`.
+ */
+export function presentsPlaceholder(value) {
+    if (!value)
+        return undefined;
+    const [scheme = "", credential = ""] = value.trim().split(/\s+/, 2);
+    switch (scheme.toLowerCase()) {
+        case "bearer":
+        case "token":
+            return credential === GITHUB_TOKEN_PLACEHOLDER ? "bearer" : undefined;
+        case "basic": {
+            let decoded;
+            try {
+                decoded = atob(credential);
+            }
+            catch {
+                return undefined;
+            }
+            const password = decoded.slice(decoded.indexOf(":") + 1);
+            return decoded.includes(":") && password === GITHUB_TOKEN_PLACEHOLDER
+                ? "basic"
+                : undefined;
+        }
+        default:
+            return undefined;
+    }
+}
+/** The real credential, in the scheme the placeholder came in. */
+export function githubAuthorization(presented, token) {
+    return presented === "basic"
+        ? `Basic ${btoa(`${GIT_USER}:${token}`)}`
+        : `Bearer ${token}`;
+}
+/** A refusal in GitHub's error shape, which `gh` and git both print. */
+export function githubError(message, status) {
+    return new Response(JSON.stringify({ message }), {
+        status,
+        headers: { "content-type": "application/json" }
+    });
+}

package/dist/claude-code/index.d.ts

@@ -1,9 +1,5 @@
-import type { AgentPlugin } from "@dynamicagents/core";
-import type { CredentialStore, Lead } from "./credentials.js";
-import { type DrainCursor, type DrainOutcome, type DrainOptions, type SessionRuntime } from "./run.js";
-import { type ClaudeCodeConfig } from "./config.js";
 /**
- * `@dynamicagents/plugins/claude-code` — subtasks that run the Claude Code CLI.
+ * `@dynamicagents/plugins/claude-code` — sub-agents that run the Claude Code CLI.
  *
  * ## Why this exists
  *
@@ -16,11 +12,12 @@ import { type ClaudeCodeConfig } from "./config.js";
  *
  * ## What it contributes, and what it does not
  *
- * It declares **one subtask type and no tool families**. That is unusual here
- * and it is the whole shape of the thing: Claude Code brings its own tools, its
- * own loop and its own context management, so there is nothing for core's
- * resumable runner to drive. The host's subagent overrides `executeChunk` and
- * calls {@link claudeCodeSession} instead.
+ * **A writer's sub-agent spec, a model, and no plugin.** Claude Code brings its own
+ * tools, its own loop and its own context management, so there is nothing for
+ * an agent loop to drive: the session *is* the sub-agent's model —
+ * {@link claudeCodeModel} — and Think's recovery drives that. A host binds
+ * {@link CLAUDE_CODE_AGENT} to a `SubAgent` class whose `getModel()` returns
+ * one, and adds the `prepare` and `settle` that claim and release a workspace.
  *
  * ## The credential never enters the container
  *
@@ -55,91 +52,20 @@ import { type ClaudeCodeConfig } from "./config.js";
  * policy is `{ mode: "http-gateway" }` and which supplies a
  * {@link CredentialStore}. See the README.
  */
-/**
- * Bind a config to a workspace runtime: start, drain, stop.
- *
- * The three calls a host's `executeChunk` needs and nothing else. State lives in
- * the {@link DrainCursor} the caller persists between chunks, so this holds none
- * and a fresh isolate picks up exactly where the last one stopped.
- */
-export declare function claudeCodeSession(config: ClaudeCodeConfig): {
-    /**
-     * Spawn a session for one subtask and drain its first window.
-     *
-     * `subtaskId` namespaces the exec id. Subtasks are a concurrent fan-out, so
-     * two sessions in one workspace under one id would spawn over each other —
-     * see {@link execIdFor}.
-     */
-    start(runtime: SessionRuntime, subtaskId: string | number, prompt: string, dir: string, sinks?: Pick<DrainOptions, "onProgress" | "onCheckpoint">): Promise<DrainOutcome>;
-    /**
-     * Re-attach to a running session and drain one more window.
-     *
-     * **A session whose container was replaced is reported, not thrown.** The
-     * attachment is the first thing to notice a replacement, and the caller is a
-     * chunk loop with a cursor it will happily keep presenting: a throw here
-     * retries the same dead id until the chunk allowance runs out, and the run
-     * ends on a stack trace that names neither the session nor the cause. A
-     * terminal outcome ends it at the first attempt instead, with the exit code
-     * the runtime uses for a killed process and an explanation on `stderr`,
-     * which is exactly the channel a session that died without a result line
-     * already reports through.
-     *
-     * **What it must not say is that starting over is safe.** A session is an
-     * agent: by the time its container went, it may have written files that
-     * reached the workspace, committed, pushed, or called something outside
-     * altogether. None of that is visible from here — only that the attachment
-     * is gone — so the honest report is what is known plus where to look, and
-     * the decision belongs to whoever can read the durable state.
-     */
-    resume(runtime: SessionRuntime, cursor: DrainCursor, sinks?: Pick<DrainOptions, "onProgress" | "onCheckpoint">): Promise<DrainOutcome>;
-    /** Stop a session — `SIGTERM`, so its own process tree goes with it. */
-    stop(runtime: SessionRuntime, subtaskId: string | number): Promise<void>;
-    /**
-     * Is any credential usable right now, and if not, when?
-     *
-     * The same question {@link egress} answers per request, asked ahead of time
-     * so a host can decline to start a session it cannot pay for. That is not a
-     * micro-optimisation: an invocation carries an 18.7-27k-token cached prefix
-     * before it does anything, so starting one and letting the gateway refuse
-     * its first model call costs a container start and that prefix to learn what
-     * this returns for free — and reports it as a failed run rather than as a
-     * rate limit with a time on it.
-     *
-     * Reads only. Nothing here marks anything spent.
-     */
-    credentials: (store: CredentialStore) => Promise<Lead>;
-    /**
-     * The `Fetcher` the workspace object installs as its egress policy.
-     *
-     * `store` is an **argument rather than a config field**, and that is the
-     * point: the credential pool's state belongs to whichever object has
-     * storage, and this same config object is also held by the parent's plugin
-     * list and by the subagent facet, neither of which has any. Making it a
-     * field would force both of them to invent one.
-     */
-    egress: (store: CredentialStore) => {
-        fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
-        connect(address: SocketAddress | string, options?: SocketOptions): Socket;
-    };
-};
-export type ClaudeCodeSession = ReturnType<typeof claudeCodeSession>;
-/**
- * The plugin.
- *
- * `subtaskType` and nothing else: no `toolFamilies`, because Claude Code's tools
- * are its own, and no `capability` on the plugin, because a plugin declaring a
- * subtask type puts its capability block on the **type** — declaring both makes
- * the main agent read the same advice twice per round.
- */
-export declare function claudeCode(config: ClaudeCodeConfig): AgentPlugin;
+export { claudeCodeModel } from "./model.js";
+export type { ClaudeCodeModelOptions, SessionEnd, SessionOutcome, SessionRecord, SessionWorkspace } from "./model.js";
+export { claudeCodeSession } from "./session.js";
+export type { ClaudeCodeSession, ResumeSession, StartSession } from "./session.js";
+export { CLAUDE_CODE_AGENT, CLAUDE_CODE_WRITE_INPUT, type ClaudeCodeInput } from "./spec.js";
 export { ANTHROPIC_HOST, claudeCodeEgress } from "./egress.js";
+export { VERIFIED_CLAUDE_CODE_VERSION } from "./verified.js";
 export type { EgressConfig } from "./egress.js";
+export { GITHUB_HOSTS, GITHUB_TOKEN_PLACEHOLDER } from "./github.js";
 export { credentialPool, readRefusal, readRateLimitEvent } from "./credentials.js";
 export type { CredentialPool, CredentialPoolConfig, CredentialState, CredentialStore, Lead, Refusal } from "./credentials.js";
-export { buildLaunch, CLAUDE_EXEC_PREFIX, CREDENTIAL_PLACEHOLDER, execIdFor, freshCursor } from "./run.js";
+export { buildLaunch, CLAUDE_EXEC_PREFIX, CREDENTIAL_PLACEHOLDER, execIdFor, followUpExecIdFor, freshCursor } from "./run.js";
 export type { DrainCursor, DrainOptions, DrainOutcome, Launch, LaunchOptions, SessionRuntime } from "./run.js";
 export { parseStream, toProgress, RATE_LIMIT_OK } from "./events.js";
 export type { ClaudeCodeEvent, ClaudeCodeResult, ClaudeCodeUsage, RateLimitInfo } from "./events.js";
-export { CLAUDE_CODE_CAPABILITY, CLAUDE_CODE_RECIPE, CLAUDE_CODE_SPEC, CLAUDE_CODE_TYPE, WORKSPACE_RUNTIME_KEY } from "./recipe.js";
-export { DEFAULT_PERMISSION_MODE, DEFAULT_TIMEOUT_MS, DEFAULT_WINDOW_MS } from "./config.js";
+export { DEFAULT_PERMISSION_MODE, DEFAULT_TIMEOUT_MS } from "./config.js";
 export type { ClaudeCodeConfig, EffortLevel, PermissionMode } from "./config.js";