@dynamicagents/plugins 0.12.0 → 0.14.0

package/dist/claude-code/session.d.ts

@@ -0,0 +1,131 @@
+import type { CredentialStore, Lead } from "./credentials.js";
+import { type DrainCursor, type DrainOutcome, type DrainOptions, type SessionRuntime } from "./run.js";
+import { type ClaudeCodeConfig, type PermissionMode } from "./config.js";
+/**
+ * What continuing an interrupted conversation takes — see
+ * {@link file://./run.ts LaunchOptions.resume}.
+ */
+export interface ResumeSession {
+    sessionId: string;
+    /** Continue under a new id, leaving the original conversation whole. */
+    fork?: boolean;
+}
+/** What one session needs to be launched: see {@link ClaudeCodeSession.start}. */
+export interface StartSession {
+    /** The whole of what this session is asked to do, or its next user turn. */
+    prompt: string;
+    /** The checkout. */
+    dir: string;
+    jsonSchema?: Record<string, unknown>;
+    /**
+     * This session's mode, over the config's — see
+     * {@link file://./model.ts ClaudeCodeModelOptions.permissionMode}.
+     */
+    permissionMode?: PermissionMode;
+    /** A Claude Code conversation to continue rather than start. */
+    resume?: ResumeSession;
+}
+/**
+ * Bind a config to a workspace runtime: start, follow up, resume, stop.
+ *
+ * What `claudeCodeModel` drives a run with, and what a host's `settle` stops
+ * one with. State lives in the {@link DrainCursor} the caller stores, so this
+ * holds none and a fresh isolate picks up exactly where the last one stopped.
+ *
+ * ## Two senses of "resume", and they are not the same mechanism
+ *
+ * {@link ClaudeCodeSession.resume} re-attaches to a running **exec** — the
+ * process is alive in the container and a drain that was cut reads on from the
+ * cursor's sequence. Nothing about the conversation changes; this is plumbing.
+ *
+ * {@link StartSession.resume} continues a Claude Code **conversation** that has
+ * already ended, in a new process with a new exec: the session's transcript is
+ * read back into context and the prompt is the next user turn. Where that
+ * transcript lives — and so how long this is possible at all — is
+ * {@link file://./run.ts SESSION_CONFIG_DIR}.
+ */
+export declare function claudeCodeSession(config: ClaudeCodeConfig): {
+    /**
+     * Spawn a session for one run and drain it.
+     *
+     * `runId` namespaces the exec id. Runs are concurrent, so two sessions in
+     * one workspace under one id would spawn over each other — see
+     * {@link execIdFor}.
+     *
+     * `resume` continues a conversation on this session's **own** exec rather
+     * than on a second one: a run given a conversation to continue has no first
+     * session of its own, so there is nothing for a follow-up exec to follow.
+     */
+    start(runtime: SessionRuntime, runId: string, options: StartSession, sinks?: DrainOptions): Promise<DrainOutcome>;
+    /**
+     * Give a finished writing session one more turn, and drain it.
+     *
+     * `sessionId` is the one the session reported — on its `result` line, or on
+     * its cursor when it ended without one. This runs in the workspace the
+     * session did, because that workspace's {@link file://./run.ts SESSION_CONFIG_DIR}
+     * is where the transcript it is continuing can be found. A drain cut short goes
+     * on through {@link resume} with the cursor it stored, like any other
+     * session's.
+     *
+     * Never forked: a follow-up is one more turn of the same conversation, which
+     * is exactly what a fork is for *not* doing. For the same reason it runs
+     * under the session's own `permissionMode`.
+     */
+    followUp(runtime: SessionRuntime, runId: string, options: {
+        sessionId: string;
+        prompt: string;
+        dir: string;
+        permissionMode?: PermissionMode;
+    }, sinks?: DrainOptions): Promise<DrainOutcome>;
+    /**
+     * Re-attach to a running session and drain it to its end.
+     *
+     * **A session whose container was replaced is reported, not thrown.** The
+     * attachment is the first thing to notice a replacement, and the caller is a
+     * recovered turn with a cursor it will happily keep presenting: a throw here
+     * retries the same dead id until the recoveries run out, and the run ends on
+     * a stack trace that names neither the session nor the cause. A
+     * terminal outcome ends it at the first attempt instead, with the exit code
+     * the runtime uses for a killed process and an explanation on `stderr`,
+     * which is exactly the channel a session that died without a result line
+     * already reports through. The wording is {@link containerLost}'s.
+     */
+    resume(runtime: SessionRuntime, cursor: DrainCursor, sinks?: DrainOptions): Promise<DrainOutcome>;
+    /** Stop a session — `SIGTERM`, so its own process tree goes with it. */
+    stop(runtime: SessionRuntime, runId: string): Promise<void>;
+    /**
+     * Is any credential usable right now, and if not, when?
+     *
+     * The same question {@link egress} answers per request, asked ahead of time
+     * so a host can decline to start a session it cannot pay for. That is not a
+     * micro-optimisation: an invocation carries an 18.7-27k-token cached prefix
+     * before it does anything, so starting one and letting the gateway refuse
+     * its first model call costs a container start and that prefix to learn what
+     * this returns for free — and reports it as a failed run rather than as a
+     * rate limit with a time on it.
+     *
+     * Reads only. Nothing here marks anything spent.
+     */
+    credentials: (store: CredentialStore) => Promise<Lead>;
+    /**
+     * The `Fetcher` the workspace object installs as its egress policy.
+     *
+     * `store` is an **argument rather than a config field**, and that is the
+     * point: the credential pool's state belongs to whichever object has
+     * storage, and this same config object is also held by the agents that run
+     * sessions, which have none of their own for it. Making it a field would
+     * force them to invent one.
+     */
+    egress: (store: CredentialStore) => {
+        fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+        connect(address: SocketAddress | string, options?: SocketOptions): Socket;
+    };
+};
+export type ClaudeCodeSession = ReturnType<typeof claudeCodeSession>;
+/**
+ * Refuse a deployment with no credential when the model is built, naming this
+ * plugin, rather than at the first model call inside a run somebody is waiting
+ * on. The thunk is still what the gateway calls per request, so a rotation is
+ * picked up.
+ */
+export declare function requireCredentials(config: ClaudeCodeConfig): void;

package/dist/claude-code/session.js

@@ -0,0 +1,288 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import { claudeCodeEgress } from "./egress.js";
+import { credentialPool } from "./credentials.js";
+import { attachRun, containerLost, drainRun, execIdFor, followUpExecIdFor, freshCursor, isExecLost, killRun, startRun } from "./run.js";
+import { DEFAULT_TIMEOUT_MS } from "./config.js";
+/**
+ * Bind a config to a workspace runtime: start, follow up, resume, stop.
+ *
+ * What `claudeCodeModel` drives a run with, and what a host's `settle` stops
+ * one with. State lives in the {@link DrainCursor} the caller stores, so this
+ * holds none and a fresh isolate picks up exactly where the last one stopped.
+ *
+ * ## Two senses of "resume", and they are not the same mechanism
+ *
+ * {@link ClaudeCodeSession.resume} re-attaches to a running **exec** — the
+ * process is alive in the container and a drain that was cut reads on from the
+ * cursor's sequence. Nothing about the conversation changes; this is plumbing.
+ *
+ * {@link StartSession.resume} continues a Claude Code **conversation** that has
+ * already ended, in a new process with a new exec: the session's transcript is
+ * read back into context and the prompt is the next user turn. Where that
+ * transcript lives — and so how long this is possible at all — is
+ * {@link file://./run.ts SESSION_CONFIG_DIR}.
+ */
+export function claudeCodeSession(config) {
+    const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const launch = (prompt, dir, permissionMode = config.permissionMode) => ({
+        prompt,
+        dir,
+        ...(config.model ? { model: config.model } : {}),
+        ...(config.effort ? { effort: config.effort } : {}),
+        ...(config.maxSubagentDepth === undefined
+            ? {}
+            : { maxSubagentDepth: config.maxSubagentDepth }),
+        ...(config.maxConcurrentSubagents === undefined
+            ? {}
+            : { maxConcurrentSubagents: config.maxConcurrentSubagents }),
+        // Forwarded only when set, so `buildLaunch` owns the default in one place
+        // rather than this line resolving it and the flag being written twice.
+        ...(permissionMode ? { permissionMode } : {}),
+        ...(config.env ? { env: config.env } : {}),
+        ...(config.author ? { author: config.author } : {}),
+        ...(config.githubToken ? { github: true } : {})
+    });
+    return {
+        /**
+         * Spawn a session for one run and drain it.
+         *
+         * `runId` namespaces the exec id. Runs are concurrent, so two sessions in
+         * one workspace under one id would spawn over each other — see
+         * {@link execIdFor}.
+         *
+         * `resume` continues a conversation on this session's **own** exec rather
+         * than on a second one: a run given a conversation to continue has no first
+         * session of its own, so there is nothing for a follow-up exec to follow.
+         */
+        async start(runtime, runId, options, sinks = {}) {
+            const env_1 = { stack: [], error: void 0, hasError: false };
+            try {
+                const execId = execIdFor(runId);
+                // `using`, so the attachment is released even when the drain throws.
+                const handle = __addDisposableResource(env_1, await startRun(runtime, {
+                    ...launch(options.prompt, options.dir, options.permissionMode),
+                    ...(options.jsonSchema ? { jsonSchema: options.jsonSchema } : {}),
+                    ...resumption(options.resume),
+                    execId,
+                    timeoutMs,
+                    signal: sinks.signal
+                }), false);
+                return await drainRun(handle, freshCursor(execId), sinks);
+            }
+            catch (e_1) {
+                env_1.error = e_1;
+                env_1.hasError = true;
+            }
+            finally {
+                __disposeResources(env_1);
+            }
+        },
+        /**
+         * Give a finished writing session one more turn, and drain it.
+         *
+         * `sessionId` is the one the session reported — on its `result` line, or on
+         * its cursor when it ended without one. This runs in the workspace the
+         * session did, because that workspace's {@link file://./run.ts SESSION_CONFIG_DIR}
+         * is where the transcript it is continuing can be found. A drain cut short goes
+         * on through {@link resume} with the cursor it stored, like any other
+         * session's.
+         *
+         * Never forked: a follow-up is one more turn of the same conversation, which
+         * is exactly what a fork is for *not* doing. For the same reason it runs
+         * under the session's own `permissionMode`.
+         */
+        async followUp(runtime, runId, options, sinks = {}) {
+            const env_2 = { stack: [], error: void 0, hasError: false };
+            try {
+                // Without one, `--resume` would be dropped and a new session started
+                // under the follow-up's id — unrelated work, reported as the follow-up.
+                if (!options.sessionId) {
+                    throw new Error("claude-code: a follow-up needs the session id its result reported");
+                }
+                const execId = followUpExecIdFor(runId);
+                const handle = __addDisposableResource(env_2, await startRun(runtime, {
+                    ...launch(options.prompt, options.dir, options.permissionMode),
+                    resume: options.sessionId,
+                    execId,
+                    timeoutMs,
+                    signal: sinks.signal
+                }), false);
+                return await drainRun(handle, freshCursor(execId), sinks);
+            }
+            catch (e_2) {
+                env_2.error = e_2;
+                env_2.hasError = true;
+            }
+            finally {
+                __disposeResources(env_2);
+            }
+        },
+        /**
+         * Re-attach to a running session and drain it to its end.
+         *
+         * **A session whose container was replaced is reported, not thrown.** The
+         * attachment is the first thing to notice a replacement, and the caller is a
+         * recovered turn with a cursor it will happily keep presenting: a throw here
+         * retries the same dead id until the recoveries run out, and the run ends on
+         * a stack trace that names neither the session nor the cause. A
+         * terminal outcome ends it at the first attempt instead, with the exit code
+         * the runtime uses for a killed process and an explanation on `stderr`,
+         * which is exactly the channel a session that died without a result line
+         * already reports through. The wording is {@link containerLost}'s.
+         */
+        async resume(runtime, cursor, sinks = {}) {
+            const env_3 = { stack: [], error: void 0, hasError: false };
+            try {
+                let handle;
+                try {
+                    handle = await attachRun(runtime, cursor, {
+                        signal: sinks.signal,
+                        maxWaitMs: timeoutMs
+                    });
+                }
+                catch (err) {
+                    if (!isExecLost(err))
+                        throw err;
+                    console.warn("[claude-code] the session's container was replaced", {
+                        execId: cursor.execId,
+                        err: String(err)
+                    });
+                    return {
+                        done: true,
+                        cursor,
+                        progress: [],
+                        exitCode: -1,
+                        stderr: containerLost()
+                    };
+                }
+                const session = __addDisposableResource(env_3, handle, false);
+                return await drainRun(session, cursor, sinks);
+            }
+            catch (e_3) {
+                env_3.error = e_3;
+                env_3.hasError = true;
+            }
+            finally {
+                __disposeResources(env_3);
+            }
+        },
+        /** Stop a session — `SIGTERM`, so its own process tree goes with it. */
+        async stop(runtime, runId) {
+            // First, and allowed to fail: most sessions never had a follow-up, and
+            // one that did has usually finished its first exec already.
+            await killRun(runtime, followUpExecIdFor(runId)).catch(() => { });
+            await killRun(runtime, execIdFor(runId));
+        },
+        /**
+         * Is any credential usable right now, and if not, when?
+         *
+         * The same question {@link egress} answers per request, asked ahead of time
+         * so a host can decline to start a session it cannot pay for. That is not a
+         * micro-optimisation: an invocation carries an 18.7-27k-token cached prefix
+         * before it does anything, so starting one and letting the gateway refuse
+         * its first model call costs a container start and that prefix to learn what
+         * this returns for free — and reports it as a failed run rather than as a
+         * rate limit with a time on it.
+         *
+         * Reads only. Nothing here marks anything spent.
+         */
+        credentials: (store) => credentialPool({ credentials: config.credentials, store }).lead(),
+        /**
+         * The `Fetcher` the workspace object installs as its egress policy.
+         *
+         * `store` is an **argument rather than a config field**, and that is the
+         * point: the credential pool's state belongs to whichever object has
+         * storage, and this same config object is also held by the agents that run
+         * sessions, which have none of their own for it. Making it a field would
+         * force them to invent one.
+         */
+        egress: (store) => claudeCodeEgress({
+            credentials: config.credentials,
+            store,
+            // Forwarded only when set. Defaulting it to `[]` here would turn "the
+            // host said nothing" into "Anthropic only", which is the one reading
+            // the three-way semantics exist to keep distinct.
+            ...(config.restrictToHosts === undefined
+                ? {}
+                : { restrictToHosts: config.restrictToHosts }),
+            ...(config.githubToken ? { githubToken: config.githubToken } : {}),
+            label: "claude-code"
+        })
+    };
+}
+/**
+ * A conversation to continue, as launch flags.
+ *
+ * One place rather than a spread at each call site, so `fork` can never travel
+ * without the id it forks — which {@link file://./run.ts buildLaunch} refuses,
+ * but refuses at launch rather than here.
+ */
+function resumption(resume) {
+    if (!resume)
+        return undefined;
+    return { resume: resume.sessionId, ...(resume.fork ? { fork: true } : {}) };
+}
+/**
+ * Refuse a deployment with no credential when the model is built, naming this
+ * plugin, rather than at the first model call inside a run somebody is waiting
+ * on. The thunk is still what the gateway calls per request, so a rotation is
+ * picked up.
+ */
+export function requireCredentials(config) {
+    if (config.credentials().filter(Boolean).length === 0) {
+        throw new Error("claude-code: no credentials. Set at least one `claude setup-token` " +
+            "credential and pass it as " +
+            "`credentials: () => [env.CLAUDE_CODE_OAUTH_TOKEN_1]`.");
+    }
+}

package/dist/claude-code/spec.d.ts

@@ -0,0 +1,46 @@
+import type { SubAgentSpec } from "@dynamicagents/core";
+import { z } from "zod";
+/**
+ * The Claude Code writer, as data: what the parent's model is offered. The host
+ * binds it to a `SubAgent` class whose model is
+ * {@link file://./model.ts claudeCodeModel}, and adds the `prepare` and
+ * `settle` that claim and release its workspace. A planner is the same spec
+ * under another name, description and input, whose model runs under `plan` —
+ * see {@link file://./model.ts ClaudeCodeModelOptions.permissionMode}.
+ *
+ * A module of its own for its `zod` schemas. `zod` costs a Worker bundle
+ * ~460 KiB, and the workspace Durable Object imports this subpath for its
+ * egress gateway alone; with `sideEffects: false`, a module nothing it uses
+ * reaches is dropped from that bundle whole.
+ *
+ * It runs **detached**: a session runs for up to its `timeoutMs`, past the
+ * point a parent's turn is cut.
+ */
+/**
+ * The writer's input: the task, and optionally the branch to add to.
+ *
+ * *Which* repository is not the parent model's to choose: the workspace is one
+ * Durable Object, one container and one checkout, keyed by caller and
+ * repository, and the parent already tracks which one is active. A repository
+ * named here would let a model name somebody else's — the same reasoning that
+ * keeps the workspace name out of model input in `/computer`.
+ *
+ * A branch is different: the model quotes it from an earlier report or a pull
+ * request, and the host's `prepare` resolves it before anything runs.
+ *
+ * Exported so a host can extend it with an input of its own that its `prepare`
+ * resolves.
+ */
+export declare const CLAUDE_CODE_WRITE_INPUT: z.ZodObject<{
+    task: z.ZodString;
+    continue: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ClaudeCodeInput = z.infer<typeof CLAUDE_CODE_WRITE_INPUT>;
+/**
+ * Sized deliberately. An invocation carries an 18.7-27k token cached prefix
+ * before it does anything — a ten-call burst billed twenty raw input tokens
+ * against 187,130 cache reads — so a session has to be worth starting. The
+ * description says that in the terms the parent's model can act on: one
+ * coherent change, not one file edit.
+ */
+export declare const CLAUDE_CODE_AGENT: SubAgentSpec<ClaudeCodeInput>;

package/dist/claude-code/spec.js

@@ -0,0 +1,83 @@
+import { z } from "zod";
+/**
+ * The Claude Code writer, as data: what the parent's model is offered. The host
+ * binds it to a `SubAgent` class whose model is
+ * {@link file://./model.ts claudeCodeModel}, and adds the `prepare` and
+ * `settle` that claim and release its workspace. A planner is the same spec
+ * under another name, description and input, whose model runs under `plan` —
+ * see {@link file://./model.ts ClaudeCodeModelOptions.permissionMode}.
+ *
+ * A module of its own for its `zod` schemas. `zod` costs a Worker bundle
+ * ~460 KiB, and the workspace Durable Object imports this subpath for its
+ * egress gateway alone; with `sideEffects: false`, a module nothing it uses
+ * reaches is dropped from that bundle whole.
+ *
+ * It runs **detached**: a session runs for up to its `timeoutMs`, past the
+ * point a parent's turn is cut.
+ */
+/**
+ * The writer's input: the task, and optionally the branch to add to.
+ *
+ * *Which* repository is not the parent model's to choose: the workspace is one
+ * Durable Object, one container and one checkout, keyed by caller and
+ * repository, and the parent already tracks which one is active. A repository
+ * named here would let a model name somebody else's — the same reasoning that
+ * keeps the workspace name out of model input in `/computer`.
+ *
+ * A branch is different: the model quotes it from an earlier report or a pull
+ * request, and the host's `prepare` resolves it before anything runs.
+ *
+ * Exported so a host can extend it with an input of its own that its `prepare`
+ * resolves.
+ */
+export const CLAUDE_CODE_WRITE_INPUT = z.object({
+    task: z
+        .string()
+        .describe("The change to make, described as you would to an engineer: what should be true when it is done, and how to tell"),
+    continue: z
+        .string()
+        .optional()
+        .describe("The branch to add to — one an earlier claude_code report named, or an open pull request's head branch; omit to start a new branch")
+});
+/**
+ * Nothing reads it: the model is the CLI, whose system prompt is its own. It
+ * exists because a spec must declare a soul, and says so, so nobody tunes it.
+ */
+const SOUL = "Not a prompt: this sub-agent's model is a Claude Code session, which brings its own.";
+/**
+ * Sized deliberately. An invocation carries an 18.7-27k token cached prefix
+ * before it does anything — a ten-call burst billed twenty raw input tokens
+ * against 187,130 cache reads — so a session has to be worth starting. The
+ * description says that in the terms the parent's model can act on: one
+ * coherent change, not one file edit.
+ */
+export const CLAUDE_CODE_AGENT = {
+    name: "claude_code",
+    description: [
+        "Hand a coding task to a Claude Code session running in your workspace",
+        "container, in whatever you have open there — a repository you checked out,",
+        "or a scratchpad. It has its own tools — it reads, edits, runs the test suite",
+        "and iterates — and it reports back what it did. It runs in the background:",
+        "the call returns at once, and its report arrives in a later turn.",
+        "",
+        "Give it **one coherent change**, described the way you would describe it to",
+        "an engineer: what should be true when it is done, and how to tell. It is",
+        "expensive to start and cheap to let run, so 'add the endpoint, its tests and",
+        "wire it up' is one session, not three. A session that is only asked to edit",
+        "a single line costs about what a substantial one costs.",
+        "",
+        "It cannot ask you anything mid-run. Anything it would need to ask, decide",
+        "first — or ask the user yourself before delegating.",
+        "",
+        "To correct or extend work that is already on a branch — the one a previous",
+        "session's report named, or an open pull request's head branch — set",
+        "`continue` to that branch: the new session starts from its tip and adds",
+        "commits to it, so pushing the branch updates its pull request. Without it, a",
+        "session starts a branch of its own, and changing an open pull request from",
+        "there means moving commits between branches."
+    ].join("\n"),
+    inputSchema: CLAUDE_CODE_WRITE_INPUT,
+    soul: SOUL,
+    detached: true,
+    formatInput: (input) => input.task
+};

package/dist/claude-code/verified.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The Claude Code version this package's egress gateway and stream parser were
+ * last verified against, and the one a deployment's image pins.
+ *
+ * Both are written against that version's traffic — its headers, its beta list,
+ * its `stream-json` lines — and the probe's capture,
+ * `test/fixtures/claude-code-probe-capture.json`, is that traffic, recorded. The
+ * specs read the capture, so they check the gateway and the parser against what
+ * this version actually sends and prints.
+ *
+ * Written by `npm run probe:claude-code -- --record`, never by hand: the value
+ * and the capture move together. AGENTS.md's "Updating Claude Code" is the
+ * procedure.
+ */
+export declare const VERIFIED_CLAUDE_CODE_VERSION = "2.1.296";

package/dist/claude-code/verified.js

@@ -0,0 +1,15 @@
+/**
+ * The Claude Code version this package's egress gateway and stream parser were
+ * last verified against, and the one a deployment's image pins.
+ *
+ * Both are written against that version's traffic — its headers, its beta list,
+ * its `stream-json` lines — and the probe's capture,
+ * `test/fixtures/claude-code-probe-capture.json`, is that traffic, recorded. The
+ * specs read the capture, so they check the gateway and the parser against what
+ * this version actually sends and prints.
+ *
+ * Written by `npm run probe:claude-code -- --record`, never by hand: the value
+ * and the capture move together. AGENTS.md's "Updating Claude Code" is the
+ * procedure.
+ */
+export const VERIFIED_CLAUDE_CODE_VERSION = "2.1.296";

package/dist/computer/context.d.ts

@@ -1,11 +1,7 @@
 import type { WorkspaceClient } from "@cloudflare/computer";
 import { type ExecGate } from "./gate.js";
-import type { WorkspaceAdvisory } from "./advisory.js";
+import type { WorkspaceAdvisory } from "../workspace/advisory.js";
 import type { ComputerConfig } from "./index.js";
-/** A command that has not finished in this long is a hung command. */
-export declare const DEFAULT_TIMEOUT_MS: number;
-/** Where checkouts live, in the container and in the workspace alike. */
-export declare const DEFAULT_CWD = "/workspace";
 /** What {@link computerContext} hands each group of tools. */
 export interface ComputerContext {
     config: ComputerConfig;

package/dist/computer/context.js

@@ -50,6 +50,7 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     var e = new Error(message);
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
+import { DEFAULT_CWD, DEFAULT_TIMEOUT_MS } from "../workspace/exec.js";
 import { withAbort } from "@dynamicagents/core";
 import { execGate, writeGate } from "./gate.js";
 /**
@@ -66,10 +67,6 @@ import { execGate, writeGate } from "./gate.js";
  * says what actually failed.
  */
 const DEFAULT_MAX_OUTPUT_CHARS = 16_000;
-/** A command that has not finished in this long is a hung command. */
-export const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
-/** Where checkouts live, in the container and in the workspace alike. */
-export const DEFAULT_CWD = "/workspace";
 /**
  * How often the install gate re-reads the install's status.
  *
@@ -108,7 +105,7 @@ export function computerContext(workspace, config, advisories, fsWorkspace = wor
         // is a read of another Durable Object's state. An error must not take out a
         // working shell — running the command is exactly what would have happened
         // before the gate existed, and a spurious blockage would strand the
-        // subagent.
+        // agent.
         const read = async () => {
             try {
                 signal?.throwIfAborted();
@@ -178,18 +175,18 @@ export function computerContext(workspace, config, advisories, fsWorkspace = wor
     /**
      * Open the workspace, run one file operation in it, and own the failure.
      *
-     * Five lines every file tool would otherwise repeat with only the verb changed
-     * — five chances for the seventh to be written without them. The catch is the
+     * Lines every file tool would otherwise repeat with only the verb changed,
+     * and a chance for the next one to be written without them. The catch is the
      * point: a failed file operation is the model's to recover from, and it can
      * only recover from what it is told, so this returns the sentence rather than
      * throwing it.
      *
-     * `sb_exec` deliberately does not use it. That one recognises `EEXEC_LOST`,
+     * `bash` deliberately does not use it. That one recognises `EEXEC_LOST`,
      * logs, and carries an install warning through the failure path — a bespoke
      * catch saying something this cannot.
      *
-     * It opens through `fsWorkspace`, which is what makes the capability sentence
-     * about these tools true: they answer while the container is down.
+     * It opens through `fsWorkspace`, which is what makes the context block's
+     * sentence about these tools true: they answer while the container is down.
      */
     const inWorkspace = async (gerund, subject, body) => {
         try {

package/dist/computer/file-lock.js

@@ -1,11 +1,12 @@
 /**
  * One mutation per file at a time, across every tool set in this isolate.
  *
- * `sb_edit` reads, replaces and writes back over RPC, and the AI SDK runs one
+ * `edit` reads, replaces and writes back over RPC, and the AI SDK runs one
  * step's tool calls concurrently — so two edits to one file would both report
- * success and the first would be lost. Module-level because a parent and a
- * subagent can hold separate tool sets over one workspace; another isolate is
- * out of reach.
+ * success and the first would be lost. The workspace's `writeFile` takes the
+ * same lock, so Think's `write` never lands between an edit's read and its
+ * write. Module-level because a parent and a sub-agent can hold separate tool
+ * sets over one workspace; another isolate is out of reach.
  */
 const tails = new Map();
 /**