@dynamicagents/plugins 0.13.0 → 0.15.0

package/dist/claude-code/session.d.ts

@@ -1,131 +0,0 @@
-import type { CredentialStore, Lead } from "./credentials.js";
-import { type DrainCursor, type DrainOutcome, type DrainOptions, type SessionRuntime } from "./run.js";
-import { type ClaudeCodeConfig, type PermissionMode } from "./config.js";
-/**
- * What continuing an interrupted conversation takes — see
- * {@link file://./run.ts LaunchOptions.resume}.
- */
-export interface ResumeSession {
-    sessionId: string;
-    /** Continue under a new id, leaving the original conversation whole. */
-    fork?: boolean;
-}
-/** What one session needs to be launched: see {@link ClaudeCodeSession.start}. */
-export interface StartSession {
-    /** The whole of what this session is asked to do, or its next user turn. */
-    prompt: string;
-    /** The checkout. */
-    dir: string;
-    jsonSchema?: Record<string, unknown>;
-    /**
-     * This session's mode, over the config's — see
-     * {@link file://./model.ts ClaudeCodeModelOptions.permissionMode}.
-     */
-    permissionMode?: PermissionMode;
-    /** A Claude Code conversation to continue rather than start. */
-    resume?: ResumeSession;
-}
-/**
- * Bind a config to a workspace runtime: start, follow up, resume, stop.
- *
- * What `claudeCodeModel` drives a run with, and what a host's `settle` stops
- * one with. State lives in the {@link DrainCursor} the caller stores, so this
- * holds none and a fresh isolate picks up exactly where the last one stopped.
- *
- * ## Two senses of "resume", and they are not the same mechanism
- *
- * {@link ClaudeCodeSession.resume} re-attaches to a running **exec** — the
- * process is alive in the container and a drain that was cut reads on from the
- * cursor's sequence. Nothing about the conversation changes; this is plumbing.
- *
- * {@link StartSession.resume} continues a Claude Code **conversation** that has
- * already ended, in a new process with a new exec: the session's transcript is
- * read back into context and the prompt is the next user turn. Where that
- * transcript lives — and so how long this is possible at all — is
- * {@link file://./run.ts SESSION_CONFIG_DIR}.
- */
-export declare function claudeCodeSession(config: ClaudeCodeConfig): {
-    /**
-     * Spawn a session for one run and drain it.
-     *
-     * `runId` namespaces the exec id. Runs are concurrent, so two sessions in
-     * one workspace under one id would spawn over each other — see
-     * {@link execIdFor}.
-     *
-     * `resume` continues a conversation on this session's **own** exec rather
-     * than on a second one: a run given a conversation to continue has no first
-     * session of its own, so there is nothing for a follow-up exec to follow.
-     */
-    start(runtime: SessionRuntime, runId: string, options: StartSession, sinks?: DrainOptions): Promise<DrainOutcome>;
-    /**
-     * Give a finished writing session one more turn, and drain it.
-     *
-     * `sessionId` is the one the session reported — on its `result` line, or on
-     * its cursor when it ended without one. This runs in the workspace the
-     * session did, because that workspace's {@link file://./run.ts SESSION_CONFIG_DIR}
-     * is where the transcript it is continuing can be found. A drain cut short goes
-     * on through {@link resume} with the cursor it stored, like any other
-     * session's.
-     *
-     * Never forked: a follow-up is one more turn of the same conversation, which
-     * is exactly what a fork is for *not* doing. For the same reason it runs
-     * under the session's own `permissionMode`.
-     */
-    followUp(runtime: SessionRuntime, runId: string, options: {
-        sessionId: string;
-        prompt: string;
-        dir: string;
-        permissionMode?: PermissionMode;
-    }, sinks?: DrainOptions): Promise<DrainOutcome>;
-    /**
-     * Re-attach to a running session and drain it to its end.
-     *
-     * **A session whose container was replaced is reported, not thrown.** The
-     * attachment is the first thing to notice a replacement, and the caller is a
-     * recovered turn with a cursor it will happily keep presenting: a throw here
-     * retries the same dead id until the recoveries run out, and the run ends on
-     * a stack trace that names neither the session nor the cause. A
-     * terminal outcome ends it at the first attempt instead, with the exit code
-     * the runtime uses for a killed process and an explanation on `stderr`,
-     * which is exactly the channel a session that died without a result line
-     * already reports through. The wording is {@link containerLost}'s.
-     */
-    resume(runtime: SessionRuntime, cursor: DrainCursor, sinks?: DrainOptions): Promise<DrainOutcome>;
-    /** Stop a session — `SIGTERM`, so its own process tree goes with it. */
-    stop(runtime: SessionRuntime, runId: string): Promise<void>;
-    /**
-     * Is any credential usable right now, and if not, when?
-     *
-     * The same question {@link egress} answers per request, asked ahead of time
-     * so a host can decline to start a session it cannot pay for. That is not a
-     * micro-optimisation: an invocation carries an 18.7-27k-token cached prefix
-     * before it does anything, so starting one and letting the gateway refuse
-     * its first model call costs a container start and that prefix to learn what
-     * this returns for free — and reports it as a failed run rather than as a
-     * rate limit with a time on it.
-     *
-     * Reads only. Nothing here marks anything spent.
-     */
-    credentials: (store: CredentialStore) => Promise<Lead>;
-    /**
-     * The `Fetcher` the workspace object installs as its egress policy.
-     *
-     * `store` is an **argument rather than a config field**, and that is the
-     * point: the credential pool's state belongs to whichever object has
-     * storage, and this same config object is also held by the agents that run
-     * sessions, which have none of their own for it. Making it a field would
-     * force them to invent one.
-     */
-    egress: (store: CredentialStore) => {
-        fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
-        connect(address: SocketAddress | string, options?: SocketOptions): Socket;
-    };
-};
-export type ClaudeCodeSession = ReturnType<typeof claudeCodeSession>;
-/**
- * Refuse a deployment with no credential when the model is built, naming this
- * plugin, rather than at the first model call inside a run somebody is waiting
- * on. The thunk is still what the gateway calls per request, so a rotation is
- * picked up.
- */
-export declare function requireCredentials(config: ClaudeCodeConfig): void;

package/dist/claude-code/session.js

@@ -1,285 +0,0 @@
-var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
-    if (value !== null && value !== void 0) {
-        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
-        var dispose, inner;
-        if (async) {
-            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
-            dispose = value[Symbol.asyncDispose];
-        }
-        if (dispose === void 0) {
-            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
-            dispose = value[Symbol.dispose];
-            if (async) inner = dispose;
-        }
-        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
-        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
-        env.stack.push({ value: value, dispose: dispose, async: async });
-    }
-    else if (async) {
-        env.stack.push({ async: true });
-    }
-    return value;
-};
-var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
-    return function (env) {
-        function fail(e) {
-            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
-            env.hasError = true;
-        }
-        var r, s = 0;
-        function next() {
-            while (r = env.stack.pop()) {
-                try {
-                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
-                    if (r.dispose) {
-                        var result = r.dispose.call(r.value);
-                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
-                    }
-                    else s |= 1;
-                }
-                catch (e) {
-                    fail(e);
-                }
-            }
-            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
-            if (env.hasError) throw env.error;
-        }
-        return next();
-    };
-})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
-    var e = new Error(message);
-    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
-});
-import { claudeCodeEgress } from "./egress.js";
-import { credentialPool } from "./credentials.js";
-import { attachRun, containerLost, drainRun, execIdFor, followUpExecIdFor, freshCursor, isExecLost, killRun, startRun } from "./run.js";
-import { DEFAULT_TIMEOUT_MS } from "./config.js";
-/**
- * Bind a config to a workspace runtime: start, follow up, resume, stop.
- *
- * What `claudeCodeModel` drives a run with, and what a host's `settle` stops
- * one with. State lives in the {@link DrainCursor} the caller stores, so this
- * holds none and a fresh isolate picks up exactly where the last one stopped.
- *
- * ## Two senses of "resume", and they are not the same mechanism
- *
- * {@link ClaudeCodeSession.resume} re-attaches to a running **exec** — the
- * process is alive in the container and a drain that was cut reads on from the
- * cursor's sequence. Nothing about the conversation changes; this is plumbing.
- *
- * {@link StartSession.resume} continues a Claude Code **conversation** that has
- * already ended, in a new process with a new exec: the session's transcript is
- * read back into context and the prompt is the next user turn. Where that
- * transcript lives — and so how long this is possible at all — is
- * {@link file://./run.ts SESSION_CONFIG_DIR}.
- */
-export function claudeCodeSession(config) {
-    const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const launch = (prompt, dir, permissionMode = config.permissionMode) => ({
-        prompt,
-        dir,
-        ...(config.model ? { model: config.model } : {}),
-        ...(config.effort ? { effort: config.effort } : {}),
-        ...(config.maxSubagentDepth === undefined
-            ? {}
-            : { maxSubagentDepth: config.maxSubagentDepth }),
-        ...(config.maxConcurrentSubagents === undefined
-            ? {}
-            : { maxConcurrentSubagents: config.maxConcurrentSubagents }),
-        // Forwarded only when set, so `buildLaunch` owns the default in one place
-        // rather than this line resolving it and the flag being written twice.
-        ...(permissionMode ? { permissionMode } : {}),
-        ...(config.env ? { env: config.env } : {}),
-        ...(config.author ? { author: config.author } : {}),
-        ...(config.githubToken ? { github: true } : {})
-    });
-    return {
-        /**
-         * Spawn a session for one run and drain it.
-         *
-         * `runId` namespaces the exec id. Runs are concurrent, so two sessions in
-         * one workspace under one id would spawn over each other — see
-         * {@link execIdFor}.
-         *
-         * `resume` continues a conversation on this session's **own** exec rather
-         * than on a second one: a run given a conversation to continue has no first
-         * session of its own, so there is nothing for a follow-up exec to follow.
-         */
-        async start(runtime, runId, options, sinks = {}) {
-            const env_1 = { stack: [], error: void 0, hasError: false };
-            try {
-                const execId = execIdFor(runId);
-                // `using`, so the attachment is released even when the drain throws.
-                const handle = __addDisposableResource(env_1, await startRun(runtime, {
-                    ...launch(options.prompt, options.dir, options.permissionMode),
-                    ...(options.jsonSchema ? { jsonSchema: options.jsonSchema } : {}),
-                    ...resumption(options.resume),
-                    execId,
-                    timeoutMs,
-                    signal: sinks.signal
-                }), false);
-                return await drainRun(handle, freshCursor(execId), sinks);
-            }
-            catch (e_1) {
-                env_1.error = e_1;
-                env_1.hasError = true;
-            }
-            finally {
-                __disposeResources(env_1);
-            }
-        },
-        /**
-         * Give a finished writing session one more turn, and drain it.
-         *
-         * `sessionId` is the one the session reported — on its `result` line, or on
-         * its cursor when it ended without one. This runs in the workspace the
-         * session did, because that workspace's {@link file://./run.ts SESSION_CONFIG_DIR}
-         * is where the transcript it is continuing can be found. A drain cut short goes
-         * on through {@link resume} with the cursor it stored, like any other
-         * session's.
-         *
-         * Never forked: a follow-up is one more turn of the same conversation, which
-         * is exactly what a fork is for *not* doing. For the same reason it runs
-         * under the session's own `permissionMode`.
-         */
-        async followUp(runtime, runId, options, sinks = {}) {
-            const env_2 = { stack: [], error: void 0, hasError: false };
-            try {
-                // Without one, `--resume` would be dropped and a new session started
-                // under the follow-up's id — unrelated work, reported as the follow-up.
-                if (!options.sessionId) {
-                    throw new Error("claude-code: a follow-up needs the session id its result reported");
-                }
-                const execId = followUpExecIdFor(runId);
-                const handle = __addDisposableResource(env_2, await startRun(runtime, {
-                    ...launch(options.prompt, options.dir, options.permissionMode),
-                    resume: options.sessionId,
-                    execId,
-                    timeoutMs,
-                    signal: sinks.signal
-                }), false);
-                return await drainRun(handle, freshCursor(execId), sinks);
-            }
-            catch (e_2) {
-                env_2.error = e_2;
-                env_2.hasError = true;
-            }
-            finally {
-                __disposeResources(env_2);
-            }
-        },
-        /**
-         * Re-attach to a running session and drain it to its end.
-         *
-         * **A session whose container was replaced is reported, not thrown.** The
-         * attachment is the first thing to notice a replacement, and the caller is a
-         * recovered turn with a cursor it will happily keep presenting: a throw here
-         * retries the same dead id until the recoveries run out, and the run ends on
-         * a stack trace that names neither the session nor the cause. A
-         * terminal outcome ends it at the first attempt instead, with the exit code
-         * the runtime uses for a killed process and an explanation on `stderr`,
-         * which is exactly the channel a session that died without a result line
-         * already reports through. The wording is {@link containerLost}'s.
-         */
-        async resume(runtime, cursor, sinks = {}) {
-            const env_3 = { stack: [], error: void 0, hasError: false };
-            try {
-                let handle;
-                try {
-                    handle = await attachRun(runtime, cursor, { signal: sinks.signal });
-                }
-                catch (err) {
-                    if (!isExecLost(err))
-                        throw err;
-                    console.warn("[claude-code] the session's container was replaced", {
-                        execId: cursor.execId,
-                        err: String(err)
-                    });
-                    return {
-                        done: true,
-                        cursor,
-                        progress: [],
-                        exitCode: -1,
-                        stderr: containerLost()
-                    };
-                }
-                const session = __addDisposableResource(env_3, handle, false);
-                return await drainRun(session, cursor, sinks);
-            }
-            catch (e_3) {
-                env_3.error = e_3;
-                env_3.hasError = true;
-            }
-            finally {
-                __disposeResources(env_3);
-            }
-        },
-        /** Stop a session — `SIGTERM`, so its own process tree goes with it. */
-        async stop(runtime, runId) {
-            // First, and allowed to fail: most sessions never had a follow-up, and
-            // one that did has usually finished its first exec already.
-            await killRun(runtime, followUpExecIdFor(runId)).catch(() => { });
-            await killRun(runtime, execIdFor(runId));
-        },
-        /**
-         * Is any credential usable right now, and if not, when?
-         *
-         * The same question {@link egress} answers per request, asked ahead of time
-         * so a host can decline to start a session it cannot pay for. That is not a
-         * micro-optimisation: an invocation carries an 18.7-27k-token cached prefix
-         * before it does anything, so starting one and letting the gateway refuse
-         * its first model call costs a container start and that prefix to learn what
-         * this returns for free — and reports it as a failed run rather than as a
-         * rate limit with a time on it.
-         *
-         * Reads only. Nothing here marks anything spent.
-         */
-        credentials: (store) => credentialPool({ credentials: config.credentials, store }).lead(),
-        /**
-         * The `Fetcher` the workspace object installs as its egress policy.
-         *
-         * `store` is an **argument rather than a config field**, and that is the
-         * point: the credential pool's state belongs to whichever object has
-         * storage, and this same config object is also held by the agents that run
-         * sessions, which have none of their own for it. Making it a field would
-         * force them to invent one.
-         */
-        egress: (store) => claudeCodeEgress({
-            credentials: config.credentials,
-            store,
-            // Forwarded only when set. Defaulting it to `[]` here would turn "the
-            // host said nothing" into "Anthropic only", which is the one reading
-            // the three-way semantics exist to keep distinct.
-            ...(config.restrictToHosts === undefined
-                ? {}
-                : { restrictToHosts: config.restrictToHosts }),
-            ...(config.githubToken ? { githubToken: config.githubToken } : {}),
-            label: "claude-code"
-        })
-    };
-}
-/**
- * A conversation to continue, as launch flags.
- *
- * One place rather than a spread at each call site, so `fork` can never travel
- * without the id it forks — which {@link file://./run.ts buildLaunch} refuses,
- * but refuses at launch rather than here.
- */
-function resumption(resume) {
-    if (!resume)
-        return undefined;
-    return { resume: resume.sessionId, ...(resume.fork ? { fork: true } : {}) };
-}
-/**
- * Refuse a deployment with no credential when the model is built, naming this
- * plugin, rather than at the first model call inside a run somebody is waiting
- * on. The thunk is still what the gateway calls per request, so a rotation is
- * picked up.
- */
-export function requireCredentials(config) {
-    if (config.credentials().filter(Boolean).length === 0) {
-        throw new Error("claude-code: no credentials. Set at least one `claude setup-token` " +
-            "credential and pass it as " +
-            "`credentials: () => [env.CLAUDE_CODE_OAUTH_TOKEN_1]`.");
-    }
-}

package/dist/workspace/ca-trust.d.ts

@@ -1,95 +0,0 @@
-import type { Workspace } from "@cloudflare/computer";
-/**
- * Making a container able to speak TLS, once there is a CA to trust.
- *
- * Only `egress: { mode: "http-gateway" }` needs this, but it lives on every
- * workspace because the cost of getting it wrong is asymmetric: the trust
- * install against a container with no CA prints one line and exits 0, while a
- * container that missed it fails every later HTTPS connection with an error
- * that names no cause.
- */
-/**
- * Install the egress interception CA, and say what was there to install.
- *
- * One shell string rather than a script in the image, because **the image cannot
- * run this at all**, and the reason is ordering rather than preference.
- * Cloudflare's own recipe assumes interception is declared as container
- * configuration, so the runtime mounts the CA before the container starts.
- * `@cloudflare/computer` uses the raw container API, where the only interception
- * hooks are methods called *after* `start()` — so an entrypoint runs strictly
- * before the CA can exist, finds nothing, and reports the container
- * un-intercepted while every later TLS connection fails.
- *
- * The listing comes first and runs unconditionally: when the CA is missing,
- * *what else is in that directory* is the only evidence distinguishing "mounted
- * somewhere else" from "never provisioned", and it costs one line.
- */
-export declare const TRUST_CA_COMMAND: string;
-export interface ContainerTrustDeps {
-    workspace: () => Workspace;
-    /** The runtime's own container handle, for the exit this has to hear about. */
-    container: () => Container | undefined;
-    /** Log prefix and object id, for the one line an operator can see. */
-    tag: () => string;
-    id: () => string;
-    /** Told when the watched container exits, for what else it described. */
-    onExit?: () => void;
-}
-/**
- * Whether the container this object is talking to has had the CA installed.
- *
- * ## Why the answer is in memory
- *
- * What it describes is a *container*, which does not outlive the isolate in any
- * way worth persisting. A stored `true` would be the exact bug this exists to
- * prevent — a flag surviving the container it describes, and vouching for its
- * replacement.
- *
- * It is wrong only in the safe direction. An isolate that lost it re-runs an
- * idempotent `install -m 644`.
- *
- * ## What clears it
- *
- * **The container's own exit**, watched through `monitor()`. This is the signal
- * that does not depend on anyone noticing: a container replaced underneath a
- * running command — by a reconnect, a relaunch, a crash — exits, and the watch
- * fires whoever caused it. Nothing else here is in a position to know, because
- * most commands run through the stub this object hands out and report their
- * failures to their own caller, not to it.
- *
- * The watch lives in memory beside the flag it clears, which is the right
- * lifetime: an isolate that loses one loses the other, and the replacement
- * starts out untrusted. It is deliberately not held open with `waitUntil` —
- * that would keep an invocation alive for the life of the container.
- *
- * A container seen not running, and a command reporting `EEXEC_LOST`, both call
- * {@link forget} as well. They are cheap, they are strictly earlier in some
- * orderings, and neither is load-bearing on its own.
- */
-export declare class ContainerTrust {
-    #private;
-    private readonly deps;
-    constructor(deps: ContainerTrustDeps);
-    /**
-     * Forget that any container was trusted.
-     *
-     * Drops the standing watch too, because this is also reached for a container
-     * that keeps running — a `running` read, a lost exec. The watch it leaves
-     * behind ignores that container's real exit, so without a fresh one nothing
-     * would clear the flag again and the replacement would be vouched for.
-     */
-    forget(): void;
-    /**
-     * Trust the CA if this container has not been trusted yet.
-     *
-     * Called from the workspace's `ready()` path, which is the earliest point that
-     * is not too early: the backend's `connect()` has completed, so start and
-     * interception have both happened.
-     *
-     * **Never throws.** A workspace that cannot trust the CA still has a checkout,
-     * a shell and a git history, and whatever runs next will say plainly what went
-     * wrong — refusing to proceed here would replace a legible TLS error with an
-     * opaque one.
-     */
-    ensure(): Promise<void>;
-}