@dynamicagents/plugins 0.13.0 → 0.15.0

package/dist/claude-code/harness-wire.js

@@ -0,0 +1,47 @@
+/** The host the CLI is pointed at by `ANTHROPIC_BASE_URL`, which the sandbox intercepts. */
+export const ANTHROPIC_PLACEHOLDER_HOST = "anthropic.harness.internal";
+const END = "claude-code-end:";
+const NOTE = "claude-code-note:";
+const SESSION = "claude-code-session:";
+export function encodeRunEnd(end) {
+    return `${END}${JSON.stringify(end)}`;
+}
+/** The end in `text`, or `undefined` for a string the daemon did not write — the harness's own `container_lost`, say. */
+export function decodeRunEnd(text) {
+    return decode(END, text);
+}
+/**
+ * One transcript note, as one message's only text part.
+ *
+ * The daemon makes the note (`./events.ts` `toProgress`) rather than sending
+ * the event, because a card clips its sections and an event does not: a tool's
+ * output is whatever the tool printed, and the harness stores every message in
+ * a row of the object's SQLite.
+ */
+export function encodeNote(note) {
+    return `${NOTE}${JSON.stringify(note)}`;
+}
+export function decodeNote(text) {
+    return decode(NOTE, text);
+}
+/**
+ * The CLI's session id, as its own message: the handle a host records the
+ * moment the `init` line names it, since a session that dies before its end
+ * reports no other.
+ */
+export function encodeSessionId(sessionId) {
+    return `${SESSION}${JSON.stringify(sessionId)}`;
+}
+export function decodeSessionId(text) {
+    return decode(SESSION, text);
+}
+function decode(prefix, text) {
+    if (!text?.startsWith(prefix))
+        return undefined;
+    try {
+        return JSON.parse(text.slice(prefix.length));
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/claude-code/index.d.ts

@@ -17,19 +17,15 @@
  * an agent loop to drive: the session *is* the sub-agent's model —
  * {@link claudeCodeModel} — and Think's recovery drives that. A host binds
  * {@link CLAUDE_CODE_AGENT} to a `SubAgent` class whose `getModel()` returns
- * one, and adds the `prepare` and `settle` that claim and release a workspace.
+ * one, and adds the `prepare` and `settle` that claim and release a sandbox.
  *
  * ## The credential never enters the container
  *
- * The session is launched with a placeholder. Every request out of the container
- * is intercepted by `computerd` and handed to {@link claudeCodeEgress} on the
- * Worker side, which swaps in a real credential and strips credential headers
- * from every other destination.
- *
- * It can **also** restrict which hosts the container may reach, but that is
- * `restrictToHosts` and it is **off unless a deployment sets it** — so do not
- * read it as a boundary that exists by default. The containment that always
- * holds is the credential swap.
+ * The session is launched with a placeholder and a placeholder host. The
+ * sandbox's egress rule, {@link claudeCodeEgress}, swaps in a real
+ * credential on the Worker side, leased from the pool the sandbox object holds
+ * ({@link credentialHost}). The image's daemon runs
+ * `@dynamicagents/plugins/claude-code/daemon`'s CLI.
  *
  * ## The 5-hour and weekly limits are routed around, not predicted
  *
@@ -37,35 +33,29 @@
  * guess about a bucket nobody can read, and it only moves when a run *ends* — so
  * it caps nothing, it only refuses to start.
  *
- * The gateway sees Anthropic's actual response, which is the one place the
+ * The egress sees Anthropic's actual response, which is the one place the
  * bucket announces itself. So the credential is a **pool**: the first usable
  * entry is used, a refusal marks it spent until its reset and advances the lead,
  * and the client's own retry — prompted by a rewritten `retry-after` — lands on
- * the next one. When every entry is spent the upstream wait passes through
- * unchanged and the run fails cleanly with the reset time. See
- * {@link file://./credentials.ts}.
+ * the next one. When every entry is spent the run fails cleanly with the reset
+ * time. See {@link file://./credentials.ts}.
  *
  * ## Requires
  *
- * One or more `claude setup-token` credentials, a container image with the CLI
- * installed at a pinned version, and a workspace Durable Object whose egress
- * policy is `{ mode: "http-gateway" }` and which supplies a
- * {@link CredentialStore}. See the README.
+ * One or more `claude setup-token` credentials and a `/sandbox` image with the
+ * CLI installed at a pinned version. See the README.
  */
-export { claudeCodeModel } from "./model.js";
-export type { ClaudeCodeModelOptions, SessionEnd, SessionOutcome, SessionRecord, SessionWorkspace } from "./model.js";
-export { claudeCodeSession } from "./session.js";
-export type { ClaudeCodeSession, ResumeSession, StartSession } from "./session.js";
+export { claudeCodeModel, CONTAINER_LOST_PROMPT, DEFAULT_TIMEOUT_MS } from "./model.js";
+export type { ClaudeCodeModelOptions, SandboxRuns, SessionEnd, SessionOutcome, SessionRecord } from "./model.js";
+export { ANTHROPIC_HOST, claudeCodeEgress, credentialHost } from "./egress.js";
+export type { ClaudeCodeEgressOptions, CredentialLease } from "./egress.js";
+export { ANTHROPIC_PLACEHOLDER_HOST } from "./harness-wire.js";
+export { CREDENTIAL_PLACEHOLDER } from "./placeholder.js";
 export { CLAUDE_CODE_AGENT, CLAUDE_CODE_WRITE_INPUT, type ClaudeCodeInput } from "./spec.js";
-export { ANTHROPIC_HOST, claudeCodeEgress } from "./egress.js";
 export { VERIFIED_CLAUDE_CODE_VERSION } from "./verified.js";
-export type { EgressConfig } from "./egress.js";
-export { GITHUB_HOSTS, GITHUB_TOKEN_PLACEHOLDER } from "./github.js";
-export { credentialPool, readRefusal, readRateLimitEvent } from "./credentials.js";
+export { credentialPool, readRefusal } from "./credentials.js";
 export type { CredentialPool, CredentialPoolConfig, CredentialState, CredentialStore, Lead, Refusal } from "./credentials.js";
-export { buildLaunch, CLAUDE_EXEC_PREFIX, CREDENTIAL_PLACEHOLDER, execIdFor, followUpExecIdFor, freshCursor } from "./run.js";
-export type { DrainCursor, DrainOptions, DrainOutcome, Launch, LaunchOptions, SessionRuntime } from "./run.js";
 export { parseStream, toProgress, RATE_LIMIT_OK } from "./events.js";
 export type { ClaudeCodeEvent, ClaudeCodeResult, ClaudeCodeUsage, RateLimitInfo } from "./events.js";
-export { DEFAULT_PERMISSION_MODE, DEFAULT_TIMEOUT_MS } from "./config.js";
+export { DEFAULT_PERMISSION_MODE } from "./config.js";
 export type { ClaudeCodeConfig, EffortLevel, PermissionMode } from "./config.js";

package/dist/claude-code/index.js

@@ -17,19 +17,15 @@
  * an agent loop to drive: the session *is* the sub-agent's model —
  * {@link claudeCodeModel} — and Think's recovery drives that. A host binds
  * {@link CLAUDE_CODE_AGENT} to a `SubAgent` class whose `getModel()` returns
- * one, and adds the `prepare` and `settle` that claim and release a workspace.
+ * one, and adds the `prepare` and `settle` that claim and release a sandbox.
  *
  * ## The credential never enters the container
  *
- * The session is launched with a placeholder. Every request out of the container
- * is intercepted by `computerd` and handed to {@link claudeCodeEgress} on the
- * Worker side, which swaps in a real credential and strips credential headers
- * from every other destination.
- *
- * It can **also** restrict which hosts the container may reach, but that is
- * `restrictToHosts` and it is **off unless a deployment sets it** — so do not
- * read it as a boundary that exists by default. The containment that always
- * holds is the credential swap.
+ * The session is launched with a placeholder and a placeholder host. The
+ * sandbox's egress rule, {@link claudeCodeEgress}, swaps in a real
+ * credential on the Worker side, leased from the pool the sandbox object holds
+ * ({@link credentialHost}). The image's daemon runs
+ * `@dynamicagents/plugins/claude-code/daemon`'s CLI.
  *
  * ## The 5-hour and weekly limits are routed around, not predicted
  *
@@ -37,28 +33,24 @@
  * guess about a bucket nobody can read, and it only moves when a run *ends* — so
  * it caps nothing, it only refuses to start.
  *
- * The gateway sees Anthropic's actual response, which is the one place the
+ * The egress sees Anthropic's actual response, which is the one place the
  * bucket announces itself. So the credential is a **pool**: the first usable
  * entry is used, a refusal marks it spent until its reset and advances the lead,
  * and the client's own retry — prompted by a rewritten `retry-after` — lands on
- * the next one. When every entry is spent the upstream wait passes through
- * unchanged and the run fails cleanly with the reset time. See
- * {@link file://./credentials.ts}.
+ * the next one. When every entry is spent the run fails cleanly with the reset
+ * time. See {@link file://./credentials.ts}.
  *
  * ## Requires
  *
- * One or more `claude setup-token` credentials, a container image with the CLI
- * installed at a pinned version, and a workspace Durable Object whose egress
- * policy is `{ mode: "http-gateway" }` and which supplies a
- * {@link CredentialStore}. See the README.
+ * One or more `claude setup-token` credentials and a `/sandbox` image with the
+ * CLI installed at a pinned version. See the README.
  */
-export { claudeCodeModel } from "./model.js";
-export { claudeCodeSession } from "./session.js";
+export { claudeCodeModel, CONTAINER_LOST_PROMPT, DEFAULT_TIMEOUT_MS } from "./model.js";
+export { ANTHROPIC_HOST, claudeCodeEgress, credentialHost } from "./egress.js";
+export { ANTHROPIC_PLACEHOLDER_HOST } from "./harness-wire.js";
+export { CREDENTIAL_PLACEHOLDER } from "./placeholder.js";
 export { CLAUDE_CODE_AGENT, CLAUDE_CODE_WRITE_INPUT } from "./spec.js";
-export { ANTHROPIC_HOST, claudeCodeEgress } from "./egress.js";
 export { VERIFIED_CLAUDE_CODE_VERSION } from "./verified.js";
-export { GITHUB_HOSTS, GITHUB_TOKEN_PLACEHOLDER } from "./github.js";
-export { credentialPool, readRefusal, readRateLimitEvent } from "./credentials.js";
-export { buildLaunch, CLAUDE_EXEC_PREFIX, CREDENTIAL_PLACEHOLDER, execIdFor, followUpExecIdFor, freshCursor } from "./run.js";
+export { credentialPool, readRefusal } from "./credentials.js";
 export { parseStream, toProgress, RATE_LIMIT_OK } from "./events.js";
-export { DEFAULT_PERMISSION_MODE, DEFAULT_TIMEOUT_MS } from "./config.js";
+export { DEFAULT_PERMISSION_MODE } from "./config.js";

package/dist/claude-code/language-model.d.ts

@@ -0,0 +1,19 @@
+import type { LanguageModel } from "ai";
+/**
+ * A run whose only output is its report, as a sub-agent's model.
+ *
+ * Both Claude Code models are this: the session is the whole turn, so the
+ * stream carries nothing but the report, and Think's stall watchdog is off, so
+ * a silent stream is not cut.
+ */
+/** The provider interface this implements, read off `ai` rather than imported. */
+export type LanguageModelV3 = Extract<LanguageModel, {
+    specificationVersion: "v3";
+}>;
+export type CallOptions = Parameters<LanguageModelV3["doStream"]>[0];
+export declare function reportingModel(modelId: string, run: (call: CallOptions) => Promise<string>): LanguageModelV3;
+/**
+ * The task: the last user message's text. On a continued turn the prompt ends
+ * with the interrupted assistant message, so the last message is not it.
+ */
+export declare function lastUserText(prompt: CallOptions["prompt"]): string;

package/dist/claude-code/language-model.js

@@ -0,0 +1,71 @@
+/** Zeroed: the session's tokens are the CLI's context, not this conversation's. */
+const USAGE = {
+    inputTokens: {
+        total: 0,
+        noCache: 0,
+        cacheRead: 0,
+        cacheWrite: 0
+    },
+    outputTokens: { total: 0, text: 0, reasoning: 0 }
+};
+export function reportingModel(modelId, run) {
+    return {
+        specificationVersion: "v3",
+        provider: "claude-code",
+        modelId,
+        supportedUrls: {},
+        async doStream(call) {
+            // The stream is returned at once and the session runs inside it, so
+            // nothing waits on a promise for the length of a session.
+            const stream = new ReadableStream({
+                async start(controller) {
+                    controller.enqueue({ type: "stream-start", warnings: [] });
+                    try {
+                        const text = await run(call);
+                        controller.enqueue({ type: "text-start", id: "report" });
+                        controller.enqueue({
+                            type: "text-delta",
+                            id: "report",
+                            delta: text
+                        });
+                        controller.enqueue({ type: "text-end", id: "report" });
+                        controller.enqueue({
+                            type: "finish",
+                            usage: USAGE,
+                            finishReason: { unified: "stop", raw: undefined }
+                        });
+                        controller.close();
+                    }
+                    catch (err) {
+                        controller.error(err);
+                    }
+                }
+            });
+            return { stream };
+        },
+        async doGenerate(call) {
+            const text = await run(call);
+            return {
+                content: [{ type: "text", text }],
+                finishReason: { unified: "stop", raw: undefined },
+                usage: USAGE,
+                warnings: []
+            };
+        }
+    };
+}
+/**
+ * The task: the last user message's text. On a continued turn the prompt ends
+ * with the interrupted assistant message, so the last message is not it.
+ */
+export function lastUserText(prompt) {
+    for (let i = prompt.length - 1; i >= 0; i--) {
+        const message = prompt[i];
+        if (message.role !== "user")
+            continue;
+        return message.content
+            .map((part) => (part.type === "text" ? part.text : ""))
+            .join("");
+    }
+    throw new Error("claude-code: the run has no task — no user message");
+}

package/dist/claude-code/model.d.ts

@@ -1,31 +1,9 @@
-import type { LanguageModel } from "ai";
 import type { ArtifactEntryDetail } from "@dynamicagents/core/artifacts";
-import type { ClaudeCodeConfig, PermissionMode } from "./config.js";
+import type { PollResult } from "../sandbox/object.js";
+import type { EffortLevel, PermissionMode } from "./config.js";
 import type { ClaudeCodeResult, RateLimitInfo } from "./events.js";
-import { type SessionRuntime } from "./run.js";
-/**
- * A Claude Code session as a sub-agent's **model**.
- *
- * Claude Code brings its own tools, its own loop and its own context, so there
- * is nothing for Think to drive but the one call that runs it — and making that
- * call the model is what puts the session under Think's recovery. A turn cut by
- * an eviction or a deploy is continued; the continuation calls `doStream`
- * again, and every step below it has already taken is stored, so it resumes
- * where it was: the session is re-attached from its cursor, and a report
- * already made is emitted again rather than made again.
- *
- * ## The report is the only text
- *
- * A run's result is what its assistant messages say, so narration streamed as
- * text would become the result and bury the report. What the session says as
- * it works goes to the parent as notes instead, through `note`. Nothing else is
- * streamed at all: Think's stall watchdog is off, so a silent stream is not cut.
- */
-/** The provider interface this implements, read off `ai` rather than imported. */
-type LanguageModelV3 = Extract<LanguageModel, {
-    specificationVersion: "v3";
-}>;
-/** How one exec of a session ended. */
+import { type LanguageModelV3 } from "./language-model.js";
+/** How one turn of a session ended. */
 export interface SessionEnd {
     exitCode: number;
     /** Absent when the process died without ever emitting a `result` line. */
@@ -35,13 +13,13 @@ export interface SessionEnd {
     /** The subscription bucket as the client last reported it, if it did. */
     rateLimit?: RateLimitInfo;
     /**
-     * The Claude Code session id, from the `init` line by way of the drain's
-     * cursor — see {@link file://./run.ts DrainCursor.sessionId}.
+     * The Claude Code session id, from the `init` line by way of the daemon's
+     * parser.
      *
      * Here as well as on `result` because the sessions worth continuing are often
-     * the ones with no result: a session ended by its time limit, a cancel or a
-     * container rollout reports none, and this is then the only handle to the
-     * conversation it got half-way through.
+     * the ones with no result: a session ended by its time limit or a cancel
+     * reports none, and this is then the only handle to the conversation it got
+     * half-way through.
      */
     sessionId?: string;
 }
@@ -69,60 +47,82 @@ export interface SessionOutcome {
     /** The follow-up's end, when `followUp` asked for one. */
     followUp?: SessionEnd;
 }
-/** The container a session runs in, released when the call that opened it ends. */
-export interface SessionWorkspace extends Disposable {
-    readonly runtime: SessionRuntime;
+/**
+ * A Claude Code session in a sandbox, as a sub-agent's model.
+ *
+ * Claude Code brings its own tools, its own loop and its own context, so there
+ * is nothing for Think to drive but the one call that runs it — and making that
+ * call the model is what puts the session under Think's recovery. The report
+ * is its only text: what the session says as it works goes to the parent as
+ * notes, through `note`. Every step's outcome is kept in the sub-agent's
+ * storage, so a recovered turn picks up where it was. What can be lost:
+ *
+ * - **Nothing streams.** The session runs as a harness operation the sandbox
+ *   keeps, and this polls it. A poll is short, so a reset of either object
+ *   costs one poll, and Think's recovery of this turn polls the same operation.
+ * - **A lost container resumes the session.** The operation settles as
+ *   `container_lost`, and this submits the next attempt to the same harness
+ *   session, whose CLI conversation the harness kept: the session is told what
+ *   happened, not briefed again.
+ */
+/** The sandbox RPCs a run uses. */
+export interface SandboxRuns {
+    createRun(runId: string, options: {
+        cwd: string;
+        forkOf?: string;
+        continues?: string;
+    }): Promise<{
+        sessionId: string;
+        created: boolean;
+    }>;
+    submit(runId: string, text: string, operationId: string): Promise<{
+        operationId: string;
+        accepted: boolean;
+    }>;
+    poll(runId: string, operationId: string, waitMs?: number, from?: number): Promise<PollResult>;
+    stopRun(runId: string): Promise<{
+        stopped: boolean;
+    }>;
 }
 export interface ClaudeCodeModelOptions {
-    config: ClaudeCodeConfig;
     /**
-     * Opens the run's container — the workspace the run's `runtime()` names.
-     * Called again to re-attach after a cut stream, so each call should reach the
-     * object through a new stub rather than one held from the last.
+     * The sandbox the run is in. Called again after a failed call, so each call
+     * should reach the object through a new stub.
      */
-    workspace: () => Promise<SessionWorkspace>;
+    sandbox: () => SandboxRuns;
     /** The sub-agent's own storage, where every step's outcome is kept. */
     storage: DurableObjectStorage;
-    /** The sub-agent's name, which is the run's id. The exec ids derive from it. */
+    /** The sub-agent's name, which is the run's id in the sandbox. */
     runId: string;
-    /** The checkout. */
+    /** The checkout, under the sandbox's `/workspace`. */
     dir: string;
-    /**
-     * A JSON Schema the session's answer must match. Its `result` then carries
-     * the answer as `structured`, for `report` to read.
-     */
-    jsonSchema?: Record<string, unknown>;
-    /**
-     * This run's mode, over {@link file://./config.ts ClaudeCodeConfig.permissionMode}.
-     *
-     * A planning run is a writing session under `plan` with a `jsonSchema`: it
-     * reads, edits nothing, and answers through `StructuredOutput` rather than an
-     * approval nobody is there to give. Carrying the plan out is a later run that
-     * resumes it with `fork` under the config's mode — the CLI takes a new
-     * `--permission-mode` on `--resume` — so the plan's own conversation stays
-     * whole for an edit.
-     */
+    /** The CLI's model. Unset, the daemon's. */
+    model?: string;
+    effort?: EffortLevel;
+    /** A JSON schema the daemon was built with, by name, that the answer must match. */
+    schema?: string;
+    /** `plan` runs read-only and answers to {@link schema}; anything else is the daemon's mode. */
     permissionMode?: PermissionMode;
     /**
-     * A Claude Code conversation for this run to continue instead of starting one
-     * — see {@link file://./session.ts StartSession.resume}.
-     *
-     * Resolved by the host, in `prepare`, against whatever it recorded through
-     * {@link ClaudeCodeModelOptions.onSession}: which conversations exist in a
-     * workspace, and which of them a caller may continue, are the host's
-     * questions. The run's prompt is then the next user turn — its `brief` hook
-     * is the place to say what changed and nothing the session already holds.
+     * Another run in this sandbox whose conversation this one carries on: as more
+     * of it, or with `fork`, as a new branch of it. Its prompt is then the next
+     * user turn.
      */
     resume?: {
-        sessionId: string;
+        run: string;
         fork?: boolean;
     };
     /**
-     * Files one note on the parent's transcript: the sub-agent's `note`. A tool
-     * call, its result and the session's own start and end arrive with a card —
-     * see {@link file://./cards.ts Card}.
+     * How long a session may run, from its first submission, before it is
+     * stopped. Default {@link DEFAULT_TIMEOUT_MS}.
+     */
+    timeoutMs?: number;
+    /**
+     * File one note on the parent's transcript. `at` is when the daemon read the
+     * line it came from: a poll files a batch at once, so the filing time would
+     * give a tool's call and its result the same moment.
      */
-    note: (key: string, text: string, detail?: ArtifactEntryDetail) => Promise<void>;
+    note: (key: string, text: string, detail?: ArtifactEntryDetail, at?: number) => Promise<void>;
     /**
      * The session's handle, as soon as there is one and again when the session
      * ends — see {@link SessionRecord}.
@@ -148,5 +148,12 @@ export interface ClaudeCodeModelOptions {
     /** The text the parent receives. Run once, and kept. */
     report: (outcome: SessionOutcome) => Promise<string>;
 }
+/**
+ * Three hours: a ceiling on a session that has stopped making progress, not a
+ * budget for one that is. No timer in the sandbox races it, since the
+ * container's idle stop never fires while an operation is open.
+ */
+export declare const DEFAULT_TIMEOUT_MS: number;
+/** What a session is told when it resumes in a new container. */
+export declare const CONTAINER_LOST_PROMPT: string;
 export declare function claudeCodeModel(options: ClaudeCodeModelOptions): LanguageModelV3;
-export {};