@dynamicagents/plugins 0.14.0 → 0.15.0

package/dist/claude-code/daemon/index.js

@@ -0,0 +1,203 @@
+import { parseStream, toProgress } from "../events.js";
+import { ANTHROPIC_PLACEHOLDER_HOST, encodeNote, encodeRunEnd, encodeSessionId } from "../harness-wire.js";
+import { CREDENTIAL_PLACEHOLDER } from "../placeholder.js";
+/** What the end of stderr is kept to, when a process leaves with no result. */
+const STDERR_KEPT = 2_000;
+/** Claude Code, as `serveSandboxDaemon`'s `cli`. */
+export function claudeCodeDaemonCli(options) {
+    // Moved, the conversations land outside `.claude/projects`, which is all the
+    // harness mirrors, and a lost container could not resume one.
+    if (options.env && "CLAUDE_CONFIG_DIR" in options.env) {
+        throw new Error("claude-code: CLAUDE_CONFIG_DIR cannot be set through `env`: each session " +
+            "keeps its conversations under its own home's .claude/projects, which " +
+            "is what the harness keeps for a lost container to resume from");
+    }
+    return {
+        id: options.id,
+        // Where the CLI keeps its conversations, under the session's home: the
+        // daemon mirrors them to the object, so a lost container resumes them.
+        stateDirs: [".claude/projects"],
+        command: (turn) => command(options, turn),
+        parser: (turn) => parser(turn.operationId)
+    };
+}
+/**
+ * One turn's command.
+ *
+ * `stream-json` with `--verbose`, because the stream is the only way to report
+ * progress before a run of minutes ends, and without `--verbose` the CLI emits
+ * only the final result even in stream mode. The mode is always passed, never
+ * left to the CLI's own — see `../config.ts` `ClaudeCodeConfig.permissionMode`.
+ *
+ * A resumed turn's prompt is the next user turn. An id whose conversation is
+ * not there is not a failed session: the CLI emits a `result` naming it, with
+ * no model call and nothing billed. A fork continues the conversation under a
+ * new id, which is what a change of mode wants — a plan's conversation stays
+ * whole for an edit afterwards.
+ *
+ * What is absent: no `--bare` and no `--settings` override. A cloned
+ * repository's `CLAUDE.md`, skills and hooks are what make the agent good at
+ * it, and the container already runs that repository's `postinstall` and test
+ * suite by design.
+ */
+function command(options, turn) {
+    const header = turn.header;
+    const mode = header?.mode === "plan"
+        ? "plan"
+        : (options.permissionMode ?? "bypassPermissions");
+    const argv = [
+        "claude",
+        "-p",
+        "--output-format",
+        "stream-json",
+        "--verbose",
+        "--permission-mode",
+        mode
+    ];
+    const sessionId = turn.state.sessionId;
+    if (sessionId) {
+        argv.push("--resume", sessionId);
+        if (header?.fork)
+            argv.push("--fork-session");
+    }
+    const model = header?.model ?? turn.settings.model ?? options.model;
+    if (model)
+        argv.push("--model", model);
+    const effort = header?.effort ?? options.effort;
+    if (effort)
+        argv.push("--effort", effort);
+    if (header?.schema !== undefined) {
+        const schema = options.schemas[header.schema];
+        if (!schema)
+            throw new Error(`no schema named ${header.schema} in this image`);
+        argv.push("--json-schema", JSON.stringify(schema));
+    }
+    return { argv, stdin: turn.prompt, env: sessionEnv(options) };
+}
+/**
+ * The session's environment. No autoupdate: the image is pinned, and an update
+ * would move the wire shape the egress and the parser are written against,
+ * mid-run. No nonessential traffic: telemetry and feature-flag fetches, off at
+ * the source. The CLI runs as the agent rather than root, so no `IS_SANDBOX`,
+ * and each session has its own home, so no `CLAUDE_CONFIG_DIR`.
+ *
+ * Git's identity is an environment, not a `git config`: every git the session
+ * starts inherits it — a superproject's submodules, a scratch clone — and it
+ * outranks every config level. Both pairs, because an amend or a rebase keeps
+ * the author and stamps a fresh committer. Applied after `env`, so the four
+ * keys are one answer.
+ *
+ * The credential and its base URL are applied last, so a deployment's `env`
+ * cannot point the CLI at a real one. What other hosts need — git's and `gh`'s
+ * placeholders — the CLI inherits from the daemon, whose environment the
+ * sandbox fills from its egress rules.
+ */
+function sessionEnv(options) {
+    const author = options.author;
+    return {
+        DISABLE_AUTOUPDATER: "1",
+        CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+        ...(options.maxSubagentDepth === undefined
+            ? {}
+            : {
+                CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH: String(options.maxSubagentDepth)
+            }),
+        ...(options.maxConcurrentSubagents === undefined
+            ? {}
+            : {
+                CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS: String(options.maxConcurrentSubagents)
+            }),
+        ...options.env,
+        ...(author
+            ? {
+                GIT_AUTHOR_NAME: author.name,
+                GIT_AUTHOR_EMAIL: author.email,
+                GIT_COMMITTER_NAME: author.name,
+                GIT_COMMITTER_EMAIL: author.email
+            }
+            : {}),
+        ANTHROPIC_BASE_URL: `http://${ANTHROPIC_PLACEHOLDER_HOST}`,
+        CLAUDE_CODE_OAUTH_TOKEN: CREDENTIAL_PLACEHOLDER
+    };
+}
+function parser(operationId) {
+    let thinkingFrom;
+    /** Notes so far, which positions each note's key. */
+    let n = 0;
+    let result;
+    let rateLimit;
+    let sessionId;
+    return {
+        line(line) {
+            const at = Date.now();
+            const parsed = parseStream(`${line}\n`, {
+                now: at,
+                ...(thinkingFrom === undefined ? {} : { thinkingFrom })
+            });
+            thinkingFrom = parsed.thinkingFrom;
+            // The resume state the harness hands the next turn of this session.
+            let state;
+            for (const event of parsed.events) {
+                if (event.kind === "init") {
+                    sessionId = event.sessionId;
+                    state = { sessionId };
+                }
+                else if (event.kind === "rateLimit")
+                    rateLimit = event.info;
+                else if (event.kind === "result")
+                    result = event.result;
+            }
+            const message = (id, text) => ({
+                type: "message",
+                message: {
+                    id: `${operationId}:${id}`,
+                    role: "assistant",
+                    parts: [{ type: "text", text }],
+                    operationId,
+                    createdAt: at
+                }
+            });
+            const events = [];
+            if (state)
+                events.push(message("session", encodeSessionId(state.sessionId)));
+            const notes = toProgress(parsed.events, n);
+            n += notes.length;
+            for (const note of notes)
+                events.push(message(note.key, encodeNote(note)));
+            if (parsed.skipped > 0) {
+                console.warn("[claude-code] a stream line was not recognised", {
+                    operationId,
+                    sample: parsed.sample
+                });
+            }
+            return { events, ...(state ? { state } : {}) };
+        },
+        /**
+         * The outcome, once the process has exited — the harness settles nothing
+         * before that either. A result with the code the CLI exited with, since a
+         * result can be an error it exits non-zero on; with no result, its stderr.
+         */
+        end(exit) {
+            if (result) {
+                return {
+                    status: "done",
+                    text: encodeRunEnd({
+                        result,
+                        exitCode: exit.code,
+                        ...(rateLimit ? { rateLimit } : {}),
+                        ...(sessionId ? { sessionId } : {})
+                    })
+                };
+            }
+            return {
+                status: "unanswered",
+                reason: encodeRunEnd({
+                    exitCode: exit.code,
+                    stderr: exit.stderr.slice(-STDERR_KEPT),
+                    ...(rateLimit ? { rateLimit } : {}),
+                    ...(sessionId ? { sessionId } : {})
+                })
+            };
+        }
+    };
+}

package/dist/claude-code/egress.d.ts

@@ -1,126 +1,44 @@
-import { type CredentialStore } from "./credentials.js";
+import type { EgressCall, SandboxEgressRule } from "../sandbox/egress.js";
+import { type Lead } from "./credentials.js";
 /**
- * `@dynamicagents/plugins/claude-code` — the container's only way out.
- *
- * `egress: { mode: "http-gateway", gateway }` makes `computerd` intercept every
- * outbound request in the container and tunnel it back to the workspace Durable
- * Object, which reconstructs it against its original absolute URL and hands it
- * here. So this function sits on the **Worker side of the trust boundary** and
- * sees the whole of what the container tries to reach.
- *
- * Intercepting HTTPS means terminating it, which has a cost this file does not
- * pay and the container does: the runtime presents its own certificate, so an
- * image that has not installed the interception CA has no working HTTPS client
- * at all — not even `npm`. Nothing here can fix that from the Worker side; the
- * image's entrypoint has to, and the README's "Your image must trust the
- * interception CA" section is the whole of what that takes.
- *
- * That position is what makes three otherwise-hard things easy, and they are the
- * reason this file exists rather than a plain allowlist:
- *
- * 1. **The real credential never enters the container.** Claude Code is launched
- *    with a placeholder; the swap happens here. A `postinstall` script in a
- *    cloned repository can read every environment variable the container has and
- *    still learn nothing — which is the repository's standing rule ("hand it the
- *    action, not the credential") applied to a process nobody can constrain. A
- *    GitHub token, when configured, is held the same way — see `./github.ts`.
- * 2. **Any restriction that is applied is total.** Not a policy the container
- *    cooperates with; the only route out. Restriction is **off by default** —
- *    see {@link EgressConfig.restrictToHosts} for why.
- * 3. **Exhaustion is seen, so it can be routed around.** This is the only place
- *    Anthropic's actual response is visible, and therefore the only place that
- *    can learn a subscription bucket is empty. See {@link EgressConfig.store}
- *    and `credentials.ts`.
- *
- * ## What this deliberately does not do
- *
- * It does not meter, and a budget gate must not come back: an estimate of spend
- * is a guess about a bucket nobody can read, moves only once per run, and the
- * bucket announces the answer exactly — see the docblock in `credentials.ts`.
- *
- * And it does not, by default, **bound exfiltration**. The container holds the
- * checkout, and with no restriction configured it can send it anywhere. That is
- * a deliberate default rather than an oversight — the reasoning is on
- * {@link EgressConfig.restrictToHosts} — and what it means for a reader is that
- * the containment here is "the container holds no credential", full stop. Do not
- * read a host restriction that is switched off as a boundary that exists.
+ * The Anthropic credential, swapped in on the Worker side of a sandbox.
+ *
+ * The CLI holds a placeholder OAuth token, this sets the pool's lead as the
+ * Bearer, and a refusal that spends or rejects the credential moves the lead
+ * and tells the CLI to retry on the next one — `./credentials.ts` reads the
+ * refusal. A sandbox's egress entrypoint is stateless, so the pool lives in the
+ * sandbox the request came from, reached through `call.sandbox()` as a
+ * {@link CredentialLease}.
+ *
+ * The CLI reaches this over plain HTTP to a placeholder host the harness
+ * intercepts, so nothing in the container terminates TLS. The daemon points
+ * the CLI at it (`./daemon/index.ts`), after the deployment's own environment,
+ * so the rule sets no `env`.
  */
 /** Anthropic's API host — the one destination that gets a credential. */
 export declare const ANTHROPIC_HOST = "api.anthropic.com";
-export interface EgressConfig {
-    /**
-     * The credential pool — see {@link file://./config.ts ClaudeCodeConfig.credentials}.
-     *
-     * Called per request, so it must be cheap. This is the one place a real
-     * credential is read: the session is launched with `CREDENTIAL_PLACEHOLDER`
-     * and the swap happens here.
-     */
-    credentials: () => readonly string[];
-    /**
-     * Where the pool's `{ index → resetAt }` map is persisted.
-     *
-     * Supplied by the host because the state belongs to the host's storage: it is
-     * kept per workspace Durable Object, so each workspace learns a rotation
-     * independently. The cost of that is one wasted `429` per workspace per
-     * rotation; the saving is a Durable Object class, a binding and a migration.
-     */
-    store: CredentialStore;
-    /**
-     * Restrict the container to these hosts, plus `api.anthropic.com`.
-     *
-     * **Three-way, and each value means literally what it says:**
-     *
-     * | Value | Effect |
-     * |---|---|
-     * | omitted | unrestricted — the default |
-     * | `["registry.npmjs.org"]` | that host, plus Anthropic |
-     * | `[]` | Anthropic only |
-     *
-     * An empty array is *not* the same as omitting the field, deliberately. A host
-     * computing this list — `repos.flatMap(hostsFor)`, say — that happens to
-     * produce `[]` means "nothing extra", and collapsing that into "everything"
-     * would hand the widest possible policy to an expression that returned
-     * nothing.
-     *
-     * ## Why unrestricted is the default
-     *
-     * A curated list is permanently wrong for a coding agent. `esbuild`, `swc` and
-     * `sharp` fetch prebuilt binaries from release CDNs; Playwright downloads
-     * browsers from a third host; corepack fetches package managers; and reading
-     * documentation is part of the job. The failure mode is the bad one — `npm ci`
-     * dying inside a `postinstall` with a network error nobody connects to a list
-     * three files away.
-     *
-     * Little is lost by defaulting open, because **the restriction was never what
-     * protected the credential**. The swap is keyed on the destination being
-     * Anthropic and credential headers are stripped from everything else, so both
-     * hold whatever this says. What an unrestricted policy does give up is a bound
-     * on *exfiltration*: the container holds the checkout and can send it
-     * anywhere. That matches `/computer`, whose egress has always been
-     * unrestricted, for the same reason.
-     *
-     * Matched **exactly** on hostname when set. No wildcards, and that is not an
-     * omission: `*.example.com` is how a restriction quietly becomes no
-     * restriction, the first time a host serves user-controlled subdomains.
-     */
-    restrictToHosts?: readonly string[];
-    /**
-     * The GitHub token to swap for its placeholder, read per request. It reaches
-     * {@link GITHUB_HOSTS} and nowhere else. Unset, GitHub is reached
-     * anonymously like any other host. See `./github.ts`.
-     */
-    githubToken?: () => string | undefined;
-    /** Named in log lines so one Worker's several gateways stay tellable apart. */
+/** The pool, as the object holding it answers over RPC. */
+export interface CredentialLease {
+    lead(): Promise<Lead>;
+    spend(id: string, resetAt: number): Promise<Lead>;
+    reject(id: string): Promise<Lead>;
+}
+export interface ClaudeCodeEgressOptions {
+    /** The pool `call` leases from. Default: the sandbox it came from, which holds one through {@link credentialHost}. */
+    pool?: (call: EgressCall) => CredentialLease;
     label?: string;
     now?: () => number;
 }
+/** The egress rule of a sandbox that runs Claude Code. */
+export declare function claudeCodeEgress(options?: ClaudeCodeEgressOptions): SandboxEgressRule;
 /**
- * Build the `Fetcher` a `WorkspaceEgressPolicy` takes.
- *
- * A real object rather than a cast: `Fetcher` requires `connect` as well as
- * `fetch`, and container egress is HTTP only, so `connect` throws a sentence
- * naming why instead of being absent. If a future `computerd` ever opens a raw
- * socket through this policy, the failure says so rather than arriving as
- * `undefined is not a function` several frames away.
+ * The pool a sandbox object holds, for its RPCs to answer {@link CredentialLease}
+ * with — and `admit`, which a session start calls: a mark lasts one session.
  */
-export declare function claudeCodeEgress(config: EgressConfig): Fetcher;
+export declare function credentialHost(options: {
+    storage: DurableObjectStorage;
+    credentials: () => readonly string[];
+    key?: string;
+}): CredentialLease & {
+    admit(): Promise<Lead>;
+};