@dynamicagents/plugins 0.14.0 → 0.16.0

package/README.md

@@ -26,20 +26,20 @@ An agent installs plugins by listing them in `getPlugins()`, on a `StepAgent` fr
 import { StepAgent } from "@dynamicagents/core/agent";
 import { browser } from "@dynamicagents/plugins/browser";
 import { computer, computerWorkspace } from "@dynamicagents/plugins/computer";
-// `workspaceConfig` names the `/workspace` object this agent works in.
-import { repo } from "@dynamicagents/plugins/repo";
+// `sandboxConfig` names the `/sandbox` object this agent works in.
+import { repo } from "@dynamicagents/plugins/repo-github";
 
 export class Coder extends StepAgent<Env> {
-  // `computer` runs commands in a container, so the agent's own workspace —
+  // The tools run commands in a container, so the agent's own workspace —
   // what Think's `read` and `write` work on — has to be that container's.
-  override workspace = computerWorkspace(workspaceConfig(this.env), () =>
+  override workspace = computerWorkspace(sandboxConfig(this.env), () =>
     this.pluginContext().runtime()
   );
 
   override getPlugins() {
     return [
       browser({ binding: this.env.BROWSER }),
-      computer(workspaceConfig(this.env)),
+      computer({ shell: "bash" }),
       repo(repoConfig(this.env))
     ];
   }
@@ -64,14 +64,14 @@ plugin to the tools an install names.
 
 ## The plugins
 
-| Subpath                            | What it adds                                                                                                     | Needs                                              |
-| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
-| [`/browser`](src/browser/)         | Read web pages via Browser Rendering Quick Actions                                                               | `BROWSER` (paid plan)                              |
-| [`/claude-code`](src/claude-code/) | Sub-agents whose model is a Claude Code session in the workspace container                                       | one or more `claude setup-token` credentials       |
-| [`/computer`](src/computer/)       | An agent's tools over a workspace — `bash`, `grep`, `edit` — and the workspace Think's file tools use            | a `/workspace` object                              |
-| [`/repo`](src/repo/)               | Clone, commit, push a branch, open a pull request — over any container                                           | `GITHUB_TOKEN`                                     |
-| [`/scratch`](src/scratch/)         | A throwaway git repository with no remote, for work that needs a container but no checkout                       | —                                                  |
-| [`/workspace`](src/workspace/)     | The Durable Object a container workspace lives in — its container, credentialed git, dependency install and sync | `@cloudflare/computer`, `@platformatic/vfs` (paid) |
+| Subpath                            | What it adds                                                                                              | Needs                                              |
+| ---------------------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
+| [`/browser`](src/browser/)         | Read web pages via Browser Rendering Quick Actions                                                        | `BROWSER` (paid plan)                              |
+| [`/claude-code`](src/claude-code/) | Sub-agents whose model is a Claude Code session in a sandbox                                              | one or more `claude setup-token` credentials       |
+| [`/computer`](src/computer/)       | An agent's tools over a sandbox — `bash`, `grep`, `edit` — and the workspace Think's file tools use       | a `/sandbox` object                                |
+| [`/repo-github`](src/repo-github/) | Clone, commit, push a branch, open a pull request on GitHub — over any container                          | `GITHUB_TOKEN`                                     |
+| [`/sandbox`](src/sandbox/)         | A container whose disk is the checkout, driven from a Durable Object through `agents`' `ContainerHarness` | `@cloudflare/sandbox`, an image running its daemon |
+| [`/scratch`](src/scratch/)         | A throwaway git repository with no remote, for work that needs a container but no checkout                | —                                                  |
 
 Each directory has its own README with the config shape and a paste-ready `wrangler.jsonc`
 snippet — a plugin cannot add its own binding, which is why it declares what it needs.
@@ -111,7 +111,7 @@ The rules the whole design rests on:
 
 A write that must not happen twice — a comment, a reply — is a Think `action()` in
 `actions(ctx)`, with an idempotency key, so a recovered turn replays it rather than
-repeating it. [`/repo`](src/repo/) has two.
+repeating it. [`/repo-github`](src/repo-github/) has two.
 
 A plugin that owns a domain some work is delegated into exports a `SubAgentSpec` as data,
 and the agent binds it to a `SubAgent` class — see [`/claude-code`](src/claude-code/).

package/dist/claude-code/cards.d.ts

@@ -52,4 +52,6 @@ export declare function initCard(event: InitEvent): Card;
 export declare function resultCard(result: ClaudeCodeResult): Card;
 /** A session its run gave up on before reading its end, and why. */
 export declare function lostCard(why: string): Card;
+/** A session's container lost mid-turn, and the session resuming in a new one. */
+export declare function containerLostCard(reason: string): Card;
 export {};

package/dist/claude-code/cards.js

@@ -272,6 +272,17 @@ export function lostCard(why) {
         }
     };
 }
+/** A session's container lost mid-turn, and the session resuming in a new one. */
+export function containerLostCard(reason) {
+    return {
+        text: "Container lost — the session resumes in a new one",
+        detail: {
+            title: "Session",
+            status: "error",
+            sections: [section("Why", reason, "text")]
+        }
+    };
+}
 function duration(ms) {
     const s = Math.round(ms / 1000);
     if (s < 60)

package/dist/claude-code/config.d.ts

@@ -1,10 +1,6 @@
 /**
- * Everything one deployment of this plugin tunes, in one shape.
- *
- * Config at instantiation rather than an `env` argument, for the reason the
- * whole package works this way: `Env` is the ambient interface `wrangler types`
- * generates into a *consumer's* app and does not exist here, and on Workers
- * there is no module-scope `env` to read anyway.
+ * What one deployment tunes about its sessions, in one shape: the daemon reads
+ * the CLI's half, and the sub-agent's model the ceiling.
  */
 /**
  * The permission modes `claude --permission-mode` accepts.
@@ -49,26 +45,6 @@ export declare const DEFAULT_PERMISSION_MODE: PermissionMode;
  */
 export type EffortLevel = "low" | "medium" | "high" | "xhigh" | "max";
 export interface ClaudeCodeConfig {
-    /**
-     * The credential pool, in priority order — index 0 is tried first.
-     *
-     * A thunk so a rotated secret is picked up without rebuilding the plugin list.
-     * **These values never enter the container** — one is read on the Worker side
-     * by the egress gateway and swapped into the outbound request. The container
-     * gets {@link file://./run.ts CREDENTIAL_PLACEHOLDER}.
-     *
-     * `claude setup-token` OAuth credentials. There is deliberately no API-key
-     * path: the subscription credential is the one that reaches frontier models
-     * through this client, and a second path would be a second thing to get wrong.
-     *
-     * **Why a pool.** A subscription has a rolling 5-hour bucket and a weekly one,
-     * neither readable. Rather than estimate spend against them, the gateway uses
-     * the first usable entry and moves on when Anthropic says that one is done —
-     * see {@link file://./credentials.ts}. An array of one is valid and behaves
-     * exactly as a single credential did: used until its bucket empties, then
-     * refused with the reset time.
-     */
-    credentials: () => readonly string[];
     /** Which model the session runs. Unset, Claude Code picks its own default. */
     model?: string;
     /**
@@ -91,8 +67,7 @@ export interface ClaudeCodeConfig {
      * Advisory, and the distinction is the reason there is no turn ceiling beside
      * them — see the README on what this package deliberately does not do. That
      * tree is invisible to the agent running the session, so it multiplies
-     * whatever these say; {@link timeoutMs} is the ceiling that actually holds, because the
-     * container runtime enforces it.
+     * whatever these say; {@link timeoutMs} is the ceiling that actually holds.
      */
     maxSubagentDepth?: number;
     maxConcurrentSubagents?: number;
@@ -116,67 +91,19 @@ export interface ClaudeCodeConfig {
      *
      * What makes bypassing acceptable is not this flag being careful. It is that
      * the container has nothing to protect: it holds no credential — the real one
-     * is swapped in by the egress gateway on the Worker side — and it already runs
-     * a cloned repository's `postinstall` and its test suite, which is arbitrary
+     * is swapped in by the egress on the Worker side — and it already runs a
+     * cloned repository's `postinstall` and its test suite, which is arbitrary
      * code execution by design. Gating the agent's own edits while that stands
      * open buys nothing. Containment is the credential swap.
      *
-     * See {@link file://./run.ts buildLaunch} for the root guard this mode trips,
-     * which is the other half of making it work.
-     *
-     * A run may set its own, over this one: a planning run's is `plan` — see
-     * {@link file://./model.ts ClaudeCodeModelOptions.permissionMode}.
+     * A run may set its own, over this one: a planning run's is `plan`, as its run
+     * header says — see `../sandbox/header.ts`.
      */
     permissionMode?: PermissionMode;
     /**
-     * Restrict the container's egress to these hosts, plus `api.anthropic.com`.
-     *
-     * **Omit it and egress is unrestricted, which is the default.** An empty array
-     * is not the same thing — it means Anthropic only. See
-     * {@link file://./egress.ts EgressConfig.restrictToHosts} for the full table
-     * and for why open is the default.
-     *
-     * A restriction that leaves out `github.com` and `api.github.com` leaves out
-     * {@link githubToken} with them.
-     */
-    restrictToHosts?: readonly string[];
-    /**
-     * GitHub as the deployment's account, for a session that pushes its branch,
-     * opens its pull request and answers its review. Read per request, on the
-     * Worker side.
-     *
-     * The session gets a placeholder as `GH_TOKEN` and as git's credential, and
-     * the egress gateway swaps in this token for GitHub's hosts only — see
-     * {@link file://./github.ts}. Unset, `gh` and git reach GitHub anonymously.
-     */
-    githubToken?: () => string | undefined;
-    /**
-     * Ceiling on the whole session, enforced by the container runtime.
-     *
-     * **Must stay below the workspace's container-idle timer**, which is the
-     * invariant that has already caused one outage in this repository: two timers
-     * of similar length started moments apart, and whichever fired first destroyed
-     * the container the other depended on.
+     * How long a session may run before its sub-agent stops it — a ceiling on a
+     * session that has stopped making progress. See
+     * {@link file://./model.ts DEFAULT_TIMEOUT_MS}.
      */
     timeoutMs?: number;
-    /** Extra environment for the session. Never secrets — see the README. */
-    env?: Record<string, string>;
-    /**
-     * Who the session's own git commits are attributed to.
-     *
-     * A session has a shell and a checkout, so it commits — and it amends,
-     * rebases and cherry-picks, none of which a host can intercept the way it
-     * names an identity on a commit it makes itself. Left unset, every one of
-     * those falls through to whatever config the checkout happens to carry, which
-     * is a value frozen whenever that checkout was created.
-     *
-     * See {@link file://./run.ts buildLaunch} for why this becomes an environment
-     * rather than a `git config`.
-     */
-    author?: {
-        name: string;
-        email: string;
-    };
 }
-/** Fifteen minutes, well under the coder workspace's 20-minute idle timer. */
-export declare const DEFAULT_TIMEOUT_MS: number;

package/dist/claude-code/config.js

@@ -7,5 +7,3 @@
  * {@link ClaudeCodeConfig.permissionMode}.
  */
 export const DEFAULT_PERMISSION_MODE = "bypassPermissions";
-/** Fifteen minutes, well under the coder workspace's 20-minute idle timer. */
-export const DEFAULT_TIMEOUT_MS = 15 * 60_000;

package/dist/claude-code/credentials.d.ts

@@ -1,39 +1,12 @@
-/**
- * `@dynamicagents/plugins/claude-code` — the credential pool, and how exhaustion is
- * detected.
- *
- * ## Why a pool rather than a budget
- *
- * A Claude subscription has two limits that matter here: a rolling 5-hour
- * session bucket and a weekly one. Neither is readable, so staying under them by
- * *estimating* spend is the wrong instrument twice over — the estimate is a
- * guess about a bucket nobody can see, and it only moves when a run *ends*,
- * since usage is learned from the terminal `result` event. It is never a cap on
- * spend, only a gate on starting. The bucket itself says so precisely the moment
- * it is empty: Anthropic answers `429`.
- *
- * So this module does not predict. It **detects and routes around**: the
- * credential becomes an ordered pool, the gateway uses the first usable entry,
- * and a refusal moves the lead on. One mechanism covers both the 5-hour and the
- * weekly limit, because to this code they differ only in how far out the reset
- * is.
- *
- * ## Everything here is pure
- *
- * No storage, no `fetch`, no Durable Object — the host passes a
- * {@link CredentialStore} and the clock. That is the discipline `JobLifecycle`
- * and `InstallProbe` already set in this repository, and it is what lets the
- * rotation rules be specified without a container: a pool with a fake store is
- * two object literals.
- */
 /**
  * One entry's state, as the host persists it.
  *
  * `resetAt` is a wall-clock ms deadline; `0` means usable now. `dead` is a
  * different claim from an exhausted bucket and is kept separate for that reason:
  * a spent credential recovers by itself at `resetAt`, a rejected one never does
- * and needs an operator. Collapsing them would either resurrect a revoked token
- * on a timer or retire a good one permanently.
+ * on a timer. Collapsing them would resurrect a revoked token at some distant
+ * `resetAt`. Both are cleared by {@link CredentialPool.reopen}, which is not a
+ * timer: a revoked token costs one `401` per session and is rotated away.
  */
 export interface CredentialState {
     /**
@@ -55,6 +28,11 @@ export interface CredentialState {
     id: string;
     resetAt: number;
     dead?: boolean;
+    /**
+     * Which {@link CredentialPool.reopen} this state belongs to; absent is `0`.
+     * A later epoch replaces an earlier one outright — see {@link merge}.
+     */
+    epoch?: number;
 }
 /**
  * A stable, non-secret identifier for a credential.
@@ -113,6 +91,12 @@ export interface CredentialPool {
     spend(id: string, resetAt: number): Promise<Lead>;
     /** This credential is not valid — revoked, not spent. See {@link spend}. */
     reject(id: string): Promise<Lead>;
+    /**
+     * Forget every mark, so the next request asks Anthropic again — see "A mark
+     * lasts one session" above. Writes only when something was marked. The lead
+     * it returns is usable unless no credential is configured.
+     */
+    reopen(): Promise<Lead>;
 }
 export interface CredentialPoolConfig {
     /**
@@ -135,6 +119,17 @@ export interface CredentialPoolConfig {
     now?: () => number;
 }
 export declare function credentialPool(config: CredentialPoolConfig): CredentialPool;
+/**
+ * The pool over `config.store`, one per store for the isolate's life.
+ *
+ * The egress gateway and a session's admission hold the same store, and they
+ * have to be one pool: a pool's mirror is what carries a mark or a clear past a
+ * failed write, and its writes are ordered only among themselves. Two pools
+ * over one store each hold up alone and disagree once storage fails. The first
+ * caller's `credentials` and `now` are the pool's, which is safe because every
+ * holder of a store is configured from one deployment.
+ */
+export declare function sharedPool(config: CredentialPoolConfig): CredentialPool;
 /**
  * What an Anthropic refusal means for the credential that sent it.
  *
@@ -151,29 +146,16 @@ export type Refusal = {
     kind: "transient";
     retryAfterMs: number;
 };
-/**
- * Read the client's own bucket reading as a verdict on the credential in use.
- *
- * `undefined` means "nothing to act on", which today is every reading — see
- * {@link RATE_LIMIT_SPENT}. Otherwise the epoch-milliseconds the bucket refills,
- * ready for {@link CredentialPool.spend}.
- *
- * Here rather than beside the parser because this is the same question
- * {@link readRefusal} answers about a response: is this credential still worth
- * using? The parser's job is to say what the line contained.
- */
-export declare function readRateLimitEvent(info: {
-    status: string;
-    resetsAt?: number;
-}): number | undefined;
 /**
  * Read a response as a verdict on the credential that produced it.
  *
+ * A spent subscription bucket arrives as a `429` with
+ * `anthropic-ratelimit-unified-status: rejected`, the reset in
+ * `anthropic-ratelimit-unified-reset` (unix seconds) and the same wait in
+ * `retry-after` (seconds); `-representative-claim` names the bucket.
+ *
  * Returns `undefined` for anything it does not recognise — which the caller
- * treats as "forward it unchanged, and log the whole thing". That branch is not
- * a fallback, it is the instrument: **no genuine subscription-exhaustion `429`
- * has ever been observed through this path**, so the rules below are inferences
- * from the documented API rate limits, and the first real one is what will
- * settle them.
+ * treats as "forward it unchanged, and log the whole thing", so a refusal of
+ * another shape arrives named.
  */
 export declare function readRefusal(response: Response, at: number): Refusal | undefined;

package/dist/claude-code/credentials.js

@@ -18,6 +18,18 @@
  * weekly limit, because to this code they differ only in how far out the reset
  * is.
  *
+ * ## A mark lasts one session
+ *
+ * A spent or rejected mark is Anthropic's answer at the time, not a fact until
+ * `resetAt`: a plan upgrade, extra usage switched on, or a reset Anthropic
+ * grants early all make it wrong, and a deployment that trusts it refuses work
+ * Anthropic would take, for hours. Asking again is nearly free — a refusal bills
+ * nothing and comes back in milliseconds, and rotating through a pool of three
+ * spent credentials has taken about a second. So a host calls
+ * {@link CredentialPool.reopen} when it admits a session, and that session's
+ * first model call marks again whatever is still spent. Within the session the
+ * marks route as above.
+ *
  * ## Everything here is pure
  *
  * No storage, no `fetch`, no Durable Object — the host passes a
@@ -26,6 +38,7 @@
  * rotation rules be specified without a container: a pool with a fake store is
  * two object literals.
  */
+import { sha256Hex } from "@dynamicagents/core";
 /**
  * A stable, non-secret identifier for a credential.
  *
@@ -38,26 +51,33 @@
  * resisting a preimage attack.
  */
 export async function fingerprint(token) {
-    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
-    return [...new Uint8Array(digest).slice(0, 8)]
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("");
+    // Eight bytes, so sixteen hex characters.
+    return (await sha256Hex(token)).slice(0, 16);
 }
 /**
  * Fold two views of one credential's state together.
  *
- * Safe to apply in any order and any number of times, because both fields are
- * **monotonic**: `resetAt` only moves later (a bucket does not un-empty early)
- * and `dead` only turns on. That is what lets storage and the in-memory mirror
- * below be merged rather than one of them being chosen — there is no ordering in
- * which the merge loses information.
+ * Safe to apply in any order and any number of times, which is what lets
+ * storage and the in-memory mirror below be merged rather than one of them
+ * being chosen. The later epoch wins outright — that is how a reopen clears a
+ * mark. Within an epoch both fields are **monotonic**: `resetAt` only moves
+ * later and `dead` only turns on, so two refusals racing cannot make a spent
+ * credential look usable early.
+ *
+ * An epoch rather than a timestamp, so a reopen and a refusal in the same
+ * millisecond cannot tie.
  */
 function merge(a, b) {
+    const ea = a.epoch ?? 0;
+    const eb = b.epoch ?? 0;
+    if (ea !== eb)
+        return ea > eb ? a : b;
     const dead = a.dead === true || b.dead === true;
     return {
         id: a.id,
         resetAt: Math.max(a.resetAt, b.resetAt),
-        ...(dead ? { dead: true } : {})
+        ...(dead ? { dead: true } : {}),
+        ...(ea ? { epoch: ea } : {})
     };
 }
 export function credentialPool(config) {
@@ -135,27 +155,43 @@ export function credentialPool(config) {
             ? { ok: false }
             : { ok: false, retryAt: earliest };
     };
-    const update = async (id, change) => {
+    /**
+     * Every change runs after the one before it has written. Each is a read, a
+     * change and a whole-snapshot write, so two interleaved would let the earlier
+     * snapshot land last and put back what the later one cleared.
+     */
+    let tail = Promise.resolve();
+    const serial = (change) => {
+        const run = tail.then(change);
+        tail = run.catch(() => { });
+        return run;
+    };
+    /**
+     * The mirror is updated **before** the write is attempted, so a write that
+     * fails still changes what this isolate does next.
+     */
+    const persist = async (states, detail) => {
+        mirror = states;
+        await config.store.write(states).catch((err) => {
+            console.error("[claude-code] could not persist the credential pool", {
+                ...detail,
+                err: String(err)
+            });
+        });
+    };
+    const update = (id, change) => serial(async () => {
         const { tokens, keys, states } = await load();
         const index = keys.indexOf(id);
-        // An id that is no longer configured: the operator replaced that credential
-        // between the request going out and its refusal coming back. There is
-        // nothing to mark, and marking the slot instead is the bug `id` exists to
-        // prevent — so this returns the current lead and moves on.
+        // An id that is no longer configured: the operator replaced that
+        // credential between the request going out and its refusal coming back.
+        // There is nothing to mark, and marking the slot instead is the bug `id`
+        // exists to prevent — so this returns the current lead and moves on.
         if (id && index >= 0) {
             states[index] = change(states[index] ?? { id, resetAt: 0 });
-            // The mirror is updated **before** the write is attempted, so a write that
-            // fails still changes what this isolate does next.
-            mirror = states;
-            await config.store.write(states).catch((err) => {
-                console.error("[claude-code] could not persist the credential pool", {
-                    id,
-                    err: String(err)
-                });
-            });
+            await persist(states, { id });
         }
         return pick(tokens, keys, states);
-    };
+    });
     return {
         async lead() {
             const { tokens, keys, states } = await load();
@@ -172,9 +208,50 @@ export function credentialPool(config) {
         },
         reject(id) {
             return update(id, (state) => ({ ...state, dead: true }));
-        }
+        },
+        reopen: () => serial(async () => {
+            const { tokens, keys, states } = await load();
+            const at = now();
+            const slots = [];
+            states.forEach((state, i) => {
+                if (!state.dead && state.resetAt <= at)
+                    return;
+                states[i] = {
+                    id: state.id,
+                    resetAt: 0,
+                    epoch: (state.epoch ?? 0) + 1
+                };
+                slots.push(i);
+            });
+            if (slots.length) {
+                console.info("[claude-code] asking Anthropic again about credentials", {
+                    slots
+                });
+                await persist(states, { slots });
+            }
+            return pick(tokens, keys, states);
+        })
     };
 }
+const pools = new WeakMap();
+/**
+ * The pool over `config.store`, one per store for the isolate's life.
+ *
+ * The egress gateway and a session's admission hold the same store, and they
+ * have to be one pool: a pool's mirror is what carries a mark or a clear past a
+ * failed write, and its writes are ordered only among themselves. Two pools
+ * over one store each hold up alone and disagree once storage fails. The first
+ * caller's `credentials` and `now` are the pool's, which is safe because every
+ * holder of a store is configured from one deployment.
+ */
+export function sharedPool(config) {
+    let pool = pools.get(config.store);
+    if (!pool) {
+        pool = credentialPool(config);
+        pools.set(config.store, pool);
+    }
+    return pool;
+}
 /**
  * The only status that retires a credential.
  *
@@ -183,9 +260,9 @@ export function credentialPool(config) {
  * permission_error` for a credential that is fine but may not have the thing
  * being asked for. Reading the second as "this credential is bad" turns a
  * *configuration* mistake — a model the subscription cannot reach, say — into a
- * permanent, pool-wide outage: every credential 403s in turn, every one is
- * retired, and `dead` is the one state nothing clears on its own. An operator
- * would have to delete Durable Object storage to recover from a typo.
+ * pool-wide outage: every credential 403s in turn, every one is retired, and
+ * each session ends telling an operator to mint a new credential — the wrong
+ * instruction for a typo.
  *
  * A 403 is therefore left unclassified: forwarded to the client untouched, and
  * logged whole by the gateway. That is the same treatment every other
@@ -224,9 +301,8 @@ function retryAfterMs(value, at) {
  * Parse a reset header, which may be unix seconds or an RFC 3339 timestamp.
  *
  * Anthropic documents the `anthropic-ratelimit-*-reset` family as RFC 3339, and
- * the unified variant has been reported as an epoch. Both are accepted rather
- * than guessed at, because this is exactly the field the box in the plan says is
- * unverified — and a parser that handles both cannot be wrong about which.
+ * sends the unified one as unix seconds. Both are accepted, so neither family
+ * changing form can read as "no reset".
  */
 function resetAtFrom(value) {
     if (!value)
@@ -240,52 +316,17 @@ function resetAtFrom(value) {
     const parsed = Date.parse(trimmed);
     return Number.isNaN(parsed) ? undefined : parsed;
 }
-/**
- * The `rate_limit_event` statuses that mean the bucket is empty.
- *
- * **Empty, and that is the finding rather than a placeholder.** The client
- * announces its bucket on every session and the only status ever observed is
- * {@link file://./events.ts RATE_LIMIT_OK} — so there is no known value here to
- * put in, and putting in a guess is the expensive half of the asymmetry
- * {@link readRefusal} is built around: reading a healthy bucket as exhausted
- * retires a working credential for hours, and with a pool of one that is an
- * outage. The same reasoning that leaves a 403 unclassified leaves this set
- * empty.
- *
- * What fills it is the log. `run.ts` reports every change of reading, and a
- * status that is not `allowed` is also surfaced as a progress note, so the first
- * real one arrives named — at which point it goes in here and the pool starts
- * rotating *before* Anthropic refuses a request rather than because it did.
- */
-const RATE_LIMIT_SPENT = new Set();
-/**
- * Read the client's own bucket reading as a verdict on the credential in use.
- *
- * `undefined` means "nothing to act on", which today is every reading — see
- * {@link RATE_LIMIT_SPENT}. Otherwise the epoch-milliseconds the bucket refills,
- * ready for {@link CredentialPool.spend}.
- *
- * Here rather than beside the parser because this is the same question
- * {@link readRefusal} answers about a response: is this credential still worth
- * using? The parser's job is to say what the line contained.
- */
-export function readRateLimitEvent(info) {
-    if (!RATE_LIMIT_SPENT.has(info.status))
-        return undefined;
-    // Seconds on the wire. A value passed through unconverted lands in 1970, and a
-    // credential marked spent until then reads as usable — the failure would be
-    // this function doing nothing, silently.
-    return info.resetsAt === undefined ? undefined : info.resetsAt * 1000;
-}
 /**
  * Read a response as a verdict on the credential that produced it.
  *
+ * A spent subscription bucket arrives as a `429` with
+ * `anthropic-ratelimit-unified-status: rejected`, the reset in
+ * `anthropic-ratelimit-unified-reset` (unix seconds) and the same wait in
+ * `retry-after` (seconds); `-representative-claim` names the bucket.
+ *
  * Returns `undefined` for anything it does not recognise — which the caller
- * treats as "forward it unchanged, and log the whole thing". That branch is not
- * a fallback, it is the instrument: **no genuine subscription-exhaustion `429`
- * has ever been observed through this path**, so the rules below are inferences
- * from the documented API rate limits, and the first real one is what will
- * settle them.
+ * treats as "forward it unchanged, and log the whole thing", so a refusal of
+ * another shape arrives named.
  */
 export function readRefusal(response, at) {
     if (response.status === INVALID_STATUS)

package/dist/claude-code/daemon/index.d.ts

@@ -0,0 +1,24 @@
+import type { SandboxDaemonOptions } from "../../sandbox/daemon/index.js";
+import type { EffortLevel, PermissionMode } from "../config.js";
+export interface ClaudeCodeDaemonOptions {
+    /** Reported in the daemon's `hello`, and what the sandbox object names as its adapter. */
+    id: string;
+    /** The JSON schemas a run header may name, by name. */
+    schemas: Readonly<Record<string, Record<string, unknown>>>;
+    /** For a run whose header names none. */
+    model?: string;
+    effort?: EffortLevel;
+    /** A `build` run's mode. A `plan` run is always `plan`. */
+    permissionMode?: PermissionMode;
+    /** Who the session's own commits are attributed to — every git it starts, a submodule's and an amend's included. */
+    author?: {
+        name: string;
+        email: string;
+    };
+    maxSubagentDepth?: number;
+    maxConcurrentSubagents?: number;
+    /** More environment for the session. Never a credential: it is the container's. */
+    env?: Readonly<Record<string, string>>;
+}
+/** Claude Code, as `serveSandboxDaemon`'s `cli`. */
+export declare function claudeCodeDaemonCli(options: ClaudeCodeDaemonOptions): SandboxDaemonOptions["cli"];