@falkenslab/agent-kit 0.30.1 → 0.32.0

package/dist/core/externalExtensions.js

@@ -1,10 +1,8 @@
-import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 import { cp, mkdtemp, readdir, readFile, rm, stat, writeFile, mkdir } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { promisify } from "node:util";
 import { capabilitiesProblem, parseCapabilities, parseDescriptions, providedBy } from "./extensions.js";
 import { getLanguage } from "./messages/index.js";
 import { truncate } from "./toolLabels.js";
@@ -14,6 +12,7 @@ import { extensionSecretsPath, fillOptions, missingOptions, optionsNamed, parseO
 import { isTrusted } from "./workspaceTrust.js";
 import { checkRequirements, describeMissing, findOnPath, parseRequirements, requirementsProblem } from "./extensionRequirements.js";
 import { cachedPackageDir, cachedPackageProblem, cachePackage, npxServer, packageCacheDir, packageSpec } from "./npxPackages.js";
+import { cloneRepository } from "./gitClone.js";
 /** Whether a server is remote (#61). */
 export function isRemoteServer(server) {
     return "url" in server;
@@ -203,7 +202,20 @@ async function pluginServers(dir, raw) {
 }
 /** `${CLAUDE_PLUGIN_ROOT}`, `${CLAUDE_PLUGIN_DATA}` and `${VAR}` (the agent's variable) in a server's values. */
 function expand(value, folders) {
-    return value.replace(/\$\{(\w+)\}/g, (_, name) => name === "CLAUDE_PLUGIN_ROOT" ? folders.root : name === "CLAUDE_PLUGIN_DATA" ? folders.data : (process.env[name] ?? ""));
+    return value.replace(/\$\{(\w+)\}/g, (_, name) => (name === "CLAUDE_PLUGIN_ROOT" ? folders.root : name === "CLAUDE_PLUGIN_DATA" ? folders.data : (process.env[name] ?? "")));
+}
+/** The POSIX locale for a session's language: what any program reads to speak the person's language. */
+const LOCALES = { en: "en_US.UTF-8", es: "es_ES.UTF-8", fr: "fr_FR.UTF-8", de: "de_DE.UTF-8" };
+/**
+ * A server's locale in the session's language (#86): `LANG` and `LC_MESSAGES`, and `LC_ALL` when the
+ * system sets one (it would win). The standard way, so a server asks in the person's language
+ * knowing nothing of the kit, and does the same under Claude Code or any other client.
+ */
+function localeEnv(language) {
+    const locale = language ? LOCALES[language] : undefined;
+    if (!locale)
+        return {};
+    return { LANG: locale, LC_MESSAGES: locale, ...(process.env.LC_ALL ? { LC_ALL: locale } : {}) };
 }
 /**
  * Why one of an extension's servers can't run through the launcher (Node, its script first,
@@ -214,7 +226,8 @@ function serverLaunch(name, server, folders, packages = {}) {
     const { root } = folders;
     // Its folders as variables too, as Claude Code gives them to a plugin's servers.
     const declared = Object.fromEntries(Object.entries(server.env ?? {}).map(([key, value]) => [key, expand(String(value), folders)]));
-    const env = { CLAUDE_PLUGIN_ROOT: root, CLAUDE_PLUGIN_DATA: folders.data, ...declared };
+    // And the session's language as its locale (#86): a server that reads it can ask and answer in it.
+    const env = { CLAUDE_PLUGIN_ROOT: root, CLAUDE_PLUGIN_DATA: folders.data, ...localeEnv(folders.language), ...declared };
     const npx = npxServer(server);
     if (typeof npx === "string")
         return `${npx} (its server "${name}")`;
@@ -390,7 +403,7 @@ function externalExtension(installed, manifest, cache, unavailable = []) {
             const remote = [];
             if (Object.keys(manifest.servers).length)
                 await mkdir(installed.dataDir, { recursive: true });
-            const folders = { root: installed.dir, data: installed.dataDir };
+            const folders = { root: installed.dir, data: installed.dataDir, language: getLanguage() };
             // A remote server's options go into its URL and headers here, when the session opens: the
             // SDK fixes them then, so a changed value takes opening the session again (#61).
             const values = Object.values(manifest.servers).some(isRemoteServer) ? await readOptionValues(installed.privateDir, installed.name, manifest.userConfig, installed.lock.options) : {};
@@ -525,7 +538,6 @@ async function problem(installed, cache) {
         return options;
     return (await serversProblem(manifest, installed.dir, { cache, locked: installed.lock.packages })) ?? { manifest, unavailable };
 }
-const exec = promisify(execFile);
 /** Whether `source` names a git repository rather than a folder. */
 export function isGitSource(source) {
     return /^(https?:\/\/|git@|ssh:\/\/|git:\/\/|file:\/\/|github:)/.test(source) || /\.git(#.*)?$/.test(source);
@@ -549,12 +561,9 @@ export async function addExtension(source, scopeDir, options = {}) {
     if (isGitSource(source)) {
         const [url, ref] = source.replace(/^github:/, "https://github.com/").split("#");
         clone = await mkdtemp(path.join(os.tmpdir(), "agent-kit-extension-"));
-        // A pinned commit needs the history to check it out; otherwise the tip is enough.
-        await exec("git", ["clone", ...(options.sha ? [] : ["--depth", "1"]), ...(ref ? ["--branch", ref] : []), url, clone]);
-        if (options.sha)
-            await exec("git", ["-C", clone, "checkout", "--quiet", options.sha]);
-        commit = (await exec("git", ["-C", clone, "rev-parse", "HEAD"])).stdout.trim();
-        if (options.sha && commit !== options.sha.toLowerCase())
+        // Without the git program (#89): a pinned commit takes the history, otherwise the tip is enough.
+        commit = await cloneRepository(url, clone, { ...(ref ? { ref } : {}), ...(options.sha ? { sha: options.sha } : {}) });
+        if (options.sha && !commit.startsWith(options.sha.toLowerCase()))
             throw new Error(`${url} has no commit ${options.sha}.`);
         from = clone;
     }

package/dist/core/gitClone.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Clones a git repository into `dir` (#89), without the `git` program: an extension or a
+ * marketplace from GitHub installs on a computer without Git, as in a desktop app on a clean
+ * Windows. Over HTTP(S) with isomorphic-git (pure JavaScript: Node and Electron); a `file://`
+ * repository is read where it is and its files written out, never changed; SSH (`git@…`,
+ * `ssh://`, `git://`), which isomorphic-git can't speak, goes to the system's `git` when there is
+ * one. `ref` is a branch or a tag (the default branch without it); `sha` pins a commit, which must
+ * be on that branch's history. Returns the commit checked out. `dir` keeps no `.git`.
+ */
+export declare function cloneRepository(url: string, dir: string, options?: {
+    ref?: string;
+    sha?: string;
+}): Promise<string>;

package/dist/core/gitClone.js

@@ -0,0 +1,117 @@
+import { execFile } from "node:child_process";
+import fs from "node:fs";
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import git from "isomorphic-git";
+import http from "isomorphic-git/http/node";
+const exec = promisify(execFile);
+/**
+ * Clones a git repository into `dir` (#89), without the `git` program: an extension or a
+ * marketplace from GitHub installs on a computer without Git, as in a desktop app on a clean
+ * Windows. Over HTTP(S) with isomorphic-git (pure JavaScript: Node and Electron); a `file://`
+ * repository is read where it is and its files written out, never changed; SSH (`git@…`,
+ * `ssh://`, `git://`), which isomorphic-git can't speak, goes to the system's `git` when there is
+ * one. `ref` is a branch or a tag (the default branch without it); `sha` pins a commit, which must
+ * be on that branch's history. Returns the commit checked out. `dir` keeps no `.git`.
+ */
+export async function cloneRepository(url, dir, options = {}) {
+    try {
+        if (/^(git@|ssh:\/\/|git:\/\/)/.test(url))
+            return await cloneWithGitProgram(url, dir, options);
+        if (/^https?:\/\//.test(url))
+            return await cloneOverHttp(url, dir, options);
+        // A local repository: a file:// URL, or a path (one ending in .git, perhaps bare).
+        return await exportLocal(url.startsWith("file://") ? fileURLToPath(url) : path.resolve(url), dir, options);
+    }
+    catch (error) {
+        throw new Error(explain(url, options, error), { cause: error });
+    }
+}
+/** Over HTTP(S): the tip of a branch or tag in one shallow fetch, or its history when a commit is pinned. */
+async function cloneOverHttp(url, dir, { ref, sha }) {
+    await git.clone({ fs, http, dir, url, ...(ref ? { ref } : {}), singleBranch: true, ...(sha ? {} : { depth: 1 }), noTags: !ref });
+    if (sha)
+        await git.checkout({ fs, dir, ref: await expandCommit(path.join(dir, ".git"), sha), force: true });
+    const commit = await git.resolveRef({ fs, dir, ref: "HEAD" });
+    await fs.promises.rm(path.join(dir, ".git"), { recursive: true, force: true });
+    return commit;
+}
+/** A local repository: the commit's files written into `dir`, the repository itself untouched (no checkout, no index). */
+async function exportLocal(repo, dir, { ref, sha }) {
+    // A working copy's .git, or the repository itself when it's bare.
+    const gitdir = fs.existsSync(path.join(repo, ".git")) ? path.join(repo, ".git") : repo;
+    const commit = sha ? await expandCommit(gitdir, sha) : await git.resolveRef({ fs, gitdir, ref: ref ?? "HEAD" });
+    const { commit: { tree } } = await git.readCommit({ fs, gitdir, oid: commit });
+    await git.walk({
+        fs,
+        gitdir,
+        trees: [git.TREE({ ref: tree })],
+        map: async (filepath, [entry]) => {
+            if (!entry || filepath === ".")
+                return true;
+            const type = await entry.type();
+            const target = path.join(dir, filepath);
+            if (type === "tree")
+                await mkdir(target, { recursive: true });
+            else if (type === "blob") {
+                await mkdir(path.dirname(target), { recursive: true });
+                await writeFile(target, (await entry.content()) ?? new Uint8Array());
+            }
+            return true;
+        },
+    });
+    return commit;
+}
+/** A commit given whole or abbreviated, as git takes it: the whole id, or an error when there's no such commit. */
+async function expandCommit(gitdir, sha) {
+    const oid = sha.length === 40 ? sha.toLowerCase() : await git.expandOid({ fs, gitdir, oid: sha.toLowerCase() });
+    await git.readCommit({ fs, gitdir, oid });
+    return oid;
+}
+/** SSH, which isomorphic-git can't speak: the system's `git`, or a clear error without one. */
+async function cloneWithGitProgram(url, dir, { ref, sha }) {
+    try {
+        await exec("git", ["clone", ...(sha ? [] : ["--depth", "1"]), ...(ref ? ["--branch", ref] : []), url, dir]);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            throw Object.assign(new Error("no git"), { code: "NoGitForSsh" });
+        throw error;
+    }
+    if (sha)
+        await exec("git", ["-C", dir, "checkout", "--quiet", sha]);
+    const commit = (await exec("git", ["-C", dir, "rev-parse", "HEAD"])).stdout.trim();
+    await fs.promises.rm(path.join(dir, ".git"), { recursive: true, force: true });
+    return commit;
+}
+/** What went wrong, for a person: which repository, and whether it's the network, the repository, the ref or the commit. */
+function explain(url, { ref, sha }, error) {
+    const code = error.code ?? "";
+    const status = error.data?.statusCode;
+    let host = url;
+    try {
+        host = new URL(url).host || url;
+    }
+    catch {
+        // Not a URL (git@host:…): the address as given.
+    }
+    if (code === "NoGitForSsh")
+        return `${url} is an SSH address, which needs the git program, and this computer has none: use its HTTPS address instead.`;
+    if (code === "HttpError" && (status === 401 || status === 403 || status === 404))
+        return `${url} isn't a repository this computer can reach: it doesn't exist, or it's private.`;
+    if (code === "HttpError")
+        return `${host} answered with an error (${status ?? "?"}) for ${url}.`;
+    if (["ENOTFOUND", "EAI_AGAIN", "ECONNREFUSED", "ECONNRESET", "ETIMEDOUT"].includes(code))
+        return `Couldn't reach ${host} for ${url}: check the network.`;
+    if (code === "NotFoundError" || code === "AmbiguousError") {
+        if (sha)
+            return `${url} has no commit ${sha}${ref ? ` on ${ref}` : ""}.`;
+        if (ref)
+            return `${url} has no branch or tag ${ref}.`;
+    }
+    if (code === "NotFoundError" && !/^https?:\/\//.test(url))
+        return `${url} isn't a git repository.`;
+    return `Couldn't get ${url}${ref ? ` at ${ref}` : ""}: ${error instanceof Error ? error.message : String(error)}`;
+}

package/dist/core/hooks/languageReminder.d.ts

@@ -0,0 +1,16 @@
+import type { HookCallback } from "@anthropic-ai/claude-agent-sdk";
+import { type Language } from "../language.js";
+/**
+ * The reply language, said again next to what the model just read (#85): with only the system
+ * prompt's line, far from the turn, its narration between tool calls drifted to English after an
+ * English result (a source, a skill, the kit's own messages). One short line, about fifteen tokens.
+ */
+export declare function languageReminderLine(language: Language): string;
+/**
+ * Its hooks: after each of the main agent's tool calls (a subagent has its own prompt line, and
+ * its narration isn't the person's), and with the person's message.
+ */
+export declare function createLanguageReminder(language: Language): {
+    postToolUse: HookCallback;
+    userPromptSubmit: HookCallback;
+};

package/dist/core/hooks/languageReminder.js

@@ -0,0 +1,24 @@
+import { LANGUAGE_NAMES } from "../language.js";
+/**
+ * The reply language, said again next to what the model just read (#85): with only the system
+ * prompt's line, far from the turn, its narration between tool calls drifted to English after an
+ * English result (a source, a skill, the kit's own messages). One short line, about fifteen tokens.
+ */
+export function languageReminderLine(language) {
+    return `Reply language: ${LANGUAGE_NAMES[language]}, your narration between tool calls too.`;
+}
+/**
+ * Its hooks: after each of the main agent's tool calls (a subagent has its own prompt line, and
+ * its narration isn't the person's), and with the person's message.
+ */
+export function createLanguageReminder(language) {
+    const line = languageReminderLine(language);
+    return {
+        postToolUse: async (input) => {
+            if (input.agent_id)
+                return {};
+            return { hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: line } };
+        },
+        userPromptSubmit: async () => ({ hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext: line } }),
+    };
+}

package/dist/core/hooks/stepGate.d.ts

@@ -1,4 +1,5 @@
 import type { HookCallback } from "@anthropic-ai/claude-agent-sdk";
+import { type ToolLabels } from "../toolLabels.js";
 /**
  * PreToolUse hook for "interactive" mode: pauses before every action and asks for
  * confirmation (by keyboard or by file, see humanInput.ts), like reviewing a plan step
@@ -7,5 +8,9 @@ import type { HookCallback } from "@anthropic-ai/claude-agent-sdk";
  * `isActive` lets one session switch between "guided" and "interactive" while it runs (see
  * session.ts's `ModeControl`): the hook stays registered and, while inactive, gives no
  * decision at all, so the tool call goes on exactly as if the hook weren't there.
+ *
+ * The panel says the call as the chat does (#88), in the person's language: the session's
+ * labels (`labels`: the extensions'), else the kit's for its own tools, then the tool's name and
+ * its parameters in one line, cut short; the person approving needn't read JSON.
  */
-export declare function createStepGate(runDir: string, isActive?: () => boolean, selfAskingTools?: readonly string[]): HookCallback;
+export declare function createStepGate(runDir: string, isActive?: () => boolean, selfAskingTools?: readonly string[], labels?: () => ToolLabels | undefined): HookCallback;

package/dist/core/hooks/stepGate.js

@@ -1,5 +1,8 @@
 import { askForDecision } from "./humanInput.js";
 import { t } from "../messages/index.js";
+import { createFriendlyToolLabel, withToolLabels } from "../toolLabels.js";
+/** How much of a call's parameters the panel shows, as one line (#88). */
+const MAX_PARAMETERS = 300;
 const SELF_ASKING_SERVERS = ["mcp__approvals__", "mcp__manualLogin__"];
 const SELF_ASKING_TOOLS = new Set(["TodoWrite"]);
 /**
@@ -10,8 +13,13 @@ const SELF_ASKING_TOOLS = new Set(["TodoWrite"]);
  * `isActive` lets one session switch between "guided" and "interactive" while it runs (see
  * session.ts's `ModeControl`): the hook stays registered and, while inactive, gives no
  * decision at all, so the tool call goes on exactly as if the hook weren't there.
+ *
+ * The panel says the call as the chat does (#88), in the person's language: the session's
+ * labels (`labels`: the extensions'), else the kit's for its own tools, then the tool's name and
+ * its parameters in one line, cut short; the person approving needn't read JSON.
  */
-export function createStepGate(runDir, isActive = () => true, selfAskingTools = []) {
+export function createStepGate(runDir, isActive = () => true, selfAskingTools = [], labels = () => undefined) {
+    const describe = withToolLabels(labels, createFriendlyToolLabel());
     return async (input) => {
         if (!isActive())
             return {};
@@ -20,9 +28,10 @@ export function createStepGate(runDir, isActive = () => true, selfAskingTools =
         // a source) or only keeps the task list isn't asked about first: that would be asking to ask.
         if (SELF_ASKING_SERVERS.some((prefix) => pre.tool_name.startsWith(prefix)) || SELF_ASKING_TOOLS.has(pre.tool_name) || selfAskingTools.includes(pre.tool_name))
             return {};
+        const compact = JSON.stringify(pre.tool_input ?? {});
         const answer = await askForDecision(runDir, {
             title: t().proposedAction,
-            lines: [t().toolLine(pre.tool_name), t().parametersLine(JSON.stringify(pre.tool_input, null, 2))],
+            lines: [describe(pre.tool_name, pre.tool_input), t().toolLine(pre.tool_name), t().parametersLine(compact.length > MAX_PARAMETERS ? `${compact.slice(0, MAX_PARAMETERS)}…` : compact)],
         });
         if (answer === "q") {
             return {

package/dist/core/hooks/transcriptLogger.d.ts

@@ -9,8 +9,8 @@ export interface TranscriptLogger {
 /**
  * Logs every tool call (request + result) as one JSON line, redacting `secrets` (e.g. a
  * domain-specific password — see `BaseSessionConfig.secrets`) plus
- * `CLAUDE_CODE_OAUTH_TOKEN`, which this kit always scrubs regardless of domain since it
- * owns the auth-token concept (see claudeAuth.ts).
+ * `CLAUDE_CODE_OAUTH_TOKEN` when the person's environment sets one, which this kit always
+ * scrubs regardless of domain (it never handles a token itself: see claudeAuth.ts).
  */
 export declare function createTranscriptLogger(transcriptPath: string, secrets?: readonly string[]): TranscriptLogger;
 /** Avoids bloating the transcript with large payloads (browser-tool screenshots/base64). */

package/dist/core/hooks/transcriptLogger.js

@@ -10,8 +10,8 @@ function redact(text, secrets) {
 /**
  * Logs every tool call (request + result) as one JSON line, redacting `secrets` (e.g. a
  * domain-specific password — see `BaseSessionConfig.secrets`) plus
- * `CLAUDE_CODE_OAUTH_TOKEN`, which this kit always scrubs regardless of domain since it
- * owns the auth-token concept (see claudeAuth.ts).
+ * `CLAUDE_CODE_OAUTH_TOKEN` when the person's environment sets one, which this kit always
+ * scrubs regardless of domain (it never handles a token itself: see claudeAuth.ts).
  */
 export function createTranscriptLogger(transcriptPath, secrets = []) {
     const allSecrets = [...secrets, process.env.CLAUDE_CODE_OAUTH_TOKEN].filter((s) => Boolean(s));

package/dist/core/marketplaces.d.ts

@@ -1,3 +1,12 @@
+/**
+ * Marketplaces (ADR-025, #29): a repository of extensions is a Claude Code marketplace as it is,
+ * a folder or git repository with `.claude-plugin/marketplace.json` listing plugins and where
+ * each comes from. An agent knows the marketplaces added to it, kept in its extensions folder
+ * (`marketplaces.json`, and a copy of each in `.marketplaces/<name>/`), and installs from them
+ * by `<plugin>@<marketplace>` into either scope, through `addExtension()`: the same copy, hash and
+ * lock as any extension. Its official marketplace is known without asking; any other is added
+ * only by hand, after a warning (the command asks to type its name).
+ */
 /** Where a marketplace's plugin comes from, as `marketplace.json` says (Claude Code's forms). */
 export type PluginSource = string | {
     source: "github";

package/dist/core/marketplaces.js

@@ -1,20 +1,9 @@
-import { execFile } from "node:child_process";
 import { cp, mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { promisify } from "node:util";
 import { addExtension, isGitSource } from "./externalExtensions.js";
 import { fetchArchivePlugin, fetchNpmPlugin } from "./pluginDownloads.js";
-/**
- * Marketplaces (ADR-025, #29): a repository of extensions is a Claude Code marketplace as it is,
- * a folder or git repository with `.claude-plugin/marketplace.json` listing plugins and where
- * each comes from. An agent knows the marketplaces added to it, kept in its extensions folder
- * (`marketplaces.json`, and a copy of each in `.marketplaces/<name>/`), and installs from them
- * by `<plugin>@<marketplace>` into either scope, through `addExtension()`: the same copy, hash and
- * lock as any extension. Its official marketplace is known without asking; any other is added
- * only by hand, after a warning (the command asks to type its name).
- */
-const exec = promisify(execFile);
+import { cloneRepository } from "./gitClone.js";
 const REGISTRY = "marketplaces.json";
 const COPIES = ".marketplaces";
 const NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
@@ -77,9 +66,8 @@ async function fetchMarketplace(source) {
     try {
         if (await isGitMarketplace(source)) {
             const [location, ref] = source.split("#");
-            await exec("git", ["clone", "--depth", "1", ...(ref ? ["--branch", ref] : []), gitUrl(location), copy]);
-            const commit = (await exec("git", ["-C", copy, "rev-parse", "HEAD"])).stdout.trim();
-            await rm(path.join(copy, ".git"), { recursive: true, force: true });
+            // Without the git program (#89).
+            const commit = await cloneRepository(gitUrl(location), copy, ref ? { ref } : {});
             return { copy, commit };
         }
         await cp(path.resolve(source), copy, { recursive: true, filter: (file) => path.basename(file) !== ".git" });

package/dist/core/messages/de.js

@@ -194,12 +194,14 @@ export const de = {
         presentingPlan: "Plan vorlegen",
     },
     auth: {
-        noToken: "Es wurde kein Claude-Authentifizierungstoken gefunden",
-        noTokenDetail: "(weder die Umgebungsvariable CLAUDE_CODE_OAUTH_TOKEN noch ein im Code übergebenes).",
-        generateQuestion: 'Jetzt eines mit "claude setup-token" erzeugen? (erfordert ein Claude-Pro/Max-Abonnement)',
-        cantStart: "Der Agent kann ohne Token nicht starten. Setze CLAUDE_CODE_OAUTH_TOKEN von Hand (oder starte erneut und lass es erzeugen) und versuche es noch einmal.",
-        generatingHeading: "=== Claude-Authentifizierungstoken wird erzeugt ===",
-        browserWillOpen: "Zum Anmelden öffnet sich ein Browser; folge den Anweisungen, die der Befehl unten ausgibt.",
-        generated: "Token für diese Ausführung erzeugt. Speichere es selbst (z. B. CLAUDE_CODE_OAUTH_TOKEN im Profil deiner Shell), um diesen Schritt beim nächsten Mal zu überspringen.",
+        notSignedIn: "Du bist nicht bei Claude angemeldet",
+        notSignedInDetail: "Melde dich mit deinem Claude-Konto auf Anthropics eigener Seite an: Das übernimmt Claude Code, das mit diesem Agenten kommt, und es speichert die Anmeldung selbst. Oder setze ANTHROPIC_API_KEY, um einen API-Schlüssel zu verwenden.",
+        signInQuestion: "Jetzt mit deinem Claude-Konto anmelden?",
+        cantStart: "Der Agent kann ohne Claude nicht starten. Starte ihn erneut und melde dich an, oder setze ANTHROPIC_API_KEY.",
+        signingInHeading: "=== Anmeldung bei Claude ===",
+        browserWillOpen: "Ein Browser öffnet sich mit Anthropics Anmeldeseite. Zeigt die Seite einen Code, füge ihn hier ein.",
+        signedIn: "Angemeldet. Claude Code speichert die Anmeldung, du wirst nicht erneut gefragt.",
+        notCompleted: "Die Anmeldung wurde nicht abgeschlossen. Starte den Agenten erneut, um es noch einmal zu versuchen, oder setze ANTHROPIC_API_KEY.",
+        noClaude: "Das Claude-Code-Programm, das mit dem Agent SDK kommt (@anthropic-ai/claude-agent-sdk-<Plattform>-<Architektur>), ist nicht installiert, daher ist keine Anmeldung möglich. Installiere den Agenten neu, oder setze ANTHROPIC_API_KEY.",
     },
 };

package/dist/core/messages/en.d.ts

@@ -203,13 +203,15 @@ export interface Messages {
         presentingPlan: string;
     };
     auth: {
-        noToken: string;
-        noTokenDetail: string;
-        generateQuestion: string;
+        notSignedIn: string;
+        notSignedInDetail: string;
+        signInQuestion: string;
         cantStart: string;
-        generatingHeading: string;
+        signingInHeading: string;
         browserWillOpen: string;
-        generated: string;
+        signedIn: string;
+        notCompleted: string;
+        noClaude: string;
     };
 }
 export declare const en: Messages;

package/dist/core/messages/en.js

@@ -193,12 +193,14 @@ export const en = {
         presentingPlan: "Presenting the plan",
     },
     auth: {
-        noToken: "No Claude authentication token was found",
-        noTokenDetail: "(neither the CLAUDE_CODE_OAUTH_TOKEN environment variable, nor one passed in).",
-        generateQuestion: 'Generate one now with "claude setup-token" (requires a Claude Pro/Max subscription)?',
-        cantStart: "The agent can't start without a token. Set CLAUDE_CODE_OAUTH_TOKEN by hand (or run this again and accept generating it) and try again.",
-        generatingHeading: "=== Generating a Claude authentication token ===",
-        browserWillOpen: "A browser will open to log in; follow the instructions the command itself prints below.",
-        generated: "Token generated for this run. Save it yourself (e.g. CLAUDE_CODE_OAUTH_TOKEN in your shell profile) to skip this next time.",
+        notSignedIn: "You aren't signed in to Claude",
+        notSignedInDetail: "Sign in with your Claude account on Anthropic's own page: Claude Code, which comes with this agent, does it and keeps the sign-in itself. Or set ANTHROPIC_API_KEY to use an API key.",
+        signInQuestion: "Sign in with your Claude account now?",
+        cantStart: "The agent can't start without Claude. Run it again and sign in, or set ANTHROPIC_API_KEY.",
+        signingInHeading: "=== Signing in to Claude ===",
+        browserWillOpen: "A browser will open on Anthropic's sign-in page. If the page shows a code, paste it here.",
+        signedIn: "Signed in. Claude Code keeps the sign-in, so this won't be asked again.",
+        notCompleted: "The sign-in didn't complete. Run the agent again to retry, or set ANTHROPIC_API_KEY.",
+        noClaude: "Claude Code's binary, which comes with the Agent SDK (@anthropic-ai/claude-agent-sdk-<platform>-<arch>), isn't installed, so there's no way to sign in. Reinstall the agent, or set ANTHROPIC_API_KEY.",
     },
 };

package/dist/core/messages/es.js

@@ -194,12 +194,14 @@ export const es = {
         presentingPlan: "Presentando el plan",
     },
     auth: {
-        noToken: "No se ha encontrado ningún token de autenticación de Claude",
-        noTokenDetail: "(ni la variable de entorno CLAUDE_CODE_OAUTH_TOKEN ni uno pasado por código).",
-        generateQuestion: '¿Generar uno ahora con "claude setup-token"? (requiere una suscripción Claude Pro/Max)',
-        cantStart: "El agente no puede arrancar sin un token. Define CLAUDE_CODE_OAUTH_TOKEN a mano (o vuelve a ejecutarlo y acepta generarlo) e inténtalo de nuevo.",
-        generatingHeading: "=== Generando un token de autenticación de Claude ===",
-        browserWillOpen: "Se abrirá un navegador para iniciar sesión; sigue las instrucciones que el propio comando muestra abajo.",
-        generated: "Token generado para esta ejecución. Guárdalo tú (p. ej. CLAUDE_CODE_OAUTH_TOKEN en el perfil de tu shell) para no repetir esto la próxima vez.",
+        notSignedIn: "No has iniciado sesión en Claude",
+        notSignedInDetail: "Inicia sesión con tu cuenta de Claude en la propia página de Anthropic: lo hace Claude Code, que viene con este agente, y guarda él mismo la sesión. O define ANTHROPIC_API_KEY para usar una API key.",
+        signInQuestion: "¿Iniciar sesión ahora con tu cuenta de Claude?",
+        cantStart: "El agente no puede arrancar sin Claude. Vuelve a ejecutarlo e inicia sesión, o define ANTHROPIC_API_KEY.",
+        signingInHeading: "=== Iniciando sesión en Claude ===",
+        browserWillOpen: "Se abrirá un navegador en la página de inicio de sesión de Anthropic. Si la página muestra un código, pégalo aquí.",
+        signedIn: "Sesión iniciada. Claude Code la guarda, así que no se volverá a pedir.",
+        notCompleted: "El inicio de sesión no se completó. Vuelve a ejecutar el agente para reintentarlo, o define ANTHROPIC_API_KEY.",
+        noClaude: "No está instalado el binario de Claude Code que trae el Agent SDK (@anthropic-ai/claude-agent-sdk-<plataforma>-<arquitectura>), así que no hay cómo iniciar sesión. Reinstala el agente, o define ANTHROPIC_API_KEY.",
     },
 };

package/dist/core/messages/fr.js

@@ -194,12 +194,14 @@ export const fr = {
         presentingPlan: "Présentation du plan",
     },
     auth: {
-        noToken: "Aucun jeton d'authentification Claude n'a été trouvé",
-        noTokenDetail: "(ni la variable d'environnement CLAUDE_CODE_OAUTH_TOKEN, ni un jeton passé par le code).",
-        generateQuestion: 'En générer un maintenant avec "claude setup-token" ? (nécessite un abonnement Claude Pro/Max)',
-        cantStart: "L'agent ne peut pas démarrer sans jeton. Définissez CLAUDE_CODE_OAUTH_TOKEN à la main (ou relancez et acceptez de le générer), puis réessayez.",
-        generatingHeading: "=== Génération d'un jeton d'authentification Claude ===",
-        browserWillOpen: "Un navigateur va s'ouvrir pour vous connecter ; suivez les instructions que la commande affiche ci-dessous.",
-        generated: "Jeton généré pour cette exécution. Enregistrez-le vous-même (par ex. CLAUDE_CODE_OAUTH_TOKEN dans le profil de votre shell) pour éviter cette étape la prochaine fois.",
+        notSignedIn: "Tu n'es pas connecté à Claude",
+        notSignedInDetail: "Connecte-toi avec ton compte Claude sur la page d'Anthropic : c'est Claude Code, fourni avec cet agent, qui s'en charge et garde lui-même la connexion. Ou définis ANTHROPIC_API_KEY pour utiliser une clé d'API.",
+        signInQuestion: "Se connecter maintenant avec ton compte Claude ?",
+        cantStart: "L'agent ne peut pas démarrer sans Claude. Relance-le et connecte-toi, ou définis ANTHROPIC_API_KEY.",
+        signingInHeading: "=== Connexion à Claude ===",
+        browserWillOpen: "Un navigateur va s'ouvrir sur la page de connexion d'Anthropic. Si la page affiche un code, colle-le ici.",
+        signedIn: "Connecté. Claude Code garde la connexion : on ne te la redemandera pas.",
+        notCompleted: "La connexion n'a pas abouti. Relance l'agent pour réessayer, ou définis ANTHROPIC_API_KEY.",
+        noClaude: "Le binaire de Claude Code fourni avec l'Agent SDK (@anthropic-ai/claude-agent-sdk-<plateforme>-<architecture>) n'est pas installé : impossible de se connecter. Réinstalle l'agent, ou définis ANTHROPIC_API_KEY.",
     },
 };

package/dist/core/packaged.d.ts

@@ -1,5 +1,11 @@
 /** A path inside `…/app.asar/…`, as the unpacked copy next to it (`…/app.asar.unpacked/…`); any other path as it is. */
 export declare function outsideArchive(file: string): string;
+/**
+ * The module requests that name the SDK's CLI binary on this platform, in the SDK's order:
+ * `@anthropic-ai/claude-agent-sdk-<platform>-<arch>/claude[.exe]`, both libcs on Linux (musl
+ * first when the system runs on it, as the SDK decides).
+ */
+export declare function claudeBinaryRequests(platform?: NodeJS.Platform, arch?: string, musl?: boolean): string[];
 /**
  * The SDK's CLI binary unpacked next to the archive, when the kit runs packaged: the SDK would
  * resolve it inside `app.asar`, where it can't be executed, and its first turn would hang with

package/dist/core/packaged.js

@@ -11,6 +11,22 @@ const ARCHIVE = /([\\/])app\.asar([\\/])/;
 export function outsideArchive(file) {
     return file.replace(ARCHIVE, "$1app.asar.unpacked$2");
 }
+/**
+ * The module requests that name the SDK's CLI binary on this platform, in the SDK's order:
+ * `@anthropic-ai/claude-agent-sdk-<platform>-<arch>/claude[.exe]`, both libcs on Linux (musl
+ * first when the system runs on it, as the SDK decides).
+ */
+export function claudeBinaryRequests(platform = process.platform, arch = process.arch, musl = platform === "linux" && runsOnMusl()) {
+    const packages = platform === "linux" ? (musl ? [`linux-${arch}-musl`, `linux-${arch}`] : [`linux-${arch}`, `linux-${arch}-musl`]) : [`${platform}-${arch}`];
+    return packages.map((suffix) => `@anthropic-ai/claude-agent-sdk-${suffix}/claude${platform === "win32" ? ".exe" : ""}`);
+}
+/** A Linux whose C library is musl (Alpine): Node's report names no glibc version there. */
+function runsOnMusl() {
+    if (process.platform !== "linux")
+        return false;
+    const report = process.report?.getReport();
+    return Boolean(report?.header) && report?.header?.glibcVersionRuntime === undefined;
+}
 /**
  * The SDK's CLI binary unpacked next to the archive, when the kit runs packaged: the SDK would
  * resolve it inside `app.asar`, where it can't be executed, and its first turn would hang with
@@ -19,11 +35,10 @@ export function outsideArchive(file) {
  * when not packaged, or when the build didn't unpack it: then the SDK finds its own.
  */
 export function unpackedClaudeExecutable(resolve = createRequire(import.meta.url).resolve, platform = process.platform, arch = process.arch) {
-    const packages = platform === "linux" ? [`linux-${arch}`, `linux-${arch}-musl`] : [`${platform}-${arch}`];
-    for (const suffix of packages) {
+    for (const request of claudeBinaryRequests(platform, arch)) {
         let file;
         try {
-            file = resolve(`@anthropic-ai/claude-agent-sdk-${suffix}/claude${platform === "win32" ? ".exe" : ""}`);
+            file = resolve(request);
         }
         catch {
             continue;

package/dist/core/session.js

@@ -31,6 +31,7 @@ import { createElicitationHandler } from "./elicitation.js";
 import { createReadOnlyHints, createToolHints } from "./readOnlyHints.js";
 import { projectServerDuplicates } from "./projectServers.js";
 import { createSignInReminder, SIGN_IN_RULE } from "./hooks/signInReminder.js";
+import { createLanguageReminder } from "./hooks/languageReminder.js";
 import { agentKitVersion } from "./version.js";
 /**
  * Builds the `options` object passed to the Agent SDK's `query()` — everything about
@@ -58,6 +59,8 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
     // for the interface too, so the agent answers in the language its interface is in.
     const language = chooseLanguage(config.language);
     const replyLine = spec.replyInLanguage === false ? null : replyLanguageInstruction(language);
+    // Said again next to what the model reads, so its narration doesn't drift to English (#85).
+    const languageReminder = spec.replyInLanguage !== false && spec.replyInLanguage !== "prompt-only" && language !== "en" ? createLanguageReminder(language) : undefined;
     const withReplyLine = (prompt) => (replyLine ? `${prompt}\n\n${replyLine}` : prompt);
     const modeControl = createModeControl(mode);
     // The human approval server only exists outside autonomous mode: the point of
@@ -379,7 +382,7 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
                     : []),
                 // Registered wherever the approval tool is, and asking only while the current mode is
                 // "interactive": a guided session can switch to interactive and back (ModeControl).
-                ...(includeApprovalTool ? [{ hooks: [createStepGate(runDir, () => modeControl.mode === "interactive", fromExtensions((contribution) => contribution.selfAskingTools))] }] : []),
+                ...(includeApprovalTool ? [{ hooks: [createStepGate(runDir, () => modeControl.mode === "interactive", fromExtensions((contribution) => contribution.selfAskingTools), () => toolLabels)] }] : []),
                 // Likewise for "plan", which any non-autonomous session can switch into: the agent
                 // only reads and plans while it's on (hooks/planGate.ts).
                 ...(includeApprovalTool
@@ -405,12 +408,14 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
                     ]
                     : []),
             ],
-            PostToolUse: [{ hooks: [transcriptLogger.postToolUse] }],
+            PostToolUse: [{ hooks: [transcriptLogger.postToolUse] }, ...(languageReminder ? [{ hooks: [languageReminder.postToolUse] }] : [])],
             // The person's message: it ends a batch they approved (#74), and carries the sign-in reminders (#82).
-            ...(guidedGate || signInExtensions.length
+            ...(guidedGate || signInExtensions.length || languageReminder
                 ? {
                     UserPromptSubmit: [
                         ...(guidedGate ? [{ hooks: [guidedGate.userPromptSubmit] }] : []),
+                        // The reply language, next to the person's message too (#85).
+                        ...(languageReminder ? [{ hooks: [languageReminder.userPromptSubmit] }] : []),
                         // With the person's message, which extensions now wait for a sign-in (#82).
                         ...(signInExtensions.length ? [{ hooks: [createSignInReminder({ extensions: () => signInExtensions, status: () => late.view?.controls().mcpServerStatus })] }] : []),
                     ],

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export { setTheme, getTheme, DEFAULT_THEME, type Theme, type ThemeColor } from "
 export { isExitPromptError } from "./tui/promptErrors.js";
 export { allowAnyMcpTool } from "./core/mcpPermissions.js";
 export { createPromptLoader } from "./core/promptTemplate.js";
-export { resolveClaudeAuth, type ClaudeAuthConfig } from "./core/claudeAuth.js";
+export { claudeExecutable, claudeSignedIn, startClaudeSignIn, type ClaudeAuthOptions, type ClaudeSignIn } from "./core/claudeAuth.js";
 export { ensureClaudeAuth } from "./tui/claudeAuth.js";
 export { createFriendlyToolLabel, truncate, truncatePath, withToolLabels, withToolPhrases, withToolResults, quietResults, type ToolResult, type ToolDescriber, type ToolLabel, type ToolLabels, } from "./core/toolLabels.js";
 export type { Mode, BaseSessionConfig, AgentSpec, AgentIdentity, PlanModeSpec, ExtensionGateSpec } from "./core/agentSpec.js";