@fusionkit/tool-claude 0.1.6

package/dist/harness.d.ts

@@ -0,0 +1,25 @@
+import type { NetworkPolicy } from "@fusionkit/protocol";
+import type { SessionBackend } from "@fusionkit/runner";
+import type { ClaudeCodeBindingOptions } from "@fusionkit/session-harness";
+import type { HarnessAdapter } from "@fusionkit/ensemble";
+export type ClaudeCodeHarnessEnv = Record<string, string | undefined>;
+export type ClaudeCodeHarnessOptions = ClaudeCodeBindingOptions & {
+    id?: string;
+    /** Defaults to `process.env`; tests can pass `{}` for deterministic skips. */
+    env?: ClaudeCodeHarnessEnv;
+    /** Already-released secret values forwarded through the session backend seam. */
+    secrets?: {
+        name: string;
+        value: string;
+    }[];
+    /** Test/extension seam. Defaults to `aiSdkHarnessBackend(...)`. */
+    backend?: SessionBackend;
+    pool?: string;
+    network?: NetworkPolicy;
+    timeoutMs?: number;
+    logMaxBytes?: number;
+    skipWhenUnavailable?: boolean;
+};
+export declare function claudeCodeHarnessCredentialSkipReason(env?: ClaudeCodeHarnessEnv, options?: ClaudeCodeHarnessOptions): string | undefined;
+export declare function createClaudeCodeHarness(options?: ClaudeCodeHarnessOptions): HarnessAdapter;
+export declare function claudeCodeHarness(options?: ClaudeCodeHarnessOptions): HarnessAdapter;

package/dist/harness.js

@@ -0,0 +1,399 @@
+import { artifactHash } from "@fusionkit/protocol";
+import { CapabilityMismatchError, prepareExecution } from "@fusionkit/runner";
+import { aiSdkHarnessBackend } from "@fusionkit/session-harness";
+import { hardeningToJson } from "@fusionkit/ensemble";
+const ZERO_HASH = "0".repeat(64);
+const ZERO_GIT_SHA = "0".repeat(40);
+const DEFAULT_POOL = "ensemble";
+const DEFAULT_RUNTIME = "node24";
+const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
+const DEFAULT_LOG_MAX_BYTES = 256 * 1024;
+const DEFAULT_CLAUDE_NETWORK = {
+    defaultDeny: true,
+    allowHosts: ["registry.npmjs.org", "api.anthropic.com", "ai-gateway.vercel.sh"]
+};
+const AUTH_ENV_NAMES = [
+    "AI_GATEWAY_API_KEY",
+    "AI_GATEWAY_BASE_URL",
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "ANTHROPIC_BASE_URL"
+];
+function candidateId(input) {
+    return `${input.descriptor.id}_${input.model.id}_${input.ordinal}`;
+}
+function envValue(env, name) {
+    const value = env[name];
+    return value && value.length > 0 ? value : undefined;
+}
+function authEnvFrom(env) {
+    const authEnv = {};
+    for (const name of AUTH_ENV_NAMES) {
+        const value = envValue(env, name);
+        if (value !== undefined)
+            authEnv[name] = value;
+    }
+    return authEnv;
+}
+function credentialGate(env, options) {
+    const missing = [];
+    const hasProviderCredential = envValue(env, "AI_GATEWAY_API_KEY") ??
+        envValue(env, "ANTHROPIC_API_KEY") ??
+        envValue(env, "ANTHROPIC_AUTH_TOKEN");
+    const hasSandboxCredential = options.backend !== undefined ||
+        options.createSandboxProvider !== undefined ||
+        options.token !== undefined ||
+        envValue(env, "VERCEL_TOKEN") !== undefined;
+    if (!hasSandboxCredential)
+        missing.push("VERCEL_TOKEN");
+    if (!hasProviderCredential) {
+        missing.push("ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|AI_GATEWAY_API_KEY");
+    }
+    if (missing.length > 0) {
+        return {
+            available: false,
+            missing,
+            reason: "Claude Code harness skipped: missing Claude Code credential/env; set VERCEL_TOKEN and one of " +
+                "ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, or AI_GATEWAY_API_KEY."
+        };
+    }
+    return { available: true, authEnv: authEnvFrom(env) };
+}
+export function claudeCodeHarnessCredentialSkipReason(env = process.env, options = {}) {
+    const gate = credentialGate(env, options);
+    return gate.available ? undefined : gate.reason;
+}
+function backendFor(options, env) {
+    return (options.backend ??
+        aiSdkHarnessBackend({
+            ...(options.runtime !== undefined ? { runtime: options.runtime } : {}),
+            ...(options.bridgePort !== undefined ? { bridgePort: options.bridgePort } : {}),
+            token: options.token ?? envValue(env, "VERCEL_TOKEN"),
+            teamId: options.teamId ?? envValue(env, "VERCEL_TEAM_ID"),
+            projectId: options.projectId ?? envValue(env, "VERCEL_PROJECT_ID"),
+            ...(options.model !== undefined ? { model: options.model } : {}),
+            ...(options.maxTurns !== undefined ? { maxTurns: options.maxTurns } : {}),
+            ...(options.thinking !== undefined ? { thinking: options.thinking } : {}),
+            ...(options.startupTimeoutMs !== undefined
+                ? { startupTimeoutMs: options.startupTimeoutMs }
+                : {}),
+            ...(options.createHarness !== undefined ? { createHarness: options.createHarness } : {}),
+            ...(options.createSandboxProvider !== undefined
+                ? { createSandboxProvider: options.createSandboxProvider }
+                : {})
+        }));
+}
+function contractFor(input) {
+    const timeoutMs = input.options.timeoutMs ?? input.descriptor.policy.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    return {
+        version: "warrant.contract.v1",
+        runId: `ensemble_${input.candidateId}`,
+        issuedAt: new Date().toISOString(),
+        issuer: { keyId: "ensemble-claude-code", role: "plane" },
+        requestedBy: { kind: "service", id: "handoffkit-ensemble" },
+        agent: { kind: "claude-code" },
+        task: { prompt: input.descriptor.prompt },
+        runner: {
+            pool: input.options.pool ??
+                input.descriptor.runtime.environmentId ??
+                input.descriptor.runtime.id ??
+                DEFAULT_POOL
+        },
+        workspace: {
+            version: "warrant.manifest.v1",
+            baseRef: (input.repoBaseSha ?? input.descriptor.baseGitSha) || ZERO_GIT_SHA,
+            bundleHash: ZERO_HASH,
+            untrackedFiles: [],
+            deniedPatterns: [],
+            deniedPaths: []
+        },
+        policyHash: ZERO_HASH,
+        secrets: input.options.secrets?.map((secret) => ({ name: secret.name, scope: "ensemble" })) ?? [],
+        network: input.options.network ??
+            (input.descriptor.runtime.isolation?.networkPolicy
+                ? {
+                    defaultDeny: input.descriptor.runtime.isolation.networkPolicy.defaultDeny,
+                    allowHosts: [...input.descriptor.runtime.isolation.networkPolicy.allowHosts]
+                }
+                : DEFAULT_CLAUDE_NETWORK),
+        budget: {
+            ...(input.descriptor.policy.budgetUsd !== undefined
+                ? { maxSpendUsd: input.descriptor.policy.budgetUsd }
+                : {}),
+            maxDurationMin: Math.ceil(timeoutMs / 60_000)
+        },
+        disclosure: "minimal-context",
+        isolation: "vercel-sandbox",
+        execution: {
+            kind: "agent",
+            agent: { kind: "claude-code" },
+            prompt: input.descriptor.prompt,
+            timeoutMs,
+            env: { vars: input.gate.authEnv, egressProxy: false },
+            log: {
+                stdout: "capture",
+                stderr: "merge",
+                maxBytes: input.options.logMaxBytes ?? DEFAULT_LOG_MAX_BYTES
+            }
+        },
+        expiresAt: new Date(Date.now() + timeoutMs).toISOString(),
+        signatures: []
+    };
+}
+function hardeningFor(input) {
+    const networkPolicy = input.options.network ??
+        input.descriptor.runtime.isolation?.networkPolicy ??
+        DEFAULT_CLAUDE_NETWORK;
+    const mountPolicy = input.descriptor.runtime.isolation?.mountPolicy;
+    const secretPolicy = input.descriptor.runtime.isolation?.secretPolicy;
+    return {
+        requested_isolation: "microvm",
+        actual_isolation: input.finished ? "vercel-sandbox" : "process",
+        runtime: {
+            provider: "vercel-sandbox",
+            runtime: input.options.runtime ??
+                (input.descriptor.runtime.isolation?.kind === "microvm"
+                    ? input.descriptor.runtime.isolation.runtime
+                    : undefined) ??
+                DEFAULT_RUNTIME,
+            workdir: mountPolicy?.workdir ?? input.repoDir
+        },
+        mount_policy: {
+            worktree_writable: mountPolicy?.worktreeWritable ?? true,
+            read_only_caches: [...(mountPolicy?.readOnlyCachePaths ?? [])],
+            ignored_dirs: [...(mountPolicy?.ignoredDirs ?? [".git", "node_modules", ".warrant"])]
+        },
+        network_policy: {
+            default_deny: networkPolicy.defaultDeny,
+            allow_hosts: [...networkPolicy.allowHosts],
+            enforced: input.finished
+        },
+        cleanup: input.finished
+            ? { attempted: true, succeeded: true, status: "succeeded" }
+            : { attempted: false, succeeded: true, status: "not_required" },
+        secret_absence: {
+            secret_names: [
+                ...(secretPolicy?.secretNames ?? input.options.secrets?.map((secret) => secret.name) ?? [])
+            ],
+            secret_value_hashes: [...(secretPolicy?.secretValueHashes ?? [])],
+            injected_env_names: [...(secretPolicy?.injectedEnvNames ?? input.authEnvNames)],
+            scanned: false,
+            leaks_found: false,
+            scan_scope: [],
+            leak_count: 0
+        }
+    };
+}
+function skippedOutput(input) {
+    const evidenceHash = artifactHash(input.reason);
+    const repoDir = input.runInput.worktree?.path ?? input.runInput.descriptor.sourceRepo;
+    return {
+        candidateId: candidateId(input.runInput),
+        model: input.runInput.model,
+        status: "skipped",
+        ...(input.runInput.worktree
+            ? {
+                branchName: input.runInput.worktree.branchName,
+                worktreePath: input.runInput.worktree.path
+            }
+            : {}),
+        transcript: input.reason,
+        summary: input.reason,
+        error: {
+            kind: "capability_missing",
+            message: input.reason,
+            retryable: false
+        },
+        verification: {
+            status: "skipped",
+            evidence: [input.reason, evidenceHash],
+            exitCode: 0
+        },
+        metadata: {
+            adapter: "claude-code",
+            credential_gate: "skipped",
+            missing_credentials: [...input.missing],
+            hardening: hardeningToJson(hardeningFor({
+                descriptor: input.runInput.descriptor,
+                options: input.options,
+                repoDir,
+                authEnvNames: [],
+                finished: false
+            }))
+        }
+    };
+}
+function failureOutput(input) {
+    const message = input.error instanceof Error ? input.error.message : String(input.error);
+    const errorHash = artifactHash(message);
+    const repoDir = input.runInput.worktree?.path ?? input.runInput.descriptor.sourceRepo;
+    return {
+        candidateId: candidateId(input.runInput),
+        model: input.runInput.model,
+        status: "failed",
+        ...(input.runInput.worktree
+            ? {
+                branchName: input.runInput.worktree.branchName,
+                worktreePath: input.runInput.worktree.path
+            }
+            : {}),
+        transcript: `Claude Code harness failed: ${message}`,
+        error: {
+            kind: "provider_error",
+            message,
+            retryable: true
+        },
+        verification: {
+            status: "failed",
+            evidence: [errorHash],
+            exitCode: 1
+        },
+        metadata: {
+            adapter: "claude-code",
+            credential_gate: "available",
+            event_count: 0,
+            auth_env_names: [...input.authEnvNames],
+            hardening: hardeningToJson(hardeningFor({
+                descriptor: input.runInput.descriptor,
+                options: input.options,
+                repoDir,
+                authEnvNames: input.authEnvNames,
+                finished: false
+            }))
+        }
+    };
+}
+export function createClaudeCodeHarness(options = {}) {
+    const id = options.id ?? "claude-code";
+    const env = options.env ?? process.env;
+    const skipWhenUnavailable = options.skipWhenUnavailable ?? true;
+    return {
+        id,
+        harnessKind: "claude_code",
+        prepare: () => {
+            const gate = credentialGate(env, options);
+            if (!gate.available) {
+                if (skipWhenUnavailable)
+                    return { gate };
+                throw new CapabilityMismatchError(gate.reason);
+            }
+            return { gate, backend: backendFor(options, env) };
+        },
+        capabilities: () => {
+            const gate = credentialGate(env, options);
+            return {
+                workspace_read: gate.available ? "supported" : "degraded",
+                workspace_write: gate.available ? "supported" : "degraded",
+                apply_patch: gate.available ? "supported" : "degraded",
+                tool_records: "supported",
+                verification: gate.available ? "supported" : "degraded",
+                microvm_isolation: gate.available ? "supported" : "degraded",
+                credential_gate: gate.available ? "supported" : "degraded"
+            };
+        },
+        verificationProfile: () => ({
+            id: `${id}-verification`,
+            requiredEvidence: ["structured transcript", "exit code", "worktree diff or skip reason"]
+        }),
+        run: async (runInput) => {
+            const state = runInput.prepared;
+            if (!state.gate.available) {
+                return skippedOutput({
+                    runInput,
+                    reason: state.gate.reason,
+                    missing: state.gate.missing,
+                    options
+                });
+            }
+            const id = candidateId(runInput);
+            const repoDir = runInput.worktree?.path ?? runInput.descriptor.workspace ?? runInput.descriptor.sourceRepo;
+            const backend = state.backend ?? backendFor(options, env);
+            const contract = contractFor({
+                descriptor: runInput.descriptor,
+                candidateId: id,
+                options,
+                gate: state.gate,
+                ...(runInput.worktree ? { repoBaseSha: runInput.worktree.baseGitSha } : {})
+            });
+            const events = [];
+            const authEnvNames = Object.keys(state.gate.authEnv);
+            try {
+                const result = await backend.execute({
+                    contract,
+                    repoDir,
+                    secrets: options.secrets ?? [],
+                    execution: prepareExecution({ contract }),
+                    emit: (event) => {
+                        events.push(event);
+                    }
+                });
+                const transcript = result.log.toString("utf8");
+                const outputHash = artifactHash(transcript);
+                const status = result.exitCode === 0 ? "succeeded" : "failed";
+                return {
+                    candidateId: id,
+                    model: runInput.model,
+                    status,
+                    ...(runInput.worktree
+                        ? {
+                            branchName: runInput.worktree.branchName,
+                            worktreePath: runInput.worktree.path
+                        }
+                        : {}),
+                    transcript,
+                    toolRecords: [
+                        {
+                            execution_id: `exec_${id}`,
+                            plan_id: `plan_${id}`,
+                            status,
+                            output_hash: outputHash
+                        }
+                    ],
+                    verification: {
+                        status,
+                        evidence: [`exit_code=${result.exitCode}`, outputHash],
+                        exitCode: result.exitCode
+                    },
+                    ...(status === "failed"
+                        ? {
+                            error: {
+                                kind: "provider_error",
+                                message: "Claude Code harness exited non-zero",
+                                retryable: true
+                            }
+                        }
+                        : {}),
+                    metadata: {
+                        adapter: "claude-code",
+                        backend_isolation: backend.isolation,
+                        credential_gate: "available",
+                        event_count: events.length,
+                        auth_env_names: authEnvNames,
+                        hardening: hardeningToJson(hardeningFor({
+                            descriptor: runInput.descriptor,
+                            options,
+                            repoDir,
+                            authEnvNames,
+                            finished: true
+                        }))
+                    }
+                };
+            }
+            catch (error) {
+                if (skipWhenUnavailable && error instanceof CapabilityMismatchError) {
+                    return skippedOutput({
+                        runInput,
+                        reason: error.message,
+                        missing: ["capability_mismatch"],
+                        options
+                    });
+                }
+                return failureOutput({ runInput, error, options, authEnvNames });
+            }
+        },
+        collectArtifacts: () => []
+    };
+}
+export function claudeCodeHarness(options = {}) {
+    return createClaudeCodeHarness(options);
+}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+import type { ToolIntegration } from "@fusionkit/tools";
+export declare const claudeTool: ToolIntegration;
+export { claudeCodeHarness, claudeCodeHarnessCredentialSkipReason, createClaudeCodeHarness } from "./harness.js";
+export type { ClaudeCodeHarnessEnv, ClaudeCodeHarnessOptions } from "./harness.js";
+export { claudeEnv, launchClaude } from "./launch.js";

package/dist/index.js

@@ -0,0 +1,57 @@
+import { claudeCodeHarness, claudeCodeHarnessCredentialSkipReason, createClaudeCodeHarness } from "./harness.js";
+import { launchClaude } from "./launch.js";
+const LIVE_SMOKE_PROMPT = "Read README.md if present, then reply exactly CLAUDE_LIVE_SMOKE_OK. Do not modify files.";
+export const claudeTool = {
+    id: "claude",
+    aliases: ["claude-code"],
+    displayName: "Claude Code",
+    pickerHint: "Claude Code",
+    binary: "claude",
+    modes: ["fusion", "local"],
+    harnessKinds: ["claude-code"],
+    launch: launchClaude,
+    createHarness: (_kind, options) => createClaudeCodeHarness({
+        ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {})
+    }),
+    harness: {
+        harnessKind: "claude_code",
+        sideEffects: "writes_workspace",
+        responseShape: "Return a Claude Code-style transcript summary with patch/worktree evidence."
+    },
+    dashboard: {
+        id: "claude-code",
+        harnessKind: "claude_code",
+        displayName: "Claude Code",
+        availability: "credential_gated",
+        capabilities: {
+            model_override: "supported",
+            transcript_capture: "supported",
+            diff_capture: "supported",
+            tool_loop_capture: "supported",
+            patch_apply_visibility: "supported",
+            route_model_observation: "degraded",
+            verification_hint: "supported",
+            replay_support: "degraded"
+        },
+        notes: ["Credential-gated; dashboard smoke uses an empty env skip path."],
+        makeMatrixHarness: (env) => claudeCodeHarness({ env }),
+        credentialSkipReason: (env) => claudeCodeHarnessCredentialSkipReason(env),
+        smoke: {
+            taskId: "claude-code-skipped",
+            model: { id: "claude", model: "claude-sonnet-4-6" },
+            sideEffects: "writes_workspace",
+            allowedTools: ["read_file", "write_file", "apply_patch"],
+            makeHarness: () => claudeCodeHarness({ env: {} })
+        },
+        liveSmoke: {
+            taskId: "claude-code-live",
+            envName: "FUSIONKIT_CLAUDE_SMOKE",
+            prompt: LIVE_SMOKE_PROMPT,
+            modelEnvName: "FUSIONKIT_CLAUDE_SMOKE_MODEL",
+            defaultModel: "claude-sonnet-4-6",
+            makeHarness: (env) => claudeCodeHarness({ env, skipWhenUnavailable: false })
+        }
+    }
+};
+export { claudeCodeHarness, claudeCodeHarnessCredentialSkipReason, createClaudeCodeHarness } from "./harness.js";
+export { claudeEnv, launchClaude } from "./launch.js";

package/dist/launch.d.ts

@@ -0,0 +1,5 @@
+import type { ToolLaunchContext } from "@fusionkit/tools";
+/** Environment for Claude Code: point it at the gateway's Anthropic surface. */
+export declare function claudeEnv(gatewayUrl: string, authToken?: string): Record<string, string>;
+/** Boot the Claude Code CLI pointed at the gateway's Anthropic surface. */
+export declare function launchClaude(ctx: ToolLaunchContext): Promise<number>;

package/dist/launch.js

@@ -0,0 +1,18 @@
+import { LOCAL_MODEL_LABEL, spawnTool } from "@fusionkit/tools";
+/** Environment for Claude Code: point it at the gateway's Anthropic surface. */
+export function claudeEnv(gatewayUrl, authToken) {
+    return {
+        ANTHROPIC_BASE_URL: gatewayUrl,
+        ANTHROPIC_AUTH_TOKEN: authToken ?? LOCAL_MODEL_LABEL,
+        // Surface the local model in the /model picker (Anthropic discovery).
+        CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY: "1"
+    };
+}
+/** Boot the Claude Code CLI pointed at the gateway's Anthropic surface. */
+export async function launchClaude(ctx) {
+    ctx.prepareForPassthrough();
+    if (ctx.mode === "fusion") {
+        ctx.log("fusion: launching claude...");
+    }
+    return await spawnTool("claude", ctx.toolArgs, claudeEnv(ctx.gatewayUrl, ctx.authToken), ctx.repo);
+}

package/dist/test/claude-code.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/claude-code.test.js

@@ -0,0 +1,157 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { assertHarnessRunResultV1, requestHash } from "@fusionkit/protocol";
+import { gitText } from "@fusionkit/workspace";
+import { createMockHarness, runEnsemble } from "@fusionkit/ensemble";
+import { claudeCodeHarness, claudeCodeHarnessCredentialSkipReason } from "../index.js";
+const BASE_DESCRIPTOR = {
+    id: "ensemble_test",
+    models: [{ id: "claude", model: "claude-sonnet-4-6" }],
+    runtime: { id: "local" },
+    judge: { id: "judge", model: "fake-judge" },
+    policy: {
+        id: "policy",
+        allowedTools: ["read_file"],
+        sideEffects: "read_only",
+        timeoutMs: 1_000
+    },
+    prompt: "Summarize model-fusion evidence.",
+    sourceRepo: "handoffkit",
+    baseGitSha: "a".repeat(40)
+};
+function descriptor(overrides = {}) {
+    return {
+        ...BASE_DESCRIPTOR,
+        harness: createMockHarness(),
+        ...overrides
+    };
+}
+function makeRepo() {
+    const root = mkdtempSync(join(tmpdir(), "ensemble-repo-"));
+    const repo = join(root, "repo");
+    mkdirSync(repo);
+    gitText(repo, ["init", "--quiet", "--initial-branch=main"]);
+    gitText(repo, ["config", "user.email", "ensemble@warrant.local"]);
+    gitText(repo, ["config", "user.name", "ensemble"]);
+    writeFileSync(join(repo, "README.md"), "# ensemble\n");
+    gitText(repo, ["add", "-A"]);
+    gitText(repo, ["commit", "--quiet", "-m", "init"]);
+    return {
+        repo,
+        outputRoot: join(root, "out"),
+        head: gitText(repo, ["rev-parse", "HEAD"]).trim(),
+        cleanup: () => rmSync(root, { recursive: true, force: true })
+    };
+}
+function liveClaudeSmokeSkipReason() {
+    if ((process.env.FUSIONKIT_CLAUDE_SMOKE ?? process.env.WARRANT_CLAUDE_SMOKE) !== "1") {
+        return "set FUSIONKIT_CLAUDE_SMOKE=1 plus Claude Code credentials to run the live Claude Code smoke";
+    }
+    return claudeCodeHarnessCredentialSkipReason() ?? false;
+}
+test("claude-code adapter can replace mock and skip clearly without credentials", async () => {
+    const result = await runEnsemble(descriptor({
+        models: [{ id: "claude", model: "claude-sonnet-4-6" }],
+        harness: claudeCodeHarness({ env: {} })
+    }));
+    assert.equal(result.candidates.length, 1);
+    assert.equal(result.harnessRunResult.status, "skipped");
+    assert.equal(result.candidates[0]?.status, "skipped");
+    assert.equal(result.candidates[0]?.error?.kind, "capability_missing");
+    assert.match(result.candidates[0]?.error?.message ?? "", /missing Claude Code credential/);
+    assert.match(result.summary?.candidates[0]?.verification?.evidence[0] ?? "", /missing Claude/);
+});
+test("claude-code adapter delegates through a session backend from a generic descriptor", async () => {
+    const repo = makeRepo();
+    const seen = {};
+    const backend = {
+        isolation: "vercel-sandbox",
+        supports: () => true,
+        execute: async (input) => {
+            seen.agentKind = input.contract.agent.kind;
+            seen.env = input.execution.env;
+            seen.repoDir = input.repoDir;
+            assert.equal(input.contract.isolation, "vercel-sandbox");
+            assert.equal(input.contract.execution?.kind, "agent");
+            assert.equal(input.secrets.length, 0);
+            writeFileSync(join(input.repoDir, "CLAUDE_RESULT.md"), "fake claude result\n");
+            input.emit({
+                type: "command.executed",
+                argvHash: requestHash({ adapter: "claude-code" }),
+                exitCode: 0
+            });
+            return { exitCode: 0, log: Buffer.from("fake claude transcript") };
+        }
+    };
+    try {
+        const result = await runEnsemble(descriptor({
+            models: [{ id: "claude", model: "claude-sonnet-4-6" }],
+            harness: claudeCodeHarness({
+                env: {
+                    ANTHROPIC_API_KEY: "sk-ant-test",
+                    VERCEL_TOKEN: "vercel-test"
+                },
+                backend
+            }),
+            workspace: repo.repo,
+            baseGitSha: repo.head,
+            outputRoot: repo.outputRoot,
+            cleanupWorktrees: true
+        }));
+        assert.equal(result.harnessRunResult.status, "succeeded");
+        assert.equal(result.candidates[0]?.status, "succeeded");
+        assert.equal(seen.agentKind, "claude-code");
+        assert.equal(seen.env?.ANTHROPIC_API_KEY, "sk-ant-test");
+        assert.equal(Object.hasOwn(seen.env ?? {}, "VERCEL_TOKEN"), false);
+        assert.notEqual(seen.repoDir, repo.repo);
+        assert.ok(result.artifacts.some((artifact) => artifact.kind === "patch"));
+        assert.match(result.candidates[0]?.metadata?.adapter, /claude-code/);
+    }
+    finally {
+        repo.cleanup();
+    }
+});
+test("smoke: claude-code adapter runs live when credentials are available", { skip: liveClaudeSmokeSkipReason() }, async () => {
+    const repo = makeRepo();
+    try {
+        const result = await runEnsemble(descriptor({
+            id: "claude_smoke",
+            models: [{ id: "claude", model: "claude-sonnet-4-6" }],
+            harness: claudeCodeHarness(),
+            runtime: {
+                id: "vercel-sandbox",
+                isolation: {
+                    kind: "microvm",
+                    networkPolicy: {
+                        defaultDeny: true,
+                        allowHosts: [
+                            "registry.npmjs.org",
+                            "api.anthropic.com",
+                            "ai-gateway.vercel.sh"
+                        ]
+                    }
+                }
+            },
+            policy: {
+                id: "claude-smoke-policy",
+                allowedTools: ["read_file"],
+                sideEffects: "read_only",
+                timeoutMs: 180_000
+            },
+            prompt: "Read README.md if present, then reply exactly CLAUDE_LIVE_SMOKE_OK. Do not modify files.",
+            workspace: repo.repo,
+            baseGitSha: repo.head,
+            outputRoot: repo.outputRoot,
+            cleanupWorktrees: true
+        }));
+        assertHarnessRunResultV1(result.harnessRunResult);
+        assert.equal(result.harnessRunResult.status, "succeeded");
+        assert.equal(result.candidates[0]?.status, "succeeded");
+    }
+    finally {
+        repo.cleanup();
+    }
+});

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@fusionkit/tool-claude",
+  "private": false,
+  "version": "0.1.6",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/velum-labs/handoffkit.git",
+    "directory": "packages/tool-claude"
+  },
+  "description": "Claude Code tool integration for fusionkit: launcher env shim plus the ensemble Claude Code harness adapter.",
+  "license": "UNLICENSED",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "@fusionkit/ensemble": "0.1.6",
+    "@fusionkit/protocol": "0.1.6",
+    "@fusionkit/runner": "0.1.6",
+    "@fusionkit/session-harness": "0.1.6",
+    "@fusionkit/tools": "0.1.6"
+  },
+  "devDependencies": {
+    "@fusionkit/workspace": "0.1.6"
+  }
+}