@hydraharness/harness-subagent-claude-code 0.1.1-rc.6

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,147 @@
+# @hydraharness/harness-subagent-claude-code
+
+This package registers a Profile-named Claude Code subagent provider whose default name is `claude-code`. Each accepted run invokes the official Claude Agent SDK in the delegating Session's workspace, lets the pinned SDK select its installed platform CLI, submits one self-contained text task, and returns either the strict final answer or a separate safe failure diagnostic through the shared [`@hydraharness/harness-subagent`](../subagent/README.md) result contract.
+
+## Start and ownership
+
+`start(request)` accepts only a non-empty sequence of text blocks and derives the child cwd from the parent Session. It creates one private `AbortController`, calls the official SDK `query()`, and publishes the run only after the SDK's `spawnClaudeCodeProcess` hook has supplied a live CLI handle owned by [`@hydraharness/harness-subprocess`](../../subprocess/subprocess/README.md). A failure or cancellation before publication closes the query, terminates any acquired process tree, waits for it to exit, and rejects `start()`.
+
+The SDK receives the exact concatenated text task. The provider iterates the complete SDK message stream and accepts only a `result` message with `subtype: "success"`, `is_error: false`, and a nonblank `result`, followed by normal iterator completion. Every failure still maps to `error`: the four error subtypes in Agent SDK 0.3.220 retain their exact category, an error-marked or blank success becomes `invalid-success`, a missing result becomes `missing-result`, an unclassified query failure becomes `unknown`, and an early CLI exit becomes `process-exit`. The diagnostic also names the current `query-start`, `query-run`, `process`, or `teardown` stage and independently includes an observed exit code and signal. The provider produces neither `max-tokens` nor `refusal`.
+
+Local cancellation wins the result race and maps to `aborted` without a failure diagnostic. `dispose()` is idempotent: it aborts the run, asks the SDK query to close, invokes the shared process-tree termination escalation, and waits for whole-tree exit. SDK graceful close expresses protocol intent; the subprocess handle remains the authority for process quiescence. Startup and teardown rejections expose the same fixed safe stage and process facts through their Error message, while the original product or Host error remains on the internal cause chain and in the Provider's Host log. Result failure and independent teardown failure remain separate.
+
+## Native settings and interaction
+
+The provider deliberately omits the SDK `settingSources` option. The official SDK therefore reads the host's normal user, project, and local Claude settings relative to the parent Session cwd, including native account state and product configuration. The provider neither copies nor filters those files and does not create or modify login state. The Profile-selected `permissionMode` is the one query-level override: Claude Code still owns its settings and sandbox, while the selected native mode decides how this unattended query handles permission checks.
+
+Each query sets `persistSession: false` and disables `AskUserQuestion`. Except in bypass mode, `canUseTool` immediately denies requests that still require human approval. Plan mode also places `ExitPlanMode` in the SDK's `disallowedTools`, so native settings cannot pre-approve a transition back to execution and the model must return the completed plan as its final answer. MCP elicitation is declined, the known refusal fallback dialog is cancelled, and undeclared dialog kinds use the SDK's no-dialog failure behavior. These decisions never wait for a user interface. When both facts contribute to a failed run, `SubagentResult.diagnostic` contains the structured failure line first and the latest safe permission decision second; the shared result boundary limits the complete text to 4096 UTF-8 bytes. Successful and locally cancelled runs expose neither captured fact.
+
+## Capabilities and context
+
+The provider advertises no optional start-time capabilities and reports `inheritsParentContext: false`. Claude Code receives the standalone text task and the parent Session cwd, but not the parent conversation, persona, tool filter, depth policy, or structured-output contract. Every run has an independent SDK query, cancellation controller, CLI process, and non-persisted product session.
+
+## Configuration
+
+| Key | Default | Meaning |
+|---|---|---|
+| `providerName` | `claude-code` | Non-empty registry name on `ctx.subagents`; each mounted instance needs a unique value. |
+| `env` | `{}` | Explicit SDK/CLI environment layered over the shared credential-scrubbed parent environment. |
+| `permissionMode` | `dontAsk` | Native non-interactive permission policy fixed for every run from this Provider instance. |
+| `disposeGraceMs` | `3000` | Positive finite grace in milliseconds, no greater than [`MAX_TIMER_DELAY_MS`](../../util/timeout/README.md), between the shared process-tree owner's termination tiers; disposal then waits for whole-tree exit. |
+
+| `permissionMode` value | Native behavior |
+|---|---|
+| `dontAsk` | Deny operations that are not already authorized instead of prompting. |
+| `acceptEdits` | Accept file edits; any remaining permission prompt is denied by the unattended callback. |
+| `auto` | Let Claude Code's native classifier allow or deny permission requests. |
+| `plan` | Run in native planning mode, deny execution approval, and return the completed plan as the final answer. |
+| `bypassPermissions` | Explicitly set the SDK's dangerous confirmation and bypass permission checks. |
+
+Production omits `pathToClaudeCodeExecutable`, so Agent SDK 0.3.220 selects the matching native `claude` or `claude.exe` from its own platform package and passes that absolute command through the custom-spawn hook to `@hydraharness/harness-subprocess`. The provider does not inspect `PATH`, implement platform selection, or fall back to a host `claude`. Native settings and authentication remain authoritative, while `permissionMode` is the only query-level policy override. The plugin does not select a model, create a product home, log in, or probe an account. Credential-shaped ambient variables are removed before the explicit `env` overlay is applied, so an API key or token intended for the child must be supplied there. Non-credential endpoint variables such as `ANTHROPIC_BASE_URL`, along with ordinary ambient values such as `PATH` and `HOME`, remain inherited unless overridden; `PATH` does not choose the Claude executable.
+
+This package is an optional Profile Bundle. Install it into the target Profile, then restart that Profile; installation brings the pinned Agent SDK and one compatible platform CLI payload into that Profile, while the declared `cordis.patch.yml` layer registers only the dormant `claude-code` Host provider and starts no Claude process. Removing the package withdraws that provider and its private runtime closure on the next Profile start.
+
+```sh
+hydra plugin --profile <name> add @hydraharness/harness-subagent-claude-code
+hydra plugin --profile <name> remove @hydraharness/harness-subagent-claude-code
+hydra --profile <name>
+```
+
+Installation controls Host availability, not model permission. The Bundle supplies the dormant default `claude-code` row; the Profile may replace that row's complete config or mount additional rows with distinct `providerName`, `permissionMode`, and `env` values. Loading an instance starts no Claude process until a bound tool calls it. Each `@hydraharness/harness-tool-subagent` row names one provider and needs its own `toolName`, so the model sees static tools rather than a dynamic provider selector. Full Agent Presets carry a matching default product tool row with `disabled: true`; copy a preset and remove that field to expose `subagent_claude_code` only to agents composed from the copy. Its `one-shot` policy keeps omitted or `false` `run_in_background` calls in the foreground, while explicit `true` returns a parent-owned Job id for `job_output` or `job_kill`. The base host and full presets already provide the generic Job registry and controls.
+
+The standalone composition below shows the complete explicit capability. A Profile based on `@hydraharness/harness-base` keeps its existing Job rows, adds the product provider and tool rows, and does not mount duplicate Job services.
+
+```yaml
+- id: subagent-claude-safe
+  name: '@hydraharness/harness-subagent-claude-code'
+  config:
+    providerName: claude-safe
+    permissionMode: dontAsk
+    env:
+      ANTHROPIC_API_KEY: !!js process.env.ANTHROPIC_API_KEY
+
+- id: subagent-claude-bypass
+  name: '@hydraharness/harness-subagent-claude-code'
+  config:
+    providerName: claude-bypass
+    permissionMode: bypassPermissions
+    env:
+      ANTHROPIC_API_KEY: !!js process.env.ANTHROPIC_API_KEY
+```
+
+```yaml
+- id: jobs
+  name: '@hydraharness/harness-jobs-local'
+
+- id: tool-jobs
+  name: '@hydraharness/harness-tool-jobs'
+
+- id: tool-subagent-claude-safe
+  name: '@hydraharness/harness-tool-subagent'
+  disabled: true
+  config:
+    provider: claude-safe
+    toolName: subagent_claude_safe
+    backgroundMode: one-shot
+    maxDepth: provider-managed
+
+- id: tool-subagent-claude-bypass
+  name: '@hydraharness/harness-tool-subagent'
+  config:
+    provider: claude-bypass
+    toolName: subagent_claude_bypass
+    backgroundMode: one-shot
+    maxDepth: provider-managed
+```
+
+## Product compatibility and evidence
+
+The runtime dependency is pinned to `@anthropic-ai/claude-agent-sdk@0.3.220`, whose eight platform packages carry Claude Code 2.1.220. A normal install selects one payload for the current OS, CPU, and Linux libc. For the current darwin-arm64 payload, `npm pack --dry-run --json` reports 74,858,812 packed bytes and 256,908,856 unpacked bytes; other platforms may differ, and these values are disclosure rather than an installation threshold. The keyless real-product test runs the SDK-selected CLI against a loopback Messages fixture and asserts that the shared subprocess argv begins with that platform package's native executable. Loader composition proves that installing the Bundle registers only the dormant Claude Code provider and starts no product process.
+
+Installing with optional dependencies omitted, using an unsupported platform, or losing the selected payload leaves provider registration dormant but makes the first delegation fail at the SDK startup boundary. The caller receives the safe `query-start` / `unknown` failure fact; the native payload error remains only on the internal cause chain and in the Provider's Host log. The provider neither probes a host CLI nor retries with one.
+
+Loader composition proves that the Bundle default, two additional named Claude instances, and the existing Codex package coexist without starting either product.
+
+The project owner's identity-scoped distribution authorization covers the official SDK and the official CLI/platform payloads declared by each SDK version. [`THIRD_PARTY_NOTICES.md`](../../../THIRD_PARTY_NOTICES.md) discloses the current optional payload closure without classifying its declared terms as permissive; unrelated non-permissive runtime dependencies continue to fail the notices gate.
+
+## Model Experience
+
+### Child request
+
+#### What the model sees
+
+The Claude Code child receives the standalone text task as one fresh SDK query. Its workspace is the parent Session cwd; its model, system instructions, tools, sandbox, and authentication come from native Claude settings, the selected Provider instance's Profile configuration fixes the query's environment and non-interactive permission mode, and the executable version comes from the Bundle's pinned SDK platform payload.
+
+#### Token effect
+
+The child pays for an independent Claude Code context and query. Child tokens do not enter the parent's context.
+
+#### KV Cache effect
+
+Independent of the parent request cache. Reuse depends only on Claude Code's own model, instructions, tools, native settings, and fresh query.
+
+### Parent scheduling and results, indirectly
+
+#### What the model sees
+
+Through `@hydraharness/harness-tool-subagent`, a foreground call gives the parent the strict final Claude Code answer or an error containing the stop reason and optional safe diagnostic for a non-completed result. That diagnostic can distinguish the fixed SDK error category, lifecycle stage, and observed process outcome without copying raw product text. A background call first returns a Job id; the generic job controls later deliver a completion notice, expose the same final answer or failed status detail through `job_output`, and let `job_kill` request cancellation. Claude Code reasoning, tool activity, intermediate messages, stderr, workspace diffs, usage, product ids, tool inputs, and raw protocol payloads are not copied into the parent Session.
+
+#### Token effect
+
+Foreground input grows by the retained final answer or error. Background input also includes the start acknowledgement, completion notice, and any `job_output`, `job_kill`, or later status results; child tokens still do not enter the parent context. This provider adds no parent tool schema by itself.
+
+#### KV Cache effect
+
+Append-only: foreground adds one result after the reusable parent prefix, while background appends the Job acknowledgement, notice, and later control or collection results. Background scheduling can add a notice-driven turn, but none of these messages rewrites the earlier prefix.
+
+## Known Limitations and Deferred Work
+
+- **One fresh query and process per run** — there is no continuation, resume, pooling, progress stream, or product-session persistence.
+- **Static instance selection** — Profile rows fix provider names and tool bindings; calls cannot choose a provider dynamically, and every exposed tool needs a unique `toolName`.
+- **Host settings are intentionally authoritative** — project and user settings can change model, tools, and behavior; the provider does not provide a filtered or hermetic production mode.
+- **Authentication and account state remain native** — the Bundle supplies the CLI but does not create an account, log in, or rewrite Claude settings; configuration and authentication failures surface with their lifecycle stage and the safe `unknown` fallback rather than a separate public classification.
+- **The SDK platform payload is required at delegation time** — installs that omit optional dependencies, unsupported platforms, and missing or damaged payloads fail at the first query; there is no host-CLI fallback.
+- **No human interaction path** — `AskUserQuestion` is disabled, permission prompts are denied, MCP elicitation is declined, and blocking dialogs fail closed instead of suspending.
+- **Assistant payload is final text only** — a failed run may additionally expose the separate safe diagnostic; reasoning, intermediate messages, tool traffic, usage, stderr, and workspace diffs remain product-local, while generic Job ids, notices, and status come from the shared job runtime.
+- **No optional shared capabilities** — output schemas, child personas, tool filtering, and harness depth enforcement are rejected by the shared service for this provider.
+- **No wall-clock timeout or side-effect rollback** — the caller cancels long work, and files or external systems changed before cancellation are not restored.

package/cordis.patch.yml

@@ -0,0 +1,6 @@
+# This optional Profile layer registers the dormant Claude Code provider. Agent
+# presets separately decide whether one session receives its delegation tool.
+
+- insert:
+    - id: subagent-claude-code
+      name: '@hydraharness/harness-subagent-claude-code'

package/lib/index.js

@@ -0,0 +1,563 @@
+import z from "@hydraharness/schemastery";
+import { MAX_TIMER_DELAY_MS } from "@hydraharness/harness-timeout";
+import { NO_START_CAPABILITIES, assertPositiveFinite, resolveChildCwd, settleRunResult, subprocessRunHandle } from "@hydraharness/harness-subagent";
+import { randomUUID } from "node:crypto";
+import { query } from "@anthropic-ai/claude-agent-sdk";
+import { SessionId } from "@hydraharness/harness-session";
+import { scrubbedParentEnv } from "@hydraharness/harness-subprocess";
+import { EventEmitter } from "node:events";
+//#region lib/types/process.js
+/**
+* Projection from the shared managed-process handle to the official Claude
+* Agent SDK's custom-spawn process interface.
+*
+* @module @hydraharness/harness-subagent-claude-code/process
+*/
+function thrown$1(value) {
+	/* v8 ignore next -- the subprocess seam rejects with Error. */
+	return value instanceof Error ? value : new Error(String(value));
+}
+/**
+* Encode the SDK's complete child environment as a subprocess overlay.
+* @param env - SDK-composed child environment after its removals and replacements.
+* @returns explicit values plus tombstones for surviving ambient names the SDK removed.
+*/
+function sdkEnvironmentOverlay(env) {
+	const overlay = { ...env };
+	for (const name of Object.keys(scrubbedParentEnv())) if (!(name in env)) overlay[name] = void 0;
+	return overlay;
+}
+/**
+* Translate one official SDK spawn request to the shared process owner.
+* @param options - command, arguments, workspace, environment, and forwarded signal from the SDK.
+* @param graceMs - process-tree termination grace.
+* @returns the fully explicit shared subprocess request.
+*/
+function claudeSpawnSpec(options, graceMs) {
+	if (options.cwd === void 0 || options.cwd.length === 0) throw new Error("subagent-claude-code: SDK spawn request omitted its workspace");
+	return {
+		argv: [options.command, ...options.args],
+		cwd: options.cwd,
+		stdio: {
+			stdin: "pipe",
+			stdout: "pipe",
+			stderr: "inherit"
+		},
+		graceMs,
+		signal: options.signal,
+		env: sdkEnvironmentOverlay(options.env)
+	};
+}
+/**
+* SDK-facing view of one shared managed process. Protocol transport remains
+* in the official SDK; this adapter only projects streams and exit events.
+*/
+var ManagedClaudeCodeProcess = class {
+	child;
+	stdin;
+	stdout;
+	events = new EventEmitter();
+	outcomeValue;
+	killRequested = false;
+	/**
+	* Project a managed process with piped stdin and stdout.
+	* @param child - shared handle that remains the process-tree authority.
+	*/
+	constructor(child) {
+		this.child = child;
+		this.stdin = child.stdin;
+		this.stdout = child.stdout;
+		this.events.on("error", () => {});
+		child.done.then((outcome) => {
+			this.outcomeValue = outcome;
+			this.events.emit("exit", outcome.exitCode, outcome.signal);
+		}, (error) => {
+			this.events.emit("error", thrown$1(error));
+		});
+	}
+	/** Whether the SDK has requested managed tree termination. */
+	get killed() {
+		return this.killRequested;
+	}
+	/** Direct-child exit code, or null while running or after signal exit. */
+	get exitCode() {
+		return this.outcomeValue?.exitCode ?? null;
+	}
+	/** Direct-child terminating signal, if any. */
+	get signalCode() {
+		return this.outcomeValue?.signal ?? null;
+	}
+	/** Exact managed-process outcome after exit, or undefined while running. */
+	get outcome() {
+		return this.outcomeValue;
+	}
+	/**
+	* Route the SDK's termination request to the tree-scoped process owner.
+	* @param _signal - SDK-selected signal; the shared seam owns its escalation ladder.
+	* @returns false only after exit or a previous termination request.
+	*/
+	kill(_signal) {
+		if (this.killRequested || this.outcomeValue !== void 0) return false;
+		this.killRequested = true;
+		this.child.terminate();
+		return true;
+	}
+	/** Register a persistent process lifecycle listener. */
+	on(event, listener) {
+		this.events.on(event, listener);
+	}
+	/** Register a one-shot process lifecycle listener. */
+	once(event, listener) {
+		this.events.once(event, listener);
+	}
+	/** Remove a process lifecycle listener. */
+	off(event, listener) {
+		this.events.off(event, listener);
+	}
+};
+//#endregion
+//#region lib/types/run.js
+/**
+* One-shot Claude Code lifecycle: invoke the official Agent SDK, place its
+* real CLI process under the shared subprocess owner, map only strict SDK
+* success to completion, and dispose to whole-tree quiescence.
+*
+* @module @hydraharness/harness-subagent-claude-code/run
+*/
+/** Default POSIX grace between subprocess termination tiers. */
+const DEFAULT_DISPOSE_GRACE_MS = 3e3;
+/** Claude Code permission modes that cannot wait for a human response. */
+const CLAUDE_CODE_PERMISSION_MODES = [
+	"dontAsk",
+	"acceptEdits",
+	"auto",
+	"plan",
+	"bypassPermissions"
+];
+/** Safe default for unattended Claude Code runs. */
+const DEFAULT_CLAUDE_CODE_PERMISSION_MODE = "dontAsk";
+const SUPPORTED_UNATTENDED_DIALOG_KINDS = ["refusal_fallback_prompt"];
+function failureDiagnostic(facts) {
+	const fields = [
+		"product: Claude Code",
+		`stage: ${facts.stage}`,
+		`category: ${facts.category}`
+	];
+	const exitCode = facts.outcome?.exitCode;
+	if (exitCode !== null && exitCode !== void 0) fields.push(`exit code: ${exitCode}`);
+	const signal = facts.outcome?.signal;
+	if (signal !== null && signal !== void 0) fields.push(`signal: ${signal}`);
+	return `Product subagent failure (${fields.join("; ")})`;
+}
+var ClaudeCodeFailure = class extends Error {
+	facts;
+	constructor(facts, cause) {
+		super(`subagent-claude-code: ${failureDiagnostic(facts)}`, cause === void 0 ? void 0 : { cause });
+		this.facts = facts;
+		this.name = "ClaudeCodeFailure";
+	}
+};
+function sdkFailureCategory(subtype) {
+	switch (subtype) {
+		case "error_during_execution":
+		case "error_max_turns":
+		case "error_max_budget_usd":
+		case "error_max_structured_output_retries": return subtype;
+		default: return "unknown";
+	}
+}
+/**
+* Hide an unpublished product startup failure behind fixed safe facts.
+* @param cause - original host-side failure retained only on the Error cause chain.
+* @returns a rejection safe to expose through the subagent start boundary.
+*/
+function claudeCodeStartupFailure(cause) {
+	return new ClaudeCodeFailure({
+		stage: "query-start",
+		category: "unknown"
+	}, cause);
+}
+function unattendedDiagnostic(mode, request, decision, reason) {
+	return `Claude Code unattended decision (mode: ${mode}; request: ${request}; decision: ${decision}): ${reason}`;
+}
+function thrown(value) {
+	/* v8 ignore next -- typed SDK and subprocess failures reject with Error. */
+	return value instanceof Error ? value : new Error(String(value));
+}
+/** Read live request cancellation across awaited startup cleanup. */
+function isAborted(signal) {
+	return signal.aborted;
+}
+/**
+* Validate and preserve the one-shot task before crossing the SDK boundary.
+* @param prompt - task content accepted from the shared subagent service.
+* @returns the exact text sequence as one SDK prompt.
+*/
+function textTask(prompt) {
+	if (prompt.length === 0) throw new Error("subagent-claude-code: the one-shot task must contain only text blocks");
+	const texts = [];
+	for (const block of prompt) {
+		if (block.type !== "text") throw new Error("subagent-claude-code: the one-shot task must contain only text blocks");
+		texts.push(block.text);
+	}
+	if (texts.every((text) => text.trim().length === 0)) throw new Error("subagent-claude-code: the one-shot task must not be empty");
+	return texts.join("");
+}
+/**
+* Strictly derive the only SDK result that can complete a shared run.
+* @param message - an official discriminated result union.
+* @returns exact final text for a successful, non-error result.
+*/
+function successfulResult(message) {
+	if (message.subtype !== "success") {
+		const category = sdkFailureCategory(message.subtype);
+		const detail = category === "unknown" ? void 0 : message.errors.join("; ");
+		throw new ClaudeCodeFailure({
+			stage: "query-run",
+			category
+		}, detail === void 0 || detail.length === 0 ? void 0 : new Error(detail));
+	}
+	if (message.is_error || message.result.trim().length === 0) throw new ClaudeCodeFailure({
+		stage: "query-run",
+		category: "invalid-success"
+	});
+	return message.result;
+}
+/**
+* Consume the complete SDK stream and require one strict success plus normal
+* iterator completion.
+* @param query - published official SDK query.
+* @param onPermissionDenied - records a safe fact when the SDK reports native denial.
+* @param onResult - records that the SDK supplied a terminal result message.
+* @returns the completed shared result.
+*/
+async function consumeClaudeQuery(query, onPermissionDenied, onResult) {
+	let answer;
+	for await (const message of query) {
+		if (message.type === "system" && message.subtype === "permission_denied") {
+			onPermissionDenied?.();
+			continue;
+		}
+		if (message.type !== "result") continue;
+		onResult?.();
+		answer = successfulResult(message);
+	}
+	if (answer === void 0) throw new ClaudeCodeFailure({
+		stage: "query-run",
+		category: "missing-result"
+	});
+	return {
+		output: [{
+			type: "text",
+			text: answer
+		}],
+		stopReason: "completed"
+	};
+}
+/**
+* Close the official query, terminate the managed process tree, and wait for
+* the subprocess owner to prove it is gone.
+* @param query - official SDK query, when creation reached that point.
+* @param child - live shared-service handle that owns the CLI process tree;
+* spawn-failed handles settle at the startup boundary instead.
+*/
+async function disposeClaudeCodeChild(query, child) {
+	const failures = [];
+	try {
+		query?.close();
+	} catch (error) {
+		failures.push(thrown(error));
+	}
+	child.terminate();
+	try {
+		await child.waitForExit();
+	} catch (error) {
+		failures.push(thrown(error));
+	}
+	const outcome = await child.done;
+	const firstFailure = failures[0];
+	if (firstFailure !== void 0) throw new ClaudeCodeFailure({
+		stage: "teardown",
+		category: "unknown",
+		outcome
+	}, failures.length === 1 ? firstFailure : new AggregateError(failures, "Claude Code teardown failures"));
+}
+/**
+* Build the fixed official SDK options for one one-shot provider run.
+* @param spec - Workspace, environment, process service, and disposal policy.
+* @param controller - per-run cancellation owner.
+* @param capture - receives the shared child and SDK-facing process synchronously.
+* @param captureDiagnostic - receives safe facts from unattended interaction callbacks.
+* @returns options that inherit native settings while disabling persistence and user questions.
+*/
+function claudeQueryOptions(spec, controller, capture, captureDiagnostic) {
+	return {
+		abortController: controller,
+		cwd: spec.cwd,
+		env: {
+			...scrubbedParentEnv(),
+			...spec.env
+		},
+		persistSession: false,
+		disallowedTools: spec.permissionMode === "plan" ? ["AskUserQuestion", "ExitPlanMode"] : ["AskUserQuestion"],
+		permissionMode: spec.permissionMode,
+		...spec.permissionMode === "bypassPermissions" ? { allowDangerouslySkipPermissions: true } : { canUseTool: () => {
+			captureDiagnostic(unattendedDiagnostic(spec.permissionMode, "tool permission", "denied", "the provider does not request human approval"));
+			return Promise.resolve({
+				behavior: "deny",
+				message: "This unattended Claude Code subagent cannot request human approval."
+			});
+		} },
+		onElicitation: () => {
+			captureDiagnostic(unattendedDiagnostic(spec.permissionMode, "MCP elicitation", "declined", "the provider does not collect interactive MCP input"));
+			return Promise.resolve({ action: "decline" });
+		},
+		onUserDialog: () => {
+			captureDiagnostic(unattendedDiagnostic(spec.permissionMode, "user dialog", "cancelled", "the provider does not render blocking dialogs"));
+			return Promise.resolve({ behavior: "cancelled" });
+		},
+		supportedDialogKinds: SUPPORTED_UNATTENDED_DIALOG_KINDS,
+		spawnClaudeCodeProcess: (options) => {
+			const child = spec.spawn(claudeSpawnSpec(options, spec.disposeGraceMs));
+			const process = new ManagedClaudeCodeProcess(child);
+			capture(child, process);
+			return process;
+		}
+	};
+}
+/**
+* Start one official Claude Agent SDK query and publish its one-shot run.
+* @param request - resolved shared subagent request.
+* @param spec - Workspace, environment, process service, and diagnostic policy.
+* @returns the published run after both Query and real CLI handle exist.
+*/
+async function startClaudeCodeRun(request, spec) {
+	const prompt = textTask(request.prompt);
+	if (request.signal.aborted) throw new Error("subagent-claude-code: request was aborted before SDK startup");
+	const controller = new AbortController();
+	const requestCancel = () => {
+		if (!controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("subagent-claude-code: run cancelled locally"));
+	};
+	const onAbort = () => {
+		requestCancel();
+	};
+	request.signal.addEventListener("abort", onAbort, { once: true });
+	const reportFailure = (error) => {
+		try {
+			spec.onError?.(error, "error");
+		} catch {}
+	};
+	let child;
+	let query$1;
+	let managedProcess;
+	let diagnostic;
+	const capturePermissionDiagnostic = (value) => {
+		diagnostic = value;
+	};
+	const prependFailureDiagnostic = (facts) => {
+		const failure = failureDiagnostic(facts);
+		diagnostic = diagnostic === void 0 ? failure : `${failure}\n${diagnostic}`;
+	};
+	const captureChild = (captured, process) => {
+		child = captured;
+		managedProcess = process;
+	};
+	try {
+		query$1 = query({
+			prompt,
+			options: claudeQueryOptions(spec, controller, captureChild, capturePermissionDiagnostic)
+		});
+		if (child === void 0 || child.pid <= 0) throw new Error("subagent-claude-code: official SDK did not publish a controllable Claude Code process");
+		if (controller.signal.aborted) throw new Error("subagent-claude-code: request was aborted before SDK startup");
+	} catch (error) {
+		request.signal.removeEventListener("abort", onAbort);
+		const cancelledBeforeCleanup = controller.signal.aborted;
+		await Promise.resolve();
+		const startupFacts = {
+			stage: "query-start",
+			category: "unknown",
+			outcome: managedProcess?.outcome
+		};
+		const startupFailure = (cause = error) => new ClaudeCodeFailure(startupFacts, thrown(cause));
+		requestCancel();
+		if (child !== void 0 && child.pid <= 0) {
+			let closeError;
+			try {
+				query$1?.close();
+			} catch (disposeError) {
+				closeError = thrown(disposeError);
+			}
+			let spawnError = thrown(error);
+			try {
+				await child.done;
+			} catch (childError) {
+				spawnError = thrown(childError);
+			}
+			if (closeError !== void 0) {
+				const failure = startupFailure(spawnError);
+				const cleanupFailure = new ClaudeCodeFailure({
+					stage: "teardown",
+					category: "unknown"
+				}, closeError);
+				const aggregate = new AggregateError([failure, cleanupFailure], `${failure.message}; ${cleanupFailure.message}`);
+				reportFailure(aggregate);
+				throw aggregate;
+			}
+			if (cancelledBeforeCleanup || isAborted(request.signal)) throw new Error("subagent-claude-code: request was aborted before SDK startup");
+			const failure = startupFailure(spawnError);
+			reportFailure(failure);
+			throw failure;
+		}
+		if (child !== void 0) try {
+			await disposeClaudeCodeChild(query$1, child);
+		} catch (disposeError) {
+			const failure = startupFailure();
+			const cleanupFailure = thrown(disposeError);
+			const aggregate = new AggregateError([failure, cleanupFailure], `${failure.message}; ${cleanupFailure.message}`);
+			reportFailure(aggregate);
+			throw aggregate;
+		}
+		else if (query$1 !== void 0) try {
+			query$1.close();
+		} catch (disposeError) {
+			const failure = startupFailure();
+			const cleanupFailure = new ClaudeCodeFailure({
+				stage: "teardown",
+				category: "unknown"
+			}, thrown(disposeError));
+			const aggregate = new AggregateError([failure, cleanupFailure], `${failure.message}; ${cleanupFailure.message}`);
+			reportFailure(aggregate);
+			throw aggregate;
+		}
+		if (cancelledBeforeCleanup || isAborted(request.signal)) throw new Error("subagent-claude-code: request was aborted before SDK startup");
+		const failure = startupFailure();
+		reportFailure(failure);
+		throw failure;
+	}
+	const publishedQuery = query$1;
+	const publishedChild = child;
+	let receivedResult = false;
+	const result = settleRunResult({
+		attempt: async () => {
+			try {
+				return await consumeClaudeQuery(publishedQuery, () => {
+					capturePermissionDiagnostic(unattendedDiagnostic(spec.permissionMode, "tool permission", "denied", "Claude Code denied the request before an interactive prompt"));
+				}, () => {
+					receivedResult = true;
+				});
+			} catch (error) {
+				const processOutcome = managedProcess?.outcome;
+				let facts;
+				if (error instanceof ClaudeCodeFailure) facts = {
+					...error.facts,
+					outcome: processOutcome
+				};
+				else if (processOutcome !== void 0 && !receivedResult) facts = {
+					stage: "process",
+					category: "process-exit",
+					outcome: processOutcome
+				};
+				else facts = {
+					stage: "query-run",
+					category: "unknown",
+					outcome: processOutcome
+				};
+				prependFailureDiagnostic(facts);
+				throw error instanceof ClaudeCodeFailure ? error : new ClaudeCodeFailure(facts, thrown(error));
+			}
+		},
+		collectOutput: () => [],
+		collectDiagnostic: () => diagnostic,
+		cancelled: () => controller.signal.aborted,
+		onError: spec.onError,
+		signal: request.signal,
+		onAbort
+	});
+	return subprocessRunHandle({
+		id: SessionId(randomUUID()),
+		result,
+		signal: request.signal,
+		onAbort,
+		requestCancel,
+		teardown: async () => {
+			try {
+				await disposeClaudeCodeChild(publishedQuery, publishedChild);
+			} catch (error) {
+				const failure = thrown(error);
+				reportFailure(failure);
+				throw failure;
+			}
+		}
+	});
+}
+//#endregion
+//#region lib/types/index.js
+/**
+* Profile-named Claude Code one-shot subagent provider. Every accepted run
+* invokes the official Agent SDK in the delegating Session's workspace and
+* places the SDK-spawned real CLI under the shared subprocess owner.
+*
+* @module @hydraharness/harness-subagent-claude-code
+*/
+const name = "subagent-claude-code";
+const inject = ["subagents", "subprocess"];
+const DEFAULT_PROVIDER_NAME = "claude-code";
+const Config = z.object({
+	providerName: z.string().min(1).default(DEFAULT_PROVIDER_NAME),
+	env: z.dict(z.string()).default({}),
+	permissionMode: z.union([...CLAUDE_CODE_PERMISSION_MODES]).default(DEFAULT_CLAUDE_CODE_PERMISSION_MODE),
+	disposeGraceMs: z.number().default(DEFAULT_DISPOSE_GRACE_MS)
+});
+var ClaudeCodeProvider = class {
+	name;
+	ctx;
+	config;
+	capabilities = NO_START_CAPABILITIES;
+	inheritsParentContext = false;
+	constructor(name, ctx, config) {
+		this.name = name;
+		this.ctx = ctx;
+		this.config = config;
+	}
+	async start(request) {
+		const parentCwd = request.parent.session.header.cwd;
+		if (parentCwd === void 0) throw new Error("subagent-claude-code: no working directory for the child — delegate from a parent session that has one");
+		let cwd;
+		try {
+			cwd = resolveChildCwd("subagent-claude-code", void 0, parentCwd);
+		} catch (error) {
+			if (request.signal.aborted) throw new Error("subagent-claude-code: request was aborted before SDK startup");
+			const failure = claudeCodeStartupFailure(error);
+			this.ctx.logger.warn(`subagent-claude-code "${this.name}": child start failed: %o`, failure);
+			throw failure;
+		}
+		return startClaudeCodeRun(request, {
+			cwd,
+			permissionMode: this.config.permissionMode,
+			env: this.config.env,
+			disposeGraceMs: this.config.disposeGraceMs,
+			spawn: (spawnSpec) => this.ctx.subprocess.spawn(spawnSpec),
+			onError: (error, stopReason) => {
+				this.ctx.logger.warn(`subagent-claude-code "${this.name}": child run failed (${stopReason}): %o`, error);
+			}
+		});
+	}
+};
+/**
+* Register one Profile-named Claude Code provider.
+* @param ctx - context carrying shared subagent and subprocess services.
+* @param config - registry name, permission mode, child environment, and disposal grace.
+*/
+function apply(ctx, config) {
+	const resolved = {
+		providerName: config.providerName ?? DEFAULT_PROVIDER_NAME,
+		env: config.env,
+		permissionMode: config.permissionMode ?? "dontAsk",
+		disposeGraceMs: config.disposeGraceMs
+	};
+	assertPositiveFinite("subagent-claude-code", "disposeGraceMs", resolved.disposeGraceMs);
+	if (resolved.disposeGraceMs > MAX_TIMER_DELAY_MS) throw new Error(`subagent-claude-code: disposeGraceMs must be no greater than ${MAX_TIMER_DELAY_MS}`);
+	ctx.subagents.registerProvider(new ClaudeCodeProvider(resolved.providerName, ctx, resolved));
+}
+//#endregion
+export { Config, apply, inject, name };

package/lib/invariant.js

@@ -0,0 +1,24 @@
+//#region lib/types/invariant.js
+/**
+* Package-owned invariant companion for
+* `@hydraharness/harness-subagent-claude-code`.
+* @module @hydraharness/harness-subagent-claude-code/invariant
+*/
+const PACKAGE_NAME = "@hydraharness/harness-subagent-claude-code";
+/** Cordis companion plugin name. */
+const name = "subagent-claude-code-invariant";
+/** Service required before the companion can reserve package ownership. */
+const inject = ["invariants"];
+/**
+* No runtime invariant: lifecycle pairing belongs to the shared subagent
+* service and process-tree ownership belongs to the subprocess service.
+*/
+const install = () => {};
+/**
+* Register this package's invariant companion.
+* @param ctx - plugin context carrying the invariant registry.
+* @returns the installed registration's disposer.
+*/
+const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//#endregion
+export { apply, inject, name };

package/lib/types/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Profile-named Claude Code one-shot subagent provider. Every accepted run
+ * invokes the official Agent SDK in the delegating Session's workspace and
+ * places the SDK-spawned real CLI under the shared subprocess owner.
+ *
+ * @module @hydraharness/harness-subagent-claude-code
+ */
+import type { Context } from '@hydraharness/cordis';
+import z from '@hydraharness/schemastery';
+import { type ClaudeCodePermissionMode } from './run.ts';
+export declare const name = "subagent-claude-code";
+export declare const inject: string[];
+/** Deployment-owned permission, environment, and process-release settings. */
+export interface Config {
+    /** Provider name on `ctx.subagents` (default `claude-code`). */
+    providerName?: string;
+    /**
+     * Explicit environment entries layered over the subprocess seam's
+     * credential-scrubbed parent environment.
+     */
+    env?: Record<string, string>;
+    /**
+     * Native non-interactive mode fixed for this Provider instance. Defaults to
+     * `dontAsk`; `acceptEdits` accepts edits, `auto` uses the native classifier,
+     * `plan` returns a plan without approving execution, and
+     * `bypassPermissions` explicitly skips permission checks.
+     */
+    permissionMode?: ClaudeCodePermissionMode;
+    /** Grace in milliseconds for Claude Code process-tree termination. */
+    disposeGraceMs?: number;
+}
+export declare const Config: z<Config>;
+/**
+ * Register one Profile-named Claude Code provider.
+ * @param ctx - context carrying shared subagent and subprocess services.
+ * @param config - registry name, permission mode, child environment, and disposal grace.
+ */
+export declare function apply(ctx: Context, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/invariant.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Package-owned invariant companion for
+ * `@hydraharness/harness-subagent-claude-code`.
+ * @module @hydraharness/harness-subagent-claude-code/invariant
+ */
+import type { Context } from '@hydraharness/cordis';
+/** Cordis companion plugin name. */
+export declare const name = "subagent-claude-code-invariant";
+/** Service required before the companion can reserve package ownership. */
+export declare const inject: string[];
+/**
+ * Register this package's invariant companion.
+ * @param ctx - plugin context carrying the invariant registry.
+ * @returns the installed registration's disposer.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/lib/types/process.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Projection from the shared managed-process handle to the official Claude
+ * Agent SDK's custom-spawn process interface.
+ *
+ * @module @hydraharness/harness-subagent-claude-code/process
+ */
+import type { SpawnedProcess, SpawnOptions } from '@anthropic-ai/claude-agent-sdk';
+import { type SubprocessHandle, type SubprocessOutcome, type SubprocessSpawnSpec } from '@hydraharness/harness-subprocess';
+/**
+ * Encode the SDK's complete child environment as a subprocess overlay.
+ * @param env - SDK-composed child environment after its removals and replacements.
+ * @returns explicit values plus tombstones for surviving ambient names the SDK removed.
+ */
+export declare function sdkEnvironmentOverlay(env: SpawnOptions['env']): NodeJS.ProcessEnv;
+/**
+ * Translate one official SDK spawn request to the shared process owner.
+ * @param options - command, arguments, workspace, environment, and forwarded signal from the SDK.
+ * @param graceMs - process-tree termination grace.
+ * @returns the fully explicit shared subprocess request.
+ */
+export declare function claudeSpawnSpec(options: SpawnOptions, graceMs: number): SubprocessSpawnSpec;
+/**
+ * SDK-facing view of one shared managed process. Protocol transport remains
+ * in the official SDK; this adapter only projects streams and exit events.
+ */
+export declare class ManagedClaudeCodeProcess implements SpawnedProcess {
+    private readonly child;
+    readonly stdin: import("stream").Writable;
+    readonly stdout: import("stream").Readable;
+    private readonly events;
+    private outcomeValue;
+    private killRequested;
+    /**
+     * Project a managed process with piped stdin and stdout.
+     * @param child - shared handle that remains the process-tree authority.
+     */
+    constructor(child: SubprocessHandle);
+    /** Whether the SDK has requested managed tree termination. */
+    get killed(): boolean;
+    /** Direct-child exit code, or null while running or after signal exit. */
+    get exitCode(): number | null;
+    /** Direct-child terminating signal, if any. */
+    get signalCode(): NodeJS.Signals | null;
+    /** Exact managed-process outcome after exit, or undefined while running. */
+    get outcome(): SubprocessOutcome | undefined;
+    /**
+     * Route the SDK's termination request to the tree-scoped process owner.
+     * @param _signal - SDK-selected signal; the shared seam owns its escalation ladder.
+     * @returns false only after exit or a previous termination request.
+     */
+    kill(_signal: NodeJS.Signals): boolean;
+    /** Register a persistent process lifecycle listener. */
+    on(event: 'exit' | 'error', listener: ((code: number | null, signal: NodeJS.Signals | null) => void) | ((error: Error) => void)): void;
+    /** Register a one-shot process lifecycle listener. */
+    once(event: 'exit' | 'error', listener: ((code: number | null, signal: NodeJS.Signals | null) => void) | ((error: Error) => void)): void;
+    /** Remove a process lifecycle listener. */
+    off(event: 'exit' | 'error', listener: ((code: number | null, signal: NodeJS.Signals | null) => void) | ((error: Error) => void)): void;
+}
+//# sourceMappingURL=process.d.ts.map

package/lib/types/run.d.ts

@@ -0,0 +1,87 @@
+/**
+ * One-shot Claude Code lifecycle: invoke the official Agent SDK, place its
+ * real CLI process under the shared subprocess owner, map only strict SDK
+ * success to completion, and dispose to whole-tree quiescence.
+ *
+ * @module @hydraharness/harness-subagent-claude-code/run
+ */
+import { type Options, type Query, type SDKMessage, type SDKResultMessage } from '@anthropic-ai/claude-agent-sdk';
+import type { ContentBlock } from '@hydraharness/harness-llm';
+import { type SubagentResult, type SubagentRun, type SubagentStartRequest, type SubagentStopReason } from '@hydraharness/harness-subagent';
+import { type SubprocessHandle, type SubprocessSpawnSpec } from '@hydraharness/harness-subprocess';
+import { ManagedClaudeCodeProcess } from './process.ts';
+/** Default POSIX grace between subprocess termination tiers. */
+export declare const DEFAULT_DISPOSE_GRACE_MS = 3000;
+/** Claude Code permission modes that cannot wait for a human response. */
+export declare const CLAUDE_CODE_PERMISSION_MODES: readonly ["dontAsk", "acceptEdits", "auto", "plan", "bypassPermissions"];
+/** Profile-selectable non-interactive Claude Code permission mode. */
+export type ClaudeCodePermissionMode = typeof CLAUDE_CODE_PERMISSION_MODES[number];
+/** Safe default for unattended Claude Code runs. */
+export declare const DEFAULT_CLAUDE_CODE_PERMISSION_MODE: ClaudeCodePermissionMode;
+/**
+ * Hide an unpublished product startup failure behind fixed safe facts.
+ * @param cause - original host-side failure retained only on the Error cause chain.
+ * @returns a rejection safe to expose through the subagent start boundary.
+ */
+export declare function claudeCodeStartupFailure(cause: unknown): Error;
+/** Fully resolved inputs for one official Claude Agent SDK query. */
+export interface ClaudeCodeRunSpec {
+    /** Parent Session workspace supplied to the SDK and real CLI. */
+    readonly cwd: string;
+    /** Profile-selected native non-interactive permission mode. */
+    readonly permissionMode: ClaudeCodePermissionMode;
+    /** Explicit deployment/test environment layered after shared scrubbing. */
+    readonly env: Record<string, string>;
+    /** Subprocess termination grace passed to the shared process-tree owner. */
+    readonly disposeGraceMs: number;
+    /** Shared subprocess service spawn operation. */
+    readonly spawn: (spec: SubprocessSpawnSpec) => SubprocessHandle;
+    /** Host diagnostic sink for a product failure kept outside model-visible text. */
+    readonly onError?: (error: Error, stopReason: SubagentStopReason) => void;
+}
+/**
+ * Validate and preserve the one-shot task before crossing the SDK boundary.
+ * @param prompt - task content accepted from the shared subagent service.
+ * @returns the exact text sequence as one SDK prompt.
+ */
+export declare function textTask(prompt: readonly ContentBlock[]): string;
+/**
+ * Strictly derive the only SDK result that can complete a shared run.
+ * @param message - an official discriminated result union.
+ * @returns exact final text for a successful, non-error result.
+ */
+export declare function successfulResult(message: SDKResultMessage): string;
+/**
+ * Consume the complete SDK stream and require one strict success plus normal
+ * iterator completion.
+ * @param query - published official SDK query.
+ * @param onPermissionDenied - records a safe fact when the SDK reports native denial.
+ * @param onResult - records that the SDK supplied a terminal result message.
+ * @returns the completed shared result.
+ */
+export declare function consumeClaudeQuery(query: AsyncIterable<SDKMessage>, onPermissionDenied?: () => void, onResult?: () => void): Promise<SubagentResult>;
+/**
+ * Close the official query, terminate the managed process tree, and wait for
+ * the subprocess owner to prove it is gone.
+ * @param query - official SDK query, when creation reached that point.
+ * @param child - live shared-service handle that owns the CLI process tree;
+ * spawn-failed handles settle at the startup boundary instead.
+ */
+export declare function disposeClaudeCodeChild(query: Pick<Query, 'close'> | undefined, child: SubprocessHandle): Promise<void>;
+/**
+ * Build the fixed official SDK options for one one-shot provider run.
+ * @param spec - Workspace, environment, process service, and disposal policy.
+ * @param controller - per-run cancellation owner.
+ * @param capture - receives the shared child and SDK-facing process synchronously.
+ * @param captureDiagnostic - receives safe facts from unattended interaction callbacks.
+ * @returns options that inherit native settings while disabling persistence and user questions.
+ */
+export declare function claudeQueryOptions(spec: ClaudeCodeRunSpec, controller: AbortController, capture: (child: SubprocessHandle, process: ManagedClaudeCodeProcess) => void, captureDiagnostic: (diagnostic: string) => void): Options;
+/**
+ * Start one official Claude Agent SDK query and publish its one-shot run.
+ * @param request - resolved shared subagent request.
+ * @param spec - Workspace, environment, process service, and diagnostic policy.
+ * @returns the published run after both Query and real CLI handle exist.
+ */
+export declare function startClaudeCodeRun(request: SubagentStartRequest, spec: ClaudeCodeRunSpec): Promise<SubagentRun>;
+//# sourceMappingURL=run.d.ts.map

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@hydraharness/harness-subagent-claude-code",
+  "description": "One-shot Claude Code subagent provider over the official Agent SDK",
+  "version": "0.1.1-rc.6",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MaiHongPhong1902/Hydra-Harness.git",
+    "directory": "packages/subagent/subagent-claude-code"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "cordis.patch.yml",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "hydra": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "peerDependencies": {
+    "@hydraharness/harness-invariants": "^0.1.1-rc.6",
+    "@hydraharness/harness-subagent": "^0.1.1-rc.6",
+    "@hydraharness/harness-session": "^0.1.1-rc.6",
+    "@hydraharness/harness-llm": "^0.1.1-rc.6",
+    "@hydraharness/harness-timeout": "^0.1.1-rc.6",
+    "@hydraharness/harness-subprocess": "^0.1.1-rc.6",
+    "@hydraharness/cordis": "^4.0.2"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "0.93.0",
+    "@anthropic-ai/claude-agent-sdk": "0.3.220",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^4.4.3",
+    "@hydraharness/schemastery": "^3.18.2"
+  },
+  "devDependencies": {
+    "@hydraharness/harness-agent": "^0.1.1-rc.6",
+    "@hydraharness/harness-llm": "^0.1.1-rc.6",
+    "@hydraharness/harness-loader-smoke": "^0.1.1-rc.6",
+    "@hydraharness/harness-invariants": "^0.1.1-rc.6",
+    "@hydraharness/harness-session": "^0.1.1-rc.6",
+    "@hydraharness/harness-subagent": "^0.1.1-rc.6",
+    "@hydraharness/harness-timeout": "^0.1.1-rc.6",
+    "@hydraharness/harness-subprocess-local": "^0.1.1-rc.6",
+    "@hydraharness/harness-subprocess": "^0.1.1-rc.6",
+    "@hydraharness/cordis": "^4.0.2"
+  }
+}