@longshot-harness/longshot-linux-x64 0.1.0-beta.1 → 0.1.0-beta.2

package/sidecars/claude/main.py

@@ -1,367 +0,0 @@
-"""Entry point for the Claude sidecar process.
-
-Speaks the frozen wire protocol documented in docs/claude-sidecar.md over
-stdin/stdout; protocol.py owns the envelope and framing. This file owns the
-hello gate, the SDK-presence check and the op dispatcher: session.py
-(T16-S02) owns ClaudeAgentOptions and ClaudeSDKClient and, as of T18, the
-three operations that drive a turn on it; events.py (T17) owns the event
-stream; T20 adds tool execution.
-"""
-
-import sys
-
-# Must run before any other code. On Windows, stdout's default encoding is
-# not UTF-8, and its text-mode newline translation turns "\n" into "\r\n"
-# *inside* a frame; today's json parsing tolerates the stray "\r" as
-# insignificant whitespace, but relying on that is out of scope here.
-# Redirecting sys.stdout to stderr afterwards means one forgotten call to the
-# print builtin lands in diagnostics instead of corrupting the frame stream;
-# the real stdout stays reachable as _frames for the one thing that may still
-# write to it.
-_frames = sys.stdout
-_frames.reconfigure(encoding="utf-8", newline="\n")
-sys.stdout = sys.stderr
-
-EXIT_OK = 0
-EXIT_INTERNAL_ERROR = 1
-EXIT_PROTOCOL_ERROR = 2
-EXIT_ENVIRONMENT_ERROR = (
-    3  # "environment", not "protocol": no interpreter, no SDK, no CLI
-)
-
-# Before any other import: session.py imports claude_agent_sdk at module
-# level too, and an uncaught ImportError there would print a Python
-# traceback instead of the one readable diagnostic line T16-S03 requires.
-# Checking here, first, means the frame stream is never opened at all when
-# the SDK is missing - there is nothing left to open before sys.exit below
-# runs. The reason reaches Longshot through the stderr drain that already
-# exists for T16-S01 (that drain is why this write is enough; nothing here
-# needs to reach stdout).
-#
-# The exception text is carried, not swallowed: a sidecar module shadowing
-# one of the SDK's own dependencies raises ImportError here too, and without
-# the real cause it reads as an absent package (`mcp.py` was exactly that).
-try:
-    import claude_agent_sdk  # noqa: F401
-except ImportError as exc:
-    sys.stderr.write(
-        "claude sidecar: claude-agent-sdk is not installed; install it with "
-        "`pip install claude-agent-sdk` (see sidecars/claude/README.md); "
-        f"import failed with: {exc!r}\n"
-    )
-    sys.exit(EXIT_ENVIRONMENT_ERROR)
-
-import asyncio  # noqa: E402  (see the ordering comment above)
-import importlib.metadata  # noqa: E402
-import os  # noqa: E402
-import shutil  # noqa: E402
-import subprocess  # noqa: E402
-
-from protocol import (  # noqa: E402
-    PROTOCOL_VERSION,
-    Code,
-    FrameError,
-    Op,
-    read_frame,
-    refusal,
-    resolve,
-    response,
-    write_frame,
-)
-from session import Refusal, Session, check_permission_mode  # noqa: E402
-
-# One event loop for the process lifetime, not one per call: the live
-# ClaudeSDKClient a session.start answers with stays bound to whichever loop
-# ran connect(), and session.read/session.close/session.close-on-EOF must
-# reach the same client later.
-_loop = asyncio.new_event_loop()
-
-
-def _run(coro):
-    return _loop.run_until_complete(coro)
-
-
-_session = Session()
-
-# Every operation dispatched to session.Session: the five T16-S02/T22
-# session ones plus T18's three, which are session operations in the same
-# sense - each needs the one live client and the one stream state that
-# object already holds. Each handler takes the frame's params and returns
-# the result dict to answer with; a session.Refusal it raises is turned
-# into a wire refusal by main().
-_SESSION_HANDLERS = {
-    Op.SESSION_START: lambda params: _run(_session.start(params)),
-    Op.SESSION_RESUME: lambda params: _run(_session.resume(params)),
-    Op.SESSION_READ: lambda params: _session.read(params.get("session_id", "")),
-    Op.SESSION_HISTORY: lambda params: _run(_session.history(params)),
-    Op.SESSION_CLOSE: lambda params: _run(_session.close(params.get("session_id", ""))),
-    Op.INPUT_SUBMIT: lambda params: _run(_session.submit(params)),
-    Op.TURN_INTERRUPT: lambda params: _run(
-        _session.interrupt(params.get("session_id", ""))
-    ),
-    Op.MODEL_SET: lambda params: _run(_session.set_model(params)),
-}
-
-# The two ops that leave the session open and ready to accept input, and so
-# emit session.ready once each. The event is written here, immediately after
-# the op's own result frame, and never from inside the handler: the caller
-# learns the session's id from that result, so an event naming a session
-# Longshot has not been told about yet would be a frame out of order. The
-# SDK's `system`/`init` message is not the trigger - it does not arrive until
-# a query is sent, which would leave an open-but-unprompted session emitting
-# nothing at all (events.session_ready's own docstring).
-_READY_AFTER = {Op.SESSION_START, Op.SESSION_RESUME}
-
-# Every op Longshot may send that this build does not implement yet, and the
-# task that will. There is no "accept and stay silent": each answers
-# `internal`, naming its owner, per docs/claude-sidecar.md's refusal table.
-# The table is empty as of T18: permission.set left it when T21 landed, and
-# input.submit, turn.interrupt and model.set when this one did, so every op
-# in Op.KNOWN now has a handler above. It stays here, empty, because the
-# refusal at the bottom of the dispatch loop is what an op added to
-# Op.KNOWN without a handler answers - the alternative is a request that
-# gets no frame back at all and a caller that waits forever.
-_UNIMPLEMENTED_OWNERS: dict[str, str] = {}
-
-
-def _diag(message: str) -> None:
-    """Write one diagnostic line to the real stderr. Never the print builtin
-    (see the ordering comment above) and never protocol data."""
-    sys.stderr.write(message)
-    sys.stderr.write("\n")
-    sys.stderr.flush()
-
-
-def disconnect_client() -> None:
-    """Disconnects the live ClaudeSDKClient, if one was ever connected. The
-    finally block below calls this unconditionally, on EOF as much as on a
-    clean session.close: this is the point where the sidecar releases its
-    `claude` grandchild (T16, "Отсутствие процесса-сироты")."""
-    _run(_session.disconnect())
-
-
-# The one string reported when a version cannot be established. It is never
-# a refusal: docs/claude-sidecar.md requires both members of the hello result
-# to be present, and a handshake that failed because a version string could
-# not be read would trade a working session for a diagnostic.
-_UNKNOWN_VERSION = "unknown"
-
-
-def _sdk_version() -> str:
-    """The Agent SDK version this sidecar drives. Free: the package is
-    already imported by the preamble above, so this reads its installed
-    metadata and spawns nothing."""
-    try:
-        return importlib.metadata.version("claude-agent-sdk")
-    except importlib.metadata.PackageNotFoundError:
-        return _UNKNOWN_VERSION
-
-
-def _cli_version() -> str:
-    """The Claude CLI version this sidecar drives, read once at hello.
-
-    `claude --version` starts no session and spends no inference, and it is
-    the only way to learn the number: the SDK reports it nowhere, and
-    get_server_info() is both session-scoped and silent about it. shutil.which
-    rather than a bare name in the argv, because on Windows the CLI is a
-    `.cmd` shim that CreateProcess would not find on its own.
-    """
-    exe = shutil.which("claude")
-    if not exe:
-        return _UNKNOWN_VERSION
-    try:
-        out = subprocess.run(  # noqa: S603
-            [exe, "--version"], capture_output=True, text=True, timeout=10, check=False
-        )
-    except (OSError, subprocess.SubprocessError):
-        return _UNKNOWN_VERSION
-    if out.returncode != 0:
-        return _UNKNOWN_VERSION
-    return out.stdout.strip() or _UNKNOWN_VERSION
-
-
-def _hello_result() -> dict:
-    return {
-        "protocol": PROTOCOL_VERSION,
-        "sidecar": {"name": "claude-sidecar", "version": "0.1.0", "pid": os.getpid()},
-        "cli_version": _cli_version(),
-        "sdk_version": _sdk_version(),
-    }
-
-
-def _id_of(frame: dict) -> int:
-    frame_id = frame.get("id")
-    return frame_id if isinstance(frame_id, int) else 0
-
-
-def main() -> int:
-    greeted = False
-    try:
-        while True:
-            try:
-                # Under the loop, not on the bare main thread: this read is
-                # where the sidecar spends every idle moment, and the process
-                # has exactly one event loop, which only turns inside _run.
-                # Reading straight from sys.stdin here suspended
-                # events.run_stream's task for the whole wait, so no
-                # message.delta, tool.started, error or turn.completed could
-                # leave the process between operations - the frames were
-                # produced and then sat in a task nobody was pumping.
-                # asyncio.to_thread parks the blocking readline on a worker
-                # thread while run_until_complete turns the loop, so the
-                # stream task drains on its own. Only the read moves: the
-                # dispatch below stays synchronous, every handler keeps its
-                # own _run, and the writes here keep running on a main
-                # thread that is by construction not inside the loop.
-                frame = _run(asyncio.to_thread(read_frame, sys.stdin))
-            except FrameError as exc:
-                _diag(f"malformed frame: {exc}")
-                return EXIT_PROTOCOL_ERROR
-
-            if frame is None:
-                # EOF is the one unconditional exit point of this loop: a
-                # Longshot stopped any way at all, including a hard kill,
-                # closes this process's stdin, and that is the whole
-                # mechanism behind "no orphan sidecar" (T16).
-                return EXIT_OK
-
-            kind = frame.get("kind")
-            op = frame.get("op")
-            frame_id = _id_of(frame)
-
-            if not greeted:
-                if kind != "request" or op != Op.HELLO:
-                    write_frame(
-                        _frames,
-                        refusal(
-                            frame_id,
-                            Code.HELLO_REQUIRED,
-                            f"the sidecar channel received {op or ''!r} before completing the "
-                            "hello handshake; a sidecar channel must complete hello first",
-                        ),
-                    )
-                    return EXIT_PROTOCOL_ERROR
-
-                params = frame.get("params") or {}
-                if params.get("protocol") != PROTOCOL_VERSION:
-                    write_frame(
-                        _frames,
-                        refusal(
-                            frame_id,
-                            Code.UNSUPPORTED_VERSION,
-                            f"sidecar protocol mismatch: this sidecar speaks protocol "
-                            f"{PROTOCOL_VERSION}, longshot speaks protocol "
-                            f"{params.get('protocol')!r}. Reinstall the sidecar that ships with "
-                            "this longshot build, or run the longshot build that matches it.",
-                        ),
-                    )
-                    return EXIT_PROTOCOL_ERROR
-
-                write_frame(_frames, response(frame_id, _hello_result()))
-                greeted = True
-                continue
-
-            if kind == "request" and op == Op.HELLO:
-                # Rule 3: a second hello is malformedRequest and does NOT end
-                # the channel.
-                write_frame(
-                    _frames,
-                    refusal(
-                        frame_id,
-                        Code.MALFORMED_REQUEST,
-                        "the sidecar received hello twice; hello is the first frame of a "
-                        "channel and is sent once",
-                    ),
-                )
-                continue
-
-            if kind == "response":
-                # An answer to one of THIS sidecar's own requests -
-                # permission.request (T21) or tool.call (T20). One resolve()
-                # serves both, over protocol.py's one pending registry:
-                # routing them separately would be the second correlation
-                # mechanism T20-S02 refused. Each side keeps its own id
-                # counter (docs/claude-sidecar.md, "Correlation and
-                # identifiers"), so this is never confused with a response to
-                # a request Longshot sent. An id nobody is waiting on is
-                # dropped with a diagnostic, not refused: the waiter may
-                # already have given up (session ending), and there is no
-                # request id to answer on this path anyway.
-                if not resolve(frame):
-                    _diag(
-                        f"claude sidecar: response id={frame_id} matched no pending sidecar-initiated request"
-                    )
-                continue
-
-            if kind != "request":
-                write_frame(
-                    _frames,
-                    refusal(
-                        frame_id,
-                        Code.MALFORMED_REQUEST,
-                        f"the sidecar channel received a frame of kind {kind!r}, which "
-                        "Longshot may not send",
-                    ),
-                )
-                continue
-
-            if op not in Op.KNOWN:
-                write_frame(
-                    _frames,
-                    refusal(
-                        frame_id,
-                        Code.UNKNOWN_OPERATION,
-                        f"{op!r} is not an operation either side of the sidecar channel knows",
-                    ),
-                )
-                continue
-
-            params = frame.get("params") or {}
-
-            if op in _SESSION_HANDLERS:
-                try:
-                    result = _SESSION_HANDLERS[op](params)
-                except Refusal as exc:
-                    write_frame(_frames, refusal(frame_id, exc.code, exc.message))
-                    continue
-                write_frame(_frames, response(frame_id, result))
-                if op in _READY_AFTER:
-                    write_frame(_frames, _session.ready_event())
-                continue
-
-            if op == Op.PERMISSION_SET:
-                # T15 requires the permission_mode refusal here too, ahead of
-                # the actual mode change: the frame carries permission_mode,
-                # and I08 must hold on this side of the channel even though
-                # the other side (internal/backend/claude/settings.go)
-                # checks it as well - a check on one side is a check a
-                # refactor removes.
-                try:
-                    check_permission_mode(params.get("permission_mode") or "")
-                    result = _run(
-                        _session.set_permission_mode(
-                            params.get("session_id", ""),
-                            params["permission_mode"],
-                        )
-                    )
-                except Refusal as exc:
-                    write_frame(_frames, refusal(frame_id, exc.code, exc.message))
-                    continue
-                write_frame(_frames, response(frame_id, result))
-                continue
-
-            owner = _UNIMPLEMENTED_OWNERS.get(op, "a later task")
-            write_frame(
-                _frames,
-                refusal(
-                    frame_id,
-                    Code.INTERNAL,
-                    f"{op!r} is not implemented by this sidecar build yet; {owner} owns it",
-                ),
-            )
-    finally:
-        disconnect_client()
-
-
-if __name__ == "__main__":
-    sys.exit(main())

package/sidecars/claude/mcpserver.py

@@ -1,96 +0,0 @@
-"""Builds the in-process "longshot" MCP server ClaudeAgentOptions.mcp_servers
-takes for one session, from the tool definitions session.start carries on
-its additive `tools` field (T20-S01, docs/claude-sidecar.md's `session.start`
-params table).
-
-I12 is the whole shape of this module: the sidecar owns nothing here. Every
-declared tool gets the exact same forwarding handler (_forward) — there is
-no branch on a tool's name, no local execution of any tool, no cached
-result, and no timeout of this module's own invention: a `tool.call` request
-waits for its reply as long as it takes, by protocol v1 (T15's decision, not
-this slice's — see docs/claude-sidecar.md, "Sidecar to Longshot: requests").
-Description and input schema travel exactly as the definition carried them:
-that dictionary belongs to the Go tool registry (`T20`'s projection), not to
-this module.
-"""
-
-from __future__ import annotations
-
-from collections.abc import Awaitable, Callable
-from typing import Any
-
-# Sends one tool.call request (docs/claude-sidecar.md, "Sidecar to Longshot:
-# requests" -> "tool.call") and returns its result, {"content", "is_error"},
-# once the matching response arrives, keyed by tool_name and arguments alone.
-# session_id, turn_id and tool_id are ambient to whichever call_tool this
-# module is handed (one sidecar serves one session, I03) — the request/
-# response correlation by id belongs to protocol.py, not reinvented here.
-CallTool = Callable[[str, dict[str, Any]], Awaitable[dict[str, Any]]]
-
-# Claude adds this prefix itself, from the MCP server name ("longshot"): a
-# definition arrives as "mcp__longshot__<tool>" and registers on the server
-# under "<tool>" alone.
-_MCP_PREFIX = "mcp__longshot__"
-
-
-def _bare_name(full_name: str) -> str:
-    """The name a tool registers under on the "longshot" MCP server."""
-    return full_name.removeprefix(_MCP_PREFIX)
-
-
-async def _forward(full_name: str, arguments: dict, call_tool: CallTool) -> dict:
-    """Send one tool.call request and return its result. No branching on
-    full_name, no local fallback, no timeout of its own: the request has no
-    deadline by protocol v1, and that is T15's decision, not this slice's.
-    """
-    result = await call_tool(full_name, arguments)
-    return {
-        "content": [{"type": "text", "text": result.get("content", "")}],
-        "is_error": bool(result.get("is_error", False)),
-    }
-
-
-def _build_tool_specs(tool_definitions: list[dict], call_tool: CallTool) -> list[dict]:
-    """One spec per definition, every one sharing _forward as its handler,
-    bound to that definition's own full name (never re-derived, so a name
-    that does not start with the expected prefix still forwards under its
-    real full name). Kept free of any claude-agent-sdk import so this
-    composition step — the whole of what this module decides — stays
-    testable without the SDK installed; build_longshot_server below is the
-    thin, SDK-facing wrapper around it.
-    """
-    specs = []
-    for definition in tool_definitions:
-        full_name = definition["name"]
-
-        async def handler(arguments: dict, _full_name: str = full_name) -> dict:
-            return await _forward(_full_name, arguments, call_tool)
-
-        specs.append(
-            {
-                "name": _bare_name(full_name),
-                "description": definition["description"],
-                "input_schema": definition["input_schema"],
-                "handler": handler,
-            }
-        )
-    return specs
-
-
-def build_longshot_server(tool_definitions: list[dict], call_tool: CallTool) -> object:
-    """Build the in-process "longshot" MCP server from the definitions that
-    arrived on session.start. Every tool gets the same forwarding handler:
-    this process implements none of them (I12). An empty tool_definitions is
-    a normal outcome: the returned server simply declares no tools.
-    """
-    from claude_agent_sdk import create_sdk_mcp_server
-    from claude_agent_sdk import tool as sdk_tool
-
-    specs = _build_tool_specs(tool_definitions, call_tool)
-    sdk_tools = [
-        sdk_tool(spec["name"], spec["description"], spec["input_schema"])(
-            spec["handler"]
-        )
-        for spec in specs
-    ]
-    return create_sdk_mcp_server("longshot", tools=sdk_tools)

package/sidecars/claude/permissions.py

@@ -1,89 +0,0 @@
-"""T21: the sidecar's half of the normalised permission.request round trip.
-
-The sidecar carries no file-access level table
-(docs/tasks/runtime/claude-adapter/tasks/T21-claude-permissions.md,
-"Отображение уровней": "Таблицы уровней в Python нет и быть не должно").
-Every can_use_tool invocation is forwarded to Longshot as one
-permission.request frame and answered by whatever `behavior` Longshot's
-decide() sends back - this module never decides anything itself, it only
-carries the question and translates the answer.
-
-Two things live here, split so the first is testable without
-claude-agent-sdk installed at all (the same property events.py's
-map_message keeps, per its own module docstring):
-
-- the permission.request round trip (request_permission, and resolve
-  re-exported beside it): the correlation itself is protocol.request /
-  protocol.resolve, one registry shared with tool.call, so this module only
-  names the op and lays out its params;
-- make_can_use_tool, which wraps that round trip into the callback shape
-  ClaudeAgentOptions.can_use_tool expects and translates the wire's
-  `behavior`/`message` into the SDK's own PermissionResultAllow /
-  PermissionResultDeny. updated_input is never sent back on the wire and
-  never read from the SDK side either: nobody rewrites a tool call's
-  arguments (T21, "Нормализованный запрос разрешения").
-"""
-
-from __future__ import annotations
-
-from collections.abc import Callable
-from typing import Any
-
-# resolve is re-exported, not redefined: it is half of the primitive this
-# module's docstring names, and it now lives in protocol.py so tool.call
-# shares the one registry with it. Importing it here keeps the name this
-# module has always offered pointing at that one function.
-from protocol import Emit, request, resolve  # noqa: F401
-
-
-async def request_permission(
-    emit: Emit, session_id: str, turn_id: str, tool_name: str, tool_input: Any
-) -> dict:
-    """Sends one permission.request frame and awaits Longshot's decision.
-
-    Longshot answers immediately and always (T21, "Правило отказа по
-    умолчанию": no branch of the rule asks and no branch waits), so the only
-    way this coroutine does not resolve is the channel going away entirely -
-    the same fate as any other in-flight request when that happens, and
-    protocol.fail_pending is where that fate is dealt out.
-    """
-    return await request(
-        emit,
-        "permission.request",
-        {
-            "session_id": session_id,
-            "turn_id": turn_id,
-            "tool_name": tool_name,
-            "input": tool_input,
-        },
-    )
-
-
-def make_can_use_tool(emit: Emit, session_id: str, turn_id_of: Callable[[], str]):
-    """Builds the can_use_tool callback ClaudeAgentOptions takes for one
-    session. turn_id_of is called fresh on every invocation - never captured
-    once - so the frame always names the turn actually in flight; a
-    ToolPermissionContext carries no turn id of its own to read instead.
-
-    claude_agent_sdk's own result types are imported inside the returned
-    callback, not at module level: everything above this function is
-    testable without the package installed at all, and this is the one place
-    in the module that actually needs it.
-    """
-
-    async def handle_permission(tool_name: str, tool_input: Any, context: Any) -> Any:
-        from claude_agent_sdk import PermissionResultAllow, PermissionResultDeny
-
-        result = await request_permission(
-            emit, session_id, turn_id_of(), tool_name, tool_input
-        )
-        if result.get("behavior") == "allow":
-            return PermissionResultAllow()
-        # interrupt is left at its default False: a denied tool call ends
-        # that one call, not the turn it is inside (T21, "Отказ в разрешении
-        # посреди активного turn: turn продолжается").
-        return PermissionResultDeny(
-            message=result.get("message") or f"{tool_name} was refused"
-        )
-
-    return handle_permission