@rarebit-one/harness-kernel 0.11.0-next.1 → 0.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +66 -0
- package/dist/engines/acp.d.ts.map +1 -1
- package/dist/engines/acp.js +34 -19
- package/dist/engines/acp.js.map +1 -1
- package/dist/engines/claudeCode.d.ts +23 -1
- package/dist/engines/claudeCode.d.ts.map +1 -1
- package/dist/engines/claudeCode.js +49 -18
- package/dist/engines/claudeCode.js.map +1 -1
- package/dist/engines/claudeCodeDriver.d.ts +9 -1
- package/dist/engines/claudeCodeDriver.d.ts.map +1 -1
- package/dist/engines/claudeCodeDriver.js +30 -0
- package/dist/engines/claudeCodeDriver.js.map +1 -1
- package/dist/engines/codex.d.ts +7 -1
- package/dist/engines/codex.d.ts.map +1 -1
- package/dist/engines/codex.js +31 -19
- package/dist/engines/codex.js.map +1 -1
- package/dist/engines/codexDriver.d.ts +1 -1
- package/dist/engines/codexDriver.d.ts.map +1 -1
- package/dist/engines/codexDriver.js +6 -0
- package/dist/engines/codexDriver.js.map +1 -1
- package/dist/engines/environment.d.ts +121 -0
- package/dist/engines/environment.d.ts.map +1 -0
- package/dist/engines/environment.js +318 -0
- package/dist/engines/environment.js.map +1 -0
- package/dist/engines/gateway.d.ts +99 -0
- package/dist/engines/gateway.d.ts.map +1 -0
- package/dist/engines/gateway.js +181 -0
- package/dist/engines/gateway.js.map +1 -0
- package/dist/engines/harnessPrompt.d.ts +15 -0
- package/dist/engines/harnessPrompt.d.ts.map +1 -0
- package/dist/engines/harnessPrompt.js +33 -0
- package/dist/engines/harnessPrompt.js.map +1 -0
- package/dist/engines/native.d.ts +15 -0
- package/dist/engines/native.d.ts.map +1 -1
- package/dist/engines/native.js +74 -5
- package/dist/engines/native.js.map +1 -1
- package/dist/engines/types.d.ts +45 -2
- package/dist/engines/types.d.ts.map +1 -1
- package/dist/index.d.ts +3 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -0
- package/dist/index.js.map +1 -1
- package/dist/providers/anthropic.d.ts +3 -1
- package/dist/providers/anthropic.d.ts.map +1 -1
- package/dist/providers/anthropic.js +4 -1
- package/dist/providers/anthropic.js.map +1 -1
- package/dist/providers/index.d.ts +10 -0
- package/dist/providers/index.d.ts.map +1 -1
- package/dist/providers/index.js +3 -3
- package/dist/providers/index.js.map +1 -1
- package/dist/providers/openai.d.ts +3 -1
- package/dist/providers/openai.d.ts.map +1 -1
- package/dist/providers/openai.js +4 -2
- package/dist/providers/openai.js.map +1 -1
- package/dist/providers/openrouter.d.ts +3 -1
- package/dist/providers/openrouter.d.ts.map +1 -1
- package/dist/providers/openrouter.js +4 -2
- package/dist/providers/openrouter.js.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -515,6 +515,72 @@ Behaviour that follows from this, since 0.10.0:
|
|
|
515
515
|
an API key.
|
|
516
516
|
- An ACP agent no longer falls back to the host's provider keys.
|
|
517
517
|
|
|
518
|
+
### Run environment
|
|
519
|
+
|
|
520
|
+
A `RunSpec` may carry an environment that every engine starts from:
|
|
521
|
+
`instructions` (`system`, `agentsMd`), `agentFiles` (nested `AGENTS.md`),
|
|
522
|
+
`skills` (Agent Skills directories) and `sources` (inline input files). Every
|
|
523
|
+
field is optional; a spec with none of them runs exactly as before.
|
|
524
|
+
|
|
525
|
+
The work is split in two. The **caller** puts the workdir half on disk, because
|
|
526
|
+
it owns the tree's lifecycle: it writes before setup and restores before
|
|
527
|
+
diffing, so none of it reaches the change set.
|
|
528
|
+
|
|
529
|
+
```ts
|
|
530
|
+
import { materializeEnvironment } from "@rarebit-one/harness-kernel"
|
|
531
|
+
|
|
532
|
+
const env = await materializeEnvironment(spec) // AGENTS.md, .agents/skills/<name>/, sources
|
|
533
|
+
try {
|
|
534
|
+
await runSetup()
|
|
535
|
+
await engine.run(spec, ctx)
|
|
536
|
+
} finally {
|
|
537
|
+
await env.restore() // merged files back, created files gone; harness edits kept and reported
|
|
538
|
+
}
|
|
539
|
+
```
|
|
540
|
+
|
|
541
|
+
Each **engine** compiles the rest into its own harness:
|
|
542
|
+
|
|
543
|
+
| Engine | `instructions.system` | `instructions.agentsMd` | `skills` |
|
|
544
|
+
|---|---|---|---|
|
|
545
|
+
| native | system prompt | system prompt | index in the system prompt; files on disk |
|
|
546
|
+
| claude-code | `systemPrompt` preset + `append` | `append` (Claude Code does not read `AGENTS.md`) | local plugin in a temp dir |
|
|
547
|
+
| codex | `$CODEX_HOME/AGENTS.md` | the workdir `AGENTS.md` | index in `$CODEX_HOME/AGENTS.md` |
|
|
548
|
+
| ACP | top of the prompt | the workdir `AGENTS.md` | index at the top of the prompt |
|
|
549
|
+
|
|
550
|
+
With an environment, claude-code also loads `settingSources: ["project"]` only,
|
|
551
|
+
so the workspace's `CLAUDE.md` and `.claude/` apply but the host's user
|
|
552
|
+
settings do not. `src/engines/__goldens__/conformance/` pins each engine's
|
|
553
|
+
compiled output for one spec.
|
|
554
|
+
|
|
555
|
+
### Credential gateway
|
|
556
|
+
|
|
557
|
+
`RunSpec.gateway` (`{ baseUrl, runToken, routes? }`) points a run's model calls
|
|
558
|
+
at a host-side gateway that holds the real keys. Every engine sends to
|
|
559
|
+
`routes[provider] ?? <baseUrl>/p/<provider>` with the run token as its key:
|
|
560
|
+
|
|
561
|
+
- native builds its adapters with that base URL (`ProviderSelection.baseURLs`);
|
|
562
|
+
- claude-code, codex and ACP agents get `<PROVIDER>_BASE_URL` plus the token in
|
|
563
|
+
place of `<PROVIDER>_API_KEY` (and `CODEX_API_KEY` for codex).
|
|
564
|
+
|
|
565
|
+
Through a gateway, no raw credential reaches a harness: the run's BYO keys and
|
|
566
|
+
the host's env keys are both dropped, and the host's `ANTHROPIC_*`, `OPENAI_*`
|
|
567
|
+
and `OPENROUTER_*` settings are not inherited, so nothing can route around it.
|
|
568
|
+
A malformed gateway fails `supports()` rather than being ignored.
|
|
569
|
+
|
|
570
|
+
Independently of the gateway, every engine refuses a run whose `isolation` is
|
|
571
|
+
`vm` when it holds raw model credentials (a `provider.credentials` slot, or the
|
|
572
|
+
host key that engine would fall back to). A microVM run reaches models through a
|
|
573
|
+
gateway or not at all. The private (local-inference) native path gets the same
|
|
574
|
+
checks.
|
|
575
|
+
|
|
576
|
+
A `vm` run is also refused when it holds **exposed** credentials, which no
|
|
577
|
+
gateway can inject and which therefore reach the guest in the clear: non-empty
|
|
578
|
+
`secrets`, or a connector credential the harness carries itself (`auth.token`,
|
|
579
|
+
or `headers` / `env` values on a caller's connector shape). A connector whose
|
|
580
|
+
token is the gateway's run token is routed, not exposed. The caller's policy can
|
|
581
|
+
lift this with `RunSpec.exposedCredentials: "allowed"`; absent, it refuses.
|
|
582
|
+
Below `vm` nothing changes.
|
|
583
|
+
|
|
518
584
|
### The kernel defines no domain tools
|
|
519
585
|
|
|
520
586
|
`primitiveTools()` is strictly generic — sandboxed shell/file/HTTP access. Tools
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"acp.d.ts","sourceRoot":"","sources":["../../src/engines/acp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;
|
|
1
|
+
{"version":3,"file":"acp.d.ts","sourceRoot":"","sources":["../../src/engines/acp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAWlG;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAAA;IAC7B,oFAAoF;IACpF,GAAG,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChD;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAA;IACX,oFAAoF;IACpF,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kFAAkF;IAClF,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B,oFAAoF;IACpF,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,0EAA0E;IAC1E,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB;8DAC0D;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB;AAED,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,UAAU,CAAC,CAAA;AAE1F;;;;;;;;;;;;;;GAcG;AACH,qBAAa,SAAU,YAAW,WAAW;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAc;IACpC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAC/C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC;;;;OAIG;gBAED,KAAK,EAAE,YAAY,EACnB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,GAAE,SAA4B;IAQrC,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa;IAwBhC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;CAwGpE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,CAa7D;AA8BD;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,EAAE,YAgBvB,CAAA"}
|
package/dist/engines/acp.js
CHANGED
|
@@ -7,6 +7,9 @@ import { CAPABILITY_SERVER_NAME } from "./capabilityMcp.js";
|
|
|
7
7
|
import { connectorServers } from "./connectorMcp.js";
|
|
8
8
|
import { readEmissions } from "./capabilityEmissions.js";
|
|
9
9
|
import { defaultAcpDriver } from "./acpDriver.js";
|
|
10
|
+
import { harnessPrompt } from "./harnessPrompt.js";
|
|
11
|
+
import { environmentInstructions } from "./environment.js";
|
|
12
|
+
import { gatewayEnv, refuseBadGateway, refuseCredentialsInVm, withoutShadowed } from "./gateway.js";
|
|
10
13
|
const LOG_TRUNCATE = 2000;
|
|
11
14
|
/**
|
|
12
15
|
* Drives a run with any ACP-speaking coding agent (Claude Code, Codex, eve, …)
|
|
@@ -55,7 +58,11 @@ export class AcpEngine {
|
|
|
55
58
|
reason: `${this.name} engine requires the ephemeral runner profile (per-run container isolation)`,
|
|
56
59
|
};
|
|
57
60
|
}
|
|
58
|
-
|
|
61
|
+
// An ACP agent gets only the run's keys (never the host's), so only the
|
|
62
|
+
// payload's credentials count as raw here.
|
|
63
|
+
return (refuseUnisolated(this.name, spec) ??
|
|
64
|
+
refuseBadGateway(this.name, spec) ??
|
|
65
|
+
refuseCredentialsInVm(this.name, spec) ?? { ok: true });
|
|
59
66
|
}
|
|
60
67
|
async run(spec, ctx) {
|
|
61
68
|
// Emissions land OUTSIDE the sandbox so the bookkeeping file is never captured
|
|
@@ -82,13 +89,31 @@ export class AcpEngine {
|
|
|
82
89
|
args: this.agent.args(spec),
|
|
83
90
|
// The capability env also rides on the process env so the stdio capability
|
|
84
91
|
// server inherits it regardless of how the agent forwards `session/new` env.
|
|
85
|
-
|
|
92
|
+
//
|
|
93
|
+
// Through a gateway, the agent's own env is built from a spec with NO
|
|
94
|
+
// credentials (so an agent spec that copies keys copies none), every
|
|
95
|
+
// provider is pointed at its gateway route with the run token, and the
|
|
96
|
+
// provider prefixes are no longer inherited from the host.
|
|
97
|
+
env: spec.gateway
|
|
98
|
+
? {
|
|
99
|
+
...this.agent.env(withoutCredentials(spec)),
|
|
100
|
+
...gatewayEnv(spec.gateway),
|
|
101
|
+
...capabilityEnv,
|
|
102
|
+
}
|
|
103
|
+
: { ...this.agent.env(spec), ...capabilityEnv },
|
|
86
104
|
...(this.agent.inheritEnvPrefixes
|
|
87
|
-
? {
|
|
105
|
+
? {
|
|
106
|
+
inheritEnvPrefixes: spec.gateway
|
|
107
|
+
? withoutShadowed(this.agent.inheritEnvPrefixes)
|
|
108
|
+
: this.agent.inheritEnvPrefixes,
|
|
109
|
+
}
|
|
88
110
|
: {}),
|
|
89
111
|
cwd: spec.workdir,
|
|
90
112
|
mcpServers: toAcpMcpServers(servers),
|
|
91
|
-
prompt
|
|
113
|
+
// ACP's session/new has no system-prompt field, so the environment's
|
|
114
|
+
// system instructions and skills index lead the task prompt; the agent
|
|
115
|
+
// reads the workdir's AGENTS.md (materialized by the caller) itself.
|
|
116
|
+
prompt: harnessPrompt(spec, environmentInstructions(spec, { agentsMd: false, skillsIndex: true })),
|
|
92
117
|
...(spec.limits?.maxDurationMs !== undefined
|
|
93
118
|
? { maxDurationMs: spec.limits.maxDurationMs }
|
|
94
119
|
: {}),
|
|
@@ -181,21 +206,6 @@ function toAcpMcpServers(servers) {
|
|
|
181
206
|
};
|
|
182
207
|
});
|
|
183
208
|
}
|
|
184
|
-
function buildPrompt(spec) {
|
|
185
|
-
const inputs = JSON.stringify(spec.inputs ?? {}, null, 2);
|
|
186
|
-
return [
|
|
187
|
-
spec.workflow.prompt ?? `Execute the "${spec.workflow.name ?? spec.workflowPath}" workflow.`,
|
|
188
|
-
"",
|
|
189
|
-
"## Inputs",
|
|
190
|
-
"```json",
|
|
191
|
-
inputs,
|
|
192
|
-
"```",
|
|
193
|
-
"",
|
|
194
|
-
"You are running as an autonomous workflow. The current working directory is the",
|
|
195
|
-
"workspace — inspect and edit its files directly with your tools. When finished,",
|
|
196
|
-
"reply with the workflow's output as Markdown.",
|
|
197
|
-
].join("\n");
|
|
198
|
-
}
|
|
199
209
|
function truncate(text, max) {
|
|
200
210
|
return text.length <= max ? text : `${text.slice(0, max)}…`;
|
|
201
211
|
}
|
|
@@ -227,4 +237,9 @@ export const EVE_AGENT = {
|
|
|
227
237
|
return env;
|
|
228
238
|
},
|
|
229
239
|
};
|
|
240
|
+
/** The spec as an agent sees it through a gateway: its provider with no keys. */
|
|
241
|
+
function withoutCredentials(spec) {
|
|
242
|
+
const { credentials: _dropped, ...provider } = spec.provider;
|
|
243
|
+
return { ...spec, provider };
|
|
244
|
+
}
|
|
230
245
|
//# sourceMappingURL=acp.js.map
|
package/dist/engines/acp.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"acp.js","sourceRoot":"","sources":["../../src/engines/acp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,IAAI,MAAM,WAAW,CAAA;AAK5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAA8B,MAAM,mBAAmB,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;
|
|
1
|
+
{"version":3,"file":"acp.js","sourceRoot":"","sources":["../../src/engines/acp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,IAAI,MAAM,WAAW,CAAA;AAK5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAA8B,MAAM,mBAAmB,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnG,MAAM,YAAY,GAAG,IAAI,CAAA;AAsFzB;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,SAAS;IACX,IAAI,CAAQ;IAEJ,KAAK,CAAc;IACnB,sBAAsB,CAAQ;IAC9B,KAAK,CAAW;IAEjC;;;;OAIG;IACH,YACE,KAAmB,EACnB,sBAA8B,EAC9B,QAAmB,gBAAgB;QAEnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;QACtB,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAA;QACpD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED,QAAQ,CAAC,IAAa;QACpB,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACjD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;YAC9C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,4BAA4B,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK;aAC1E,CAAA;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK,WAAW,EAAE,CAAC;YAClD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,6EAA6E;aAClG,CAAA;QACH,CAAC;QACD,wEAAwE;QACxE,2CAA2C;QAC3C,OAAO,CACL,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;YACjC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;YACjC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CACvD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAa,EAAE,GAAkB;QACzC,+EAA+E;QAC/E,iFAAiF;QACjF,iCAAiC;QACjC,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAA;QAC/D,MAAM,aAAa,GAA2B;YAC5C,oBAAoB,EAAE,IAAI,CAAC,WAAW;YACtC,eAAe,EAAE,IAAI,CAAC,OAAO;YAC7B,sBAAsB,EAAE,aAAa;SACtC,CAAA;QACD,MAAM,OAAO,GAA0C;YACrD,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,CAAC,sBAAsB,CAAC,EAAE;gBACxB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO,CAAC,QAAQ;gBACzB,IAAI,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC;gBACnC,GAAG,EAAE,aAAa;aACnB;SACF,CAAA;QAED,MAAM,OAAO,GAAe;YAC1B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YAC3B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,2EAA2E;YAC3E,6EAA6E;YAC7E,EAAE;YACF,sEAAsE;YACtE,qEAAqE;YACrE,uEAAuE;YACvE,2DAA2D;YAC3D,GAAG,EAAE,IAAI,CAAC,OAAO;gBACf,CAAC,CAAC;oBACE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;oBAC3C,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;oBAC3B,GAAG,aAAa;iBACjB;gBACH,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,aAAa,EAAE;YACjD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB;gBAC/B,CAAC,CAAC;oBACE,kBAAkB,EAAE,IAAI,CAAC,OAAO;wBAC9B,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;wBAChD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB;iBAClC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC;YACpC,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,EAAE,aAAa,CACnB,IAAI,EACJ,uBAAuB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACtE;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAA;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,0BAA0B,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QAE7D,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,OAAmB,CAAA;QACvB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAClC,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE;oBACzB,IAAI,IAAI;wBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC7B,CAAC;gBACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;oBACd,IAAI,IAAI;wBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;gBACpE,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6EAA6E;YAC7E,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;gBAAE,MAAM,GAAG,CAAA;YACnC,OAAO,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAA;QAC5D,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YAC5D,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,cAAc,OAAO,CAAC,UAAU,GAAG,CAAC,CAAA;QAC1D,CAAC;QAED,0EAA0E;QAC1E,+EAA+E;QAC/E,+EAA+E;QAC/E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAClD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EACV,GAAG,EAAE,CAAC,SAAS,CAChB,CAAA;QACD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAA;QACpD,GAAG,CAAC,GAAG,CACL,GAAG,IAAI,CAAC,IAAI,iCAAiC,aAAa,CAAC,CAAC,CAAC,YAAY,aAAa,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/G,GAAG,aAAa,IAAI,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CACtE,CAAA;QACD,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAExD,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,aAAa;YAC7C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC;SAChC,CAAA;IACH,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,OAAmB;IAC/C,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU;QAAE,OAAO,WAAW,CAAA;IACxD,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAA;IACrD,QAAQ,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3B,KAAK,WAAW;YACd,OAAO,UAAU,CAAA;QACnB,KAAK,mBAAmB;YACtB,OAAO,iBAAiB,CAAA;QAC1B,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAA;QACjB;YACE,OAAO,WAAW,CAAA;IACtB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,OAA8C;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;QACpD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO;gBACL,IAAI;gBACJ,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;gBACvB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;aACpF,CAAA;QACH,CAAC;QACD,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;SAC5F,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW;IACzC,OAAO,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAA;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAiB;IACrC,IAAI,EAAE,KAAK;IACX,SAAS,EAAE,mBAAmB;IAC9B,OAAO,EAAE,KAAK;IACd,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC;IACnB,yEAAyE;IACzE,2BAA2B;IAC3B,kBAAkB,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC;IACpE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,GAAG,GAA2B,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAA;QACvC,IAAI,KAAK,EAAE,SAAS;YAAE,GAAG,CAAC,iBAAiB,GAAG,KAAK,CAAC,SAAS,CAAA;QAC7D,IAAI,KAAK,EAAE,MAAM;YAAE,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,MAAM,CAAA;QACpD,IAAI,KAAK,EAAE,UAAU;YAAE,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC,UAAU,CAAA;QAChE,OAAO,GAAG,CAAA;IACZ,CAAC;CACF,CAAA;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,IAAa;IACvC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;IAC5D,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC"}
|
|
@@ -14,8 +14,14 @@ export interface ClaudeCodeOptions {
|
|
|
14
14
|
cwd: string;
|
|
15
15
|
/** Model id (resolved: per-run model, else the engine default). */
|
|
16
16
|
model: string;
|
|
17
|
-
/** API key (per-org BYO, else the runner env key). */
|
|
17
|
+
/** API key (per-org BYO, else the runner env key). Never set when the run has a gateway. */
|
|
18
18
|
apiKey?: string;
|
|
19
|
+
/**
|
|
20
|
+
* The gateway env (base URL + run token) when the run has a credential
|
|
21
|
+
* gateway: the driver sets it INSTEAD of any key, and stops inheriting the
|
|
22
|
+
* host's `ANTHROPIC_*` settings so nothing can route around it.
|
|
23
|
+
*/
|
|
24
|
+
gatewayEnv?: Record<string, string>;
|
|
19
25
|
/** Tool allowlist; undefined means the harness's defaults. */
|
|
20
26
|
allowedTools?: string[];
|
|
21
27
|
/** Wall-clock budget in ms; undefined means no engine-imposed limit. */
|
|
@@ -28,6 +34,20 @@ export interface ClaudeCodeOptions {
|
|
|
28
34
|
connectors?: ConnectorConfig[];
|
|
29
35
|
/** The caller's cancel; the driver merges it with its own `maxDurationMs` timer. */
|
|
30
36
|
signal?: AbortSignal;
|
|
37
|
+
/**
|
|
38
|
+
* Appended to Claude Code's own system prompt: the run's environment
|
|
39
|
+
* instructions (and its `AGENTS.md` text, which Claude Code does not read).
|
|
40
|
+
* Set only when the run has an environment.
|
|
41
|
+
*/
|
|
42
|
+
systemPromptAppend?: string;
|
|
43
|
+
/**
|
|
44
|
+
* Which on-disk settings Claude Code loads. Set to `["project"]` only when
|
|
45
|
+
* the run has an environment, so the workspace's own `CLAUDE.md` and
|
|
46
|
+
* `.claude/` apply but the host's user settings do not.
|
|
47
|
+
*/
|
|
48
|
+
settingSources?: Array<"user" | "project" | "local">;
|
|
49
|
+
/** Local plugin directories to load: the run's skills. Outside the workdir. */
|
|
50
|
+
pluginDirs?: string[];
|
|
31
51
|
}
|
|
32
52
|
/** A normalized message from the harness (driver-agnostic). */
|
|
33
53
|
export type ClaudeCodeMessage = {
|
|
@@ -78,4 +98,6 @@ export declare class ClaudeCodeEngine implements AgentEngine {
|
|
|
78
98
|
supports(spec: RunSpec): EngineSupport;
|
|
79
99
|
run(spec: RunSpec, ctx: EngineContext): Promise<EngineResult>;
|
|
80
100
|
}
|
|
101
|
+
/** The plugin the run's skills are mounted as. Brand-neutral by construction. */
|
|
102
|
+
export declare const SKILLS_PLUGIN_NAME = "run-skills";
|
|
81
103
|
//# sourceMappingURL=claudeCode.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"claudeCode.d.ts","sourceRoot":"","sources":["../../src/engines/claudeCode.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAElG,OAAO,EAAuB,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;
|
|
1
|
+
{"version":3,"file":"claudeCode.d.ts","sourceRoot":"","sources":["../../src/engines/claudeCode.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAElG,OAAO,EAAuB,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAQlG;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAA;IACX,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAA;IACb,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;sFACkF;IAClF,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAA;IAC3B;gFAC4E;IAC5E,UAAU,CAAC,EAAE,eAAe,EAAE,CAAA;IAC9B,oFAAoF;IACpF,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,CAAA;IACpD,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,+DAA+D;AAC/D,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;IAChB;8DAC0D;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB,CAAA;AAEL;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,iBAAiB,KAAK,aAAa,CAAC,iBAAiB,CAAC,CAAA;AAK5F;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,iBAAiB,KAAK,cAAc,EAAE,CAAA;AAEhF,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,EAAE,qBAA2D,CAAA;AAEhG;;;;;;;;;;;;GAYG;AACH,qBAAa,gBAAiB,YAAW,WAAW;IAClD,QAAQ,CAAC,IAAI,iBAAgB;IAE7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuB;gBAGrD,KAAK,GAAE,gBAA0C,EACjD,eAAe,GAAE,qBAA8C;IAMjE,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa;IAuBhC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;CAuFpE;AAMD,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,eAAe,CAAA"}
|
|
@@ -3,6 +3,12 @@ import { refuseUnisolated } from "./isolation.js";
|
|
|
3
3
|
import { harnessOutcome } from "../signals.js";
|
|
4
4
|
import { defaultClaudeCodeDriver } from "./claudeCodeDriver.js";
|
|
5
5
|
import { writeFileCapability } from "./capability.js";
|
|
6
|
+
import { harnessPrompt } from "./harnessPrompt.js";
|
|
7
|
+
import { environmentInstructions, hasEnvironment, writeSkills } from "./environment.js";
|
|
8
|
+
import { gatewayEnv, refuseBadGateway, refuseCredentialsInVm } from "./gateway.js";
|
|
9
|
+
import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
|
|
10
|
+
import { tmpdir } from "node:os";
|
|
11
|
+
import path from "node:path";
|
|
6
12
|
const DEFAULT_MODEL = "claude-opus-4-8";
|
|
7
13
|
const LOG_TRUNCATE = 2000;
|
|
8
14
|
/** The kernel's default surface: the one capability that carries no product semantics. */
|
|
@@ -44,10 +50,16 @@ export class ClaudeCodeEngine {
|
|
|
44
50
|
reason: "claude-code engine requires the ephemeral runner profile (per-run container isolation)",
|
|
45
51
|
};
|
|
46
52
|
}
|
|
47
|
-
return refuseUnisolated("claude-code", spec) ??
|
|
53
|
+
return (refuseUnisolated("claude-code", spec) ??
|
|
54
|
+
refuseBadGateway("claude-code", spec) ??
|
|
55
|
+
refuseCredentialsInVm("claude-code", spec, ["ANTHROPIC_API_KEY"]) ?? { ok: true });
|
|
48
56
|
}
|
|
49
57
|
async run(spec, ctx) {
|
|
50
|
-
|
|
58
|
+
// With a gateway the harness holds the run token and nothing else: no BYO
|
|
59
|
+
// key, and no fallback to the host's own.
|
|
60
|
+
const apiKey = spec.gateway
|
|
61
|
+
? undefined
|
|
62
|
+
: (spec.provider.credentials?.anthropic ?? process.env.ANTHROPIC_API_KEY);
|
|
51
63
|
const model = spec.provider.model || DEFAULT_MODEL;
|
|
52
64
|
const allowedTools = Array.isArray(spec.permissions.tools) && spec.permissions.tools.length > 0
|
|
53
65
|
? spec.permissions.tools
|
|
@@ -60,18 +72,36 @@ export class ClaudeCodeEngine {
|
|
|
60
72
|
workdir: spec.workdir,
|
|
61
73
|
});
|
|
62
74
|
const options = {
|
|
63
|
-
prompt:
|
|
75
|
+
prompt: harnessPrompt(spec),
|
|
64
76
|
cwd: spec.workdir,
|
|
65
77
|
model,
|
|
66
78
|
mcpTools,
|
|
67
79
|
...(spec.connectors.length > 0 ? { connectors: spec.connectors } : {}),
|
|
68
80
|
...(apiKey ? { apiKey } : {}),
|
|
81
|
+
...(spec.gateway ? { gatewayEnv: gatewayEnv(spec.gateway, ["anthropic"]) } : {}),
|
|
69
82
|
...(allowedTools ? { allowedTools } : {}),
|
|
70
83
|
...(spec.limits?.maxDurationMs !== undefined
|
|
71
84
|
? { maxDurationMs: spec.limits.maxDurationMs }
|
|
72
85
|
: {}),
|
|
73
86
|
...(ctx.signal ? { signal: ctx.signal } : {}),
|
|
74
87
|
};
|
|
88
|
+
// The environment, compiled for Claude Code: instructions on its system
|
|
89
|
+
// prompt and skills as a local plugin in a transient dir OUTSIDE the
|
|
90
|
+
// sandbox, so neither can reach the change set. Nothing when the run has
|
|
91
|
+
// no environment: the options are exactly what they always were.
|
|
92
|
+
let pluginRoot;
|
|
93
|
+
if (hasEnvironment(spec)) {
|
|
94
|
+
options.settingSources = ["project"];
|
|
95
|
+
const append = environmentInstructions(spec, { agentsMd: true, skillsIndex: false });
|
|
96
|
+
if (append)
|
|
97
|
+
options.systemPromptAppend = append;
|
|
98
|
+
if (spec.skills && spec.skills.length > 0) {
|
|
99
|
+
pluginRoot = await mkdtemp(path.join(tmpdir(), "harness-skills-"));
|
|
100
|
+
await writeSkillsPlugin(pluginRoot, spec);
|
|
101
|
+
options.pluginDirs = [pluginRoot];
|
|
102
|
+
ctx.log(`claude-code: ${spec.skills.length} skill(s) mounted as a local plugin`);
|
|
103
|
+
}
|
|
104
|
+
}
|
|
75
105
|
ctx.log(`claude-code: driving model ${model} in ${spec.workdir}`);
|
|
76
106
|
let finalText = "";
|
|
77
107
|
let lastAssistantText = "";
|
|
@@ -101,6 +131,10 @@ export class ClaudeCodeEngine {
|
|
|
101
131
|
outcome = "canceled";
|
|
102
132
|
ctx.log("claude-code: stopped (canceled)");
|
|
103
133
|
}
|
|
134
|
+
finally {
|
|
135
|
+
if (pluginRoot)
|
|
136
|
+
await rm(pluginRoot, { recursive: true, force: true });
|
|
137
|
+
}
|
|
104
138
|
const stopped = outcome === "canceled" || outcome === "timed_out";
|
|
105
139
|
return {
|
|
106
140
|
text: finalText || (stopped ? lastAssistantText : "") || "(no output)",
|
|
@@ -108,22 +142,19 @@ export class ClaudeCodeEngine {
|
|
|
108
142
|
};
|
|
109
143
|
}
|
|
110
144
|
}
|
|
111
|
-
function buildPrompt(spec) {
|
|
112
|
-
const inputs = JSON.stringify(spec.inputs ?? {}, null, 2);
|
|
113
|
-
return [
|
|
114
|
-
spec.workflow.prompt ?? `Execute the "${spec.workflow.name ?? spec.workflowPath}" workflow.`,
|
|
115
|
-
"",
|
|
116
|
-
"## Inputs",
|
|
117
|
-
"```json",
|
|
118
|
-
inputs,
|
|
119
|
-
"```",
|
|
120
|
-
"",
|
|
121
|
-
"You are running as an autonomous workflow. The current working directory is the",
|
|
122
|
-
"workspace — inspect and edit its files directly with your tools. When finished,",
|
|
123
|
-
"reply with the workflow's output as Markdown.",
|
|
124
|
-
].join("\n");
|
|
125
|
-
}
|
|
126
145
|
function truncate(text, max) {
|
|
127
146
|
return text.length <= max ? text : `${text.slice(0, max)}…`;
|
|
128
147
|
}
|
|
148
|
+
/** The plugin the run's skills are mounted as. Brand-neutral by construction. */
|
|
149
|
+
export const SKILLS_PLUGIN_NAME = "run-skills";
|
|
150
|
+
/**
|
|
151
|
+
* A minimal local plugin holding the run's skills: a manifest plus
|
|
152
|
+
* `skills/<name>/…`, which Claude Code discovers like any plugin's skills.
|
|
153
|
+
*/
|
|
154
|
+
async function writeSkillsPlugin(root, spec) {
|
|
155
|
+
const manifestDir = path.join(root, ".claude-plugin");
|
|
156
|
+
await writeSkills(path.join(root, "skills"), spec.skills ?? []);
|
|
157
|
+
await mkdir(manifestDir, { recursive: true });
|
|
158
|
+
await writeFile(path.join(manifestDir, "plugin.json"), `${JSON.stringify({ name: SKILLS_PLUGIN_NAME, description: "Skills for this run" }, null, 2)}\n`);
|
|
159
|
+
}
|
|
129
160
|
//# sourceMappingURL=claudeCode.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"claudeCode.js","sourceRoot":"","sources":["../../src/engines/claudeCode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EAAE,cAAc,EAAkB,MAAM,eAAe,CAAA;AAG9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAA+C,MAAM,iBAAiB,CAAA;
|
|
1
|
+
{"version":3,"file":"claudeCode.js","sourceRoot":"","sources":["../../src/engines/claudeCode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EAAE,cAAc,EAAkB,MAAM,eAAe,CAAA;AAG9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAA+C,MAAM,iBAAiB,CAAA;AAClG,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACvF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAClF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,IAAI,MAAM,WAAW,CAAA;AAqE5B,MAAM,aAAa,GAAG,iBAAiB,CAAA;AACvC,MAAM,YAAY,GAAG,IAAI,CAAA;AAWzB,0FAA0F;AAC1F,MAAM,CAAC,MAAM,sBAAsB,GAA0B,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAA;AAEhG;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAG,aAAa,CAAA;IAEZ,KAAK,CAAkB;IACvB,eAAe,CAAuB;IAEvD,YACE,QAA0B,uBAAuB,EACjD,kBAAyC,sBAAsB;QAE/D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAA;IACxC,CAAC;IAED,QAAQ,CAAC,IAAa;QACpB,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;QACrD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,EAAE,CAAC;YAClD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kEAAkE;aAC3E,CAAA;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK,WAAW,EAAE,CAAC;YAClD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,wFAAwF;aAC3F,CAAA;QACH,CAAC;QACD,OAAO,CACL,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC;YACrC,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC;YACrC,qBAAqB,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAClF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAa,EAAE,GAAkB;QACzC,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO;YACzB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAA;QAClD,MAAM,YAAY,GAChB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACxE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK;YACxB,CAAC,CAAC,SAAS,CAAA;QAEf,qEAAqE;QACrE,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;YACpC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAA;QAEF,MAAM,OAAO,GAAsB;YACjC,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC;YAC3B,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,KAAK;YACL,QAAQ;YACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAA;QAED,wEAAwE;QACxE,qEAAqE;QACrE,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,UAA8B,CAAA;QAClC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,cAAc,GAAG,CAAC,SAAS,CAAC,CAAA;YACpC,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACpF,IAAI,MAAM;gBAAE,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAA;YAC/C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAA;gBAClE,MAAM,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;gBACzC,OAAO,CAAC,UAAU,GAAG,CAAC,UAAU,CAAC,CAAA;gBACjC,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,MAAM,CAAC,MAAM,qCAAqC,CAAC,CAAA;YAClF,CAAC;QACH,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,8BAA8B,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QAEjE,IAAI,SAAS,GAAG,EAAE,CAAA;QAClB,IAAI,iBAAiB,GAAG,EAAE,CAAA;QAC1B,IAAI,OAAO,GAAe,WAAW,CAAA;QAErC,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBACjC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;wBACjB,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAA;wBAChC,GAAG,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;oBACjE,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,SAAS,GAAG,OAAO,CAAC,IAAI,CAAA;oBACxB,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;oBAC5D,IAAI,OAAO,CAAC,SAAS;wBAAE,GAAG,CAAC,GAAG,CAAC,yBAAyB,OAAO,GAAG,CAAC,CAAA;yBAC9D,IAAI,OAAO,CAAC,OAAO;wBAAE,GAAG,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAA;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6EAA6E;YAC7E,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;gBAAE,MAAM,GAAG,CAAA;YACnC,OAAO,GAAG,UAAU,CAAA;YACpB,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;QAC5C,CAAC;gBAAS,CAAC;YACT,IAAI,UAAU;gBAAE,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACxE,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,WAAW,CAAA;QACjE,OAAO;YACL,IAAI,EAAE,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,aAAa;YACtE,OAAO;SACR,CAAA;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW;IACzC,OAAO,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAA;AAC7D,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAA;AAE9C;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAa;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAA;IACrD,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC/D,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,EACrC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACjG,CAAA;AACH,CAAC"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { Options } from "@anthropic-ai/claude-agent-sdk";
|
|
1
2
|
import { type StoppedBy } from "../signals.js";
|
|
2
3
|
import type { ClaudeCodeMessage, ClaudeCodeOptions } from "./claudeCode.js";
|
|
3
4
|
/**
|
|
@@ -12,6 +13,13 @@ import type { ClaudeCodeMessage, ClaudeCodeOptions } from "./claudeCode.js";
|
|
|
12
13
|
* not an interactive human, is the safety boundary.
|
|
13
14
|
*/
|
|
14
15
|
export declare function defaultClaudeCodeDriver(opts: ClaudeCodeOptions): AsyncIterable<ClaudeCodeMessage>;
|
|
16
|
+
/**
|
|
17
|
+
* The SDK options a run's environment adds: an appended system prompt, the
|
|
18
|
+
* settings sources, and the skills plugin. Empty when the engine set none of
|
|
19
|
+
* them, so a run without an environment builds exactly the options it always
|
|
20
|
+
* did.
|
|
21
|
+
*/
|
|
22
|
+
export declare function environmentSdkOptions(opts: Pick<ClaudeCodeOptions, "systemPromptAppend" | "settingSources" | "pluginDirs">): Pick<Options, "systemPrompt" | "settingSources" | "plugins">;
|
|
15
23
|
/**
|
|
16
24
|
* The CLI's environment: an allowlist, never the host's whole one. The CLI runs
|
|
17
25
|
* arbitrary bash, so anything the host process holds (its own credentials,
|
|
@@ -19,7 +27,7 @@ export declare function defaultClaudeCodeDriver(opts: ClaudeCodeOptions): AsyncI
|
|
|
19
27
|
* back ends that read `AWS_*`/`GOOGLE_*` (Bedrock, Vertex) are not reached
|
|
20
28
|
* through this engine.
|
|
21
29
|
*/
|
|
22
|
-
export declare function claudeCodeEnv(opts: Pick<ClaudeCodeOptions, "apiKey">, env?: NodeJS.ProcessEnv): Record<string, string>;
|
|
30
|
+
export declare function claudeCodeEnv(opts: Pick<ClaudeCodeOptions, "apiKey" | "gatewayEnv">, env?: NodeJS.ProcessEnv): Record<string, string>;
|
|
23
31
|
type ResultMessage = Extract<ClaudeCodeMessage, {
|
|
24
32
|
kind: "result";
|
|
25
33
|
}>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"claudeCodeDriver.d.ts","sourceRoot":"","sources":["../../src/engines/claudeCodeDriver.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"claudeCodeDriver.d.ts","sourceRoot":"","sources":["../../src/engines/claudeCodeDriver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,OAAO,EAAc,MAAM,gCAAgC,CAAA;AAC1F,OAAO,EAAW,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAM3E;;;;;;;;;;GAUG;AACH,wBAAuB,uBAAuB,CAC5C,IAAI,EAAE,iBAAiB,GACtB,aAAa,CAAC,iBAAiB,CAAC,CAmElC;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,GAAG,gBAAgB,GAAG,YAAY,CAAC,GACpF,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAAC,CAgB9D;AAKD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,YAAY,CAAC,EACtD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED,KAAK,aAAa,GAAG,OAAO,CAAC,iBAAiB,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CAAA;AAEnE;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,aAAa,GAAG,SAAS,EAC/B,SAAS,EAAE,SAAS,GAAG,SAAS,GAC/B,aAAa,GAAG,SAAS,CAG3B"}
|
|
@@ -2,6 +2,7 @@ import { runStop } from "../signals.js";
|
|
|
2
2
|
import { CAPABILITY_SERVER_NAME, capabilitySdkServer, capabilityToolIds } from "./capabilityMcp.js";
|
|
3
3
|
import { connectorServers } from "./connectorMcp.js";
|
|
4
4
|
import { childEnv } from "./isolation.js";
|
|
5
|
+
import { withoutShadowed } from "./gateway.js";
|
|
5
6
|
/**
|
|
6
7
|
* The default Claude Code driver: runs the Anthropic Agent SDK's `query()` (which
|
|
7
8
|
* spawns the Claude Code CLI) against the prepared workdir and normalizes its
|
|
@@ -55,6 +56,7 @@ export async function* defaultClaudeCodeDriver(opts) {
|
|
|
55
56
|
env: claudeCodeEnv(opts),
|
|
56
57
|
...(hasMcpServers ? { mcpServers } : {}),
|
|
57
58
|
...(allowedTools ? { allowedTools } : {}),
|
|
59
|
+
...environmentSdkOptions(opts),
|
|
58
60
|
};
|
|
59
61
|
// The stream's last result: a stop after a clean one must not relabel a run
|
|
60
62
|
// that had already finished, and one after an error result keeps its text.
|
|
@@ -82,6 +84,29 @@ export async function* defaultClaudeCodeDriver(opts) {
|
|
|
82
84
|
if (stopped)
|
|
83
85
|
yield stopped;
|
|
84
86
|
}
|
|
87
|
+
/**
|
|
88
|
+
* The SDK options a run's environment adds: an appended system prompt, the
|
|
89
|
+
* settings sources, and the skills plugin. Empty when the engine set none of
|
|
90
|
+
* them, so a run without an environment builds exactly the options it always
|
|
91
|
+
* did.
|
|
92
|
+
*/
|
|
93
|
+
export function environmentSdkOptions(opts) {
|
|
94
|
+
return {
|
|
95
|
+
...(opts.systemPromptAppend
|
|
96
|
+
? {
|
|
97
|
+
systemPrompt: {
|
|
98
|
+
type: "preset",
|
|
99
|
+
preset: "claude_code",
|
|
100
|
+
append: opts.systemPromptAppend,
|
|
101
|
+
},
|
|
102
|
+
}
|
|
103
|
+
: {}),
|
|
104
|
+
...(opts.settingSources ? { settingSources: opts.settingSources } : {}),
|
|
105
|
+
...(opts.pluginDirs && opts.pluginDirs.length > 0
|
|
106
|
+
? { plugins: opts.pluginDirs.map((dir) => ({ type: "local", path: dir })) }
|
|
107
|
+
: {}),
|
|
108
|
+
};
|
|
109
|
+
}
|
|
85
110
|
/** Host env the Claude Code CLI may inherit: its own and its provider's settings. */
|
|
86
111
|
const CLAUDE_ENV_PREFIXES = ["ANTHROPIC_", "CLAUDE_"];
|
|
87
112
|
/**
|
|
@@ -92,6 +117,11 @@ const CLAUDE_ENV_PREFIXES = ["ANTHROPIC_", "CLAUDE_"];
|
|
|
92
117
|
* through this engine.
|
|
93
118
|
*/
|
|
94
119
|
export function claudeCodeEnv(opts, env = process.env) {
|
|
120
|
+
// Through a gateway: the run token and route only. Even a stray `apiKey`
|
|
121
|
+
// is dropped, and the host's ANTHROPIC_* settings are not inherited.
|
|
122
|
+
if (opts.gatewayEnv) {
|
|
123
|
+
return childEnv(withoutShadowed(CLAUDE_ENV_PREFIXES), opts.gatewayEnv, env);
|
|
124
|
+
}
|
|
95
125
|
return childEnv(CLAUDE_ENV_PREFIXES, opts.apiKey ? { ANTHROPIC_API_KEY: opts.apiKey } : {}, env);
|
|
96
126
|
}
|
|
97
127
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"claudeCodeDriver.js","sourceRoot":"","sources":["../../src/engines/claudeCodeDriver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAkB,MAAM,eAAe,CAAA;AAEvD,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;
|
|
1
|
+
{"version":3,"file":"claudeCodeDriver.js","sourceRoot":"","sources":["../../src/engines/claudeCodeDriver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAkB,MAAM,eAAe,CAAA;AAEvD,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,uBAAuB,CAC5C,IAAuB;IAEvB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;IAEhE,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChE,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,EAAE,CAAA;;QAC7B,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnE,8EAA8E;IAC9E,kFAAkF;IAClF,kFAAkF;IAClF,qFAAqF;IACrF,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAA;IACxC,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;IAC1D,MAAM,UAAU,GAAoC,EAAE,GAAG,UAAU,EAAE,CAAA;IACrE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,UAAU,CAAC,sBAAsB,CAAC,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IAExD,iFAAiF;IACjF,kFAAkF;IAClF,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAC/C,CAAC,CAAC;YACE,GAAG,IAAI,CAAC,YAAY;YACpB,GAAG,iBAAiB,CAAC,YAAY,CAAC;YAClC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC;SACzD;QACH,CAAC,CAAC,IAAI,CAAC,YAAY,CAAA;IAEvB,MAAM,OAAO,GAAY;QACvB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,mBAAmB;QACnC,+BAA+B,EAAE,IAAI;QACrC,eAAe,EAAE,UAAU;QAC3B,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC;QACxB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,qBAAqB,CAAC,IAAI,CAAC;KAC/B,CAAA;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,UAAqC,CAAA;IACzC,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YACpE,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;YACrC,IAAI,UAAU,EAAE,IAAI,KAAK,QAAQ;gBAAE,UAAU,GAAG,UAAU,CAAA;YAC1D,IAAI,UAAU;gBAAE,MAAM,UAAU,CAAA;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,MAAM,GAAG,CAAA;IAClC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACnD,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,mBAAmB;IACnB,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACxD,IAAI,OAAO;QAAE,MAAM,OAAO,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAqF;IAErF,OAAO;QACL,GAAG,CAAC,IAAI,CAAC,kBAAkB;YACzB,CAAC,CAAC;gBACE,YAAY,EAAE;oBACZ,IAAI,EAAE,QAAiB;oBACvB,MAAM,EAAE,aAAsB;oBAC9B,MAAM,EAAE,IAAI,CAAC,kBAAkB;iBAChC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YAC/C,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;YACpF,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,mBAAmB,GAAG,CAAC,YAAY,EAAE,SAAS,CAAU,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAsD,EACtD,MAAyB,OAAO,CAAC,GAAG;IAEpC,yEAAyE;IACzE,qEAAqE;IACrE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,QAAQ,CAAC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;AAClG,CAAC;AAID;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAA+B,EAC/B,SAAgC;IAEhC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,OAAmB;IACpC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;QAChE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,qEAAqE;AACrE,SAAS,WAAW,CAAC,OAAgB;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IACtC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACb,KAA4B,CAAC,IAAI,KAAK,MAAM;YAC7C,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,EACtD,CAAC;YACD,KAAK,CAAC,IAAI,CAAE,KAA0B,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC"}
|
package/dist/engines/codex.d.ts
CHANGED
|
@@ -12,8 +12,14 @@ export interface CodexOptions {
|
|
|
12
12
|
cwd: string;
|
|
13
13
|
/** Model id (resolved: per-run model, else the engine default). */
|
|
14
14
|
model: string;
|
|
15
|
-
/** API key (per-org BYO, else the runner env key). */
|
|
15
|
+
/** API key (per-org BYO, else the runner env key). Never set when the run has a gateway. */
|
|
16
16
|
apiKey?: string;
|
|
17
|
+
/**
|
|
18
|
+
* The gateway env (base URL + run token) when the run has a credential
|
|
19
|
+
* gateway: the driver sets it INSTEAD of any key, and stops inheriting the
|
|
20
|
+
* host's `OPENAI_*` settings so nothing can route around it.
|
|
21
|
+
*/
|
|
22
|
+
gatewayEnv?: Record<string, string>;
|
|
17
23
|
/**
|
|
18
24
|
* The transient `CODEX_HOME` for this run — a temp dir OUTSIDE the sandbox that
|
|
19
25
|
* holds the `config.toml` the engine wrote (the run's MCP servers). The driver
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/engines/codex.ts"],"names":[],"mappings":"AAMA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;
|
|
1
|
+
{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/engines/codex.ts"],"names":[],"mappings":"AAMA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AASlG;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAA;IACX,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAA;IACb,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,oFAAoF;IACpF,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,+DAA+D;AAC/D,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;IAChB;+CAC2C;IAC3C,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB,CAAA;AAEL,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,aAAa,CAAC,YAAY,CAAC,CAAA;AAK7E,iFAAiF;AAEjF;;;;;;;;;;;;;GAaG;AACH,qBAAa,WAAY,YAAW,WAAW;IAC7C,QAAQ,CAAC,IAAI,WAAU;IAEvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAE/C;;;;;OAKG;gBACS,KAAK,EAAE,WAAW,YAAqB,EAAE,sBAAsB,EAAE,MAAM;IAKnF,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa;IAmBhC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;CA+HpE"}
|