@resolflow/cli 0.0.0-stage → 0.1.0-beta.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Resolflow
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,202 @@
-# Temporary Holding Version
+# Resolflow CLI (Beta)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`resolflow` runs your [Resolflow](https://resolflow.ai) agent profiles on **your own machine**: on a local model
+server (Ollama, LM Studio, vLLM, llama.cpp server) or on a coding agent you have installed (Claude Code, Codex).
+Resolflow keeps the agent loop, tools and data in the cloud; your machine only turns a prompt into text.
+Runs you start go only to your own devices and cost 0 Resolflow credits.
+
+## Install
+
+Needs **Node.js 20 or later** (`node --version`).
+
+```bash
+npm i -g @resolflow/cli
+resolflow --version
+```
+
+One-shot, without a global install (pairs this machine; then use `npx @resolflow/cli start`):
+
+```bash
+npx @resolflow/cli pair <CODE>
+```
+
+npm is the only way to install during the Beta; standalone binaries (no Node.js needed) will come later.
+
+Keychain: the CLI stores the device token in the macOS keychain (`/usr/bin/security`) or the Linux Secret Service
+(`secret-tool`), else a 0600 file with a warning. You can add the optional native `keytar` module next to the CLI
+(`npm i -g keytar`) to use it instead.
+
+## Quick start
+
+```bash
+# 1. a local model server, e.g. Ollama (or skip this and use a coding agent, see below)
+ollama pull llama3.2                 # or qwen3:4b
+# 2. in Resolflow: Agents › Devices › "Pair this device" → run the command it shows
+resolflow pair ABCD-EFGH
+# 3. serve (keep it running while you want to serve runs; Ctrl+C stops)
+resolflow start
+```
+
+Then mark a custom agent as **Use CLI** (Agents › Custom Agents) and, in Agents › Devices, choose its device and run
+its purpose checks.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `resolflow pair [code] [--api URL] [--name NAME]` | Exchanges a pairing code (10 min, single use) for a device token; stores it in the keychain. `resolflow login [--pair code]` is the same. |
+| `resolflow start [--endpoint URL] [--concurrency 1-4] [--allow-background] [--ui] [--ui-port N]` | Connects out to Resolflow and serves requests until Ctrl+C. Reconnects with backoff; stops for good if the device is revoked. |
+| `resolflow status` | API, endpoint, pairing (asks the server whether the token is still valid and the device online), local models, coding agent spend today against the daily budget (Codex not counted), last runs. |
+| `resolflow models [--endpoint URL]` | Lists the models of the local server (`GET /v1/models`). |
+| `resolflow pause` / `resolflow resume` | Kill switch. A running daemon picks it up within 2 s: in-flight requests stop, new ones are refused, the server marks the device paused. |
+| `resolflow config [key value]` | Shows or sets `endpoint`, `concurrency` (1-4), `background` (on/off), `api` (only when unpaired), `agent-turns` (1-20), `agent-budget` (USD per job), `agent-timeout` (minutes per job), `agent-daily-budget` (USD per local day, default 10, `0` = no limit; Claude Code only). `resolflow config set <key> <value>` works too. |
+| `resolflow agents` | Local coding agents (Claude Code, Codex, Antigravity): installed, version, auth (`api key` / `CLI login` / `CLI login — not available (disabled by the administrator)`), whether an API key is configured (never the key), offered or not. |
+| `resolflow config agent-key <claude\|codex> [--delete]` | Stores a coding agent's API key in the OS keychain (hidden prompt, or piped stdin). The key never leaves this machine. |
+| `resolflow config agent-auth <claude\|codex> <api_key\|login>` | How that tool authenticates on this machine: its API key (default) or your existing CLI login (Beta, see below). `login` asks Resolflow first: refused (exit code 2, not saved) while the administrator has it off. |
+| `resolflow unpair` | Revokes the device on the server and deletes the token locally. |
+| `resolflow --version` / `--help` | Version of this CLI / all commands. |
+
+`-v/--verbose` adds debug lines (still never prompts, answers or secrets).
+
+## Files
+
+`$RESOLFLOW_CONFIG_DIR`, else `$XDG_CONFIG_HOME/resolflow`, else `~/.config/resolflow` (all platforms). Directory 0700.
+
+| File | Content |
+|---|---|
+| `config.json` (0600) | API URL, local endpoint, concurrency, background consent, paused flag, device id/name/workspace. **No secret.** |
+| `device-token` (0600) | Only when no keychain is available (a warning is printed). |
+| `agent-key-<tool>` (0600) | A coding agent's API key, only when no keychain is available. |
+| `agent-spend.json` (0600) | Today's coding agent spend: `{ "day": "YYYY-MM-DD", "spentUsd": n }` (Claude Code only; see Daily budget). |
+| `runs.log` (0600) | One JSON line per served request: time, request id, model, status, error kind, duration, token counts. Never content. Last 1000 kept. |
+
+## Local coding agents (Beta)
+
+A local agent profile can use a coding agent installed on this machine instead of a model server (Agents › Devices ›
+"Local engine"). Resolflow sends one `agent_job` (prompt + JSON schema of the expected plan / document); the CLI runs
+the tool as a **text generator** and returns the structured result. Credits on Resolflow: 0; the tool's usage and
+cost estimate are recorded for reference. Your provider bills your API key as usual.
+
+```bash
+resolflow config agent-key claude      # or: export ANTHROPIC_API_KEY=…   (Codex: CODEX_API_KEY / OPENAI_API_KEY)
+resolflow agents                        # Claude Code … status: ready
+resolflow start                         # "Coding agents offered: claude-code"
+```
+
+| Tool | How it runs (flags from the official docs) |
+|---|---|
+| Claude Code ([CLI reference](https://code.claude.com/docs/en/cli-reference), [headless](https://code.claude.com/docs/en/headless)) | `claude --bare -p --output-format stream-json --verbose --include-partial-messages --tools "" --disallowedTools "mcp__*" --strict-mcp-config --permission-mode dontAsk --no-session-persistence --max-turns N --max-budget-usd X --system-prompt-file F [--json-schema S] [--model M]`, prompt on stdin, `ANTHROPIC_API_KEY`, own empty `CLAUDE_CONFIG_DIR` |
+| Codex CLI ([non-interactive](https://learn.chatgpt.com/docs/non-interactive-mode), [auth](https://learn.chatgpt.com/docs/auth)) | `codex exec --json --sandbox read-only --ephemeral --skip-git-repo-check -C <empty dir> -o F [--output-schema F] [-m M] -`, prompt on stdin, `CODEX_API_KEY`, own empty `CODEX_HOME` = `HOME` = XDG dirs. **Off by default**: offered only with `RESOLFLOW_ALLOW_CODEX_JOBS=1` (see below) |
+| Antigravity CLI | Not supported yet (stub): no stable, officially documented headless JSON mode with an API key. Never a Google login. |
+
+Safety: every job runs in an **empty private temp dir** that is deleted afterwards; no project config, hooks or MCP
+servers load; tools are off (Codex: read-only sandbox, it has no tools-off switch); never a bypass / auto-approve flag;
+the child process gets only PATH/HOME/locale/proxy variables plus its API key; **API key only** (`--bare` ignores
+Claude OAuth and the keychain; Codex's empty `CODEX_HOME` hides a saved ChatGPT login). Caps per job: turns, budget
+(Claude Code), wall time — Resolflow may ask for less, this device's `agent-*` settings are the ceiling (defaults 4
+turns, 1 USD, 10 min). Cancel from the web: SIGINT to the process group, then SIGTERM, then SIGKILL. Errors map to
+`invalid_key`, `rate_limited`, `quota`, `model_not_found`, `budget_exceeded`, `timeout`, `unsupported`, `device_error`;
+the vendor's own error text is never forwarded or logged.
+
+### Daily budget
+
+On top of the per-job caps, this device keeps a **daily ceiling on coding agent spend**: default **10 USD per local
+day** (this machine's time zone; the total starts again from 0 at local midnight).
+
+- Every Claude Code job reports its cost (`total_cost_usd`); the CLI adds it to today's total in `agent-spend.json`
+  (0600, next to `config.json`).
+- Once today's total reaches the ceiling, new jobs are refused with `budget_exceeded` (reported to Resolflow like any
+  job error) until midnight, or until you raise the ceiling.
+- When less is left than the per-job budget, the job's `--max-budget-usd` is lowered to what is left (at least
+  0.01 USD). Budget held by jobs still running counts as used, so jobs running at the same time cannot together go
+  over.
+- **Codex reports no cost, so Codex jobs are not counted** and are never refused by the daily ceiling (they keep
+  their own per-job turn and time caps).
+- Change it with `resolflow config agent-daily-budget <USD>` (or `resolflow config set agent-daily-budget <USD>`);
+  `0` = no daily limit. A running `resolflow start` uses the new value for the next job.
+- `resolflow status` and `resolflow agents` show `Agent spend today: 2.30 / 10.00 USD`.
+- A missing `agent-spend.json` counts as 0; a damaged one counts as 0 with a warning, and is rewritten by the next
+  job's cost.
+
+**Codex reads outside the job folder.** Its read-only sandbox blocks writes and network but not reads: a job prompt
+(written by the Resolflow server or a project member) could make Codex run `cat` on any file your user can read —
+SSH keys, cloud credentials, this CLI's device token — and return it in the answer. `HOME`, `CODEX_HOME` and the XDG
+dirs point at the job's empty folder, so `~` resolves there, but absolute paths still work. So `resolflow start`
+offers Codex only when you set `RESOLFLOW_ALLOW_CODEX_JOBS=1` (on a machine or user account without secrets, e.g. a
+VM or a separate OS user); `resolflow agents` says why it is not offered. Claude Code runs with tools off and is
+offered as before.
+
+### Using your existing CLI login (Beta, off by default)
+
+`resolflow config agent-auth claude login` (or `codex`) lets that tool run Resolflow jobs with the login you already
+have on this machine (your own Claude / ChatGPT plan and its limits) instead of an API key. It is available only while
+the Resolflow administrator has switched it on for that tool (Admin › Settings › Agents); otherwise the command
+answers "CLI login for Claude Code is not available: it is turned off by the Resolflow administrator" and saves
+nothing (when Resolflow cannot be reached it saves the choice with a warning — it is not used until the administrator
+allows it). You read a short terms summary with the vendor's terms links and type `yes`. Undo: `… agent-auth claude
+api_key`. Gemini / Antigravity: never (Google's terms do not allow third-party use of a Gemini CLI login).
+
+- The unmodified vendor binary reads its own login. This CLI never opens, copies, logs or uploads login files or tokens;
+  Resolflow only learns the mode name (`api_key` / `login`) per tool.
+- Only work you start yourself: background (system-triggered) runs never use a login (refused by the server and here).
+  A task review you request by hand runs through the same background review queue, so it is refused on a login
+  device too (`cli_login_background`); planning and document generation you start yourself are not background.
+- Resolflow can only refuse login mode (the `policy` it sends); it can never switch this machine to it. Until the
+  server has sent a policy, login mode is off.
+- What still loads of your own setup, and what is switched off (checked against the official docs, 2026-10-24):
+
+| Tool | Login mode |
+|---|---|
+| Claude Code | `--bare` is dropped (it never reads OAuth / the keychain) and `CLAUDE_CONFIG_DIR` is not replaced (yours is passed on if set); instead `--safe-mode` (no CLAUDE.md, skills, plugins, hooks, MCP servers, custom commands / agents, output styles, LSP servers, auto memory), `--settings '{"disableAllHooks":true}'`, `--disable-slash-commands`, plus every flag above (`--tools ""`, `--disallowedTools "mcp__*"`, `--strict-mcp-config`, `dontAsk`, no session persistence, caps). Still read: your user settings such as `env`, `model`, `apiKeyHelper`, permission rules, and your organisation's managed policy (incl. its hooks). The run is refused if any tool or MCP server is live, or a plugin that is not built into Claude Code loaded (its name is logged on this machine only); built-in plugins (`…@builtin`) and listed subagents are fine — with no tools nothing can start a subagent. Checked on a real Claude Code 2.1.308 with an OAuth login. |
+| Codex CLI | Only with `RESOLFLOW_ALLOW_CODEX_JOBS=1` as well. Your `CODEX_HOME` (else `~/.codex`, where `codex login` keeps its login) instead of an empty one; `--ignore-user-config` (no `config.toml`: MCP servers, `notify`, inline hooks, profiles, plugins, providers), `--ignore-rules`, `-c features.hooks=false` (`hooks.json`), `-c features.apps=false`, `-c features.shell_tool=false` (no commands at all), `-c features.multi_agent=false`, `-c features.memories=false`, `-c web_search="disabled"`, `-c history.persistence="none"`, plus `--sandbox read-only --ephemeral`. Still read: your global `AGENTS.md` (text) and skill metadata. A login kept in the OS keyring through `config.toml` may not be found (the job fails as "not signed in"). |
+
+Mode B (the agent works in a folder of yours with the Resolflow MCP server) is **not** available: it needs its own
+security design review (folder allow-list, write opt-in on the device, scoped MCP token). A Mode B job is answered
+`unsupported`.
+
+## Security model
+
+- **No listener by default.** The daemon only opens one outbound connection. `--ui` adds a status page bound to
+  `127.0.0.1` only, with a per-session random token (sent in the `X-Resolflow-Token` header, delivered via the URL
+  fragment), strict `Host` (DNS rebinding) and `Origin` checks, no CORS headers, a strict CSP; it can show status and
+  pause/resume — nothing else (no endpoint/token changes, no processes, no secrets).
+- **Secrets:** the device token goes to the OS keychain — `keytar` if installed, else macOS `/usr/bin/security`
+  (secret passed on stdin) or Linux `secret-tool` (stdin); otherwise a 0600 file with a warning. Never in config,
+  never printed, redacted from logs.
+- **Network:** API https only (http only to loopback, for development); local model endpoint loopback only; no
+  redirects followed; TLS verification always on.
+- **No shell, no file tools.** The only child processes are the fixed keychain tools above and, when you set one up,
+  a local coding agent run as described above; the device turns prompts into text, the tool loop runs in the cloud.
+- **No payload logging** on the device (logs and `runs.log` hold ids, model, timings, counts) or in the gateway.
+- **Server side:** token `cli_<id>_<secret>` checked by id + one constant-time hash compare, membership at handshake
+  and every minute (sweep), revocation on member removal / leave / viewer / block, handshake and pairing rate limits,
+  a device can only answer requests sent to it, one connection per device.
+- **Other traffic:** only the once-a-day version check against the npm registry (see *Updates*; off with
+  `RESOLFLOW_NO_UPDATE_CHECK=1`).
+- **Beta:** a security review of this package is part of the GA criteria.
+
+## Updates
+
+`resolflow` never updates itself. At most once a day it asks the npm registry for the latest version of
+`@resolflow/cli` (only the package name is sent; the answer is cached in `update-check.json` in the config directory)
+and prints one line after the command when a newer version exists. Update with `npm i -g @resolflow/cli@latest`. Turn the check off with `RESOLFLOW_NO_UPDATE_CHECK=1` (it is also off when `CI` or `NO_UPDATE_NOTIFIER`
+is set, or when stderr is not a terminal).
+
+## Troubleshooting
+
+| Problem | What to do |
+|---|---|
+| `resolflow: command not found` after `npm i -g` | npm's global bin directory is not on your PATH: `npm prefix -g` shows it (add its `bin`, on Windows the prefix itself). Or use `npx @resolflow/cli …`. |
+| `EACCES` during `npm i -g` | Do not use `sudo npm`; use a Node version manager (nvm, fnm, Volta) or set a user prefix: `npm config set prefix ~/.npm-global`. |
+| `Pairing code … invalid or expired` | Codes are valid for 10 minutes and once. Create a new one in Agents › Devices. |
+| `Cannot reach https://api.resolflow.ai` | Check the network / proxy (`HTTPS_PROXY`). The CLI only makes outbound HTTPS/WSS connections. |
+| `resolflow status` shows no models | Start your model server (`ollama serve`) or point the CLI at it: `resolflow config endpoint http://127.0.0.1:1234/v1`. Only addresses on this machine are allowed. |
+| The device shows **Offline** in Resolflow | `resolflow start` must be running. A revoked device stops with a message: pair it again. |
+| A coding agent shows `needs an API key` | `resolflow config agent-key claude` (or `codex`), or set `ANTHROPIC_API_KEY` / `CODEX_API_KEY`. A CLI login is used only if you chose it (`resolflow config agent-auth`). |
+| `Auth: CLI login — not available (disabled by the administrator)` | The Resolflow administrator has CLI logins off for that tool: `resolflow config agent-auth claude api_key` and `resolflow config agent-key claude`. |
+| `No OS keychain available` warning | The token is in a 0600 file in the config directory. Install `secret-tool` (Linux) or `keytar` to use a keychain. |
+| Something else | `resolflow -v status` adds debug lines (never prompts, answers or secrets). Email support@resolflow.ai with the output. |
+
+## License
+
+MIT

package/dist/adapters/antigravity.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AntigravityAdapter = void 0;
+const tools_1 = require("../agents/tools");
+const coding_agent_1 = require("./coding-agent");
+/**
+ * Antigravity CLI (`agy`; Gemini CLI was replaced by it on 2026-06-18) — documented STUB (RF-5cdd488d).
+ *
+ * Checked 2026-10-18: Google publishes no official reference for a headless JSON mode of the Antigravity CLI with an
+ * API key. Third-party write-ups describe `agy -p … --output-format json|stream-json --json-schema …` (since 1.1.8)
+ * and a GEMINI_API_KEY path behind a `modelProvider` setting (1.1.13), but also call the JSON output unstable,
+ * report print mode hanging without a TTY, and conflict on whether GEMINI_API_KEY is honoured. Decision 5a forbids
+ * the Google / Gemini login (account suspension risk), so a login-based fallback is not an option.
+ *
+ * Until official docs give a stable headless JSON + API-key mode, this adapter is never offered to Resolflow (not in
+ * hello.capabilities.adapters) and answers any job with `unsupported`. `resolflow agents` shows it as not supported.
+ */
+class AntigravityAdapter extends coding_agent_1.CodingAgentAdapter {
+    constructor(opts) {
+        super(tools_1.AGENT_TOOLS.antigravity, opts);
+    }
+    invocation() {
+        throw new Error('Antigravity CLI is not supported yet');
+    }
+    parser() {
+        throw new Error('Antigravity CLI is not supported yet');
+    }
+}
+exports.AntigravityAdapter = AntigravityAdapter;

package/dist/adapters/claude-code.js

@@ -0,0 +1,302 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClaudeStreamParser = exports.ClaudeCodeAdapter = void 0;
+exports.nonBuiltinPlugins = nonBuiltinPlugins;
+const path = __importStar(require("path"));
+const tools_1 = require("../agents/tools");
+const errors_1 = require("../agents/errors");
+const run_process_1 = require("../agents/run-process");
+const coding_agent_1 = require("./coding-agent");
+/**
+ * Claude Code, Mode A (RF-5cdd488d). Flags from the official docs (checked 2026-10-18):
+ *   https://code.claude.com/docs/en/cli-reference · https://code.claude.com/docs/en/headless
+ *
+ *   claude --bare -p                      bare: no hooks, skills, plugins, MCP servers, CLAUDE.md; API key only
+ *                                         ("In bare mode, Claude Code never reads OAuth credentials or the system keychain")
+ *     --output-format stream-json --verbose --include-partial-messages      newline-delimited events, text deltas
+ *     --tools "" --disallowedTools "mcp__*" --strict-mcp-config             no built-in tools, no MCP tools/servers
+ *     --permission-mode dontAsk                                             anything that would prompt is denied
+ *     --no-session-persistence                                              nothing saved to disk
+ *     --max-turns N --max-budget-usd X                                      per-job caps
+ *     --system-prompt-file <file>  --json-schema '<schema>'  --model <alias>
+ *   prompt on stdin; cwd = an empty temp dir; CLAUDE_CONFIG_DIR = an empty per-job dir (no user settings);
+ *   ANTHROPIC_API_KEY = the key. Never --dangerously-skip-permissions / bypassPermissions / --allowedTools.
+ *
+ * Login mode (RF-90e75d6d; the person chose `resolflow config agent-auth claude login` and the administrator allows
+ * it). Checked against the official docs on 2026-10-24 (cli-reference, headless, settings):
+ *   - `--bare` goes ("In bare mode, Claude Code never reads OAuth credentials or the system keychain"), and
+ *     CLAUDE_CONFIG_DIR is not pointed at an empty dir (the person's own CLAUDE_CONFIG_DIR, if set, is passed on).
+ *     No ANTHROPIC_API_KEY. The unmodified `claude` binary reads its own login; this CLI never touches it.
+ *   - In its place `--safe-mode`: "CLAUDE.md, skills, plugins, hooks, MCP servers, custom commands and agents, output
+ *     styles, workflows, ... status line and file-suggestion commands, LSP servers, and auto memory do not load.
+ *     Authentication, model selection, built-in tools, and permissions work normally." Managed (organisation) policy
+ *     still applies, incl. policy hooks: the person's employer's settings, not Resolflow's to override.
+ *   - `--settings '{"disableAllHooks":true}'` (also off: hooks, custom status line, file suggestion; any scope) and
+ *     `--disable-slash-commands` ("Disable all skills and commands") on top, belt and braces.
+ *   - Everything else stays: `--tools ""`, `--disallowedTools "mcp__*"`, `--strict-mcp-config` (no MCP config at
+ *     all), `--permission-mode dontAsk`, `--no-session-persistence`, the caps, an empty cwd; and the `system/init`
+ *     check below refuses to run when any tool or MCP server is live, or any plugin that is not built in loaded.
+ *   - Real Claude Code 2.1.308 with an OAuth login and exactly these flags (owner-approved run, 2026-10-24): tools 0,
+ *     mcp_servers 0, slash_commands 0, skills 0, apiKeySource none — but `plugins` still lists 3 BUILT-IN entries
+ *     (cc-plugin-agents-md@builtin, cc-plugin-telemetry@builtin, cc-plugin-plugin-authoring@builtin, path "builtin")
+ *     and `agents` lists 4. Built-in plugins ship inside the unmodified binary: allowed. Anything else is refused
+ *     and its name logged on this machine only. `agents` (subagents) are allowed: they can only be started through
+ *     the Agent / Task tool, and with `--tools ""` no tool exists (FORBIDDEN_TOOLS refuses a run where Agent / Task
+ *     is live), so no subagent can run.
+ *   - Still read from the person's user settings (safe mode keeps settings): `env`, `model`, `apiKeyHelper`,
+ *     permissions: their own machine and choices; no tool exists to use a permission.
+ *
+ * Output: `system/init`, `system/api_retry` (error categories → ErrorKind), `stream_event` (partial deltas),
+ * `assistant` (complete messages, `error` category), and a final `result` (subtype success | error_max_turns |
+ * error_max_budget_usd | error_during_execution | error_max_structured_output_retries; `structured_output`,
+ * `usage`, `total_cost_usd`).
+ */
+class ClaudeCodeAdapter extends coding_agent_1.CodingAgentAdapter {
+    constructor(opts) {
+        super(tools_1.AGENT_TOOLS['claude-code'], opts);
+    }
+    /** `result.total_cost_usd` → usage.costUsd: counted toward the daily budget (RF-27cf99e3). */
+    reportsCost = true;
+    invocation(i) {
+        const sys = [i.payload.systemPrompt?.trim(), coding_agent_1.MODE_A_NOTE].filter(Boolean).join('\n\n');
+        const sysFile = (0, run_process_1.writeJobFile)(i.root, 'system-prompt.txt', sys);
+        const login = i.authMode === 'login';
+        const args = [
+            // api_key: --bare (no OAuth / keychain, no user config). login: --safe-mode (the login works; no user
+            // customisations) + hooks off + no skills/commands (see the header)
+            ...(login ? ['--safe-mode', '--settings', '{"disableAllHooks":true}', '--disable-slash-commands'] : ['--bare']),
+            '-p',
+            '--output-format',
+            'stream-json',
+            '--verbose',
+            '--include-partial-messages',
+            '--tools',
+            '',
+            '--disallowedTools',
+            'mcp__*',
+            '--strict-mcp-config',
+            '--permission-mode',
+            'dontAsk',
+            '--no-session-persistence',
+            '--max-turns',
+            String(i.caps.maxTurns),
+            '--max-budget-usd',
+            i.caps.maxBudgetUsd.toFixed(2),
+            '--system-prompt-file',
+            sysFile,
+        ];
+        if (i.payload.outputSchema)
+            args.push('--json-schema', JSON.stringify(i.payload.outputSchema));
+        if (i.model)
+            args.push('--model', i.model);
+        const from = this.opts.env ?? process.env;
+        // login: the person's own config dir (only when they set one), no key; api_key: the key, an empty config dir
+        const extra = login
+            ? from.CLAUDE_CONFIG_DIR && path.isAbsolute(from.CLAUDE_CONFIG_DIR)
+                ? { CLAUDE_CONFIG_DIR: from.CLAUDE_CONFIG_DIR }
+                : {}
+            : { ANTHROPIC_API_KEY: i.apiKey, CLAUDE_CONFIG_DIR: path.join(i.root, 'home') };
+        return { args, env: (0, run_process_1.agentEnv)(extra, from), stdin: i.payload.prompt };
+    }
+    parser(em, i) {
+        return new ClaudeStreamParser(em, !!i.payload.outputSchema, this.opts.warn);
+    }
+}
+exports.ClaudeCodeAdapter = ClaudeCodeAdapter;
+/**
+ * Plugins in `system/init` that are NOT shipped inside the Claude Code binary (path "builtin" / name "…@builtin").
+ * Their names, for the local warning. A malformed entry counts as not built in.
+ */
+function nonBuiltinPlugins(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const p of raw) {
+        const name = typeof p === 'string' ? p : typeof p?.name === 'string' ? p.name : '';
+        const builtin = typeof p === 'object' && p !== null && p.path === 'builtin' && /@builtin$/.test(name);
+        if (!builtin)
+            out.push((name || 'unnamed').replace(/[^\w@./:-]/g, '').slice(0, 80) || 'unnamed');
+    }
+    return out;
+}
+/** Built-in tools that must never be live in a Mode A run (a newer Claude Code that ignored --tools ""). */
+const FORBIDDEN_TOOLS = /^(Bash|BashOutput|KillShell|Edit|MultiEdit|Write|Read|NotebookEdit|Glob|Grep|LS|WebFetch|WebSearch|Task|Agent|Skill|Monitor|mcp__.*)$/;
+class ClaudeStreamParser {
+    em;
+    wantsSchema;
+    warn;
+    result = null;
+    sawDelta = false;
+    text = '';
+    lastErrorKind = null;
+    /** An assistant message carried an API error: its text is the vendor's, never the answer. */
+    errorTextSeen = false;
+    openTools = new Map();
+    constructor(em, wantsSchema, 
+    /** Local log only (never sent to Resolflow): names of plugins that made the run refuse. */
+    warn) {
+        this.em = em;
+        this.wantsSchema = wantsSchema;
+        this.warn = warn;
+    }
+    line(raw) {
+        const m = (0, coding_agent_1.safeJson)(raw);
+        if (!m)
+            return;
+        switch (m.type) {
+            case 'system':
+                if (m.subtype === 'init') {
+                    const live = (Array.isArray(m.tools) ? m.tools : []).filter((t) => typeof t === 'string' && FORBIDDEN_TOOLS.test(t));
+                    const mcp = Array.isArray(m.mcp_servers) ? m.mcp_servers.length : 0;
+                    // RF-90e75d6d: a plugin that loaded anyway (login mode reads the person's settings) is refused as well
+                    const plugins = nonBuiltinPlugins(m.plugins);
+                    if (plugins.length)
+                        this.warn?.(`Claude Code loaded plugins that are not built in: ${plugins.join(', ')}; refusing to run this job.`);
+                    if (live.length || mcp || plugins.length)
+                        return this.em.failFast('unsupported', 'Claude Code started with tools enabled; refusing to run (update Claude Code or the resolflow CLI).');
+                    this.em.progress('agent ready', true);
+                }
+                else if (m.subtype === 'api_retry') {
+                    const kind = (0, errors_1.claudeErrorKind)(m.error);
+                    if (kind && errors_1.HARD_AGENT_KINDS.has(kind))
+                        return this.em.failFast(kind);
+                    this.em.progress(kind === 'rate_limited' ? 'rate limited, retrying' : 'retrying', true);
+                }
+                return;
+            case 'stream_event': {
+                const e = m.event ?? {};
+                if (m.parent_tool_use_id)
+                    return;
+                if (e.type === 'content_block_delta') {
+                    if (e.delta?.type === 'text_delta' && typeof e.delta.text === 'string' && e.delta.text) {
+                        this.sawDelta = true;
+                        this.text += e.delta.text;
+                        this.em.emit({ type: 'text_delta', text: e.delta.text });
+                    }
+                    else if (e.delta?.type === 'thinking_delta') {
+                        this.em.progress('thinking');
+                    }
+                }
+                else if (e.type === 'content_block_start' && e.content_block?.type === 'tool_use') {
+                    this.toolStart(String(e.content_block.id ?? ''), String(e.content_block.name ?? 'tool'));
+                }
+                return;
+            }
+            case 'assistant': {
+                // An API error comes as an assistant message with `error` and the vendor's text: map it to the kind only,
+                // never forward that text (it is not an answer, and can quote request details)
+                if (m.error !== undefined && m.error !== null) {
+                    this.lastErrorKind = (0, errors_1.claudeErrorKind)(m.error) ?? 'device_error';
+                    this.errorTextSeen = true;
+                    return;
+                }
+                const blocks = Array.isArray(m.message?.content) ? m.message.content : [];
+                for (const b of blocks) {
+                    if (b?.type === 'text' && typeof b.text === 'string' && !this.sawDelta && !m.parent_tool_use_id) {
+                        this.text += b.text;
+                        this.em.emit({ type: 'text_delta', text: b.text });
+                    }
+                    else if (b?.type === 'tool_use') {
+                        this.toolStart(String(b.id ?? ''), String(b.name ?? 'tool'));
+                    }
+                }
+                return;
+            }
+            case 'user': {
+                const blocks = Array.isArray(m.message?.content) ? m.message.content : [];
+                for (const b of blocks)
+                    if (b?.type === 'tool_result')
+                        this.toolEnd(String(b.tool_use_id ?? ''));
+                return;
+            }
+            case 'result':
+                this.result = m;
+                return;
+        }
+    }
+    toolStart(id, name) {
+        if (id && this.openTools.has(id))
+            return;
+        if (id)
+            this.openTools.set(id, name);
+        this.em.emit({ type: 'tool_activity', tool: name.slice(0, 100), status: 'start' });
+    }
+    toolEnd(id) {
+        const name = this.openTools.get(id);
+        if (!name)
+            return;
+        this.openTools.delete(id);
+        this.em.emit({ type: 'tool_activity', tool: name, status: 'end' });
+    }
+    finish(o) {
+        const r = this.result;
+        if (!r) {
+            const kind = this.lastErrorKind ?? (o.code === 0 ? 'device_error' : (0, errors_1.classifyAgentErrorText)(o.stderrTail));
+            return this.em.error(kind);
+        }
+        const u = r.usage ?? {};
+        const promptTokens = (0, coding_agent_1.num)(u.input_tokens) + (0, coding_agent_1.num)(u.cache_creation_input_tokens) + (0, coding_agent_1.num)(u.cache_read_input_tokens);
+        const completionTokens = (0, coding_agent_1.num)(u.output_tokens);
+        if (promptTokens || completionTokens || (0, coding_agent_1.num)(r.total_cost_usd)) {
+            this.em.usage({ promptTokens, completionTokens, ...((0, coding_agent_1.num)(r.total_cost_usd) ? { costUsd: (0, coding_agent_1.num)(r.total_cost_usd) } : {}) });
+        }
+        switch (r.subtype) {
+            case 'success': {
+                if (r.is_error || this.errorTextSeen) {
+                    const kind = this.lastErrorKind ?? (0, errors_1.classifyAgentErrorText)(String(r.result ?? ''));
+                    return this.em.error(kind === 'unsupported' ? 'device_error' : kind);
+                }
+                const text = typeof r.result === 'string' ? r.result : this.text;
+                if (!this.wantsSchema)
+                    return this.em.emit({ type: 'result', text });
+                const data = r.structured_output !== undefined && r.structured_output !== null ? r.structured_output : (0, coding_agent_1.parseJsonAnswer)(text);
+                if (data === undefined)
+                    return this.em.error('device_error', 'The coding agent finished without the structured output.');
+                return this.em.emit({ type: 'result', text: JSON.stringify(data), data });
+            }
+            case 'error_max_turns':
+            case 'error_max_budget_usd':
+                return this.em.error('budget_exceeded');
+            case 'error_max_structured_output_retries':
+                return this.em.error('device_error', 'The coding agent could not produce output matching the schema.');
+            default: {
+                const errs = Array.isArray(r.errors) ? r.errors.join('\n') : '';
+                return this.em.error(this.lastErrorKind ?? (0, errors_1.classifyAgentErrorText)(errs || o.stderrTail));
+            }
+        }
+    }
+}
+exports.ClaudeStreamParser = ClaudeStreamParser;