@seawork/server 1.0.22 → 2.0.2-rc.6

package/dist/server/server/agent/providers/claude-agent.js

@@ -8,18 +8,26 @@ import { promisify } from "node:util";
 import { query, } from "@anthropic-ai/claude-agent-sdk";
 import { resolveElectronHelperPath } from "../../../utils/electron-helper.js";
 import { spawnProcess } from "../../../utils/spawn.js";
-import { getOrchestratorModeInstructions } from "../orchestrator-instructions.js";
-import { applyProviderEnv } from "../provider-launch-config.js";
 import { getLatencyProxyUrlSync } from "../../latency-proxy.js";
+import { claudeProjectDirName } from "../claude-memory.js";
+import { getOrchestratorModeInstructions } from "../orchestrator-instructions.js";
+import { applyProviderEnv, mergeLocalhostProxyBypass, } from "../provider-launch-config.js";
 import { getClaudeModels, normalizeClaudeRuntimeModelId } from "./claude/claude-models.js";
 import { parsePartialJsonObject } from "./claude/partial-json.js";
 import { ClaudeSidechainTracker } from "./claude/sidechain-tracker.js";
 import { mapTaskNotificationSystemRecordToToolCall, mapTaskNotificationUserContentToToolCall, } from "./claude/task-notification-tool-call.js";
 import { mapClaudeCanceledToolCall, mapClaudeCompletedToolCall, mapClaudeFailedToolCall, mapClaudeRunningToolCall, } from "./claude/tool-call-mapper.js";
 import { formatDiagnosticStatus, formatProviderDiagnostic, formatProviderDiagnosticError, toDiagnosticErrorMessage, } from "./diagnostic-utils.js";
+import { appendAnthropicCustomHeaders, buildSeaworkGatewayHeaders } from "./gateway-telemetry.js";
 const fsPromises = promises;
 const execFileAsync = promisify(execFile);
 const CLAUDE_SETTING_SOURCES = ["user", "project"];
+const CLAUDE_PROVIDER = "claude";
+const CLAUDE_TOOL_SCHEMA_GUIDANCE = `
+<claude-tool-schema-guidance>
+When using Claude Code tools, follow each tool's exact input schema. The Read tool requires the argument \`file_path\`; do not use Seawork timeline display fields such as \`filePath\` as tool arguments.
+</claude-tool-schema-guidance>
+`;
 const CLAUDE_CAPABILITIES = {
     supportsStreaming: true,
     supportsSessionPersistence: true,
@@ -70,6 +78,11 @@ const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3
  * ENOENT error messages reference a real on-disk location instead of the
  * misleading asar path.
  */
+function rewriteAsarToUnpacked(p) {
+    const asarSeg = `app.asar${path.sep}`;
+    const unpackedSeg = `app.asar.unpacked${path.sep}`;
+    return p.includes(asarSeg) && !p.includes(unpackedSeg) ? p.replace(asarSeg, unpackedSeg) : p;
+}
 let cachedClaudeCliPath;
 export function resolveClaudeCliExecutable() {
     if (cachedClaudeCliPath !== undefined) {
@@ -80,13 +93,22 @@ export function resolveClaudeCliExecutable() {
         // The SDK's package.json doesn't expose "./package.json" via exports, so
         // resolve the main entry (sdk.mjs) and derive the package root from it.
         const mainPath = sdkRequire.resolve("@anthropic-ai/claude-agent-sdk");
-        let cliPath = path.join(path.dirname(mainPath), "cli.js");
-        const asarSeg = `app.asar${path.sep}`;
-        const unpackedSeg = `app.asar.unpacked${path.sep}`;
-        if (cliPath.includes(asarSeg) && !cliPath.includes(unpackedSeg)) {
-            cliPath = cliPath.replace(asarSeg, unpackedSeg);
+        // 0.2.x shipped cli.js next to the main entry.
+        const cliPath = rewriteAsarToUnpacked(path.join(path.dirname(mainPath), "cli.js"));
+        if (fs.existsSync(cliPath)) {
+            cachedClaudeCliPath = cliPath;
+            return cachedClaudeCliPath;
+        }
+        // 0.3.x ships the native `claude` binary in a per-platform optional dep.
+        const ext = process.platform === "win32" ? ".exe" : "";
+        const pkg = `@anthropic-ai/claude-agent-sdk-${process.platform}-${process.arch}/claude${ext}`;
+        try {
+            const native = rewriteAsarToUnpacked(sdkRequire.resolve(pkg));
+            cachedClaudeCliPath = fs.existsSync(native) ? native : null;
+        }
+        catch {
+            cachedClaudeCliPath = null;
         }
-        cachedClaudeCliPath = fs.existsSync(cliPath) ? cliPath : null;
     }
     catch {
         cachedClaudeCliPath = null;
@@ -113,6 +135,12 @@ function resolveClaudeSpawnCommand(spawnOptions, runtimeSettings) {
     };
 }
 export function resolveClaudeAuthSpawnEnv(mergedEnv, authMode) {
+    const mergeSeaworkCustomHeaders = (env) => {
+        return {
+            ...env,
+            ANTHROPIC_CUSTOM_HEADERS: appendAnthropicCustomHeaders(env.ANTHROPIC_CUSTOM_HEADERS, buildSeaworkGatewayHeaders(CLAUDE_PROVIDER)),
+        };
+    };
     if (authMode === "local") {
         return {
             spawnEnv: {
@@ -135,7 +163,7 @@ export function resolveClaudeAuthSpawnEnv(mergedEnv, authMode) {
         return { spawnEnv: { ...mergedEnv }, hasApiKey };
     }
     return {
-        spawnEnv: {
+        spawnEnv: mergeSeaworkCustomHeaders({
             ...mergedEnv,
             CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
             ANTHROPIC_AUTH_TOKEN: undefined,
@@ -144,11 +172,11 @@ export function resolveClaudeAuthSpawnEnv(mergedEnv, authMode) {
             CLAUDE_CODE_USE_BEDROCK: undefined,
             CLAUDE_CODE_USE_VERTEX: undefined,
             AWS_BEARER_TOKEN_BEDROCK: undefined,
-        },
+        }),
         hasApiKey,
     };
 }
-function applyRuntimeSettingsToClaudeOptions(options, runtimeSettings, launchEnv, logger) {
+function applyRuntimeSettingsToClaudeOptions(options, runtimeSettings, launchEnv, logger, latencyProxyUrl) {
     return {
         ...options,
         spawnClaudeCodeProcess: (spawnOptions) => {
@@ -162,6 +190,13 @@ function applyRuntimeSettingsToClaudeOptions(options, runtimeSettings, launchEnv
                 ...applyProviderEnv(spawnOptions.env, runtimeSettings),
                 ...(launchEnv ?? {}),
             }, runtimeSettings?.authMode);
+            // Merge the localhost bypass AFTER launchEnv is spread: a launch context
+            // that carries its own NO_PROXY would otherwise overwrite the bypass and
+            // route local daemon MCP traffic back through the CONNECT-only latency
+            // proxy. Only applies when the latency-debug proxy is active.
+            if (latencyProxyUrl) {
+                mergeLocalhostProxyBypass(spawnEnv);
+            }
             if (!isDefaultRuntime) {
                 command = resolved.command;
             }
@@ -258,6 +293,19 @@ function isClaudeThinkingEffort(value) {
 const MAX_RECENT_STDERR_CHARS = 4000;
 const STDERR_FLUSH_WAIT_MS = 150;
 const STDERR_FLUSH_POLL_INTERVAL_MS = 10;
+const MAX_PLAN_TEXT_LENGTH = 50000;
+function truncatePlanInput(input) {
+    const plan = input?.["plan"];
+    if (typeof plan !== "string") {
+        // plan key absent or non-string: discard the whole client object so unknown
+        // keys cannot leak into the plan_approval tool-call input; caller falls back
+        // to pending.request.input (the original server-side value).
+        return null;
+    }
+    // Extract only the known `plan` key; discard any other client-supplied keys
+    // so they cannot leak into the plan_approval tool-call input (matches codex path).
+    return { plan: plan.slice(0, MAX_PLAN_TEXT_LENGTH) };
+}
 function summarizeClaudeOptionsForLog(options) {
     const systemPromptRaw = options.systemPrompt;
     const systemPromptSummary = (() => {
@@ -1099,6 +1147,7 @@ class ClaudeAgentSession {
         });
         this.persistedHistory = [];
         this.historyPending = false;
+        this.historyPathCache = new Map();
         this.turnState = "idle";
         this.nextTurnOrdinal = 1;
         this.cancelCurrentTurn = null;
@@ -1114,6 +1163,7 @@ class ClaudeAgentSession {
         this.userMessageIds = [];
         this.recentStderr = "";
         this.closed = false;
+        this.maxEffortClampWarned = false;
         this.handlePermissionRequest = async (toolName, input, options) => {
             const requestId = `permission-${randomUUID()}`;
             const kind = resolvePermissionKind(toolName, input);
@@ -1366,11 +1416,18 @@ class ClaudeAgentSession {
         this.notifySubscribers({ type: "turn_started", provider: "claude" });
         try {
             await this.ensureQuery();
-            if (!this.input) {
+            // Snapshot this.input locally. ensureQuery() guarantees this.input is
+            // set on return; the previous code re-read this.input after the
+            // (sync-only) startQueryPump() call, which made the .push() vulnerable
+            // to any path that mutated this.input between the guard and the push
+            // — observed in #779 as `Cannot read properties of null (reading
+            // 'push')` after a previous turn's subprocess exit.
+            const input = this.input;
+            if (!input) {
                 throw new Error("Claude session input stream not initialized");
             }
             this.startQueryPump();
-            this.input.push(sdkMessage);
+            input.push(sdkMessage);
         }
         catch (error) {
             this.flushPendingToolCalls();
@@ -1473,6 +1530,9 @@ class ClaudeAgentSession {
         this.pendingPermissions.delete(requestId);
         pending.cleanup?.();
         if (response.behavior === "allow") {
+            const updatedInput = pending.request.kind === "plan"
+                ? truncatePlanInput(response.updatedInput)
+                : response.updatedInput;
             if (pending.request.kind === "plan") {
                 const selectedActionId = response.selectedActionId;
                 const shouldResumePriorMode = selectedActionId === "implement_resume" && this.planResumeMode === "bypassPermissions";
@@ -1483,7 +1543,7 @@ class ClaudeAgentSession {
                 this.pushToolCall(mapClaudeCompletedToolCall({
                     name: "plan_approval",
                     callId: pending.request.id,
-                    input: pending.request.input ?? null,
+                    input: updatedInput ?? pending.request.input ?? null,
                     output: {
                         approved: true,
                         actionId: selectedActionId ?? "implement",
@@ -1492,7 +1552,7 @@ class ClaudeAgentSession {
             }
             const result = {
                 behavior: "allow",
-                updatedInput: response.updatedInput ?? pending.request.input ?? {},
+                updatedInput: updatedInput ?? pending.request.input ?? {},
                 updatedPermissions: this.normalizePermissionUpdates(response.updatedPermissions),
             };
             pending.resolve(result);
@@ -1536,12 +1596,16 @@ class ClaudeAgentSession {
         // Old GA agents (1.0.16) are covered too because handle is constructed
         // here on the daemon at migrate time, not from the client payload.
         const sourcePath = this.resolveHistoryPath(this.claudeSessionId);
+        // Persist the user's pre-injection base, never the daemon-injected
+        // systemPrompt, so resume re-injects once instead of doubling.
+        const { systemPromptBase, ...rest } = this.config;
         this.persistence = {
             provider: "claude",
             sessionId: this.claudeSessionId,
             nativeHandle: this.claudeSessionId,
             metadata: {
-                ...this.config,
+                ...rest,
+                ...(systemPromptBase !== undefined ? { systemPrompt: systemPromptBase || undefined } : {}),
                 ...(sourcePath ? { sourcePath } : {}),
             },
         };
@@ -1576,7 +1640,11 @@ class ClaudeAgentSession {
         const q = await this.ensureQuery();
         const commands = await q.supportedCommands();
         const commandMap = new Map();
+        const deniedSkills = new Set(this.config.librarySkillDenylist ?? []);
         for (const cmd of commands) {
+            if (deniedSkills.has(cmd.name)) {
+                continue;
+            }
             if (!commandMap.has(cmd.name)) {
                 commandMap.set(cmd.name, {
                     name: cmd.name,
@@ -1818,17 +1886,32 @@ class ClaudeAgentSession {
         }
     }
     async buildOptions() {
+        const useLocalClaudeConfig = this.runtimeSettings?.authMode === "local";
         const thinkingOptionId = this.config.thinkingOptionId && this.config.thinkingOptionId !== "default"
             ? this.config.thinkingOptionId
             : undefined;
         let thinking;
         let effort;
         if (thinkingOptionId && isClaudeThinkingEffort(thinkingOptionId)) {
+            // Claude.ai subscription auth (local CLI) rejects effort "max" with
+            // SDK exit code 1 ("Effort level \"max\" is not available for
+            // Claude.ai subscribers"), which previously failed every turn and
+            // could wedge the session (#779). Clamp to "high" for local auth so
+            // the turn actually runs.
+            let resolvedEffort = thinkingOptionId;
+            if (useLocalClaudeConfig && resolvedEffort === "max") {
+                resolvedEffort = "high";
+                if (!this.maxEffortClampWarned) {
+                    this.maxEffortClampWarned = true;
+                    this.logger.warn({ from: "max", to: "high", reason: "claude.ai-subscription" }, "Clamping reasoning effort: Claude.ai subscription auth does not support 'max'");
+                }
+            }
             thinking = { type: "adaptive" };
-            effort = thinkingOptionId;
+            effort = resolvedEffort;
         }
         const appendedSystemPrompt = [
             getOrchestratorModeInstructions(),
+            CLAUDE_TOOL_SCHEMA_GUIDANCE,
             this.config.systemPrompt?.trim(),
         ]
             .filter((entry) => typeof entry === "string" && entry.length > 0)
@@ -1838,7 +1921,6 @@ class ClaudeAgentSession {
         // The SDK `settings` option (flag settings layer) has the highest priority.
         const seaworkHome = process.env.SEAWORK_HOME ?? path.join(os.homedir(), ".seawork");
         const seaworkSettingsPath = path.join(seaworkHome, "claude-settings.json");
-        const useLocalClaudeConfig = this.runtimeSettings?.authMode === "local";
         const hasSeaworkSettings = !useLocalClaudeConfig && fs.existsSync(seaworkSettingsPath);
         // Windows' CreateProcess returns ENOENT when the spawn cwd does not exist,
         // and the SDK mislabels that ENOENT as "Claude Code executable not found".
@@ -1927,15 +2009,17 @@ class ClaudeAgentSession {
         if (this.claudeSessionId) {
             base.resume = this.claudeSessionId;
         }
-        return this.applyRuntimeSettings(base);
+        return this.applyRuntimeSettings(base, latencyProxyUrl);
     }
-    applyRuntimeSettings(options) {
-        return applyRuntimeSettingsToClaudeOptions(options, this.runtimeSettings, this.launchEnv, this.logger);
+    applyRuntimeSettings(options, latencyProxyUrl) {
+        return applyRuntimeSettingsToClaudeOptions(options, this.runtimeSettings, this.launchEnv, this.logger, latencyProxyUrl);
     }
     normalizeMcpServers(servers) {
         const result = {};
         for (const [name, config] of Object.entries(servers)) {
-            result[name] = toClaudeSdkMcpConfig(config);
+            const sdkConfig = toClaudeSdkMcpConfig(config);
+            result[name] =
+                name === "seawork" ? Object.assign(sdkConfig, { alwaysLoad: true }) : sdkConfig;
         }
         return result;
     }
@@ -2778,12 +2862,13 @@ class ClaudeAgentSession {
         try {
             const historyPath = this.resolveHistoryPath(sessionId);
             if (!historyPath || !fs.existsSync(historyPath)) {
+                this.logger.warn({ sessionId, cwd: this.config.cwd }, "Claude transcript not found on resume");
                 return;
             }
             this.ingestPersistedHistory(fs.readFileSync(historyPath, "utf8"));
         }
         catch (error) {
-            // ignore history load failures
+            this.logger.warn({ error, sessionId }, "Failed to load Claude persisted history");
         }
     }
     ingestPersistedHistory(content) {
@@ -2826,11 +2911,40 @@ class ClaudeAgentSession {
         const cwd = this.config.cwd;
         if (!cwd)
             return null;
-        // Match Claude CLI's path sanitization: replace slashes, dots, and underscores with dashes
-        const sanitized = cwd.replace(/[\\/\.]/g, "-").replace(/_/g, "-");
+        const cached = this.historyPathCache.get(sessionId);
+        if (cached) {
+            return cached;
+        }
         const configDir = process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude");
-        const dir = path.join(configDir, "projects", sanitized);
-        return path.join(dir, `${sessionId}.jsonl`);
+        const projectsRoot = path.join(configDir, "projects");
+        // Fast path: reproduce Claude CLI's directory sanitization (slashes, dots,
+        // underscores, and Windows drive colons all collapse to dashes). Matches for
+        // the common case with a single existsSync and no directory scan.
+        const sanitized = claudeProjectDirName(cwd);
+        const guess = path.join(projectsRoot, sanitized, `${sessionId}.jsonl`);
+        if (fs.existsSync(guess)) {
+            this.historyPathCache.set(sessionId, guess);
+            return guess;
+        }
+        // Fallback: the sanitization rule can diverge from what Claude CLI actually
+        // wrote (non-ASCII paths, trailing slashes, etc.). The session id is a unique
+        // uuid, so scan project dirs for an exact `<sessionId>.jsonl` match without
+        // reading any file contents.
+        let projectDirs;
+        try {
+            projectDirs = fs.readdirSync(projectsRoot);
+        }
+        catch {
+            return guess;
+        }
+        for (const dirName of projectDirs) {
+            const candidate = path.join(projectsRoot, dirName, `${sessionId}.jsonl`);
+            if (fs.existsSync(candidate)) {
+                this.historyPathCache.set(sessionId, candidate);
+                return candidate;
+            }
+        }
+        return guess;
     }
     convertHistoryEntry(entry) {
         return convertClaudeHistoryEntry(entry, (content) => this.mapBlocksToTimeline(content));