@tangle-network/sdk-provider-claude-code 0.0.0-stage → 0.6.1

package/dist/index.mjs

@@ -0,0 +1,1877 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { InteractionKind, ProxySecretBindingSchema, ProxySecretGrantSchema, ProxySecretReceiptSchema, ProxySecretUpdateControlsSchema, ProxySecretsSchema, isProxySecretScopeAttenuation, ownPropertyRecordSchema, proxySecretPresentationsEqual, resolveTangleRouterDefaults } from "@tangle-network/agent-interface";
+import { CliProviderAdapterBase, EXECUTION_CORRELATION_HEADERS, InteractionBroker, InteractionMcpServer, TerminalPlanSupport, executionCorrelationHeaders, interactionMcpToolName, interactionToggleEnabled, jsonEventParser, localMcpArgv, localMcpEnv, nativeEffortArgs, partitionImageAttachments, reasoningEvents, recordCliTokenUsage, sessionObservedEvents, streamPartBase, textSnapshotEvents, toolResultEvents, toolStartEvents, trackFilePart, withTurnInteractions } from "@tangle-network/sdk-provider-cli-base";
+import { z } from "zod";
+import { HELD_SPARE_IDLE_MS, argAfter, createDeferredParser, createHeldSpareRegistry, launchDifferences, shellQuote } from "@tangle-network/sdk-cli-runner";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { unqualifyModelId } from "@tangle-network/agent-profile-materialize";
+import { createServer } from "node:http";
+//#region src/claude-event-state.ts
+function assistantUsageEvents(event, state, backend) {
+	const message = event.message;
+	if (message?.usage === void 0) return [];
+	const id = message.id;
+	const usage = message.usage;
+	const keys = [
+		"input_tokens",
+		"output_tokens",
+		"cache_read_input_tokens",
+		"cache_creation_input_tokens"
+	];
+	if (!(typeof id === "string" && id.length > 0 && keys.every((key) => Number.isSafeInteger(usage[key]) && usage[key] >= 0))) return [{
+		type: "raw",
+		backend,
+		event: {
+			type: "assistant.usage",
+			message_id: id,
+			usage
+		}
+	}];
+	const current = usage;
+	const previous = state.assistantUsage.get(id);
+	if (previous && keys.every((key) => current[key] === previous[key])) return [];
+	if (previous && keys.some((key) => current[key] < previous[key])) return [{
+		type: "raw",
+		backend,
+		event: {
+			type: "assistant.usage",
+			message_id: id,
+			usage: { error: "decreasing usage" }
+		}
+	}];
+	state.assistantUsage.set(id, { ...current });
+	return [{
+		type: "raw",
+		backend,
+		event: {
+			type: "assistant.usage",
+			message_id: id,
+			usage: Object.fromEntries(keys.map((key) => [key, current[key] - (previous?.[key] ?? 0)]))
+		}
+	}];
+}
+/**
+* Creates a Part base with required fields.
+*/
+/**
+* Claude Code reports Anthropic's usage shape: `input_tokens` counts only the
+* uncached prompt, and the cache read and cache creation counts are separate.
+* The canonical `inputTokens` is the whole prompt with those two classes inside
+* it, the convention the OpenCode and Codex adapters already report. Without
+* this, a cached turn reported `inputTokens: 6` beside a cache read of 120k,
+* and consumers that classify cache within the total discarded the breakdown.
+* An absent input count stays absent rather than becoming a cache-only total.
+*/
+function inclusiveClaudeInputTokens(usage) {
+	if (usage.inputTokens === void 0) return usage;
+	const inputTokens = usage.inputTokens + (usage.cacheReadInputTokens ?? 0) + (usage.cacheCreationInputTokens ?? 0);
+	return Number.isSafeInteger(inputTokens) ? {
+		...usage,
+		inputTokens
+	} : usage;
+}
+/**
+* Type guard for Claude Code events.
+*/
+function isClaudeCodeEvent(value) {
+	if (typeof value !== "object" || value === null) return false;
+	return typeof value.type === "string";
+}
+//#endregion
+//#region src/claude-shell-result.ts
+/** The prefix the CLI puts on a failed shell command's result. */
+const EXIT_CODE_PREFIX = /^(?:Error:\s*)?Exit code (-?\d+)\b/;
+function exitCodeIn(value) {
+	const text = typeof value === "string" ? value : Array.isArray(value) ? value.map((part) => typeof part === "object" && part !== null && typeof part.text === "string" ? part.text : "").join("") : void 0;
+	const match = text ? EXIT_CODE_PREFIX.exec(text.trimStart()) : null;
+	return match ? Number(match[1]) : void 0;
+}
+/**
+* A shell call's exit status and its two streams, for the part's metadata.
+*
+* The CLI sends a Bash result twice: as the tool_result text the model reads
+* (stdout and stderr together), and as a structured `tool_use_result` beside it
+* — `{ stdout, stderr, interrupted }` for a command that exited 0, or the text
+* `"Error: Exit code N\n…"` for one that did not. The structured copy is the only
+* place the streams are apart and the code is a number, so it is read here and
+* carried as `metadata` the way OpenCode carries `metadata.exit`.
+*
+* Undefined for a tool that is not a shell, or a result that says neither.
+*/
+function shellResultMetadata(toolName, content, isError, structured) {
+	if (!/^bash$/i.test(toolName)) return void 0;
+	const code = exitCodeIn(structured) ?? exitCodeIn(content);
+	if (typeof structured === "object" && structured !== null && !Array.isArray(structured)) {
+		const record = structured;
+		const stdout = typeof record.stdout === "string" ? record.stdout : void 0;
+		const stderr = typeof record.stderr === "string" ? record.stderr : void 0;
+		if (stdout !== void 0 || stderr !== void 0) {
+			const exitCode = code ?? (isError ? void 0 : 0);
+			return {
+				...exitCode !== void 0 ? { exitCode } : {},
+				...stdout !== void 0 ? { stdout } : {},
+				...stderr ? { stderr } : {}
+			};
+		}
+	}
+	return code !== void 0 ? { exitCode: code } : void 0;
+}
+//#endregion
+//#region ../runtime-contracts/dist/model-key-proxy.js
+const MODEL_KEY_PROXY_ENV = "TANGLE_OPENCODE_MODEL_PROXY";
+const TURN_KEY_PLACEHOLDER_PREFIX = "tangle-turn-key";
+const MODEL_KEY_PROXY_PATH_PREFIX = "/v1/";
+const MODEL_KEY_PROXY_SPARE_HEADER = "x-tangle-spare-id";
+const LOOPBACK_BASE_URL = /^http:\/\/127\.0\.0\.1:[0-9]+$/;
+function isTurnKeyPlaceholder(value) {
+	return value?.startsWith(`${TURN_KEY_PLACEHOLDER_PREFIX}.`) === true;
+}
+function parseModelKeyProxyBinding(raw) {
+	if (raw === void 0) return void 0;
+	const parsed = JSON.parse(raw);
+	const baseUrl = typeof parsed === "object" && parsed !== null && "baseUrl" in parsed ? parsed.baseUrl : void 0;
+	if (typeof baseUrl !== "string" || !LOOPBACK_BASE_URL.test(baseUrl)) throw new Error("Model key proxy binding is invalid");
+	return {
+		baseUrl,
+		passThrough: typeof parsed === "object" && parsed !== null && "passThrough" in parsed && parsed.passThrough === true
+	};
+}
+const MODEL_KEY_PROXY_HOME_PATH_PREFIX = "/v1h/";
+function modelKeyProxyHomeTag(runtimeHome) {
+	return Buffer.from(runtimeHome.replace(/\/+$/, "")).toString("base64url");
+}
+function proxiedModelUrl(proxyBaseUrl, upstream, options) {
+	const encoded = Buffer.from(upstream).toString("base64url");
+	return options?.runtimeHome ? `${proxyBaseUrl}${MODEL_KEY_PROXY_HOME_PATH_PREFIX}${modelKeyProxyHomeTag(options.runtimeHome)}/${encoded}` : `${proxyBaseUrl}${MODEL_KEY_PROXY_PATH_PREFIX}${encoded}`;
+}
+function baseProxyToken(token) {
+	const i = token.indexOf(".");
+	return i === -1 ? token : token.slice(0, i);
+}
+const MODEL_PROXY_TOKENS = {
+	OPENCODE_MODEL_API_KEY: "proxy-model-token",
+	OPENAI_API_KEY: "proxy-openai-token",
+	ANTHROPIC_API_KEY: "proxy-anthropic-token",
+	OPENROUTER_API_KEY: "proxy-openrouter-token",
+	TANGLE_INFERENCE_KEY: "proxy-openai-token",
+	ZAI_API_KEY: "proxy-zai-token",
+	ZHIPU_API_KEY: "proxy-zai-token"
+};
+const MODEL_PROXY_TOKEN_VALUES = new Set(Object.values(MODEL_PROXY_TOKENS));
+function isManagedModelToken(value) {
+	const key = value?.trim();
+	return !!key && MODEL_PROXY_TOKEN_VALUES.has(baseProxyToken(key));
+}
+function managedModelProxyUrl(input) {
+	if (!isManagedModelToken(input.apiKey) || isTurnKeyPlaceholder(input.apiKey)) return void 0;
+	const binding = parseModelKeyProxyBinding(input.binding);
+	if (binding?.passThrough !== true) return void 0;
+	try {
+		const url = new URL(input.upstream);
+		if (url.protocol !== "https:" && url.protocol !== "http:") return void 0;
+		if (url.username || url.password || url.search || url.hash) return void 0;
+	} catch {
+		return;
+	}
+	const runtimeHome = input.runtimeHome?.trim();
+	return proxiedModelUrl(binding.baseUrl, input.upstream, { ...runtimeHome ? { runtimeHome } : {} });
+}
+new Set([
+	...Object.keys(MODEL_PROXY_TOKENS),
+	"TANGLE_API_KEY",
+	"GITHUB_TOKEN",
+	"GH_TOKEN"
+]);
+/** True for a slot name, which exists at the proxy and never in a box env. */
+function isDeclaredSecretSlotEnvVar(name) {
+	return /^TANGLE_DECLARED_SLOT_\d+$/.test(name);
+}
+//#endregion
+//#region ../runtime-contracts/dist/harness-warm-transport.js
+/** Set only by the Sandbox API after the OpenCode warm-server rollout decision. */
+const AGENT_INTERNAL_OPENCODE_WARM_SERVER_ENV_VAR = "AGENT_INTERNAL_OPENCODE_WARM_SERVER";
+/**
+* Sidecar switch: after a warm claim, start the first session's OpenCode
+* server before that session's first turn. Effective only with
+* AGENT_INTERNAL_OPENCODE_WARM_SERVER=1. Any value other than "1" is off.
+*/
+const AGENT_INTERNAL_OPENCODE_PREWARM_ENV_VAR = "AGENT_INTERNAL_OPENCODE_PREWARM";
+/** Persistent Kimi wire process and shared create/resume prewarm gates. */
+const AGENT_INTERNAL_KIMI_WARM_SERVER_ENV_VAR = "AGENT_INTERNAL_KIMI_WARM_SERVER";
+const AGENT_INTERNAL_KIMI_PREWARM_ENV_VAR = "AGENT_INTERNAL_KIMI_PREWARM";
+/**
+* Claude Code and Codex run one process per turn. A harness's warm switch
+* sends its managed-token turns' model requests through the sidecar's key
+* proxy (which reports each turn's first model request) and lets a process
+* started ahead of the turn take the turn: Claude Code launches a managed turn
+* with its prompt on stdin (stream-json); Codex already reads its prompt from
+* stdin. Its prewarm switch starts that process at claim, boot and recover.
+* Both default off; off, every turn calls its upstream directly.
+*/
+const AGENT_INTERNAL_CLAUDE_CODE_WARM_SERVER_ENV_VAR = "AGENT_INTERNAL_CLAUDE_CODE_WARM_SERVER";
+/**
+* Per harness, the two switches the Sandbox API sets from its warm-server
+* rollout decision: the long-lived process transport, and prewarm, which
+* starts that process before the turn that uses it and is only meaningful
+* with it. A harness joins the rollout by adding one row; the Sandbox API,
+* the orchestrator's provision guard and its recreate carry all read this
+* table. Values are "1" or "0"; anything else is off.
+*/
+const HARNESS_WARM_TRANSPORT_ENV = {
+	opencode: {
+		warmServer: AGENT_INTERNAL_OPENCODE_WARM_SERVER_ENV_VAR,
+		prewarm: AGENT_INTERNAL_OPENCODE_PREWARM_ENV_VAR
+	},
+	"kimi-code": {
+		warmServer: AGENT_INTERNAL_KIMI_WARM_SERVER_ENV_VAR,
+		prewarm: AGENT_INTERNAL_KIMI_PREWARM_ENV_VAR
+	},
+	"claude-code": {
+		warmServer: AGENT_INTERNAL_CLAUDE_CODE_WARM_SERVER_ENV_VAR,
+		prewarm: "AGENT_INTERNAL_CLAUDE_CODE_PREWARM"
+	},
+	codex: {
+		warmServer: "AGENT_INTERNAL_CODEX_WARM_SERVER",
+		prewarm: "AGENT_INTERNAL_CODEX_PREWARM"
+	}
+};
+//#endregion
+//#region ../runtime-contracts/dist/proxy-secret-materialization.js
+const syntheticHeader = {
+	alg: "HS256",
+	typ: "JWT"
+};
+const encode = (value) => btoa(value instanceof Uint8Array ? String.fromCharCode(...value) : JSON.stringify(value)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+function placeholderPrefix(slot, format, expiresAt) {
+	return format === "jwt" ? `${encode(syntheticHeader)}.${encode({
+		sub: "sandbox-placeholder",
+		aud: "proxy-secret-placeholder",
+		exp: Math.floor(Date.parse(expiresAt) / 1e3)
+	})}.` : `proxy-declared-${slot.slice(21)}-token-`;
+}
+function isSyntheticPlaceholder(material) {
+	const prefix = placeholderPrefix(material.slot, material.grant.placeholderFormat, material.issuerExpiresAt);
+	return material.placeholder.startsWith(prefix) && /^[A-Za-z0-9_-]{43}$/.test(material.placeholder.slice(prefix.length));
+}
+z.array(z.strictObject({
+	binding: ProxySecretBindingSchema,
+	grant: ProxySecretGrantSchema,
+	placeholder: z.string().min(1),
+	slot: z.string().refine(isDeclaredSecretSlotEnvVar),
+	issuerExpiresAt: z.iso.datetime()
+})).superRefine((materials, ctx) => {
+	const bindings = ProxySecretsSchema.safeParse(materials.map((m) => m.binding));
+	const unique = (values) => new Set(values).size === values.length;
+	if (!bindings.success || !unique(materials.map((m) => m.slot)) || !unique(materials.map((m) => m.placeholder)) || !unique(materials.map((m) => m.grant.grantId)) || new Set(materials.map((m) => m.grant.epoch)).size > 1 || new Set(materials.map((m) => m.grant.sandboxId)).size > 1 || materials.some((material) => !isSyntheticPlaceholder(material)) || materials.some(({ binding, grant, issuerExpiresAt }) => !isProxySecretScopeAttenuation(binding, grant.scope) || !proxySecretPresentationsEqual(binding.presentation, grant.presentation) || (binding.placeholderFormat ?? "opaque") !== grant.placeholderFormat || Date.parse(grant.expiresAt) > Date.parse(issuerExpiresAt))) ctx.addIssue({
+		code: "custom",
+		message: "Invalid proxy secret materialization"
+	});
+});
+ProxySecretUpdateControlsSchema.extend({
+	resolvedSecrets: ownPropertyRecordSchema(z.string().min(1), { maxEntries: Number.MAX_SAFE_INTEGER }).default({}),
+	proxySecretGrants: ProxySecretReceiptSchema.options[0].shape.bindings,
+	expectedProxySecretGeneration: ProxySecretUpdateControlsSchema.shape.expectedProxySecretGeneration.unwrap()
+}).strict().refine((body) => new Set(body.proxySecretGrants.map((b) => b.envName)).size === body.proxySecretGrants.length);
+//#endregion
+//#region ../runtime-contracts/dist/runtime-environment.js
+const SAFE_ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function isSafeEnvVarName(name) {
+	if (typeof name !== "string") return false;
+	if (name.length === 0 || name.length > 256) return false;
+	return SAFE_ENV_VAR_NAME_RE.test(name);
+}
+/** Client proxy URLs first, then bypass names. */
+const EGRESS_PROXY_ENV_NAMES = [
+	"HTTPS_PROXY",
+	"https_proxy",
+	"HTTP_PROXY",
+	"http_proxy",
+	"NO_PROXY",
+	"no_proxy"
+];
+const CA_TRUST_ENV_NAMES = [
+	"NODE_EXTRA_CA_CERTS",
+	"SSL_CERT_FILE",
+	"CURL_CA_BUNDLE",
+	"GIT_SSL_CAINFO",
+	"NIX_SSL_CERT_FILE"
+];
+[...EGRESS_PROXY_ENV_NAMES, ...CA_TRUST_ENV_NAMES];
+const FORBIDDEN_ENV_VAR_NAMES = new Set([
+	"LD_PRELOAD",
+	"LD_LIBRARY_PATH",
+	"LD_AUDIT",
+	"DYLD_INSERT_LIBRARIES",
+	"DYLD_LIBRARY_PATH",
+	"DYLD_FALLBACK_LIBRARY_PATH",
+	"NODE_OPTIONS",
+	"NODE_PATH",
+	"NODE_TLS_REJECT_UNAUTHORIZED",
+	"PYTHONPATH",
+	"PYTHONSTARTUP",
+	"PERL5OPT",
+	"PERL5LIB",
+	"RUBYOPT",
+	"RUBYLIB",
+	"PATH",
+	"NIX_BIN_PATH",
+	"EGRESS_EDGE_POOL_ENABLED",
+	"EDGE_BIND_ID",
+	"PRIVACY_EGRESS",
+	"LOG_REDACT",
+	"IFS",
+	"BASH_ENV",
+	"ENV",
+	"SHELL",
+	"SHELLOPTS",
+	"PROMPT_COMMAND",
+	"HOME",
+	"XDG_CONFIG_HOME",
+	"XDG_DATA_HOME",
+	"XDG_CACHE_HOME",
+	"XDG_STATE_HOME",
+	"XDG_RUNTIME_DIR",
+	"HTTPS_PROXY",
+	"HTTP_PROXY",
+	"ALL_PROXY",
+	"NO_PROXY",
+	"https_proxy",
+	"http_proxy",
+	"all_proxy",
+	"no_proxy",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"REQUESTS_CA_BUNDLE",
+	"CURL_CA_BUNDLE",
+	"NODE_EXTRA_CA_CERTS",
+	"HOSTNAME",
+	"CONTAINER_ID",
+	"AGENT_WORKSPACE_ROOT",
+	"WORKSPACE_PATH",
+	"STORAGE_PATH",
+	"WORKSPACE_FILE_API_ROOT_ONLY",
+	"WORKSPACE_ALLOWED_ABSOLUTE_PATHS",
+	"TANGLE_PLAN_CALLBACK_ALLOWED_ORIGINS"
+]);
+const FORBIDDEN_ENV_VAR_PREFIXES = [
+	"SIDECAR_",
+	"ORCHESTRATOR_",
+	"AGENT_INTERNAL_",
+	"SANDBOX_DEV_",
+	"AGENT_SUBPROCESS_",
+	"TEE_ATTESTATION_"
+];
+const RUNTIME_CALLER_ALLOWED_ENV_NAMES = new Set(["SIDECAR_CAPABILITIES", "SIDECAR_PLATFORM_CONTROL_RUNTIME"]);
+new Set(Object.values(HARNESS_WARM_TRANSPORT_ENV).flatMap(({ warmServer, prewarm }) => [warmServer, prewarm]));
+function isForbiddenEnvVarName(name) {
+	if (RUNTIME_CALLER_ALLOWED_ENV_NAMES.has(name)) return false;
+	if (FORBIDDEN_ENV_VAR_NAMES.has(name)) return true;
+	for (const prefix of FORBIDDEN_ENV_VAR_PREFIXES) if (name.startsWith(prefix)) return true;
+	return false;
+}
+/**
+* POSIX names for caller-owned container env. Runtime process.env merges must additionally enforce
+* isForbiddenEnvVarName, including project provisioning and Sidecar config.
+*/
+const safeEnvRecordSchema = ownPropertyRecordSchema(z.string(), { maxEntries: Number.MAX_SAFE_INTEGER }).refine((value) => Object.keys(value).every(isSafeEnvVarName), { message: "invalid env var name" });
+/** Names only: the caller must keep a separate source and pass values to resume({ env }). */
+const sandboxEnvRecoverySchema = z.object({ callerResupplies: z.array(z.string().max(256).refine(isSafeEnvVarName, { message: "invalid env var name" })).max(128).refine((keys) => new Set(keys).size === keys.length, { message: "callerResupplies must contain unique keys" }) }).strict();
+z.object({
+	envRecovery: sandboxEnvRecoverySchema,
+	dryRun: z.boolean().optional()
+}).strict();
+z.object({
+	envRecovery: sandboxEnvRecoverySchema,
+	eligibleCallerResupplyKeys: z.array(z.string()),
+	requiredOnColdResumeKeys: z.array(z.string()),
+	automaticCredentialRecovery: z.literal(false),
+	dryRun: z.boolean()
+}).strict();
+safeEnvRecordSchema.refine((value) => Object.keys(value).every((key) => !isForbiddenEnvVarName(key) && !key.startsWith("SIDECAR_")), { message: "runtime-owned env var name cannot be set by callers" });
+//#endregion
+//#region src/claude-launch-settings.ts
+const PROFILE_SETTINGS_PATH = ".tangle/claude-settings.json";
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeClaudeSettings(base, overlay) {
+	const merged = { ...base };
+	for (const [key, value] of Object.entries(overlay)) {
+		const previous = merged[key];
+		if (Array.isArray(previous) && Array.isArray(value)) merged[key] = [...previous, ...value];
+		else if (isPlainObject(previous) && isPlainObject(value)) merged[key] = mergeClaudeSettings(previous, value);
+		else merged[key] = value;
+	}
+	return merged;
+}
+const THINKING_DISPLAY_FLAG = "--thinking-display";
+function setsThinkingDisplay(flags) {
+	return flags.some((flag) => flag === "--thinking-display" || flag.startsWith(`--thinking-display=`));
+}
+function extractProfileSettings(flags) {
+	const extraFlags = [];
+	let usesProfileSettings = false;
+	let usesOtherSettings = false;
+	for (let index = 0; index < (flags?.length ?? 0); index += 1) {
+		const flag = flags?.[index];
+		if (flag?.startsWith("--settings=")) {
+			const value = flag.slice(11);
+			if (!value) throw new Error("Claude --settings requires a value");
+			if (value === ".tangle/claude-settings.json") {
+				if (usesProfileSettings) throw new Error("Claude profile settings were supplied more than once");
+				usesProfileSettings = true;
+			} else {
+				usesOtherSettings = true;
+				extraFlags.push(flag);
+			}
+			continue;
+		}
+		if (flag !== "--settings") {
+			extraFlags.push(flag);
+			continue;
+		}
+		const value = flags?.[index + 1];
+		if (value === void 0) throw new Error("Claude --settings requires a value");
+		if (value !== ".tangle/claude-settings.json") {
+			usesOtherSettings = true;
+			extraFlags.push(flag, value);
+			index += 1;
+			continue;
+		}
+		if (usesProfileSettings) throw new Error("Claude profile settings were supplied more than once");
+		usesProfileSettings = true;
+		index += 1;
+	}
+	if (usesProfileSettings && usesOtherSettings) throw new Error("Claude profile settings cannot be combined with another --settings source");
+	return {
+		extraFlags,
+		usesProfileSettings,
+		usesOtherSettings
+	};
+}
+function readProfileSettings(workspaceRoot) {
+	const value = JSON.parse(readFileSync(resolve(workspaceRoot, PROFILE_SETTINGS_PATH), "utf8"));
+	if (!isPlainObject(value)) throw new Error("Claude profile settings must contain a JSON object");
+	return value;
+}
+/**
+* Convert a runtime `McpConfig` into the entry shape claude-code's inline
+* `--mcp-config` expects (`McpHttpServerConfig` / `McpStdioServerConfig`).
+*
+* Accepts both spellings the two config sources use — `remote`/`http` for URL
+* servers, `command` + `environment`/`env` for stdio ones — the same tolerance
+* `buildMcpAddArgs` applies, so a config that can be registered with the CLI can
+* always also be inlined.
+*/
+function toInlineMcpServer(config) {
+	if (config.type === "http" || config.type === "remote") return {
+		type: "http",
+		url: config.url,
+		...config.headers ? { headers: config.headers } : {}
+	};
+	const [bin, ...args] = localMcpArgv(config);
+	const env = localMcpEnv(config);
+	return {
+		type: "stdio",
+		command: bin,
+		...args.length > 0 ? { args } : {},
+		...env ? { env } : {}
+	};
+}
+const PLAN_HOOK_RELAY_SOURCE = `
+const endpoint = process.argv[1];
+const deny = (reason) => ({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } });
+if (!endpoint) {
+  process.stdout.write(JSON.stringify(deny("Plan hook endpoint is missing")));
+  process.exit(0);
+}
+try {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  const response = await fetch(endpoint, { method: "POST", headers: { "content-type": "application/json" }, body: Buffer.concat(chunks) });
+  if (!response.ok) throw new Error(\`Plan hook returned HTTP \${response.status}\`);
+  process.stdout.write(await response.text());
+} catch (error) {
+  process.stdout.write(JSON.stringify(deny(error instanceof Error ? error.message : String(error))));
+}
+`;
+//#endregion
+//#region src/claude-model-auth.ts
+const ANTHROPIC_BASE_URL = "https://api.anthropic.com";
+/**
+* True when `url`'s host is the managed Tangle router. The router is an
+* OpenAI/OpenRouter-compatible gateway that authenticates via
+* `Authorization: Bearer`, so a Claude Code session pointed here must carry
+* its key in ANTHROPIC_AUTH_TOKEN (Bearer), not ANTHROPIC_API_KEY (x-api-key).
+* Any other host (direct api.anthropic.com or a custom Anthropic-native proxy)
+* keeps the native x-api-key path.
+*/
+function isTangleRouterBaseUrl(url) {
+	let host;
+	try {
+		host = new URL(url).host;
+	} catch {
+		return false;
+	}
+	const defaults = resolveTangleRouterDefaults();
+	for (const candidate of [defaults.rootUrl, defaults.baseUrl]) try {
+		if (new URL(candidate).host === host) return true;
+	} catch {}
+	return false;
+}
+/**
+* The URL a Claude Code process with an API key calls, and the key proxy's
+* upstream: the config's own minus any `/vN` (the CLI appends `/v1/messages`,
+* so a box's `<router>/v1` posted `/v1/v1/messages`), else Anthropic.
+*/
+function resolveClaudeCodeBaseUrl(baseUrl) {
+	return baseUrl?.replace(/\/(v\d+)?\/*$/, "") || ANTHROPIC_BASE_URL;
+}
+/** Native subscription model IDs exclude the profile's provider qualification. */
+function normalizeExplicitClaudeModel(model, authMode) {
+	const normalized = authMode === "oauth" ? unqualifyModelId("anthropic", model) : model;
+	if (!normalized.trim()) throw new Error("Explicit Claude model is empty after provider qualification");
+	return normalized;
+}
+//#endregion
+//#region src/permission-mcp-server.ts
+/**
+* Claude Code's wiring onto the shared {@link InteractionMcpServer}
+* (`@tangle-network/sdk-provider-cli-base`). The HTTP/MCP host + tools are shared;
+* only the `--permission-prompt-tool` reply contract (`PermissionResult`) and its
+* grant mapping are claude-specific and stay here.
+*/
+const PERMISSION_MCP_SERVER_NAME = "tangle-permission";
+/** The `mcp__<server>__<tool>` name passed to `--permission-prompt-tool`. */
+const PERMISSION_MCP_TOOL = interactionMcpToolName(PERMISSION_MCP_SERVER_NAME, "permission");
+/**
+* The `ask_user` MODEL tool name. Unlike the permission tool (the
+* `--permission-prompt-tool`, auto-excluded from the toolset), this one the agent
+* calls itself, so it MUST be added to `--allowedTools`.
+*/
+const ASK_USER_MCP_TOOL = interactionMcpToolName(PERMISSION_MCP_SERVER_NAME, "ask_user");
+/**
+* Map a broker {@link PermissionGrant} to a Claude Code {@link PermissionResult}.
+* `allow_session`/`allow_always` also emit `updatedPermissions` addRules so the
+* CLI's own permission store records the grant; note each turn is a fresh
+* `claude --print` process, so cross-turn persistence is best-effort and a
+* re-prompt next turn is expected.
+*/
+function grantToPermissionResult(grant, toolName, input) {
+	if (grant === "deny") return {
+		behavior: "deny",
+		message: "Denied by user"
+	};
+	if (grant === "allow_once") return {
+		behavior: "allow",
+		updatedInput: input
+	};
+	return {
+		behavior: "allow",
+		updatedInput: input,
+		updatedPermissions: [{
+			type: "addRules",
+			rules: [{ toolName }],
+			behavior: "allow",
+			destination: grant === "allow_always" ? "localSettings" : "session"
+		}]
+	};
+}
+//#endregion
+//#region src/claude-exec-args.ts
+const DEFAULT_MODEL = "claude-sonnet-4-5";
+/** Output, model, session, prompt and permission-mode flags of one turn. */
+function claudeSessionArgs(params, planMode, routesPermissions) {
+	const args = [];
+	args.push("--print");
+	args.push("--output-format", "stream-json");
+	args.push("--verbose");
+	const authMode = params.config.authMode ?? (params.config.apiKey ? "api-key" : "oauth");
+	const model = params.model ?? params.config.model ?? (authMode === "api-key" ? DEFAULT_MODEL : void 0);
+	if (model) args.push("--model", normalizeExplicitClaudeModel(model, authMode));
+	if (params.sessionId) args.push("--resume", params.sessionId);
+	else {
+		if (params.mintedSessionId) args.push("--session-id", params.mintedSessionId);
+		if (params.systemPrompt) args.push("--system-prompt", params.systemPrompt);
+		if (params.appendSystemPrompt) args.push("--append-system-prompt", params.appendSystemPrompt);
+	}
+	if (!routesPermissions && !planMode && params.config.bypassPermissions !== false) args.push("--dangerously-skip-permissions");
+	if (planMode) args.push("--permission-mode", "plan");
+	return args;
+}
+/**
+* The inline `--settings` object of one turn: the plan hook relay and the
+* managed proxy endpoint, layered over the profile's settings file.
+*/
+function claudeTurnSettings(executionContext, profileSettings, workspaceRoot, resolveProxiedBaseUrl) {
+	const { usesProfileSettings, usesOtherSettings } = profileSettings;
+	let executionSettings;
+	if (executionContext?.planHookServer) {
+		if (usesOtherSettings) throw new Error("Claude plan hooks cannot be combined with another --settings source");
+		const planSettings = { hooks: { PreToolUse: [{
+			matcher: "ExitPlanMode",
+			hooks: [{
+				type: "command",
+				command: `${shellQuote(process.execPath)} -e ${shellQuote(PLAN_HOOK_RELAY_SOURCE)} ${shellQuote(executionContext.planHookServer.hookUrl)}`,
+				timeout: 60
+			}]
+		}] } };
+		executionSettings = mergeClaudeSettings(usesProfileSettings ? readProfileSettings(workspaceRoot) : executionSettings ?? {}, planSettings);
+	}
+	const proxiedBaseUrl = resolveProxiedBaseUrl();
+	if (proxiedBaseUrl) executionSettings = mergeClaudeSettings(executionSettings ?? (usesProfileSettings ? readProfileSettings(workspaceRoot) : {}), { env: { ANTHROPIC_BASE_URL: proxiedBaseUrl } });
+	return executionSettings;
+}
+/**
+* MCP wiring. The interactive permission decider is the
+* --permission-prompt-tool, which the CLI auto-EXCLUDES from the model
+* toolset (it must NOT be added to --allowedTools). Everything rides a
+* SINGLE --mcp-config object (the flag is passed once). Tool names follow
+* the documented `mcp__<server>__<tool>`.
+*
+* Runtime servers (hub connections, sandbox capabilities) MUST be merged
+* here, not left to `claude mcp add` alone: whenever this object is
+* non-empty we also pass --strict-mcp-config, which makes the CLI use ONLY
+* these entries and ignore its own config store. Registering a server
+* solely through the store meant it silently vanished on exactly the turns
+* that carry a permission or plan interaction.
+*
+* They need no --allowedTools entry: a normal turn runs with
+* --dangerously-skip-permissions, and a permission-routing turn is
+* deliberately supposed to surface each tool use to the human.
+*/
+function claudeMcpArgs(runtimeMcpServers, executionContext, modes) {
+	const args = [];
+	const mcpServers = { ...runtimeMcpServers };
+	const allowedMcpTools = [];
+	if (modes.hostsServer && executionContext?.permissionServer) {
+		const server = executionContext.permissionServer;
+		mcpServers[PERMISSION_MCP_SERVER_NAME] = {
+			type: "http",
+			url: server.url,
+			headers: { Authorization: `Bearer ${server.token}` }
+		};
+		if (modes.exposesAskUser) allowedMcpTools.push(ASK_USER_MCP_TOOL);
+	}
+	if (Object.keys(mcpServers).length > 0) {
+		args.push("--mcp-config", JSON.stringify({ mcpServers }));
+		args.push("--strict-mcp-config");
+	}
+	if (allowedMcpTools.length > 0) args.push("--allowedTools", allowedMcpTools.join(","));
+	if (modes.routesPermissions && executionContext?.permissionServer) args.push("--permission-prompt-tool", PERMISSION_MCP_TOOL);
+	return args;
+}
+/**
+* The turn as one stream-json user message instead of a positional arg —
+* the only way the CLI accepts inline image content.
+*/
+function claudeStreamJsonTurn(messageText, qualifyingImages) {
+	const content = messageText ? [{
+		type: "text",
+		text: messageText
+	}] : [];
+	for (const att of qualifyingImages) content.push({
+		type: "image",
+		source: att.base64 !== void 0 ? {
+			type: "base64",
+			media_type: att.mediaType ?? "image/png",
+			data: att.base64
+		} : {
+			type: "url",
+			url: att.url
+		}
+	});
+	return `${JSON.stringify({
+		type: "user",
+		message: {
+			role: "user",
+			content
+		}
+	})}\n`;
+}
+//#endregion
+//#region src/claude-execution-context.ts
+const executionContexts = /* @__PURE__ */ new WeakMap();
+function registerClaudeExecutionContext(adapter, context) {
+	executionContexts.set(adapter, context);
+	return context;
+}
+function claudeExecutionContext(adapter) {
+	return executionContexts.get(adapter);
+}
+//#endregion
+//#region src/claude-launch-routing.ts
+function claudeRoutesPlans(config) {
+	if (typeof config.interactions === "boolean" || config.interactions !== void 0 && "plan" in config.interactions) return interactionToggleEnabled(config.interactions, "plan");
+	return config.planMode === true;
+}
+/**
+* Derived interaction wiring for a turn. `routesPermissions` (interactive or
+* permission mode) installs the permission decider tool and REQUIRES dropping the
+* bypass flag; `exposesAskUser` (interactive or `interactions.question`)
+* publishes the ask_user model tool. A question-only turn hosts the server
+* for ask_user alone while permissions stay fully bypassed.
+*/
+function interactionModes(config) {
+	const interactive = config.interactivePermissions === true;
+	const routesPermissions = interactive || interactionToggleEnabled(config.interactions, "permission");
+	const exposesAskUser = interactive || interactionToggleEnabled(config.interactions, "question");
+	return {
+		routesPermissions,
+		exposesAskUser,
+		hostsServer: routesPermissions || exposesAskUser
+	};
+}
+/**
+* The box's claude-code warm switch, set from the cohort decision: it sends
+* managed turns through the key proxy and lets a held process take them.
+* Off, every turn keeps the direct path.
+*/
+function claudeWarmSwitchOn() {
+	return process.env[AGENT_INTERNAL_CLAUDE_CODE_WARM_SERVER_ENV_VAR] === "1";
+}
+/**
+* The key proxy's binding as the host or the process environment names it.
+* An explicit host value, including a scrub, wins over inherited state.
+*/
+function modelKeyProxyBindingValue(agentEnvironmentValues) {
+	const host = agentEnvironmentValues();
+	return Object.hasOwn(host, "TANGLE_OPENCODE_MODEL_PROXY") ? host[MODEL_KEY_PROXY_ENV] : process.env[MODEL_KEY_PROXY_ENV];
+}
+/**
+* Where a managed-token turn sends its model requests: the sidecar's
+* model-key proxy, which reports the turn's first request and relays every
+* header unchanged. Undefined (the direct path) off the warm switch, for a
+* caller's own key, a box whose proxy is not listening, or a turn that
+* brings its own `--settings`, which this one's cannot be combined with.
+*/
+function managedProxyBaseUrl(config, agentEnvironmentValues) {
+	if (!claudeWarmSwitchOn()) return void 0;
+	if ((config.authMode ?? (config.apiKey ? "api-key" : "oauth")) !== "api-key" || !config.apiKey) return void 0;
+	if (extractProfileSettings(config.extraFlags).usesOtherSettings) return void 0;
+	return managedModelProxyUrl({
+		binding: modelKeyProxyBindingValue(agentEnvironmentValues),
+		apiKey: config.apiKey,
+		upstream: resolveClaudeCodeBaseUrl(config.baseUrl),
+		runtimeHome: config.runtimeHome
+	});
+}
+//#endregion
+//#region src/claude-launch-adapter.ts
+/** Prompts above this many bytes go on stdin; the kernel caps one argv string at 128 KiB. */
+const MAX_ARGV_PROMPT_BYTES = 120 * 1024;
+/** Owns Claude's native launch, authentication, MCP registration, and request routing. */
+var ClaudeLaunchAdapter = class extends CliProviderAdapterBase {
+	provider = "claude-code";
+	profileHarness = "claude-code";
+	defaultCliPath = "claude";
+	/** Per-turn state must not bleed between concurrent execute calls. */
+	executionContext = registerClaudeExecutionContext(this, new AsyncLocalStorage());
+	/**
+	* Servers installed at runtime via `addMcp` (hub connections, sandbox
+	* capabilities), kept so `buildArgs` can merge them into the single
+	* `--mcp-config` object. See the merge site for why the CLI's own config
+	* store is not sufficient on its own.
+	*/
+	runtimeMcpServers = {};
+	/**
+	* Image attachments ride the native `--input-format stream-json` path
+	* (see `buildExecArgs`) instead of the `[Image: ...]` text marker — the
+	* base adapter pre-reads their base64/url into `attachments` and omits
+	* the marker for this kind.
+	*/
+	nativeAttachmentKinds() {
+		return ["image"];
+	}
+	buildExecArgs(params) {
+		const { extraFlags, usesProfileSettings, usesOtherSettings } = extractProfileSettings(params.config.extraFlags);
+		const planMode = claudeRoutesPlans(params.config);
+		const modes = interactionModes(params.config);
+		const args = claudeSessionArgs(params, planMode, modes.routesPermissions);
+		const executionContext = this.executionContext.getStore();
+		const executionSettings = claudeTurnSettings(executionContext, {
+			usesProfileSettings,
+			usesOtherSettings
+		}, params.workspaceRoot, () => managedProxyBaseUrl(params.config, () => this.agentEnvironmentValues()));
+		if (executionSettings) args.push("--settings", JSON.stringify(executionSettings));
+		else if (usesProfileSettings) args.push("--settings", PROFILE_SETTINGS_PATH);
+		const mcpArgs = claudeMcpArgs(this.runtimeMcpServers, executionContext, modes);
+		args.push(...mcpArgs);
+		if (params.config.isolateHostSettings) {
+			args.push("--setting-sources", "project,local");
+			if (!mcpArgs.includes("--strict-mcp-config")) args.push("--strict-mcp-config");
+		}
+		if (extraFlags.length > 0) args.push(...extraFlags);
+		if (!setsThinkingDisplay(extraFlags)) args.push(THINKING_DISPLAY_FLAG, "summarized");
+		args.push(...nativeEffortArgs("claude-code", params.config.profile?.model?.reasoningEffort));
+		const { native: qualifyingImages, message: messageText } = partitionImageAttachments({
+			message: params.message,
+			attachments: params.attachments,
+			qualifies: (att) => att.base64 !== void 0 || att.url !== void 0
+		});
+		const held = this.launchesHeld(params.config, params.sessionId);
+		const promptTooLongForArgv = Buffer.byteLength(messageText) > MAX_ARGV_PROMPT_BYTES;
+		if (qualifyingImages.length > 0 || held || promptTooLongForArgv) {
+			args.push("--input-format", "stream-json");
+			return {
+				command: this.getCliPath(),
+				args,
+				useStdin: true,
+				stdin: claudeStreamJsonTurn(messageText, qualifyingImages)
+			};
+		}
+		args.push(messageText);
+		return {
+			command: this.getCliPath(),
+			args,
+			useStdin: false
+		};
+	}
+	buildExecEnv(config) {
+		const env = this.agentEnvironmentValues();
+		if (process.getuid?.() === 0) env.HOME = "/home/agent";
+		const nonessentialOff = env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC;
+		env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = nonessentialOff === void 0 ? "1" : /^(?:0|false|no|off)?$/iu.test(nonessentialOff.trim()) ? void 0 : nonessentialOff;
+		if (config.isolateHostSettings) env.CLAUDE_CODE_DISABLE_AUTO_MEMORY = "1";
+		const authMode = config.authMode ?? (config.apiKey ? "api-key" : "oauth");
+		if (authMode === "api-key" || config.nativeAuthEnv !== void 0 || (config.authFiles?.length ?? 0) > 0) {
+			env.CLAUDE_CODE_OAUTH_TOKEN = void 0;
+			env.CLAUDE_CONFIG_DIR = void 0;
+			env.ANTHROPIC_CONFIG_DIR = void 0;
+			env.ANTHROPIC_PROFILE = void 0;
+			env.ANTHROPIC_FEDERATION_RULE_ID = void 0;
+			env.ANTHROPIC_ORGANIZATION_ID = void 0;
+		}
+		if (authMode === "api-key" && config.apiKey) {
+			const baseUrl = resolveClaudeCodeBaseUrl(config.baseUrl);
+			env.ANTHROPIC_BASE_URL = baseUrl;
+			if (baseUrl && isTangleRouterBaseUrl(baseUrl)) {
+				env.ANTHROPIC_AUTH_TOKEN = config.apiKey;
+				env.ANTHROPIC_API_KEY = void 0;
+			} else {
+				env.ANTHROPIC_API_KEY = config.apiKey;
+				env.ANTHROPIC_AUTH_TOKEN = void 0;
+			}
+			env.CLAUDE_CODE_USE_BEDROCK = void 0;
+			env.CLAUDE_CODE_USE_VERTEX = void 0;
+			env.CLAUDE_CODE_USE_FOUNDRY = void 0;
+		} else {
+			env.ANTHROPIC_API_KEY = void 0;
+			env.ANTHROPIC_AUTH_TOKEN = void 0;
+			env.ANTHROPIC_BASE_URL = void 0;
+			env.CLAUDE_CODE_USE_BEDROCK = void 0;
+			env.CLAUDE_CODE_USE_VERTEX = void 0;
+			env.CLAUDE_CODE_USE_FOUNDRY = void 0;
+		}
+		return env;
+	}
+	/**
+	* Whether a turn launches with its prompt on stdin (`--input-format
+	* stream-json`) instead of as an argument: a new session on the box's
+	* managed token, sent through the key proxy, with no interaction server to
+	* wire. Only such a turn can take a spare process, because the proxy, not
+	* the process environment, then carries its correlation headers: a launch
+	* the proxy would not route (its own `--settings`, OAuth, an upstream the
+	* proxy cannot name) is never held, so no spare starts for it.
+	*/
+	launchesHeld(config, sessionId) {
+		if (!claudeWarmSwitchOn() || sessionId) return false;
+		if (!isManagedModelToken(config.apiKey)) return false;
+		const { routesPermissions, exposesAskUser } = interactionModes(config);
+		if (routesPermissions || exposesAskUser || claudeRoutesPlans(config)) return false;
+		const context = this.executionContext.getStore();
+		if (context?.permissionServer || context?.planHookServer) return false;
+		return managedProxyBaseUrl(config, () => this.agentEnvironmentValues()) !== void 0;
+	}
+	/**
+	* A turn on the box's managed token sends its requests through the sidecar's
+	* model-key proxy, which reports the turn's first model request and relays
+	* every header unchanged. The correlation headers are bound against the
+	* real base URL first (bindExecutionCorrelation, inside super), so the
+	* request carries the same headers on either path. A caller's own key, or a
+	* box whose proxy is not listening, keeps the direct path.
+	*/
+	buildTurnEnvironment(executionConfig, profilePlan, workspaceRoot, correlationHeaders) {
+		const environment = super.buildTurnEnvironment(executionConfig, profilePlan, workspaceRoot, correlationHeaders);
+		const proxied = managedProxyBaseUrl(executionConfig, () => this.agentEnvironmentValues());
+		return proxied ? {
+			...environment,
+			ANTHROPIC_BASE_URL: proxied
+		} : environment;
+	}
+	/**
+	* Claude Code adds `ANTHROPIC_CUSTOM_HEADERS` (one `Name: Value` per line) to
+	* every model request, so the router records this run's trace and execution
+	* binding on each dispatch. Only the Tangle router receives them.
+	*/
+	bindExecutionCorrelation(environment, correlationHeaders) {
+		const baseUrl = environment.ANTHROPIC_BASE_URL;
+		if (correlationHeaders === void 0 || !baseUrl || !isTangleRouterBaseUrl(baseUrl)) return environment;
+		const lines = Object.entries(correlationHeaders).map(([name, value]) => `${name}: ${value}`);
+		const inherited = environment.ANTHROPIC_CUSTOM_HEADERS;
+		return {
+			...environment,
+			ANTHROPIC_CUSTOM_HEADERS: [inherited, ...lines].filter((line) => Boolean(line)).join("\n")
+		};
+	}
+	buildMcpAddArgs(name, config) {
+		const args = ["mcp", "add"];
+		if (config.type === "http" || config.type === "remote") {
+			args.push("--transport", "http", name, config.url);
+			if (config.headers) for (const [key, value] of Object.entries(config.headers)) args.push("--header", `${key}: ${value}`);
+		} else {
+			args.push(name);
+			for (const [key, value] of Object.entries(localMcpEnv(config) ?? {})) args.push("-e", `${key}=${value}`);
+			args.push("--", ...localMcpArgv(config));
+		}
+		return args;
+	}
+	/**
+	* Record the server for inline `--mcp-config` merging, then register it with
+	* the CLI as before.
+	*
+	* Both halves are load-bearing and neither replaces the other. The inline
+	* merge is what actually reaches the model, because a turn carrying any MCP
+	* server also carries `--strict-mcp-config` and the CLI then ignores its own
+	* store. The store registration is what `getMcpStatus` / `claude mcp list`
+	* report, which the sidecar exposes over `/agents/config/mcp`.
+	*
+	* Recorded first so a CLI registration failure cannot leave the agent without
+	* a server that will work perfectly well inline.
+	*/
+	async addMcp(name, config) {
+		this.runtimeMcpServers[name] = toInlineMcpServer(config);
+		await super.addMcp(name, config);
+	}
+	buildMcpListArgs() {
+		return ["mcp", "list"];
+	}
+};
+//#endregion
+//#region src/held-spare.ts
+/**
+* The Claude Code process started before the turn that uses it (the shared
+* mechanics are sdk-cli-runner held-spare.ts).
+*
+* A process started with `--input-format stream-json` and its stdin held open
+* finishes its start ahead of the turn; the turn writes its prompt and the
+* first model request leaves in tens of milliseconds.
+*
+* The one launch difference a turn may have is its correlation headers in
+* ANTHROPIC_CUSTOM_HEADERS, which a process cannot receive after it starts.
+* The spare carries a marker header instead and the sidecar's key proxy puts
+* the turn's headers on the spare's requests (runtime-contracts
+* MODEL_KEY_PROXY_SPARE_HEADER). Anything else that differs stops the spare.
+*/
+let sink;
+/**
+* The sidecar registers the proxy's hook here. Without one, no turn can
+* adopt a spare: nothing would put the turn's headers on its requests.
+*/
+function setHeldSpareTurnSink(next) {
+	sink = next;
+}
+function heldSpareTurnSink() {
+	return sink;
+}
+const claudeHeldSpares = createHeldSpareRegistry();
+//#endregion
+//#region src/claude-warm-adapter.ts
+/** How long a spare a turn reserved waits for that turn to spawn on it. */
+const HELD_SPARE_RESERVATION_MS = 3e4;
+/**
+* ANTHROPIC_CUSTOM_HEADERS lines a spare and the turn that adopts it may
+* differ in: the turn's correlation headers, which the key proxy puts on the
+* spare's requests, and the marker that names the spare to the proxy.
+*/
+const HELD_SPARE_IGNORED_HEADERS = new Set([...EXECUTION_CORRELATION_HEADERS, MODEL_KEY_PROXY_SPARE_HEADER]);
+/**
+* What must match between a spare's environment and its turn's: every value
+* as it is, bar the ANTHROPIC_CUSTOM_HEADERS lines the turn may differ in.
+*/
+function comparableLaunchValue(key, value) {
+	if (key !== "ANTHROPIC_CUSTOM_HEADERS" || value === void 0) return value;
+	const lines = value.split("\n").filter((line) => !HELD_SPARE_IGNORED_HEADERS.has((line.split(":")[0] ?? "").trim().toLowerCase()));
+	return lines.length > 0 ? lines.join("\n") : void 0;
+}
+/** Owns held-process preparation, reservation, and adoption for Claude turns. */
+var ClaudeWarmAdapter = class extends ClaudeLaunchAdapter {
+	/**
+	* Spares a turn reserved in `mintNativeSessionId`, by native session id.
+	* The turn's spawn takes its entry, also when the spare stopped meanwhile.
+	*/
+	reservedSpares = /* @__PURE__ */ new Map();
+	/**
+	* Start the process the box's first turn will adopt: the CLI launched as an
+	* ordinary new-session managed turn would launch it, with its stdin held
+	* open, in this adapter's runtime HOME. `systemPrompt` is the prompt that
+	* turn will carry; a turn whose prompt differs stops the process and starts
+	* its own. `ready` settles false when no spare could start.
+	*/
+	async prewarmProcess(workspaceRootOrUndefined, launch) {
+		this.ensureInitialized();
+		const workspaceRoot = workspaceRootOrUndefined ?? this.storagePath;
+		const refused = { ready: Promise.resolve(false) };
+		const home = this.config.runtimeHome?.trim();
+		if (!home || !claudeWarmSwitchOn()) return refused;
+		const existing = claudeHeldSpares.spareFor(home);
+		if (existing) return { ready: Promise.resolve(existing.state === "idle") };
+		const input = {
+			message: "",
+			systemPrompt: launch.systemPrompt,
+			workspaceRoot
+		};
+		if (this.resolveExecutionProfileForInput(input)) return refused;
+		const profilePlan = await this.materializeProfileResources(void 0, workspaceRoot);
+		if (profilePlan) return refused;
+		const config = this.withProfilePlan(withTurnInteractions(this.config, input), profilePlan);
+		const nativeSessionId = randomUUID();
+		const execArgs = this.buildExecArgs({
+			message: "",
+			config,
+			model: this.resolveProfileModel(void 0),
+			mintedSessionId: nativeSessionId,
+			workspaceRoot,
+			systemPrompt: this.resolveProfileSystemPrompt(launch.systemPrompt, profilePlan)
+		});
+		if (!execArgs.useStdin) return refused;
+		const env = this.buildTurnEnvironment(config, profilePlan, workspaceRoot, void 0);
+		const id = randomUUID();
+		const controller = new AbortController();
+		const parser = createDeferredParser();
+		const child = await super.spawnExecutionProcess({
+			input,
+			sessionId: nativeSessionId,
+			config,
+			execArgs,
+			workspaceRoot,
+			deferRawCapture: true,
+			env: {
+				...env,
+				ANTHROPIC_CUSTOM_HEADERS: [env.ANTHROPIC_CUSTOM_HEADERS, `${MODEL_KEY_PROXY_SPARE_HEADER}: ${id}`].filter((line) => Boolean(line)).join("\n")
+			},
+			signal: controller.signal,
+			parser: parser.config
+		});
+		const spare = {
+			id,
+			home,
+			workspaceRoot,
+			nativeSessionId,
+			upstream: resolveClaudeCodeBaseUrl(config.baseUrl),
+			args: execArgs.args,
+			env,
+			process: child,
+			parser,
+			controller,
+			startedAt: performance.now(),
+			state: "idle"
+		};
+		spare.idleTimer = setTimeout(() => {
+			this.logger.info("Held claude spare idle; stopping it", { home });
+			claudeHeldSpares.stop(spare);
+		}, HELD_SPARE_IDLE_MS);
+		spare.idleTimer.unref();
+		claudeHeldSpares.register(spare);
+		const gone = () => {
+			if (this.reservedSpares.get(nativeSessionId) === spare) this.reservedSpares.delete(nativeSessionId);
+			claudeHeldSpares.stop(spare);
+		};
+		child.exitPromise.then(gone, gone);
+		this.logger.info("Held claude spare started", { home });
+		return { ready: Promise.resolve(child.pid !== void 0) };
+	}
+	/**
+	* A new session adopts the spare in its HOME when the spare can serve the
+	* turn: the same launch, and the key proxy holding the turn's headers for
+	* the spare's requests. It then runs under the spare's native session id.
+	* Every refusal is made here, before the turn records that id; a refused
+	* spare is stopped and the turn runs under an id of its own once the
+	* spare's process has exited, so no two processes ever hold one session or
+	* share the HOME.
+	*/
+	mintNativeSessionId(context) {
+		const spare = claudeHeldSpares.spareFor(this.config.runtimeHome?.trim());
+		if (!spare || spare.state !== "idle") return randomUUID();
+		const refuse = (reason) => {
+			this.logger.info("Held claude spare not adopted", { reason });
+			claudeHeldSpares.stop(spare);
+			const fresh = () => randomUUID();
+			return spare.process.exitPromise.then(fresh, fresh);
+		};
+		if (spare.workspaceRoot !== context.workspaceRoot) return refuse("workspace");
+		const turn = context.buildExecArgs(spare.nativeSessionId);
+		if (!turn.useStdin) return refuse("prompt-not-on-stdin");
+		const differences = launchDifferences(spare, {
+			args: turn.args,
+			env: context.env
+		}, comparableLaunchValue);
+		if (differences.length > 0) return refuse(`launch differs: ${differences.join(",")}`);
+		if (context.timeoutMs !== void 0) return refuse("turn has a timeout");
+		const { input } = context;
+		const executionId = input.interactionBinding?.executionId;
+		if (!executionId) return refuse("no execution binding");
+		const headers = isTangleRouterBaseUrl(resolveClaudeCodeBaseUrl(context.config.baseUrl)) ? executionCorrelationHeaders(input.interactionBinding, input.traceId, input.managedQuoteVersion) ?? {} : {};
+		if (!heldSpareTurnSink()?.({
+			executionId,
+			spareId: spare.id,
+			upstream: spare.upstream,
+			headers
+		})) return refuse("no managed turn of this upstream holds the proxy");
+		spare.state = "reserved";
+		if (spare.idleTimer) clearTimeout(spare.idleTimer);
+		spare.idleTimer = setTimeout(() => claudeHeldSpares.stop(spare), HELD_SPARE_RESERVATION_MS);
+		spare.idleTimer.unref();
+		this.reservedSpares.set(spare.nativeSessionId, spare);
+		return spare.nativeSessionId;
+	}
+	/** A turn that reserved a spare runs on its process; any other starts one. */
+	spawnExecutionProcess(request) {
+		const nativeId = argAfter(request.execArgs.args, "--session-id");
+		const spare = nativeId ? this.reservedSpares.get(nativeId) : void 0;
+		if (!spare || !nativeId) return super.spawnExecutionProcess(request);
+		this.reservedSpares.delete(nativeId);
+		if (spare.state === "reserved") try {
+			return this.adoptHeldSpare(spare, request);
+		} catch (error) {
+			this.logger.info("Held claude spare not adopted", { reason: error instanceof Error ? error.message : String(error) });
+		}
+		else this.logger.info("Held claude spare stopped before its turn spawned");
+		const own = () => super.spawnExecutionProcess(request);
+		return spare.process.exitPromise.then(own, own);
+	}
+	adoptHeldSpare(spare, request) {
+		const adopted = claudeHeldSpares.adopt(spare, request);
+		this.logger.observePhase?.("cli_ready_wait", 0);
+		this.logger.info("Held claude spare adopted", { heldMs: Math.round(performance.now() - spare.startedAt) });
+		return adopted;
+	}
+};
+//#endregion
+//#region src/claude-event-adapter.ts
+/** Owns stream-json event translation and assistant/tool part state. */
+var ClaudeEventAdapter = class extends ClaudeWarmAdapter {
+	createEventParser(state, onEvent) {
+		const extendedState = state;
+		extendedState.contentBlocks = /* @__PURE__ */ new Map();
+		extendedState.assistantUsage = /* @__PURE__ */ new Map();
+		return jsonEventParser(this.logger, onEvent, {
+			label: "Claude Code",
+			accept: isClaudeCodeEvent,
+			map: (event) => this.mapEventToStreamEvents(event, extendedState),
+			isReady: (event) => event.type === "init" || event.type === "system" && event.subtype === "init"
+		});
+	}
+	mapEventToStreamEvents(event, state) {
+		switch (event.type) {
+			case "init": return this.mapInitEvent(event, state);
+			case "system":
+				if (event.subtype === "init" && event.session_id) return this.mapInitEvent(event, state);
+				return this.mapSystemEvent(event);
+			case "assistant": return this.mapAssistantEvent(event, state);
+			case "user": return this.mapUserEvent(event, state);
+			case "content_block_start": return this.mapContentBlockStart(event, state);
+			case "content_block_delta": return this.mapContentBlockDelta(event, state);
+			case "content_block_stop": return this.mapContentBlockStop(event, state);
+			case "tool_use": return toolStartEvents(state, event);
+			case "tool_result": return this.mapToolResultEvent(event, state);
+			case "result": return this.mapResultEvent(event, state);
+			case "error": return this.mapErrorEvent(event);
+			case "rate_limit_event":
+				observeQuotaWindow(event, state);
+				return [{
+					type: "raw",
+					backend: this.provider,
+					event
+				}];
+			default: return [{
+				type: "raw",
+				backend: this.provider,
+				event
+			}];
+		}
+	}
+	mapInitEvent(event, state) {
+		const events = event.session_id ? sessionObservedEvents(state, "claude-code", event.session_id) : [];
+		events.push({
+			type: "status",
+			status: "processing",
+			detail: "Initializing session"
+		});
+		return events;
+	}
+	mapSystemEvent(event) {
+		return [{
+			type: "status",
+			status: "processing",
+			detail: event.message
+		}];
+	}
+	/**
+	* Maps Claude Code stream-json "assistant" events to stream events.
+	* These contain the full message content (thinking, text, tool_use blocks).
+	*/
+	mapAssistantEvent(event, state) {
+		if (event.is_api_error_message || event.error === "rate_limit") {
+			const content = event.message?.content;
+			const message = (Array.isArray(content) ? content.filter((block) => block?.type === "text" && typeof block.text === "string").map((block) => block.text).join("\n") : "") || "Claude Code reported an API error";
+			const failure = quotaFailure(state, {
+				message,
+				code: event.error === "rate_limit" ? "rate_limit_error" : "native_api_error"
+			});
+			state.failure = failure;
+			return [{
+				type: "warning",
+				code: failure.code,
+				message
+			}];
+		}
+		const message = event.message;
+		const usageEvents = assistantUsageEvents(event, state, this.provider);
+		if (!message?.content || !Array.isArray(message.content)) return [...usageEvents, {
+			type: "raw",
+			backend: this.provider,
+			event
+		}];
+		if (message.id && !state.messageId) state.messageId = message.id;
+		const events = [];
+		for (const block of message.content) if (block.type === "text" && block.text) events.push(...textSnapshotEvents(state, block.text));
+		else if (block.type === "thinking" && block.thinking) events.push(...reasoningEvents(state, block.thinking, { signalPhase: false }));
+		else if (block.type === "tool_use" && block.name && block.id) {
+			if (!state.toolCalls.has(block.id)) events.push(...toolStartEvents(state, {
+				id: block.id,
+				name: block.name,
+				input: block.input
+			}));
+		}
+		return [...events, ...usageEvents];
+	}
+	mapContentBlockStart(event, state) {
+		const block = {
+			index: event.index,
+			type: event.content_block.type,
+			id: event.content_block.id,
+			name: event.content_block.name,
+			buffer: "",
+			partId: randomUUID()
+		};
+		state.contentBlocks.set(event.index, block);
+		const events = [];
+		if (block.type === "thinking") events.push({
+			type: "model-processing",
+			phase: "thinking"
+		});
+		else if (block.type === "text") events.push({
+			type: "model-processing",
+			phase: "generating"
+		});
+		return events;
+	}
+	mapContentBlockDelta(event, state) {
+		const block = state.contentBlocks.get(event.index);
+		if (!block) return [];
+		let delta = "";
+		if (event.delta.type === "text_delta" && event.delta.text) {
+			delta = event.delta.text;
+			block.buffer += delta;
+			if (block.type === "text") {
+				state.textBuffer += delta;
+				if (!state.textPartId) state.textPartId = block.partId;
+				return [{
+					type: "message.part.updated",
+					part: {
+						...streamPartBase(state, state.textPartId),
+						type: "text",
+						text: state.textBuffer
+					},
+					delta
+				}];
+			}
+		} else if (event.delta.type === "thinking_delta" && event.delta.thinking) {
+			delta = event.delta.thinking;
+			const isFirstDelta = block.buffer === "";
+			block.buffer += delta;
+			if (!block.partId) block.partId = randomUUID();
+			const partId = block.partId;
+			state.reasoningParts ??= [];
+			let entry = state.reasoningParts.find((p) => p.id === partId);
+			if (!entry) {
+				entry = {
+					id: partId,
+					text: ""
+				};
+				state.reasoningParts.push(entry);
+			}
+			entry.text = block.buffer;
+			if (isFirstDelta) state.reasoningBuffer.push(block.buffer);
+			else state.reasoningBuffer[state.reasoningBuffer.length - 1] = block.buffer;
+			return [{
+				type: "message.part.updated",
+				part: {
+					...streamPartBase(state, block.partId),
+					type: "reasoning",
+					text: block.buffer
+				},
+				delta
+			}];
+		} else if (event.delta.type === "input_json_delta" && event.delta.partial_json) block.buffer += event.delta.partial_json;
+		return [];
+	}
+	mapContentBlockStop(event, state) {
+		const block = state.contentBlocks.get(event.index);
+		if (!block) return [];
+		state.contentBlocks.delete(event.index);
+		if (block.type === "thinking" && block.buffer) {
+			if (state.reasoningBuffer.length === 0 || state.reasoningBuffer[state.reasoningBuffer.length - 1] !== block.buffer) state.reasoningBuffer.push(block.buffer);
+		}
+		return [];
+	}
+	/**
+	* The real claude CLI (2.x stream-json, verified on 2.1.209) delivers every
+	* tool result inside a top-level user event:
+	* `{type:"user", message:{content:[{type:"tool_result", tool_use_id,
+	* content, is_error?}]}}` — there is NO top-level `{type:"tool_result"}`
+	* event on that wire. Each tool_result block routes through the same
+	* completion logic as the top-level shape; other block types in the user
+	* message (echoed text, etc.) carry no completion signal and are skipped.
+	*/
+	mapUserEvent(event, state) {
+		const content = event.message?.content;
+		if (!Array.isArray(content)) return [];
+		const events = [];
+		const results = content.filter((block) => typeof block === "object" && block !== null && block.type === "tool_result" && typeof block.tool_use_id === "string");
+		const structured = results.length === 1 ? event.tool_use_result : void 0;
+		for (const block of results) events.push(...this.completeToolResult({
+			toolUseId: block.tool_use_id,
+			content: block.content,
+			isError: block.is_error === true,
+			structured
+		}, state));
+		return events;
+	}
+	/**
+	* Top-level `{type:"tool_result"}` shape — not emitted by the current CLI
+	* (results arrive via user events, see mapUserEvent) but kept for replay
+	* fixtures and synthetic feeds.
+	*/
+	mapToolResultEvent(event, state) {
+		return this.completeToolResult({
+			toolUseId: event.tool_use_id,
+			content: event.content,
+			isError: event.is_error === true
+		}, state);
+	}
+	/** Shared completion path for a tool result, however the wire delivered it. */
+	completeToolResult(result, state) {
+		const toolCall = state.toolCalls.get(result.toolUseId);
+		const metadata = toolCall ? shellResultMetadata(toolCall.name, result.content, result.isError, result.structured) : void 0;
+		return toolResultEvents(state, {
+			id: result.toolUseId,
+			content: result.content,
+			isError: result.isError,
+			...metadata ? { metadata } : {},
+			afterSuccess: (call) => this.detectFileParts(call, result.content, state)
+		});
+	}
+	/**
+	* Surfaces files an agent produced this turn from a successful tool result.
+	* Built-in write/edit tools carry the path directly on their call input, so
+	* detection needs no result content; MCP tools (`mcp__*`) instead report
+	* output as content blocks, so an `{type:"image"}` block there becomes a
+	* data-URI file part. Every other tool (Bash, Read, Grep, …) has no file
+	* signal Claude Code exposes — a shell command's side effects on disk are
+	* undetectable from the CLI's tool-result event, so those yield nothing.
+	*/
+	detectFileParts(toolCall, content, state) {
+		const events = [];
+		const input = toolCall.input ?? {};
+		const emit = (args) => {
+			const tracked = trackFilePart(state, args);
+			if (!tracked) return;
+			const filePart = {
+				...streamPartBase(state, tracked.id),
+				type: "file",
+				...tracked.filename ? { filename: tracked.filename } : {},
+				...tracked.mediaType ? { mediaType: tracked.mediaType } : {},
+				url: tracked.url
+			};
+			events.push({
+				type: "message.part.updated",
+				part: filePart
+			});
+		};
+		switch (toolCall.name) {
+			case "Write":
+				if (typeof input.file_path === "string") emit({
+					path: input.file_path,
+					changeKind: "add"
+				});
+				return events;
+			case "Edit":
+			case "MultiEdit":
+				if (typeof input.file_path === "string") emit({
+					path: input.file_path,
+					changeKind: "update"
+				});
+				return events;
+			case "NotebookEdit":
+				if (typeof input.notebook_path === "string") emit({
+					path: input.notebook_path,
+					changeKind: "update"
+				});
+				return events;
+			default: break;
+		}
+		if (toolCall.name.startsWith("mcp__") && Array.isArray(content)) for (const block of content) {
+			if (typeof block !== "object" || block === null || block.type !== "image") continue;
+			const { data, mimeType } = block;
+			if (typeof data !== "string" || typeof mimeType !== "string") {
+				this.logger.debug("malformed image block in MCP tool result", { tool: toolCall.name });
+				continue;
+			}
+			emit({
+				dataUri: `data:${mimeType};base64,${data}`,
+				mediaType: mimeType
+			});
+		}
+		return events;
+	}
+	mapResultEvent(event, state) {
+		if (event.session_id) state.sessionId = event.session_id;
+		state.resultEvent = event;
+		if (recordCliTokenUsage(state, event) && state.tokenUsage) state.tokenUsage = inclusiveClaudeInputTokens(state.tokenUsage);
+		const events = [];
+		if (event.session_id) events.push({
+			type: "session.updated",
+			sessionId: event.session_id
+		}, {
+			type: "native.session.observed",
+			provider: "claude-code",
+			nativeSessionId: event.session_id
+		});
+		if (event.is_error) {
+			const observedStatus = event.api_error_status;
+			const statusCode = typeof observedStatus === "number" && Number.isInteger(observedStatus) && observedStatus >= 400 && observedStatus <= 599 ? observedStatus : void 0;
+			const code = statusCode !== void 0 ? "native_api_error" : state.failure?.code ?? (event.terminal_reason === "api_error" ? "native_api_error" : "native_execution_failed");
+			const priorMessage = state.failure?.message;
+			state.terminalStatus = "failed";
+			const failure = quotaFailure(state, {
+				message: priorMessage || "Claude Code reported a failed result",
+				code,
+				...statusCode === void 0 ? {} : { statusCode }
+			});
+			state.failure = failure;
+			const message = (typeof event.result === "string" ? event.result : "") || (Array.isArray(event.errors) ? event.errors.filter((error) => typeof error === "string").join("; ") : "") || failure.message;
+			failure.message = message;
+			events.push({
+				type: "warning",
+				code: failure.code,
+				message
+			});
+			events.push({
+				type: "status",
+				status: "failed",
+				detail: message
+			});
+			return events;
+		}
+		if (event.result && !state.textBuffer) {
+			state.textBuffer = event.result;
+			if (!state.textPartId) state.textPartId = randomUUID();
+			const textPart = {
+				...streamPartBase(state, state.textPartId),
+				type: "text",
+				text: event.result
+			};
+			events.push({
+				type: "message.part.updated",
+				part: textPart,
+				delta: event.result
+			});
+		}
+		events.push({
+			type: "status",
+			status: "completed"
+		});
+		return events;
+	}
+	mapErrorEvent(event) {
+		const message = event.error?.message ?? event.message ?? "Unknown error";
+		return [{
+			type: "warning",
+			code: event.error?.type ?? "CLAUDE_CODE_ERROR",
+			message
+		}];
+	}
+};
+/** A rejected subscription window (stream-json rate_limit_event) names an exhausted quota and when it resets. */
+function observeQuotaWindow(event, state) {
+	const { status, resetsAt } = event.rate_limit_info ?? {};
+	state.quotaResetAt = status === "rejected" && Number.isFinite(resetsAt) ? (/* @__PURE__ */ new Date(resetsAt * 1e3)).toISOString() : void 0;
+	if (state.failure?.code) state.failure = quotaFailure(state, {
+		...state.failure,
+		code: state.failure.code
+	});
+}
+/** A rate-limit failure inside a rejected window is the seat's spent quota (runtime-contracts seat-selection), not a transient 429. */
+function quotaFailure(state, failure) {
+	return state.quotaResetAt && (failure.code === "rate_limit_error" || failure.code === "provider_quota_exhausted" || failure.statusCode === 429) ? {
+		...failure,
+		code: "provider_quota_exhausted",
+		statusCode: 429,
+		resetAt: state.quotaResetAt
+	} : failure;
+}
+//#endregion
+//#region src/plan-hook-server.ts
+var ClaudePlanHookServer = class {
+	secret = randomBytes(24).toString("hex");
+	terminalPlan;
+	server;
+	port = 0;
+	rejectionDelivered = false;
+	nativeSessionId;
+	pendingSubmissions = /* @__PURE__ */ new Set();
+	constructor(options) {
+		this.options = options;
+		this.terminalPlan = new TerminalPlanSupport({
+			planHost: options.planHost,
+			emit: options.emit,
+			providerState: () => {
+				if (!this.nativeSessionId) throw new Error("Claude session identity is unavailable");
+				return {
+					kind: "claude-code",
+					version: 1,
+					nativeSessionId: this.nativeSessionId
+				};
+			}
+		});
+	}
+	get hookUrl() {
+		return `http://127.0.0.1:${this.port}/${this.secret}`;
+	}
+	async start() {
+		const MAX_BODY = 4 * 1024 * 1024;
+		const server = createServer((request, response) => {
+			if (request.method !== "POST" || request.url !== `/${this.secret}`) {
+				response.writeHead(404).end();
+				return;
+			}
+			const chunks = [];
+			let size = 0;
+			request.on("data", (chunk) => {
+				size += chunk.length;
+				if (size > MAX_BODY) {
+					response.writeHead(413).end();
+					request.destroy();
+					return;
+				}
+				chunks.push(chunk);
+			});
+			request.on("error", () => {
+				if (!response.writableEnded) response.writeHead(400).end();
+			});
+			request.on("end", () => {
+				if (response.writableEnded) return;
+				this.handle(Buffer.concat(chunks).toString("utf8")).then((decision) => {
+					response.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify(decision));
+				}, (error) => {
+					response.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify(deny(error instanceof Error ? error.message : String(error))));
+				});
+			});
+		});
+		await new Promise((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(0, "127.0.0.1", resolve);
+		});
+		const address = server.address();
+		if (!address || typeof address === "string") {
+			await new Promise((resolve) => server.close(() => resolve()));
+			throw new Error("Claude plan hook server failed to bind a TCP port");
+		}
+		this.port = address.port;
+		this.server = server;
+	}
+	async stop() {
+		const server = this.server;
+		this.server = void 0;
+		if (!server) return;
+		await new Promise((resolve) => server.close(() => resolve()));
+	}
+	async waitForPendingSubmissions() {
+		while (this.pendingSubmissions.size > 0) await Promise.allSettled([...this.pendingSubmissions]);
+	}
+	async handle(raw) {
+		let hook;
+		try {
+			hook = JSON.parse(raw);
+		} catch {
+			throw new Error("Claude plan hook received invalid JSON");
+		}
+		if (hook.hook_event_name !== "PreToolUse" || hook.tool_name !== "ExitPlanMode" || typeof hook.session_id !== "string" || !hook.session_id || typeof hook.tool_use_id !== "string" || !hook.tool_use_id || !hook.tool_input || typeof hook.tool_input !== "object") throw new Error("Claude plan hook received an invalid ExitPlanMode call");
+		this.nativeSessionId = hook.session_id;
+		const fail = (message) => {
+			const error = new Error(message);
+			this.options.onFailure(hook.session_id, error);
+			throw error;
+		};
+		const continuation = this.options.continuation;
+		if (continuation && !this.rejectionDelivered) {
+			if (continuation.providerState.kind !== "claude-code") return fail(`Claude cannot resume ${continuation.providerState.kind} plan state`);
+			if (hook.session_id !== continuation.providerState.nativeSessionId) return fail("Claude resumed a different session than the durable plan");
+			if (hook.tool_use_id !== continuation.sourceToolCallId) return fail("Claude resumed a different deferred plan tool call");
+			if (continuation.decision.outcome === "approved") return allow(hook.tool_input);
+			this.rejectionDelivered = true;
+			return deny(`Plan rejected: ${continuation.decision.feedback}`);
+		}
+		const body = hook.tool_input.plan;
+		if (typeof body !== "string" || !body.trim()) return fail("ExitPlanMode did not provide a complete plan body");
+		try {
+			const submitted = this.terminalPlan.submit(body, hook.tool_use_id);
+			const pending = submitted.then(() => void 0, () => void 0);
+			this.pendingSubmissions.add(pending);
+			pending.finally(() => this.pendingSubmissions.delete(pending));
+			const plan = await submitted;
+			this.options.onSubmitted({
+				nativeSessionId: hook.session_id,
+				sourceToolCallId: hook.tool_use_id,
+				plan,
+				confirm: () => this.terminalPlan.confirm(),
+				withdraw: (reason) => this.terminalPlan.withdraw(reason)
+			});
+			return defer();
+		} catch (error) {
+			const failure = error instanceof Error ? error : new Error(String(error));
+			this.options.onFailure(hook.session_id, failure);
+			throw failure;
+		}
+	}
+};
+function allow(updatedInput) {
+	return { hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		permissionDecision: "allow",
+		updatedInput
+	} };
+}
+function deny(reason) {
+	return { hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		permissionDecision: "deny",
+		permissionDecisionReason: reason
+	} };
+}
+function defer() {
+	return { hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		permissionDecision: "defer"
+	} };
+}
+//#endregion
+//#region src/adapter.ts
+/**
+* A plan continuation's turn opens with the user's decision: execute the
+* approved plan, or revise the rejected one and submit it again.
+*/
+function withContinuationInstruction(effectiveInput) {
+	const continuationInstruction = effectiveInput.planContinuation ? effectiveInput.planContinuation.decision.outcome === "approved" ? `The user approved durable plan ${effectiveInput.planContinuation.plan.id}. Continue and execute that exact plan.` : `The user rejected durable plan ${effectiveInput.planContinuation.plan.id}. Revise it using this feedback:\n\n${effectiveInput.planContinuation.decision.feedback}\n\nWhen the revision is complete, call ExitPlanMode again. That submission ends this turn.` : void 0;
+	return continuationInstruction ? {
+		...effectiveInput,
+		message: [continuationInstruction, effectiveInput.message].filter((part) => typeof part === "string" && part.length > 0).join("\n\n")
+	} : effectiveInput;
+}
+/** Withdraw every plan a tracked native session submitted; returns each withdrawal failure. */
+async function withdrawTrackedPlans(reason, trackedNativeSessions, planSubmissions) {
+	return (await Promise.allSettled([...trackedNativeSessions].map((nativeSessionId) => planSubmissions.get(nativeSessionId)).filter((submission) => submission !== void 0).map((submission) => submission.withdraw(reason)))).flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+}
+/**
+* Claude Code provider adapter.
+*
+* Implements the SdkProviderAdapter interface for the Claude Code CLI tool.
+* Extends CliProviderAdapterBase with Claude Code-specific event parsing and CLI arguments.
+*/
+var ClaudeCodeProviderAdapter = class extends ClaudeEventAdapter {
+	/** Shared `kind:"permission"` round-trip — see InteractionBroker. */
+	permissions = new InteractionBroker();
+	getCapabilities() {
+		return {
+			...super.getCapabilities(),
+			multimodal: true,
+			interactions: [
+				...this.config.interactivePermissions === true || interactionToggleEnabled(this.config.interactions, "permission") ? [InteractionKind.Permission] : [],
+				...this.config.interactivePermissions === true || interactionToggleEnabled(this.config.interactions, "question") ? [InteractionKind.Question] : [],
+				...claudeRoutesPlans(this.config) ? [InteractionKind.Plan] : []
+			]
+		};
+	}
+	continuationInteractions(base, outcome) {
+		if (base === true) return outcome === "rejected" ? true : {
+			permission: true,
+			question: true,
+			plan: false
+		};
+		return {
+			...typeof base === "object" ? base : {},
+			...outcome === "approved" ? { permission: true } : {},
+			plan: outcome === "rejected"
+		};
+	}
+	/**
+	* Host a per-execution interaction MCP server when interactive permissions,
+	* permission or question interactions are on.
+	* Started BEFORE buildExecArgs runs (so its loopback port + token reach
+	* `--mcp-config`) and torn down in finally, denying any decision still pending
+	* when the turn unwinds (fail-closed). Plain turns use the base path.
+	*/
+	async execute(input, services, onEvent) {
+		const nativeResume = input.nativeResume;
+		if (nativeResume) {
+			if (nativeResume.harness !== "claude-code" || input.planContinuation) throw new Error("Claude native resume requires Claude without plan continuation");
+			await this.seedNativeSessionForResume(input, nativeResume.nativeSessionId);
+		}
+		await this.reseedNativeSessionForContinuation(input);
+		const requestedInteractions = input.interactions;
+		const configuredInteractions = this.config.interactions;
+		const baseInteractions = requestedInteractions ?? configuredInteractions;
+		const continuationInteractions = input.planContinuation ? this.continuationInteractions(baseInteractions, input.planContinuation.decision.outcome) : void 0;
+		const effectiveInput = input.planContinuation ? {
+			...input,
+			interactions: continuationInteractions
+		} : input;
+		const turnConfig = withTurnInteractions(this.config, effectiveInput);
+		const hostsPermissionServer = interactionModes(turnConfig).hostsServer;
+		const hostsPlanHook = claudeRoutesPlans(turnConfig) || !!effectiveInput.planContinuation;
+		if (!hostsPermissionServer && !hostsPlanHook) return super.execute(input, services, onEvent);
+		const permScopeId = input.sessionId ?? input.interactionBinding?.sessionId ?? randomUUID();
+		const permissionServer = hostsPermissionServer ? this.createPermissionServer(permScopeId, this.interactionExecutionBinding(input, permScopeId), onEvent, turnConfig) : void 0;
+		const trackedNativeSessions = /* @__PURE__ */ new Set();
+		const planSubmissions = /* @__PURE__ */ new Map();
+		const planFailures = /* @__PURE__ */ new Map();
+		const planHookServer = hostsPlanHook ? new ClaudePlanHookServer({
+			planHost: services.planHost,
+			continuation: effectiveInput.planContinuation,
+			emit: onEvent,
+			onSubmitted: (submission) => {
+				trackedNativeSessions.add(submission.nativeSessionId);
+				planSubmissions.set(submission.nativeSessionId, submission);
+			},
+			onFailure: (nativeSessionId, error) => {
+				trackedNativeSessions.add(nativeSessionId);
+				planFailures.set(nativeSessionId, error);
+			}
+		}) : void 0;
+		await permissionServer?.start();
+		try {
+			await planHookServer?.start();
+		} catch (error) {
+			await permissionServer?.stop();
+			throw error;
+		}
+		const executionContext = {
+			permissionServer,
+			planHookServer,
+			planSubmissions,
+			planFailures
+		};
+		try {
+			return await claudeExecutionContext(this).run(executionContext, () => super.execute(withContinuationInstruction(effectiveInput), services, onEvent));
+		} catch (error) {
+			await planHookServer?.stop();
+			await planHookServer?.waitForPendingSubmissions();
+			const withdrawals = await withdrawTrackedPlans(`Claude failed to terminalize its planning turn: ${error instanceof Error ? error.message : String(error)}`, trackedNativeSessions, planSubmissions);
+			if (withdrawals.length > 0) throw new AggregateError([error, ...withdrawals], "Claude planning failed and its durable plan could not be withdrawn");
+			throw error;
+		} finally {
+			this.permissions.failSession(permScopeId);
+			await Promise.all([permissionServer?.stop(), planHookServer?.stop()]);
+		}
+	}
+	/**
+	* Make the plan continuation's recorded native Claude session authoritative
+	* on the session store so super.execute resumes that conversation. Seed it
+	* when the local mapping is missing, and overwrite a mapping that points at a
+	* different conversation — an intervening turn can recreate the mapping with a
+	* fresh providerSessionId after the plan was submitted (e.g. the box was
+	* recycled and the store lost its entry). Leaving a stale, different id in
+	* place would resume the wrong conversation, which the plan hook then rejects
+	* as a different session than the durable plan. A mapping that already points
+	* at the recorded session is left untouched.
+	*/
+	async reseedNativeSessionForContinuation(input) {
+		const continuation = input.planContinuation;
+		if (!input.sessionId || !continuation || continuation.providerState.kind !== "claude-code") return;
+		const nativeSessionId = continuation.providerState.nativeSessionId;
+		const store = this.getSessionStore();
+		const existing = await store.get(input.sessionId);
+		if (!existing) await store.create({
+			id: input.sessionId,
+			workspaceRoot: input.workspaceRoot ?? this.storagePath,
+			providerSessionId: nativeSessionId
+		});
+		else if (existing.providerSessionId !== nativeSessionId) await store.update(input.sessionId, { providerSessionId: nativeSessionId });
+	}
+	async respondToInteraction(response) {
+		if (this.permissions.respond(response)) return;
+		this.permissions.respondQuestion(response);
+	}
+	/**
+	* Build the per-execution interaction MCP server. The `permission` bridge
+	* (the `--permission-prompt-tool` decider) is registered only when the turn
+	* routes permissions; the `ask_user` model tool only when the question
+	* channel is exposed — a question-only turn therefore hosts a server
+	* where the permission tool does not even exist.
+	*/
+	createPermissionServer(permScopeId, binding, onEvent, config = this.config) {
+		const modes = interactionModes(config);
+		const permission = async ({ tool_name, input: toolInput, tool_use_id }) => {
+			return grantToPermissionResult(await this.permissions.request({
+				id: tool_use_id,
+				sessionId: permScopeId,
+				binding,
+				toolName: tool_name,
+				input: toolInput,
+				allowlistGrant: "deny",
+				emit: onEvent
+			}), tool_name, toolInput);
+		};
+		const askUser = async ({ questions }) => this.permissions.requestQuestion({
+			id: randomUUID(),
+			sessionId: permScopeId,
+			binding,
+			questions,
+			emit: onEvent
+		});
+		return new InteractionMcpServer({
+			serverName: PERMISSION_MCP_SERVER_NAME,
+			...modes.routesPermissions ? { permission } : {},
+			...modes.exposesAskUser ? { askUser } : {}
+		});
+	}
+	async executionOutcome(state, _input) {
+		const result = state.resultEvent;
+		const nativeSessionId = state.sessionId;
+		const executionContext = claudeExecutionContext(this).getStore();
+		const failure = nativeSessionId ? executionContext?.planFailures.get(nativeSessionId) : void 0;
+		if (failure) throw failure;
+		const submission = nativeSessionId ? executionContext?.planSubmissions.get(nativeSessionId) : void 0;
+		if (result?.stop_reason === "tool_deferred") {
+			const deferred = result.deferred_tool_use;
+			if (!submission || !deferred) throw new Error("Claude deferred a tool without a committed durable plan");
+			if (deferred.name !== "ExitPlanMode" || deferred.id !== submission.sourceToolCallId) throw new Error("Claude deferred a different tool than the committed durable plan");
+			await submission.confirm();
+			return {
+				type: "awaiting_plan_decision",
+				plan: submission.plan
+			};
+		}
+		if (result?.stop_reason === "tool_deferred_unavailable") throw new Error("Claude could not resume the deferred plan tool");
+		if (submission) throw new Error("Claude committed a durable plan without ending at its deferred tool");
+		return { type: "completed" };
+	}
+};
+//#endregion
+export { ClaudeCodeProviderAdapter, claudeHeldSpares, normalizeExplicitClaudeModel, resolveClaudeCodeBaseUrl, setHeldSpareTurnSink };
+
+//# sourceMappingURL=index.mjs.map