@tanstack/ai-claude-code 0.2.3 → 0.3.0

package/dist/esm/adapters/policy-map.js

@@ -1,51 +1,49 @@
-const WRITE_TOOLS = ["Write", "Edit", "MultiEdit"];
-const NETWORK_TOOLS = ["WebFetch", "WebSearch"];
-const BUILTIN_TOOL_NAMES = /* @__PURE__ */ new Set([
-  "Bash",
-  "Read",
-  "Write",
-  "Edit",
-  "MultiEdit",
-  "Glob",
-  "Grep",
-  "WebFetch",
-  "WebSearch",
-  "NotebookEdit",
-  "Task"
+//#region src/adapters/policy-map.ts
+var WRITE_TOOLS = [
+	"Write",
+	"Edit",
+	"MultiEdit"
+];
+var NETWORK_TOOLS = ["WebFetch", "WebSearch"];
+var BUILTIN_TOOL_NAMES = /* @__PURE__ */ new Set([
+	"Bash",
+	"Read",
+	"Write",
+	"Edit",
+	"MultiEdit",
+	"Glob",
+	"Grep",
+	"WebFetch",
+	"WebSearch",
+	"NotebookEdit",
+	"Task"
 ]);
 function modeFor(decision) {
-  switch (decision) {
-    case "allow":
-      return "bypassPermissions";
-    case "ask":
-      return "acceptEdits";
-    case "deny":
-      return "default";
-  }
+	switch (decision) {
+		case "allow": return "bypassPermissions";
+		case "ask": return "acceptEdits";
+		case "deny": return "default";
+	}
 }
 function mapPolicyToClaudeFlags(policy) {
-  const allowedTools = [];
-  const disallowedTools = [];
-  if (!policy) return { allowedTools, disallowedTools };
-  if (policy.capabilities?.fileWrite === "deny")
-    disallowedTools.push(...WRITE_TOOLS);
-  if (policy.capabilities?.network === "deny")
-    disallowedTools.push(...NETWORK_TOOLS);
-  for (const pattern of policy.commands?.deny ?? []) {
-    if (BUILTIN_TOOL_NAMES.has(pattern)) disallowedTools.push(pattern);
-  }
-  for (const pattern of policy.commands?.allow ?? []) {
-    if (BUILTIN_TOOL_NAMES.has(pattern)) allowedTools.push(pattern);
-  }
-  const result = {
-    allowedTools: [...new Set(allowedTools)],
-    disallowedTools: [...new Set(disallowedTools)]
-  };
-  if (policy.default !== void 0)
-    result.permissionMode = modeFor(policy.default);
-  return result;
+	const allowedTools = [];
+	const disallowedTools = [];
+	if (!policy) return {
+		allowedTools,
+		disallowedTools
+	};
+	if (policy.capabilities?.fileWrite === "deny") disallowedTools.push(...WRITE_TOOLS);
+	if (policy.capabilities?.network === "deny") disallowedTools.push(...NETWORK_TOOLS);
+	for (const pattern of policy.commands?.deny ?? []) if (BUILTIN_TOOL_NAMES.has(pattern)) disallowedTools.push(pattern);
+	for (const pattern of policy.commands?.allow ?? []) if (BUILTIN_TOOL_NAMES.has(pattern)) allowedTools.push(pattern);
+	const result = {
+		allowedTools: [...new Set(allowedTools)],
+		disallowedTools: [...new Set(disallowedTools)]
+	};
+	if (policy.default !== void 0) result.permissionMode = modeFor(policy.default);
+	return result;
 }
-export {
-  mapPolicyToClaudeFlags
-};
-//# sourceMappingURL=policy-map.js.map
+//#endregion
+export { mapPolicyToClaudeFlags };
+
+//# sourceMappingURL=policy-map.js.map

package/dist/esm/adapters/policy-map.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-map.js","sources":["../../../src/adapters/policy-map.ts"],"sourcesContent":["/**\n * Map a portable {@link SandboxPolicy} onto Claude Code CLI permission flags.\n *\n * This is a best-effort, coarse mapping (the CLI's permission model is\n * tool-level + a permission mode, not arbitrary command globs):\n *\n * - `default` decision → `--permission-mode`:\n *     `'allow'` → `bypassPermissions`, `'acceptEdits'`-ish `'ask'` → `acceptEdits`,\n *     `'deny'` → `default` (in `-p` mode, prompts are auto-denied).\n * - `capabilities.fileWrite === 'deny'` → disallow `Write`,`Edit`,`MultiEdit`.\n * - `capabilities.network === 'deny'` → disallow `WebFetch`,`WebSearch`.\n * - `commands.deny` that name a bare built-in tool (e.g. `Bash`) are added to\n *   `--disallowedTools`; fine-grained command-glob enforcement is left to the\n *   MCP permission-prompt tool (interactive approvals).\n *\n * Returns the permission mode plus tool allow/deny additions; the adapter\n * merges these with its own config.\n */\nimport type { PolicyDecision, SandboxPolicy } from '@tanstack/ai-sandbox'\nimport type { ClaudeCodePermissionMode } from './text'\n\nexport interface ClaudePolicyFlags {\n  permissionMode?: ClaudeCodePermissionMode\n  allowedTools: Array<string>\n  disallowedTools: Array<string>\n}\n\nconst WRITE_TOOLS = ['Write', 'Edit', 'MultiEdit']\nconst NETWORK_TOOLS = ['WebFetch', 'WebSearch']\nconst BUILTIN_TOOL_NAMES = new Set([\n  'Bash',\n  'Read',\n  'Write',\n  'Edit',\n  'MultiEdit',\n  'Glob',\n  'Grep',\n  'WebFetch',\n  'WebSearch',\n  'NotebookEdit',\n  'Task',\n])\n\nfunction modeFor(decision: PolicyDecision): ClaudeCodePermissionMode {\n  switch (decision) {\n    case 'allow':\n      return 'bypassPermissions'\n    case 'ask':\n      return 'acceptEdits'\n    case 'deny':\n      return 'default'\n  }\n}\n\nexport function mapPolicyToClaudeFlags(\n  policy: SandboxPolicy | undefined,\n): ClaudePolicyFlags {\n  const allowedTools: Array<string> = []\n  const disallowedTools: Array<string> = []\n  if (!policy) return { allowedTools, disallowedTools }\n\n  if (policy.capabilities?.fileWrite === 'deny')\n    disallowedTools.push(...WRITE_TOOLS)\n  if (policy.capabilities?.network === 'deny')\n    disallowedTools.push(...NETWORK_TOOLS)\n\n  // Tool-name-level command rules map directly; everything else is left to the\n  // permission-prompt tool.\n  for (const pattern of policy.commands?.deny ?? []) {\n    if (BUILTIN_TOOL_NAMES.has(pattern)) disallowedTools.push(pattern)\n  }\n  for (const pattern of policy.commands?.allow ?? []) {\n    if (BUILTIN_TOOL_NAMES.has(pattern)) allowedTools.push(pattern)\n  }\n\n  const result: ClaudePolicyFlags = {\n    allowedTools: [...new Set(allowedTools)],\n    disallowedTools: [...new Set(disallowedTools)],\n  }\n  if (policy.default !== undefined)\n    result.permissionMode = modeFor(policy.default)\n  return result\n}\n"],"names":[],"mappings":"AA2BA,MAAM,cAAc,CAAC,SAAS,QAAQ,WAAW;AACjD,MAAM,gBAAgB,CAAC,YAAY,WAAW;AAC9C,MAAM,yCAAyB,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,QAAQ,UAAoD;AACnE,UAAQ,UAAA;AAAA,IACN,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EAAA;AAEb;AAEO,SAAS,uBACd,QACmB;AACnB,QAAM,eAA8B,CAAA;AACpC,QAAM,kBAAiC,CAAA;AACvC,MAAI,CAAC,OAAQ,QAAO,EAAE,cAAc,gBAAA;AAEpC,MAAI,OAAO,cAAc,cAAc;AACrC,oBAAgB,KAAK,GAAG,WAAW;AACrC,MAAI,OAAO,cAAc,YAAY;AACnC,oBAAgB,KAAK,GAAG,aAAa;AAIvC,aAAW,WAAW,OAAO,UAAU,QAAQ,CAAA,GAAI;AACjD,QAAI,mBAAmB,IAAI,OAAO,EAAG,iBAAgB,KAAK,OAAO;AAAA,EACnE;AACA,aAAW,WAAW,OAAO,UAAU,SAAS,CAAA,GAAI;AAClD,QAAI,mBAAmB,IAAI,OAAO,EAAG,cAAa,KAAK,OAAO;AAAA,EAChE;AAEA,QAAM,SAA4B;AAAA,IAChC,cAAc,CAAC,GAAG,IAAI,IAAI,YAAY,CAAC;AAAA,IACvC,iBAAiB,CAAC,GAAG,IAAI,IAAI,eAAe,CAAC;AAAA,EAAA;AAE/C,MAAI,OAAO,YAAY;AACrB,WAAO,iBAAiB,QAAQ,OAAO,OAAO;AAChD,SAAO;AACT;"}
+{"version":3,"file":"policy-map.js","names":[],"sources":["../../../src/adapters/policy-map.ts"],"sourcesContent":["/**\n * Map a portable {@link SandboxPolicy} onto Claude Code CLI permission flags.\n *\n * This is a best-effort, coarse mapping (the CLI's permission model is\n * tool-level + a permission mode, not arbitrary command globs):\n *\n * - `default` decision → `--permission-mode`:\n *     `'allow'` → `bypassPermissions`, `'acceptEdits'`-ish `'ask'` → `acceptEdits`,\n *     `'deny'` → `default` (in `-p` mode, prompts are auto-denied).\n * - `capabilities.fileWrite === 'deny'` → disallow `Write`,`Edit`,`MultiEdit`.\n * - `capabilities.network === 'deny'` → disallow `WebFetch`,`WebSearch`.\n * - `commands.deny` that name a bare built-in tool (e.g. `Bash`) are added to\n *   `--disallowedTools`; fine-grained command-glob enforcement is left to the\n *   MCP permission-prompt tool (interactive approvals).\n *\n * Returns the permission mode plus tool allow/deny additions; the adapter\n * merges these with its own config.\n */\nimport type { PolicyDecision, SandboxPolicy } from '@tanstack/ai-sandbox'\nimport type { ClaudeCodePermissionMode } from './text'\n\nexport interface ClaudePolicyFlags {\n  permissionMode?: ClaudeCodePermissionMode\n  allowedTools: Array<string>\n  disallowedTools: Array<string>\n}\n\nconst WRITE_TOOLS = ['Write', 'Edit', 'MultiEdit']\nconst NETWORK_TOOLS = ['WebFetch', 'WebSearch']\nconst BUILTIN_TOOL_NAMES = new Set([\n  'Bash',\n  'Read',\n  'Write',\n  'Edit',\n  'MultiEdit',\n  'Glob',\n  'Grep',\n  'WebFetch',\n  'WebSearch',\n  'NotebookEdit',\n  'Task',\n])\n\nfunction modeFor(decision: PolicyDecision): ClaudeCodePermissionMode {\n  switch (decision) {\n    case 'allow':\n      return 'bypassPermissions'\n    case 'ask':\n      return 'acceptEdits'\n    case 'deny':\n      return 'default'\n  }\n}\n\nexport function mapPolicyToClaudeFlags(\n  policy: SandboxPolicy | undefined,\n): ClaudePolicyFlags {\n  const allowedTools: Array<string> = []\n  const disallowedTools: Array<string> = []\n  if (!policy) return { allowedTools, disallowedTools }\n\n  if (policy.capabilities?.fileWrite === 'deny')\n    disallowedTools.push(...WRITE_TOOLS)\n  if (policy.capabilities?.network === 'deny')\n    disallowedTools.push(...NETWORK_TOOLS)\n\n  // Tool-name-level command rules map directly; everything else is left to the\n  // permission-prompt tool.\n  for (const pattern of policy.commands?.deny ?? []) {\n    if (BUILTIN_TOOL_NAMES.has(pattern)) disallowedTools.push(pattern)\n  }\n  for (const pattern of policy.commands?.allow ?? []) {\n    if (BUILTIN_TOOL_NAMES.has(pattern)) allowedTools.push(pattern)\n  }\n\n  const result: ClaudePolicyFlags = {\n    allowedTools: [...new Set(allowedTools)],\n    disallowedTools: [...new Set(disallowedTools)],\n  }\n  if (policy.default !== undefined)\n    result.permissionMode = modeFor(policy.default)\n  return result\n}\n"],"mappings":";AA2BA,IAAM,cAAc;CAAC;CAAS;CAAQ;AAAW;AACjD,IAAM,gBAAgB,CAAC,YAAY,WAAW;AAC9C,IAAM,qCAAqB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,QAAQ,UAAoD;CACnE,QAAQ,UAAR;EACE,KAAK,SACH,OAAO;EACT,KAAK,OACH,OAAO;EACT,KAAK,QACH,OAAO;CACX;AACF;AAEA,SAAgB,uBACd,QACmB;CACnB,MAAM,eAA8B,CAAC;CACrC,MAAM,kBAAiC,CAAC;CACxC,IAAI,CAAC,QAAQ,OAAO;EAAE;EAAc;CAAgB;CAEpD,IAAI,OAAO,cAAc,cAAc,QACrC,gBAAgB,KAAK,GAAG,WAAW;CACrC,IAAI,OAAO,cAAc,YAAY,QACnC,gBAAgB,KAAK,GAAG,aAAa;CAIvC,KAAK,MAAM,WAAW,OAAO,UAAU,QAAQ,CAAC,GAC9C,IAAI,mBAAmB,IAAI,OAAO,GAAG,gBAAgB,KAAK,OAAO;CAEnE,KAAK,MAAM,WAAW,OAAO,UAAU,SAAS,CAAC,GAC/C,IAAI,mBAAmB,IAAI,OAAO,GAAG,aAAa,KAAK,OAAO;CAGhE,MAAM,SAA4B;EAChC,cAAc,CAAC,GAAG,IAAI,IAAI,YAAY,CAAC;EACvC,iBAAiB,CAAC,GAAG,IAAI,IAAI,eAAe,CAAC;CAC/C;CACA,IAAI,OAAO,YAAY,KAAA,GACrB,OAAO,iBAAiB,QAAQ,OAAO,OAAO;CAChD,OAAO;AACT"}

package/dist/esm/adapters/projection.js

@@ -1,101 +1,166 @@
-import { resolveGitSkillDir, isSecretRef } from "@tanstack/ai-sandbox";
+import { isSecretRef, resolveGitSkillDir } from "@tanstack/ai-sandbox";
+//#region src/adapters/projection.ts
+/**
+* Claude Code workspace projector — the reference implementation the other
+* harness projectors (codex, opencode) mirror.
+*
+* `withSandbox` surfaces a portable `WorkspaceProjection` (skills, plugins, a
+* secret resolver, and a one-time marker path) via a capability. Each harness
+* adapter reads it in its `chatStream` setup and projects those inputs into the
+* CLI's native format. For Claude Code that means:
+*
+*   - MCP servers   → a project-scoped `.mcp.json` at the workspace root.
+*   - gitSkill repos → linked under `.claude/skills/<basename>`.
+*   - agentSkill     → no reliable claude primitive pulls a public skill by
+*                      bare name, so we warn and skip rather than invent one.
+*   - plugins        → `claude plugin install <name>` (best-effort).
+*
+* The secret-bearing `.mcp.json` is (re)written on EVERY call, re-resolving
+* secrets each time, so claude always reads current values and a snapshot can
+* never serve a stale or rotated secret. Only the safe, idempotent, non-secret
+* operations (gitSkill links, plugin installs, agentSkill handling) are guarded
+* by a one-time marker file under the workspace.
+*
+* External-convention caveat: the `.mcp.json` location/shape, the skills dir,
+* and the plugin-install command are verified against the installed `claude`
+* CLI. Where claude has no clean primitive (agentSkill by bare name) we no-op
+* with a warning instead of fabricating a command.
+*/
+/** POSIX single-quote escape for embedding a value in a shell command. */
 function shellQuote(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
+	return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+/** Last path segment of a `gitSkill` clone dir, used as the skills-dir name. */
 function basenameOf(path) {
-  const segments = path.split("/").filter((segment) => segment !== "");
-  return segments[segments.length - 1] ?? path;
+	const segments = path.split("/").filter((segment) => segment !== "");
+	return segments[segments.length - 1] ?? path;
 }
+/** True when `value` is a `bearer(ref)` marker created by `@tanstack/ai-sandbox`. */
 function isBearerMarker(value) {
-  return typeof value === "object" && value !== null && isSecretRef(value.__bearerRef);
+	return typeof value === "object" && value !== null && isSecretRef(value.__bearerRef);
 }
+/**
+* Resolve a single MCP header value: a `SecretRef` resolves to its plaintext, a
+* `bearer(ref)` marker resolves to `Bearer <plaintext>`, and a plain string is
+* passed through unchanged.
+*/
 function resolveHeaderValue(value, resolveSecret) {
-  if (isSecretRef(value)) return resolveSecret(value);
-  if (isBearerMarker(value)) return `Bearer ${resolveSecret(value.__bearerRef)}`;
-  return value;
+	if (isSecretRef(value)) return resolveSecret(value);
+	if (isBearerMarker(value)) return `Bearer ${resolveSecret(value.__bearerRef)}`;
+	return value;
 }
+/**
+* Build claude's project-scoped MCP config from the `{ kind: 'mcp' }` skills,
+* resolving every header value (SecretRef / bearer / string). Returns
+* `undefined` when there are no MCP skills so the caller can skip the write.
+*/
 function buildMcpConfig(skills, resolveSecret) {
-  const mcpServers = {};
-  let count = 0;
-  for (const skill of skills) {
-    if (skill.kind !== "mcp") continue;
-    count += 1;
-    const headers = {};
-    const rawHeaders = skill.config.headers ?? {};
-    for (const [name, value] of Object.entries(rawHeaders)) {
-      headers[name] = resolveHeaderValue(value, resolveSecret);
-    }
-    const rawUrl = skill.config["url"];
-    const url = typeof rawUrl === "string" ? rawUrl : "";
-    mcpServers[skill.name] = { type: "http", url, headers };
-  }
-  return count > 0 ? { mcpServers } : void 0;
+	const mcpServers = {};
+	let count = 0;
+	for (const skill of skills) {
+		if (skill.kind !== "mcp") continue;
+		count += 1;
+		const headers = {};
+		const rawHeaders = skill.config.headers ?? {};
+		for (const [name, value] of Object.entries(rawHeaders)) headers[name] = resolveHeaderValue(value, resolveSecret);
+		const rawUrl = skill.config["url"];
+		const url = typeof rawUrl === "string" ? rawUrl : "";
+		mcpServers[skill.name] = {
+			type: "http",
+			url,
+			headers
+		};
+	}
+	return count > 0 ? { mcpServers } : void 0;
 }
+/**
+* Write the project-scoped `.mcp.json`, re-resolving every secret. This runs on
+* EVERY projection call (never gated by the marker) so claude always reads the
+* current secret values and a snapshot can never serve a stale or rotated one.
+* With `snapshot:'after-run'` the file may still be captured in the image, so
+* secret-bearing MCP material is best used with the default `after-setup`
+* strategy. When there are no MCP skills the write is skipped.
+*/
 async function projectMcpServers(handle, projection) {
-  const config = buildMcpConfig(projection.skills, projection.resolveSecret);
-  if (config === void 0) return;
-  const target = `${projection.root}/.mcp.json`;
-  await handle.fs.write(target, JSON.stringify(config, null, 2));
+	const config = buildMcpConfig(projection.skills, projection.resolveSecret);
+	if (config === void 0) return;
+	const target = `${projection.root}/.mcp.json`;
+	await handle.fs.write(target, JSON.stringify(config, null, 2));
 }
+/**
+* Ensure each cloned `gitSkill` repo is available under claude's project skills
+* dir (`<root>/.claude/skills/<basename>`) via a symlink, falling back to a
+* recursive copy on platforms without `ln -s`.
+*/
 async function projectGitSkills(handle, projection) {
-  const skillsDir = `${projection.root}/.claude/skills`;
-  let madeDir = false;
-  for (const skill of projection.skills) {
-    if (skill.kind !== "git") continue;
-    if (!madeDir) {
-      await handle.fs.mkdir(skillsDir);
-      madeDir = true;
-    }
-    const source = skill.into ?? resolveGitSkillDir(projection.root, skill);
-    const target = `${skillsDir}/${basenameOf(source)}`;
-    const lnCmd = `ln -s ${shellQuote(source)} ${shellQuote(target)}`;
-    const result = await handle.process.exec(lnCmd, { cwd: projection.root });
-    if (result.exitCode !== 0) {
-      const cpCmd = `cp -r ${shellQuote(source)} ${shellQuote(target)}`;
-      const copied = await handle.process.exec(cpCmd, { cwd: projection.root });
-      if (copied.exitCode !== 0) {
-        console.warn(
-          `[claude-code] failed to link gitSkill "${skill.repo}" into ${target}: ${copied.stderr.trim()}`
-        );
-      }
-    }
-  }
+	const skillsDir = `${projection.root}/.claude/skills`;
+	let madeDir = false;
+	for (const skill of projection.skills) {
+		if (skill.kind !== "git") continue;
+		if (!madeDir) {
+			await handle.fs.mkdir(skillsDir);
+			madeDir = true;
+		}
+		const source = skill.into ?? resolveGitSkillDir(projection.root, skill);
+		const target = `${skillsDir}/${basenameOf(source)}`;
+		const lnCmd = `ln -s ${shellQuote(source)} ${shellQuote(target)}`;
+		if ((await handle.process.exec(lnCmd, { cwd: projection.root })).exitCode !== 0) {
+			const cpCmd = `cp -r ${shellQuote(source)} ${shellQuote(target)}`;
+			const copied = await handle.process.exec(cpCmd, { cwd: projection.root });
+			if (copied.exitCode !== 0) console.warn(`[claude-code] failed to link gitSkill "${skill.repo}" into ${target}: ${copied.stderr.trim()}`);
+		}
+	}
 }
+/**
+* `agentSkill` references a public skill by bare name. Claude Code has no
+* primitive to fetch a skill from a bare name (skills resolve from local
+* `.claude/skills/` dirs and plugin marketplaces), so we warn and skip rather
+* than fabricate a command.
+*/
 function projectAgentSkills(projection) {
-  for (const skill of projection.skills) {
-    if (skill.kind !== "agent-skill") continue;
-    console.warn(
-      `[claude-code] agentSkill "${skill.name}" cannot be projected: Claude Code has no command to install a public skill by bare name. Provide it as a gitSkill or a plugin instead. Skipping.`
-    );
-  }
+	for (const skill of projection.skills) {
+		if (skill.kind !== "agent-skill") continue;
+		console.warn(`[claude-code] agentSkill "${skill.name}" cannot be projected: Claude Code has no command to install a public skill by bare name. Provide it as a gitSkill or a plugin instead. Skipping.`);
+	}
 }
+/**
+* Install each declared plugin via `claude plugin install <name>`. Plugin
+* installs are best-effort: a failure (no marketplace, network, …) warns but
+* never throws, so a missing plugin can't break the run.
+*/
 async function projectPlugins(handle, projection) {
-  for (const name of projection.plugins) {
-    const cmd = `claude plugin install ${shellQuote(name)}`;
-    try {
-      const result = await handle.process.exec(cmd, { cwd: projection.root });
-      if (result.exitCode !== 0) {
-        console.warn(
-          `[claude-code] "claude plugin install ${name}" exited ${result.exitCode}: ${result.stderr.trim()}`
-        );
-      }
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      console.warn(
-        `[claude-code] failed to install plugin "${name}": ${message}`
-      );
-    }
-  }
+	for (const name of projection.plugins) {
+		const cmd = `claude plugin install ${shellQuote(name)}`;
+		try {
+			const result = await handle.process.exec(cmd, { cwd: projection.root });
+			if (result.exitCode !== 0) console.warn(`[claude-code] "claude plugin install ${name}" exited ${result.exitCode}: ${result.stderr.trim()}`);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			console.warn(`[claude-code] failed to install plugin "${name}": ${message}`);
+		}
+	}
 }
+/**
+* Project a `WorkspaceProjection` into the Claude Code sandbox. Safe to call on
+* every `chatStream`. The secret-bearing `.mcp.json` is (re)written on every
+* call, re-resolving secrets, so claude always reads current values and a
+* snapshot can never serve a stale or rotated secret. The safe, idempotent,
+* non-secret operations (gitSkill links, plugin installs, agentSkill handling)
+* are guarded by a one-time marker so they run only on the first call after
+* create/restore.
+*
+* @param handle     - The sandbox handle (`fs` + `process`).
+* @param projection - The portable workspace inputs from `withSandbox`.
+*/
 async function projectClaudeWorkspace(handle, projection) {
-  await projectMcpServers(handle, projection);
-  if (await handle.fs.exists(projection.markerPath)) return;
-  await projectGitSkills(handle, projection);
-  projectAgentSkills(projection);
-  await projectPlugins(handle, projection);
-  await handle.fs.write(projection.markerPath, "");
+	await projectMcpServers(handle, projection);
+	if (await handle.fs.exists(projection.markerPath)) return;
+	await projectGitSkills(handle, projection);
+	projectAgentSkills(projection);
+	await projectPlugins(handle, projection);
+	await handle.fs.write(projection.markerPath, "");
 }
-export {
-  projectClaudeWorkspace
-};
-//# sourceMappingURL=projection.js.map
+//#endregion
+export { projectClaudeWorkspace };
+
+//# sourceMappingURL=projection.js.map

package/dist/esm/adapters/projection.js.map

@@ -1 +1 @@
-{"version":3,"file":"projection.js","sources":["../../../src/adapters/projection.ts"],"sourcesContent":["/**\n * Claude Code workspace projector — the reference implementation the other\n * harness projectors (codex, opencode) mirror.\n *\n * `withSandbox` surfaces a portable `WorkspaceProjection` (skills, plugins, a\n * secret resolver, and a one-time marker path) via a capability. Each harness\n * adapter reads it in its `chatStream` setup and projects those inputs into the\n * CLI's native format. For Claude Code that means:\n *\n *   - MCP servers   → a project-scoped `.mcp.json` at the workspace root.\n *   - gitSkill repos → linked under `.claude/skills/<basename>`.\n *   - agentSkill     → no reliable claude primitive pulls a public skill by\n *                      bare name, so we warn and skip rather than invent one.\n *   - plugins        → `claude plugin install <name>` (best-effort).\n *\n * The secret-bearing `.mcp.json` is (re)written on EVERY call, re-resolving\n * secrets each time, so claude always reads current values and a snapshot can\n * never serve a stale or rotated secret. Only the safe, idempotent, non-secret\n * operations (gitSkill links, plugin installs, agentSkill handling) are guarded\n * by a one-time marker file under the workspace.\n *\n * External-convention caveat: the `.mcp.json` location/shape, the skills dir,\n * and the plugin-install command are verified against the installed `claude`\n * CLI. Where claude has no clean primitive (agentSkill by bare name) we no-op\n * with a warning instead of fabricating a command.\n */\nimport { isSecretRef, resolveGitSkillDir } from '@tanstack/ai-sandbox'\nimport type {\n  BearerRef,\n  SandboxHandle,\n  SecretRef,\n  WorkspaceProjection,\n  WorkspaceSkill,\n} from '@tanstack/ai-sandbox'\n\n/** POSIX single-quote escape for embedding a value in a shell command. */\nfunction shellQuote(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`\n}\n\n/** Last path segment of a `gitSkill` clone dir, used as the skills-dir name. */\nfunction basenameOf(path: string): string {\n  const segments = path.split('/').filter((segment) => segment !== '')\n  return segments[segments.length - 1] ?? path\n}\n\n/** True when `value` is a `bearer(ref)` marker created by `@tanstack/ai-sandbox`. */\nfunction isBearerMarker(value: unknown): value is BearerRef {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    isSecretRef((value as { __bearerRef?: unknown }).__bearerRef)\n  )\n}\n\n/**\n * Resolve a single MCP header value: a `SecretRef` resolves to its plaintext, a\n * `bearer(ref)` marker resolves to `Bearer <plaintext>`, and a plain string is\n * passed through unchanged.\n */\nfunction resolveHeaderValue(\n  value: string | SecretRef | BearerRef,\n  resolveSecret: (ref: SecretRef) => string,\n): string {\n  if (isSecretRef(value)) return resolveSecret(value)\n  if (isBearerMarker(value)) return `Bearer ${resolveSecret(value.__bearerRef)}`\n  return value\n}\n\n/** A claude-format HTTP MCP server entry. */\ninterface ClaudeMcpServer {\n  type: 'http'\n  url: string\n  headers: Record<string, string>\n}\n\n/**\n * Build claude's project-scoped MCP config from the `{ kind: 'mcp' }` skills,\n * resolving every header value (SecretRef / bearer / string). Returns\n * `undefined` when there are no MCP skills so the caller can skip the write.\n */\nfunction buildMcpConfig(\n  skills: Array<WorkspaceSkill>,\n  resolveSecret: (ref: SecretRef) => string,\n): { mcpServers: Record<string, ClaudeMcpServer> } | undefined {\n  const mcpServers: Record<string, ClaudeMcpServer> = {}\n  let count = 0\n  for (const skill of skills) {\n    if (skill.kind !== 'mcp') continue\n    count += 1\n    const headers: Record<string, string> = {}\n    const rawHeaders = skill.config.headers ?? {}\n    for (const [name, value] of Object.entries(rawHeaders)) {\n      headers[name] = resolveHeaderValue(value, resolveSecret)\n    }\n    const rawUrl = skill.config['url']\n    const url = typeof rawUrl === 'string' ? rawUrl : ''\n    mcpServers[skill.name] = { type: 'http', url, headers }\n  }\n  return count > 0 ? { mcpServers } : undefined\n}\n\n/**\n * Write the project-scoped `.mcp.json`, re-resolving every secret. This runs on\n * EVERY projection call (never gated by the marker) so claude always reads the\n * current secret values and a snapshot can never serve a stale or rotated one.\n * With `snapshot:'after-run'` the file may still be captured in the image, so\n * secret-bearing MCP material is best used with the default `after-setup`\n * strategy. When there are no MCP skills the write is skipped.\n */\nasync function projectMcpServers(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  const config = buildMcpConfig(projection.skills, projection.resolveSecret)\n  if (config === undefined) return\n  const target = `${projection.root}/.mcp.json`\n  await handle.fs.write(target, JSON.stringify(config, null, 2))\n}\n\n/**\n * Ensure each cloned `gitSkill` repo is available under claude's project skills\n * dir (`<root>/.claude/skills/<basename>`) via a symlink, falling back to a\n * recursive copy on platforms without `ln -s`.\n */\nasync function projectGitSkills(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  const skillsDir = `${projection.root}/.claude/skills`\n  let madeDir = false\n  for (const skill of projection.skills) {\n    if (skill.kind !== 'git') continue\n    if (!madeDir) {\n      await handle.fs.mkdir(skillsDir)\n      madeDir = true\n    }\n    const source = skill.into ?? resolveGitSkillDir(projection.root, skill)\n    const target = `${skillsDir}/${basenameOf(source)}`\n    const lnCmd = `ln -s ${shellQuote(source)} ${shellQuote(target)}`\n    const result = await handle.process.exec(lnCmd, { cwd: projection.root })\n    if (result.exitCode !== 0) {\n      const cpCmd = `cp -r ${shellQuote(source)} ${shellQuote(target)}`\n      const copied = await handle.process.exec(cpCmd, { cwd: projection.root })\n      if (copied.exitCode !== 0) {\n        console.warn(\n          `[claude-code] failed to link gitSkill \"${skill.repo}\" into ${target}: ${copied.stderr.trim()}`,\n        )\n      }\n    }\n  }\n}\n\n/**\n * `agentSkill` references a public skill by bare name. Claude Code has no\n * primitive to fetch a skill from a bare name (skills resolve from local\n * `.claude/skills/` dirs and plugin marketplaces), so we warn and skip rather\n * than fabricate a command.\n */\nfunction projectAgentSkills(projection: WorkspaceProjection): void {\n  for (const skill of projection.skills) {\n    if (skill.kind !== 'agent-skill') continue\n    console.warn(\n      `[claude-code] agentSkill \"${skill.name}\" cannot be projected: Claude Code has ` +\n        'no command to install a public skill by bare name. Provide it as a gitSkill ' +\n        'or a plugin instead. Skipping.',\n    )\n  }\n}\n\n/**\n * Install each declared plugin via `claude plugin install <name>`. Plugin\n * installs are best-effort: a failure (no marketplace, network, …) warns but\n * never throws, so a missing plugin can't break the run.\n */\nasync function projectPlugins(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  for (const name of projection.plugins) {\n    const cmd = `claude plugin install ${shellQuote(name)}`\n    try {\n      const result = await handle.process.exec(cmd, { cwd: projection.root })\n      if (result.exitCode !== 0) {\n        console.warn(\n          `[claude-code] \"claude plugin install ${name}\" exited ${result.exitCode}: ${result.stderr.trim()}`,\n        )\n      }\n    } catch (error: unknown) {\n      const message = error instanceof Error ? error.message : String(error)\n      console.warn(\n        `[claude-code] failed to install plugin \"${name}\": ${message}`,\n      )\n    }\n  }\n}\n\n/**\n * Project a `WorkspaceProjection` into the Claude Code sandbox. Safe to call on\n * every `chatStream`. The secret-bearing `.mcp.json` is (re)written on every\n * call, re-resolving secrets, so claude always reads current values and a\n * snapshot can never serve a stale or rotated secret. The safe, idempotent,\n * non-secret operations (gitSkill links, plugin installs, agentSkill handling)\n * are guarded by a one-time marker so they run only on the first call after\n * create/restore.\n *\n * @param handle     - The sandbox handle (`fs` + `process`).\n * @param projection - The portable workspace inputs from `withSandbox`.\n */\nexport async function projectClaudeWorkspace(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  // Always re-resolve and rewrite the secret-bearing MCP config so rotated\n  // secrets re-apply and snapshots can't serve stale values.\n  await projectMcpServers(handle, projection)\n\n  // Gate only the safe, idempotent, non-secret operations on the marker.\n  if (await handle.fs.exists(projection.markerPath)) return\n\n  await projectGitSkills(handle, projection)\n  projectAgentSkills(projection)\n  await projectPlugins(handle, projection)\n\n  await handle.fs.write(projection.markerPath, '')\n}\n"],"names":[],"mappings":";AAoCA,SAAS,WAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,CAAC;AACzC;AAGA,SAAS,WAAW,MAAsB;AACxC,QAAM,WAAW,KAAK,MAAM,GAAG,EAAE,OAAO,CAAC,YAAY,YAAY,EAAE;AACnE,SAAO,SAAS,SAAS,SAAS,CAAC,KAAK;AAC1C;AAGA,SAAS,eAAe,OAAoC;AAC1D,SACE,OAAO,UAAU,YACjB,UAAU,QACV,YAAa,MAAoC,WAAW;AAEhE;AAOA,SAAS,mBACP,OACA,eACQ;AACR,MAAI,YAAY,KAAK,EAAG,QAAO,cAAc,KAAK;AAClD,MAAI,eAAe,KAAK,EAAG,QAAO,UAAU,cAAc,MAAM,WAAW,CAAC;AAC5E,SAAO;AACT;AAcA,SAAS,eACP,QACA,eAC6D;AAC7D,QAAM,aAA8C,CAAA;AACpD,MAAI,QAAQ;AACZ,aAAW,SAAS,QAAQ;AAC1B,QAAI,MAAM,SAAS,MAAO;AAC1B,aAAS;AACT,UAAM,UAAkC,CAAA;AACxC,UAAM,aAAa,MAAM,OAAO,WAAW,CAAA;AAC3C,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACtD,cAAQ,IAAI,IAAI,mBAAmB,OAAO,aAAa;AAAA,IACzD;AACA,UAAM,SAAS,MAAM,OAAO,KAAK;AACjC,UAAM,MAAM,OAAO,WAAW,WAAW,SAAS;AAClD,eAAW,MAAM,IAAI,IAAI,EAAE,MAAM,QAAQ,KAAK,QAAA;AAAA,EAChD;AACA,SAAO,QAAQ,IAAI,EAAE,WAAA,IAAe;AACtC;AAUA,eAAe,kBACb,QACA,YACe;AACf,QAAM,SAAS,eAAe,WAAW,QAAQ,WAAW,aAAa;AACzE,MAAI,WAAW,OAAW;AAC1B,QAAM,SAAS,GAAG,WAAW,IAAI;AACjC,QAAM,OAAO,GAAG,MAAM,QAAQ,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC/D;AAOA,eAAe,iBACb,QACA,YACe;AACf,QAAM,YAAY,GAAG,WAAW,IAAI;AACpC,MAAI,UAAU;AACd,aAAW,SAAS,WAAW,QAAQ;AACrC,QAAI,MAAM,SAAS,MAAO;AAC1B,QAAI,CAAC,SAAS;AACZ,YAAM,OAAO,GAAG,MAAM,SAAS;AAC/B,gBAAU;AAAA,IACZ;AACA,UAAM,SAAS,MAAM,QAAQ,mBAAmB,WAAW,MAAM,KAAK;AACtE,UAAM,SAAS,GAAG,SAAS,IAAI,WAAW,MAAM,CAAC;AACjD,UAAM,QAAQ,SAAS,WAAW,MAAM,CAAC,IAAI,WAAW,MAAM,CAAC;AAC/D,UAAM,SAAS,MAAM,OAAO,QAAQ,KAAK,OAAO,EAAE,KAAK,WAAW,MAAM;AACxE,QAAI,OAAO,aAAa,GAAG;AACzB,YAAM,QAAQ,SAAS,WAAW,MAAM,CAAC,IAAI,WAAW,MAAM,CAAC;AAC/D,YAAM,SAAS,MAAM,OAAO,QAAQ,KAAK,OAAO,EAAE,KAAK,WAAW,MAAM;AACxE,UAAI,OAAO,aAAa,GAAG;AACzB,gBAAQ;AAAA,UACN,0CAA0C,MAAM,IAAI,UAAU,MAAM,KAAK,OAAO,OAAO,MAAM;AAAA,QAAA;AAAA,MAEjG;AAAA,IACF;AAAA,EACF;AACF;AAQA,SAAS,mBAAmB,YAAuC;AACjE,aAAW,SAAS,WAAW,QAAQ;AACrC,QAAI,MAAM,SAAS,cAAe;AAClC,YAAQ;AAAA,MACN,6BAA6B,MAAM,IAAI;AAAA,IAAA;AAAA,EAI3C;AACF;AAOA,eAAe,eACb,QACA,YACe;AACf,aAAW,QAAQ,WAAW,SAAS;AACrC,UAAM,MAAM,yBAAyB,WAAW,IAAI,CAAC;AACrD,QAAI;AACF,YAAM,SAAS,MAAM,OAAO,QAAQ,KAAK,KAAK,EAAE,KAAK,WAAW,MAAM;AACtE,UAAI,OAAO,aAAa,GAAG;AACzB,gBAAQ;AAAA,UACN,wCAAwC,IAAI,YAAY,OAAO,QAAQ,KAAK,OAAO,OAAO,MAAM;AAAA,QAAA;AAAA,MAEpG;AAAA,IACF,SAAS,OAAgB;AACvB,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,cAAQ;AAAA,QACN,2CAA2C,IAAI,MAAM,OAAO;AAAA,MAAA;AAAA,IAEhE;AAAA,EACF;AACF;AAcA,eAAsB,uBACpB,QACA,YACe;AAGf,QAAM,kBAAkB,QAAQ,UAAU;AAG1C,MAAI,MAAM,OAAO,GAAG,OAAO,WAAW,UAAU,EAAG;AAEnD,QAAM,iBAAiB,QAAQ,UAAU;AACzC,qBAAmB,UAAU;AAC7B,QAAM,eAAe,QAAQ,UAAU;AAEvC,QAAM,OAAO,GAAG,MAAM,WAAW,YAAY,EAAE;AACjD;"}
+{"version":3,"file":"projection.js","names":[],"sources":["../../../src/adapters/projection.ts"],"sourcesContent":["/**\n * Claude Code workspace projector — the reference implementation the other\n * harness projectors (codex, opencode) mirror.\n *\n * `withSandbox` surfaces a portable `WorkspaceProjection` (skills, plugins, a\n * secret resolver, and a one-time marker path) via a capability. Each harness\n * adapter reads it in its `chatStream` setup and projects those inputs into the\n * CLI's native format. For Claude Code that means:\n *\n *   - MCP servers   → a project-scoped `.mcp.json` at the workspace root.\n *   - gitSkill repos → linked under `.claude/skills/<basename>`.\n *   - agentSkill     → no reliable claude primitive pulls a public skill by\n *                      bare name, so we warn and skip rather than invent one.\n *   - plugins        → `claude plugin install <name>` (best-effort).\n *\n * The secret-bearing `.mcp.json` is (re)written on EVERY call, re-resolving\n * secrets each time, so claude always reads current values and a snapshot can\n * never serve a stale or rotated secret. Only the safe, idempotent, non-secret\n * operations (gitSkill links, plugin installs, agentSkill handling) are guarded\n * by a one-time marker file under the workspace.\n *\n * External-convention caveat: the `.mcp.json` location/shape, the skills dir,\n * and the plugin-install command are verified against the installed `claude`\n * CLI. Where claude has no clean primitive (agentSkill by bare name) we no-op\n * with a warning instead of fabricating a command.\n */\nimport { isSecretRef, resolveGitSkillDir } from '@tanstack/ai-sandbox'\nimport type {\n  BearerRef,\n  SandboxHandle,\n  SecretRef,\n  WorkspaceProjection,\n  WorkspaceSkill,\n} from '@tanstack/ai-sandbox'\n\n/** POSIX single-quote escape for embedding a value in a shell command. */\nfunction shellQuote(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`\n}\n\n/** Last path segment of a `gitSkill` clone dir, used as the skills-dir name. */\nfunction basenameOf(path: string): string {\n  const segments = path.split('/').filter((segment) => segment !== '')\n  return segments[segments.length - 1] ?? path\n}\n\n/** True when `value` is a `bearer(ref)` marker created by `@tanstack/ai-sandbox`. */\nfunction isBearerMarker(value: unknown): value is BearerRef {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    isSecretRef((value as { __bearerRef?: unknown }).__bearerRef)\n  )\n}\n\n/**\n * Resolve a single MCP header value: a `SecretRef` resolves to its plaintext, a\n * `bearer(ref)` marker resolves to `Bearer <plaintext>`, and a plain string is\n * passed through unchanged.\n */\nfunction resolveHeaderValue(\n  value: string | SecretRef | BearerRef,\n  resolveSecret: (ref: SecretRef) => string,\n): string {\n  if (isSecretRef(value)) return resolveSecret(value)\n  if (isBearerMarker(value)) return `Bearer ${resolveSecret(value.__bearerRef)}`\n  return value\n}\n\n/** A claude-format HTTP MCP server entry. */\ninterface ClaudeMcpServer {\n  type: 'http'\n  url: string\n  headers: Record<string, string>\n}\n\n/**\n * Build claude's project-scoped MCP config from the `{ kind: 'mcp' }` skills,\n * resolving every header value (SecretRef / bearer / string). Returns\n * `undefined` when there are no MCP skills so the caller can skip the write.\n */\nfunction buildMcpConfig(\n  skills: Array<WorkspaceSkill>,\n  resolveSecret: (ref: SecretRef) => string,\n): { mcpServers: Record<string, ClaudeMcpServer> } | undefined {\n  const mcpServers: Record<string, ClaudeMcpServer> = {}\n  let count = 0\n  for (const skill of skills) {\n    if (skill.kind !== 'mcp') continue\n    count += 1\n    const headers: Record<string, string> = {}\n    const rawHeaders = skill.config.headers ?? {}\n    for (const [name, value] of Object.entries(rawHeaders)) {\n      headers[name] = resolveHeaderValue(value, resolveSecret)\n    }\n    const rawUrl = skill.config['url']\n    const url = typeof rawUrl === 'string' ? rawUrl : ''\n    mcpServers[skill.name] = { type: 'http', url, headers }\n  }\n  return count > 0 ? { mcpServers } : undefined\n}\n\n/**\n * Write the project-scoped `.mcp.json`, re-resolving every secret. This runs on\n * EVERY projection call (never gated by the marker) so claude always reads the\n * current secret values and a snapshot can never serve a stale or rotated one.\n * With `snapshot:'after-run'` the file may still be captured in the image, so\n * secret-bearing MCP material is best used with the default `after-setup`\n * strategy. When there are no MCP skills the write is skipped.\n */\nasync function projectMcpServers(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  const config = buildMcpConfig(projection.skills, projection.resolveSecret)\n  if (config === undefined) return\n  const target = `${projection.root}/.mcp.json`\n  await handle.fs.write(target, JSON.stringify(config, null, 2))\n}\n\n/**\n * Ensure each cloned `gitSkill` repo is available under claude's project skills\n * dir (`<root>/.claude/skills/<basename>`) via a symlink, falling back to a\n * recursive copy on platforms without `ln -s`.\n */\nasync function projectGitSkills(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  const skillsDir = `${projection.root}/.claude/skills`\n  let madeDir = false\n  for (const skill of projection.skills) {\n    if (skill.kind !== 'git') continue\n    if (!madeDir) {\n      await handle.fs.mkdir(skillsDir)\n      madeDir = true\n    }\n    const source = skill.into ?? resolveGitSkillDir(projection.root, skill)\n    const target = `${skillsDir}/${basenameOf(source)}`\n    const lnCmd = `ln -s ${shellQuote(source)} ${shellQuote(target)}`\n    const result = await handle.process.exec(lnCmd, { cwd: projection.root })\n    if (result.exitCode !== 0) {\n      const cpCmd = `cp -r ${shellQuote(source)} ${shellQuote(target)}`\n      const copied = await handle.process.exec(cpCmd, { cwd: projection.root })\n      if (copied.exitCode !== 0) {\n        console.warn(\n          `[claude-code] failed to link gitSkill \"${skill.repo}\" into ${target}: ${copied.stderr.trim()}`,\n        )\n      }\n    }\n  }\n}\n\n/**\n * `agentSkill` references a public skill by bare name. Claude Code has no\n * primitive to fetch a skill from a bare name (skills resolve from local\n * `.claude/skills/` dirs and plugin marketplaces), so we warn and skip rather\n * than fabricate a command.\n */\nfunction projectAgentSkills(projection: WorkspaceProjection): void {\n  for (const skill of projection.skills) {\n    if (skill.kind !== 'agent-skill') continue\n    console.warn(\n      `[claude-code] agentSkill \"${skill.name}\" cannot be projected: Claude Code has ` +\n        'no command to install a public skill by bare name. Provide it as a gitSkill ' +\n        'or a plugin instead. Skipping.',\n    )\n  }\n}\n\n/**\n * Install each declared plugin via `claude plugin install <name>`. Plugin\n * installs are best-effort: a failure (no marketplace, network, …) warns but\n * never throws, so a missing plugin can't break the run.\n */\nasync function projectPlugins(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  for (const name of projection.plugins) {\n    const cmd = `claude plugin install ${shellQuote(name)}`\n    try {\n      const result = await handle.process.exec(cmd, { cwd: projection.root })\n      if (result.exitCode !== 0) {\n        console.warn(\n          `[claude-code] \"claude plugin install ${name}\" exited ${result.exitCode}: ${result.stderr.trim()}`,\n        )\n      }\n    } catch (error: unknown) {\n      const message = error instanceof Error ? error.message : String(error)\n      console.warn(\n        `[claude-code] failed to install plugin \"${name}\": ${message}`,\n      )\n    }\n  }\n}\n\n/**\n * Project a `WorkspaceProjection` into the Claude Code sandbox. Safe to call on\n * every `chatStream`. The secret-bearing `.mcp.json` is (re)written on every\n * call, re-resolving secrets, so claude always reads current values and a\n * snapshot can never serve a stale or rotated secret. The safe, idempotent,\n * non-secret operations (gitSkill links, plugin installs, agentSkill handling)\n * are guarded by a one-time marker so they run only on the first call after\n * create/restore.\n *\n * @param handle     - The sandbox handle (`fs` + `process`).\n * @param projection - The portable workspace inputs from `withSandbox`.\n */\nexport async function projectClaudeWorkspace(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  // Always re-resolve and rewrite the secret-bearing MCP config so rotated\n  // secrets re-apply and snapshots can't serve stale values.\n  await projectMcpServers(handle, projection)\n\n  // Gate only the safe, idempotent, non-secret operations on the marker.\n  if (await handle.fs.exists(projection.markerPath)) return\n\n  await projectGitSkills(handle, projection)\n  projectAgentSkills(projection)\n  await projectPlugins(handle, projection)\n\n  await handle.fs.write(projection.markerPath, '')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAS,WAAW,OAAuB;CACzC,OAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,EAAE;AAC1C;;AAGA,SAAS,WAAW,MAAsB;CACxC,MAAM,WAAW,KAAK,MAAM,GAAG,CAAC,CAAC,QAAQ,YAAY,YAAY,EAAE;CACnE,OAAO,SAAS,SAAS,SAAS,MAAM;AAC1C;;AAGA,SAAS,eAAe,OAAoC;CAC1D,OACE,OAAO,UAAU,YACjB,UAAU,QACV,YAAa,MAAoC,WAAW;AAEhE;;;;;;AAOA,SAAS,mBACP,OACA,eACQ;CACR,IAAI,YAAY,KAAK,GAAG,OAAO,cAAc,KAAK;CAClD,IAAI,eAAe,KAAK,GAAG,OAAO,UAAU,cAAc,MAAM,WAAW;CAC3E,OAAO;AACT;;;;;;AAcA,SAAS,eACP,QACA,eAC6D;CAC7D,MAAM,aAA8C,CAAC;CACrD,IAAI,QAAQ;CACZ,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,OAAO;EAC1B,SAAS;EACT,MAAM,UAAkC,CAAC;EACzC,MAAM,aAAa,MAAM,OAAO,WAAW,CAAC;EAC5C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,UAAU,GACnD,QAAQ,QAAQ,mBAAmB,OAAO,aAAa;EAEzD,MAAM,SAAS,MAAM,OAAO;EAC5B,MAAM,MAAM,OAAO,WAAW,WAAW,SAAS;EAClD,WAAW,MAAM,QAAQ;GAAE,MAAM;GAAQ;GAAK;EAAQ;CACxD;CACA,OAAO,QAAQ,IAAI,EAAE,WAAW,IAAI,KAAA;AACtC;;;;;;;;;AAUA,eAAe,kBACb,QACA,YACe;CACf,MAAM,SAAS,eAAe,WAAW,QAAQ,WAAW,aAAa;CACzE,IAAI,WAAW,KAAA,GAAW;CAC1B,MAAM,SAAS,GAAG,WAAW,KAAK;CAClC,MAAM,OAAO,GAAG,MAAM,QAAQ,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC/D;;;;;;AAOA,eAAe,iBACb,QACA,YACe;CACf,MAAM,YAAY,GAAG,WAAW,KAAK;CACrC,IAAI,UAAU;CACd,KAAK,MAAM,SAAS,WAAW,QAAQ;EACrC,IAAI,MAAM,SAAS,OAAO;EAC1B,IAAI,CAAC,SAAS;GACZ,MAAM,OAAO,GAAG,MAAM,SAAS;GAC/B,UAAU;EACZ;EACA,MAAM,SAAS,MAAM,QAAQ,mBAAmB,WAAW,MAAM,KAAK;EACtE,MAAM,SAAS,GAAG,UAAU,GAAG,WAAW,MAAM;EAChD,MAAM,QAAQ,SAAS,WAAW,MAAM,EAAE,GAAG,WAAW,MAAM;EAE9D,KAAI,MADiB,OAAO,QAAQ,KAAK,OAAO,EAAE,KAAK,WAAW,KAAK,CAAC,EAAA,CAC7D,aAAa,GAAG;GACzB,MAAM,QAAQ,SAAS,WAAW,MAAM,EAAE,GAAG,WAAW,MAAM;GAC9D,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK,OAAO,EAAE,KAAK,WAAW,KAAK,CAAC;GACxE,IAAI,OAAO,aAAa,GACtB,QAAQ,KACN,0CAA0C,MAAM,KAAK,SAAS,OAAO,IAAI,OAAO,OAAO,KAAK,GAC9F;EAEJ;CACF;AACF;;;;;;;AAQA,SAAS,mBAAmB,YAAuC;CACjE,KAAK,MAAM,SAAS,WAAW,QAAQ;EACrC,IAAI,MAAM,SAAS,eAAe;EAClC,QAAQ,KACN,6BAA6B,MAAM,KAAK,kJAG1C;CACF;AACF;;;;;;AAOA,eAAe,eACb,QACA,YACe;CACf,KAAK,MAAM,QAAQ,WAAW,SAAS;EACrC,MAAM,MAAM,yBAAyB,WAAW,IAAI;EACpD,IAAI;GACF,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK,KAAK,EAAE,KAAK,WAAW,KAAK,CAAC;GACtE,IAAI,OAAO,aAAa,GACtB,QAAQ,KACN,wCAAwC,KAAK,WAAW,OAAO,SAAS,IAAI,OAAO,OAAO,KAAK,GACjG;EAEJ,SAAS,OAAgB;GACvB,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACrE,QAAQ,KACN,2CAA2C,KAAK,KAAK,SACvD;EACF;CACF;AACF;;;;;;;;;;;;;AAcA,eAAsB,uBACpB,QACA,YACe;CAGf,MAAM,kBAAkB,QAAQ,UAAU;CAG1C,IAAI,MAAM,OAAO,GAAG,OAAO,WAAW,UAAU,GAAG;CAEnD,MAAM,iBAAiB,QAAQ,UAAU;CACzC,mBAAmB,UAAU;CAC7B,MAAM,eAAe,QAAQ,UAAU;CAEvC,MAAM,OAAO,GAAG,MAAM,WAAW,YAAY,EAAE;AACjD"}