@tanstack/ai-claude-code 0.3.1 → 0.4.0

package/dist/esm/adapters/claude-run-source.d.ts

@@ -0,0 +1,14 @@
+/** Placeholder swapped for the schema JSON after the runner reads the files. */
+export declare const CLAUDE_JSON_SCHEMA_PLACEHOLDER = "__TANSTACK_SCHEMA__";
+/**
+ * Written into the sandbox and run with `node`.
+ *
+ * The shell only sees two filenames. The runner reads the argv array and the
+ * schema JSON from those files, then spawn()s claude so `--json-schema` is a
+ * real argv value (the CLI rejects a file path).
+ *
+ * On Windows, `claude` is often a `.cmd` shim. `spawn(cmd, args)` without a
+ * shell cannot find that shim, so we go through `sh` with `"$0"` / `"$@"`
+ * (git-bash is already on PATH in the local-process sandbox).
+ */
+export declare const CLAUDE_RUNNER_SOURCE: string;

package/dist/esm/adapters/claude-run-source.js

@@ -0,0 +1,70 @@
+//#region src/adapters/claude-run-source.ts
+/** Placeholder swapped for the schema JSON after the runner reads the files. */
+var CLAUDE_JSON_SCHEMA_PLACEHOLDER = "__TANSTACK_SCHEMA__";
+/**
+* Written into the sandbox and run with `node`.
+*
+* The shell only sees two filenames. The runner reads the argv array and the
+* schema JSON from those files, then spawn()s claude so `--json-schema` is a
+* real argv value (the CLI rejects a file path).
+*
+* On Windows, `claude` is often a `.cmd` shim. `spawn(cmd, args)` without a
+* shell cannot find that shim, so we go through `sh` with `"$0"` / `"$@"`
+* (git-bash is already on PATH in the local-process sandbox).
+*/
+var CLAUDE_RUNNER_SOURCE = `import { spawn } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+
+const argvFile = process.argv[2]
+if (!argvFile) {
+  console.error('tanstack-claude-run: missing argv file')
+  process.exit(1)
+}
+
+const argv = JSON.parse(readFileSync(argvFile, 'utf8'))
+if (!Array.isArray(argv)) {
+  console.error('tanstack-claude-run: argv file must be a JSON array')
+  process.exit(1)
+}
+
+const schemaFile = process.argv[3]
+if (schemaFile) {
+  const schema = readFileSync(schemaFile, 'utf8')
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === ${JSON.stringify(CLAUDE_JSON_SCHEMA_PLACEHOLDER)}) argv[i] = schema
+  }
+}
+
+const [cmd, ...args] = argv
+if (typeof cmd !== 'string' || cmd === '') {
+  console.error('tanstack-claude-run: missing command')
+  process.exit(1)
+}
+
+const opts = {
+  stdio: ['pipe', 'pipe', 'pipe'],
+  env: process.env,
+  windowsHide: true,
+}
+
+const child =
+  process.platform === 'win32'
+    ? spawn('sh', ['-c', 'exec "$0" "$@"', cmd, ...args], opts)
+    : spawn(cmd, args, opts)
+
+process.stdin.pipe(child.stdin)
+child.stdout.pipe(process.stdout)
+child.stderr.pipe(process.stderr)
+child.on('error', (error) => {
+  console.error(error)
+  process.exit(1)
+})
+child.on('exit', (code, signal) => {
+  if (signal) process.exit(1)
+  process.exit(code ?? 1)
+})
+`;
+//#endregion
+export { CLAUDE_JSON_SCHEMA_PLACEHOLDER, CLAUDE_RUNNER_SOURCE };
+
+//# sourceMappingURL=claude-run-source.js.map

package/dist/esm/adapters/claude-run-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-run-source.js","names":[],"sources":["../../../src/adapters/claude-run-source.ts"],"sourcesContent":["/** Placeholder swapped for the schema JSON after the runner reads the files. */\nexport const CLAUDE_JSON_SCHEMA_PLACEHOLDER = '__TANSTACK_SCHEMA__'\n\n/**\n * Written into the sandbox and run with `node`.\n *\n * The shell only sees two filenames. The runner reads the argv array and the\n * schema JSON from those files, then spawn()s claude so `--json-schema` is a\n * real argv value (the CLI rejects a file path).\n *\n * On Windows, `claude` is often a `.cmd` shim. `spawn(cmd, args)` without a\n * shell cannot find that shim, so we go through `sh` with `\"$0\"` / `\"$@\"`\n * (git-bash is already on PATH in the local-process sandbox).\n */\nexport const CLAUDE_RUNNER_SOURCE = `import { spawn } from 'node:child_process'\nimport { readFileSync } from 'node:fs'\n\nconst argvFile = process.argv[2]\nif (!argvFile) {\n  console.error('tanstack-claude-run: missing argv file')\n  process.exit(1)\n}\n\nconst argv = JSON.parse(readFileSync(argvFile, 'utf8'))\nif (!Array.isArray(argv)) {\n  console.error('tanstack-claude-run: argv file must be a JSON array')\n  process.exit(1)\n}\n\nconst schemaFile = process.argv[3]\nif (schemaFile) {\n  const schema = readFileSync(schemaFile, 'utf8')\n  for (let i = 0; i < argv.length; i++) {\n    if (argv[i] === ${JSON.stringify(CLAUDE_JSON_SCHEMA_PLACEHOLDER)}) argv[i] = schema\n  }\n}\n\nconst [cmd, ...args] = argv\nif (typeof cmd !== 'string' || cmd === '') {\n  console.error('tanstack-claude-run: missing command')\n  process.exit(1)\n}\n\nconst opts = {\n  stdio: ['pipe', 'pipe', 'pipe'],\n  env: process.env,\n  windowsHide: true,\n}\n\nconst child =\n  process.platform === 'win32'\n    ? spawn('sh', ['-c', 'exec \"$0\" \"$@\"', cmd, ...args], opts)\n    : spawn(cmd, args, opts)\n\nprocess.stdin.pipe(child.stdin)\nchild.stdout.pipe(process.stdout)\nchild.stderr.pipe(process.stderr)\nchild.on('error', (error) => {\n  console.error(error)\n  process.exit(1)\n})\nchild.on('exit', (code, signal) => {\n  if (signal) process.exit(1)\n  process.exit(code ?? 1)\n})\n`\n"],"mappings":";;AACA,IAAa,iCAAiC;;;;;;;;;;;;AAa9C,IAAa,uBAAuB;;;;;;;;;;;;;;;;;;;sBAmBd,KAAK,UAAU,8BAA8B,EAAE"}

package/dist/esm/adapters/projection.js

@@ -1,4 +1,4 @@
-import { isSecretRef, resolveGitSkillDir } from "@tanstack/ai-sandbox";
+import { discoverSkillDirs, isSecretRef, resolveGitSkillDir, resolveHarnessCwd } from "@tanstack/ai-sandbox";
 //#region src/adapters/projection.ts
 /**
 * Claude Code workspace projector — the reference implementation the other
@@ -30,11 +30,6 @@ import { isSecretRef, resolveGitSkillDir } from "@tanstack/ai-sandbox";
 function shellQuote(value) {
 	return `'${value.replace(/'/g, `'\\''`)}'`;
 }
-/** Last path segment of a `gitSkill` clone dir, used as the skills-dir name. */
-function basenameOf(path) {
-	const segments = path.split("/").filter((segment) => segment !== "");
-	return segments[segments.length - 1] ?? path;
-}
 /** True when `value` is a `bearer(ref)` marker created by `@tanstack/ai-sandbox`. */
 function isBearerMarker(value) {
 	return typeof value === "object" && value !== null && isSecretRef(value.__bearerRef);
@@ -102,12 +97,16 @@ async function projectGitSkills(handle, projection) {
 			madeDir = true;
 		}
 		const source = skill.into ?? resolveGitSkillDir(projection.root, skill);
-		const target = `${skillsDir}/${basenameOf(source)}`;
-		const lnCmd = `ln -s ${shellQuote(source)} ${shellQuote(target)}`;
-		if ((await handle.process.exec(lnCmd, { cwd: projection.root })).exitCode !== 0) {
-			const cpCmd = `cp -r ${shellQuote(source)} ${shellQuote(target)}`;
-			const copied = await handle.process.exec(cpCmd, { cwd: projection.root });
-			if (copied.exitCode !== 0) console.warn(`[claude-code] failed to link gitSkill "${skill.repo}" into ${target}: ${copied.stderr.trim()}`);
+		const discovered = await discoverSkillDirs(handle, source);
+		for (const { name, dir } of discovered) {
+			const target = resolveHarnessCwd(handle, `${skillsDir}/${name}`);
+			const realDir = resolveHarnessCwd(handle, dir);
+			const lnCmd = `ln -s ${shellQuote(realDir)} ${shellQuote(target)}`;
+			if ((await handle.process.exec(lnCmd, { cwd: projection.root })).exitCode !== 0) {
+				const cpCmd = `cp -r ${shellQuote(realDir)} ${shellQuote(target)}`;
+				const copied = await handle.process.exec(cpCmd, { cwd: projection.root });
+				if (copied.exitCode !== 0) console.warn(`[claude-code] failed to link gitSkill "${skill.repo}" into ${target}: ${copied.stderr.trim()}`);
+			}
 		}
 	}
 }

package/dist/esm/adapters/projection.js.map

@@ -1 +1 @@
-{"version":3,"file":"projection.js","names":[],"sources":["../../../src/adapters/projection.ts"],"sourcesContent":["/**\n * Claude Code workspace projector — the reference implementation the other\n * harness projectors (codex, opencode) mirror.\n *\n * `withSandbox` surfaces a portable `WorkspaceProjection` (skills, plugins, a\n * secret resolver, and a one-time marker path) via a capability. Each harness\n * adapter reads it in its `chatStream` setup and projects those inputs into the\n * CLI's native format. For Claude Code that means:\n *\n *   - MCP servers   → a project-scoped `.mcp.json` at the workspace root.\n *   - gitSkill repos → linked under `.claude/skills/<basename>`.\n *   - agentSkill     → no reliable claude primitive pulls a public skill by\n *                      bare name, so we warn and skip rather than invent one.\n *   - plugins        → `claude plugin install <name>` (best-effort).\n *\n * The secret-bearing `.mcp.json` is (re)written on EVERY call, re-resolving\n * secrets each time, so claude always reads current values and a snapshot can\n * never serve a stale or rotated secret. Only the safe, idempotent, non-secret\n * operations (gitSkill links, plugin installs, agentSkill handling) are guarded\n * by a one-time marker file under the workspace.\n *\n * External-convention caveat: the `.mcp.json` location/shape, the skills dir,\n * and the plugin-install command are verified against the installed `claude`\n * CLI. Where claude has no clean primitive (agentSkill by bare name) we no-op\n * with a warning instead of fabricating a command.\n */\nimport { isSecretRef, resolveGitSkillDir } from '@tanstack/ai-sandbox'\nimport type {\n  BearerRef,\n  SandboxHandle,\n  SecretRef,\n  WorkspaceProjection,\n  WorkspaceSkill,\n} from '@tanstack/ai-sandbox'\n\n/** POSIX single-quote escape for embedding a value in a shell command. */\nfunction shellQuote(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`\n}\n\n/** Last path segment of a `gitSkill` clone dir, used as the skills-dir name. */\nfunction basenameOf(path: string): string {\n  const segments = path.split('/').filter((segment) => segment !== '')\n  return segments[segments.length - 1] ?? path\n}\n\n/** True when `value` is a `bearer(ref)` marker created by `@tanstack/ai-sandbox`. */\nfunction isBearerMarker(value: unknown): value is BearerRef {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    isSecretRef((value as { __bearerRef?: unknown }).__bearerRef)\n  )\n}\n\n/**\n * Resolve a single MCP header value: a `SecretRef` resolves to its plaintext, a\n * `bearer(ref)` marker resolves to `Bearer <plaintext>`, and a plain string is\n * passed through unchanged.\n */\nfunction resolveHeaderValue(\n  value: string | SecretRef | BearerRef,\n  resolveSecret: (ref: SecretRef) => string,\n): string {\n  if (isSecretRef(value)) return resolveSecret(value)\n  if (isBearerMarker(value)) return `Bearer ${resolveSecret(value.__bearerRef)}`\n  return value\n}\n\n/** A claude-format HTTP MCP server entry. */\ninterface ClaudeMcpServer {\n  type: 'http'\n  url: string\n  headers: Record<string, string>\n}\n\n/**\n * Build claude's project-scoped MCP config from the `{ kind: 'mcp' }` skills,\n * resolving every header value (SecretRef / bearer / string). Returns\n * `undefined` when there are no MCP skills so the caller can skip the write.\n */\nfunction buildMcpConfig(\n  skills: Array<WorkspaceSkill>,\n  resolveSecret: (ref: SecretRef) => string,\n): { mcpServers: Record<string, ClaudeMcpServer> } | undefined {\n  const mcpServers: Record<string, ClaudeMcpServer> = {}\n  let count = 0\n  for (const skill of skills) {\n    if (skill.kind !== 'mcp') continue\n    count += 1\n    const headers: Record<string, string> = {}\n    const rawHeaders = skill.config.headers ?? {}\n    for (const [name, value] of Object.entries(rawHeaders)) {\n      headers[name] = resolveHeaderValue(value, resolveSecret)\n    }\n    const rawUrl = skill.config['url']\n    const url = typeof rawUrl === 'string' ? rawUrl : ''\n    mcpServers[skill.name] = { type: 'http', url, headers }\n  }\n  return count > 0 ? { mcpServers } : undefined\n}\n\n/**\n * Write the project-scoped `.mcp.json`, re-resolving every secret. This runs on\n * EVERY projection call (never gated by the marker) so claude always reads the\n * current secret values and a snapshot can never serve a stale or rotated one.\n * With `snapshot:'after-run'` the file may still be captured in the image, so\n * secret-bearing MCP material is best used with the default `after-setup`\n * strategy. When there are no MCP skills the write is skipped.\n */\nasync function projectMcpServers(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  const config = buildMcpConfig(projection.skills, projection.resolveSecret)\n  if (config === undefined) return\n  const target = `${projection.root}/.mcp.json`\n  await handle.fs.write(target, JSON.stringify(config, null, 2))\n}\n\n/**\n * Ensure each cloned `gitSkill` repo is available under claude's project skills\n * dir (`<root>/.claude/skills/<basename>`) via a symlink, falling back to a\n * recursive copy on platforms without `ln -s`.\n */\nasync function projectGitSkills(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  const skillsDir = `${projection.root}/.claude/skills`\n  let madeDir = false\n  for (const skill of projection.skills) {\n    if (skill.kind !== 'git') continue\n    if (!madeDir) {\n      await handle.fs.mkdir(skillsDir)\n      madeDir = true\n    }\n    const source = skill.into ?? resolveGitSkillDir(projection.root, skill)\n    const target = `${skillsDir}/${basenameOf(source)}`\n    const lnCmd = `ln -s ${shellQuote(source)} ${shellQuote(target)}`\n    const result = await handle.process.exec(lnCmd, { cwd: projection.root })\n    if (result.exitCode !== 0) {\n      const cpCmd = `cp -r ${shellQuote(source)} ${shellQuote(target)}`\n      const copied = await handle.process.exec(cpCmd, { cwd: projection.root })\n      if (copied.exitCode !== 0) {\n        console.warn(\n          `[claude-code] failed to link gitSkill \"${skill.repo}\" into ${target}: ${copied.stderr.trim()}`,\n        )\n      }\n    }\n  }\n}\n\n/**\n * `agentSkill` references a public skill by bare name. Claude Code has no\n * primitive to fetch a skill from a bare name (skills resolve from local\n * `.claude/skills/` dirs and plugin marketplaces), so we warn and skip rather\n * than fabricate a command.\n */\nfunction projectAgentSkills(projection: WorkspaceProjection): void {\n  for (const skill of projection.skills) {\n    if (skill.kind !== 'agent-skill') continue\n    console.warn(\n      `[claude-code] agentSkill \"${skill.name}\" cannot be projected: Claude Code has ` +\n        'no command to install a public skill by bare name. Provide it as a gitSkill ' +\n        'or a plugin instead. Skipping.',\n    )\n  }\n}\n\n/**\n * Install each declared plugin via `claude plugin install <name>`. Plugin\n * installs are best-effort: a failure (no marketplace, network, …) warns but\n * never throws, so a missing plugin can't break the run.\n */\nasync function projectPlugins(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  for (const name of projection.plugins) {\n    const cmd = `claude plugin install ${shellQuote(name)}`\n    try {\n      const result = await handle.process.exec(cmd, { cwd: projection.root })\n      if (result.exitCode !== 0) {\n        console.warn(\n          `[claude-code] \"claude plugin install ${name}\" exited ${result.exitCode}: ${result.stderr.trim()}`,\n        )\n      }\n    } catch (error: unknown) {\n      const message = error instanceof Error ? error.message : String(error)\n      console.warn(\n        `[claude-code] failed to install plugin \"${name}\": ${message}`,\n      )\n    }\n  }\n}\n\n/**\n * Project a `WorkspaceProjection` into the Claude Code sandbox. Safe to call on\n * every `chatStream`. The secret-bearing `.mcp.json` is (re)written on every\n * call, re-resolving secrets, so claude always reads current values and a\n * snapshot can never serve a stale or rotated secret. The safe, idempotent,\n * non-secret operations (gitSkill links, plugin installs, agentSkill handling)\n * are guarded by a one-time marker so they run only on the first call after\n * create/restore.\n *\n * @param handle     - The sandbox handle (`fs` + `process`).\n * @param projection - The portable workspace inputs from `withSandbox`.\n */\nexport async function projectClaudeWorkspace(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  // Always re-resolve and rewrite the secret-bearing MCP config so rotated\n  // secrets re-apply and snapshots can't serve stale values.\n  await projectMcpServers(handle, projection)\n\n  // Gate only the safe, idempotent, non-secret operations on the marker.\n  if (await handle.fs.exists(projection.markerPath)) return\n\n  await projectGitSkills(handle, projection)\n  projectAgentSkills(projection)\n  await projectPlugins(handle, projection)\n\n  await handle.fs.write(projection.markerPath, '')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAS,WAAW,OAAuB;CACzC,OAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,EAAE;AAC1C;;AAGA,SAAS,WAAW,MAAsB;CACxC,MAAM,WAAW,KAAK,MAAM,GAAG,CAAC,CAAC,QAAQ,YAAY,YAAY,EAAE;CACnE,OAAO,SAAS,SAAS,SAAS,MAAM;AAC1C;;AAGA,SAAS,eAAe,OAAoC;CAC1D,OACE,OAAO,UAAU,YACjB,UAAU,QACV,YAAa,MAAoC,WAAW;AAEhE;;;;;;AAOA,SAAS,mBACP,OACA,eACQ;CACR,IAAI,YAAY,KAAK,GAAG,OAAO,cAAc,KAAK;CAClD,IAAI,eAAe,KAAK,GAAG,OAAO,UAAU,cAAc,MAAM,WAAW;CAC3E,OAAO;AACT;;;;;;AAcA,SAAS,eACP,QACA,eAC6D;CAC7D,MAAM,aAA8C,CAAC;CACrD,IAAI,QAAQ;CACZ,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,OAAO;EAC1B,SAAS;EACT,MAAM,UAAkC,CAAC;EACzC,MAAM,aAAa,MAAM,OAAO,WAAW,CAAC;EAC5C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,UAAU,GACnD,QAAQ,QAAQ,mBAAmB,OAAO,aAAa;EAEzD,MAAM,SAAS,MAAM,OAAO;EAC5B,MAAM,MAAM,OAAO,WAAW,WAAW,SAAS;EAClD,WAAW,MAAM,QAAQ;GAAE,MAAM;GAAQ;GAAK;EAAQ;CACxD;CACA,OAAO,QAAQ,IAAI,EAAE,WAAW,IAAI,KAAA;AACtC;;;;;;;;;AAUA,eAAe,kBACb,QACA,YACe;CACf,MAAM,SAAS,eAAe,WAAW,QAAQ,WAAW,aAAa;CACzE,IAAI,WAAW,KAAA,GAAW;CAC1B,MAAM,SAAS,GAAG,WAAW,KAAK;CAClC,MAAM,OAAO,GAAG,MAAM,QAAQ,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC/D;;;;;;AAOA,eAAe,iBACb,QACA,YACe;CACf,MAAM,YAAY,GAAG,WAAW,KAAK;CACrC,IAAI,UAAU;CACd,KAAK,MAAM,SAAS,WAAW,QAAQ;EACrC,IAAI,MAAM,SAAS,OAAO;EAC1B,IAAI,CAAC,SAAS;GACZ,MAAM,OAAO,GAAG,MAAM,SAAS;GAC/B,UAAU;EACZ;EACA,MAAM,SAAS,MAAM,QAAQ,mBAAmB,WAAW,MAAM,KAAK;EACtE,MAAM,SAAS,GAAG,UAAU,GAAG,WAAW,MAAM;EAChD,MAAM,QAAQ,SAAS,WAAW,MAAM,EAAE,GAAG,WAAW,MAAM;EAE9D,KAAI,MADiB,OAAO,QAAQ,KAAK,OAAO,EAAE,KAAK,WAAW,KAAK,CAAC,EAAA,CAC7D,aAAa,GAAG;GACzB,MAAM,QAAQ,SAAS,WAAW,MAAM,EAAE,GAAG,WAAW,MAAM;GAC9D,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK,OAAO,EAAE,KAAK,WAAW,KAAK,CAAC;GACxE,IAAI,OAAO,aAAa,GACtB,QAAQ,KACN,0CAA0C,MAAM,KAAK,SAAS,OAAO,IAAI,OAAO,OAAO,KAAK,GAC9F;EAEJ;CACF;AACF;;;;;;;AAQA,SAAS,mBAAmB,YAAuC;CACjE,KAAK,MAAM,SAAS,WAAW,QAAQ;EACrC,IAAI,MAAM,SAAS,eAAe;EAClC,QAAQ,KACN,6BAA6B,MAAM,KAAK,kJAG1C;CACF;AACF;;;;;;AAOA,eAAe,eACb,QACA,YACe;CACf,KAAK,MAAM,QAAQ,WAAW,SAAS;EACrC,MAAM,MAAM,yBAAyB,WAAW,IAAI;EACpD,IAAI;GACF,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK,KAAK,EAAE,KAAK,WAAW,KAAK,CAAC;GACtE,IAAI,OAAO,aAAa,GACtB,QAAQ,KACN,wCAAwC,KAAK,WAAW,OAAO,SAAS,IAAI,OAAO,OAAO,KAAK,GACjG;EAEJ,SAAS,OAAgB;GACvB,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACrE,QAAQ,KACN,2CAA2C,KAAK,KAAK,SACvD;EACF;CACF;AACF;;;;;;;;;;;;;AAcA,eAAsB,uBACpB,QACA,YACe;CAGf,MAAM,kBAAkB,QAAQ,UAAU;CAG1C,IAAI,MAAM,OAAO,GAAG,OAAO,WAAW,UAAU,GAAG;CAEnD,MAAM,iBAAiB,QAAQ,UAAU;CACzC,mBAAmB,UAAU;CAC7B,MAAM,eAAe,QAAQ,UAAU;CAEvC,MAAM,OAAO,GAAG,MAAM,WAAW,YAAY,EAAE;AACjD"}
+{"version":3,"file":"projection.js","names":[],"sources":["../../../src/adapters/projection.ts"],"sourcesContent":["/**\n * Claude Code workspace projector — the reference implementation the other\n * harness projectors (codex, opencode) mirror.\n *\n * `withSandbox` surfaces a portable `WorkspaceProjection` (skills, plugins, a\n * secret resolver, and a one-time marker path) via a capability. Each harness\n * adapter reads it in its `chatStream` setup and projects those inputs into the\n * CLI's native format. For Claude Code that means:\n *\n *   - MCP servers   → a project-scoped `.mcp.json` at the workspace root.\n *   - gitSkill repos → linked under `.claude/skills/<basename>`.\n *   - agentSkill     → no reliable claude primitive pulls a public skill by\n *                      bare name, so we warn and skip rather than invent one.\n *   - plugins        → `claude plugin install <name>` (best-effort).\n *\n * The secret-bearing `.mcp.json` is (re)written on EVERY call, re-resolving\n * secrets each time, so claude always reads current values and a snapshot can\n * never serve a stale or rotated secret. Only the safe, idempotent, non-secret\n * operations (gitSkill links, plugin installs, agentSkill handling) are guarded\n * by a one-time marker file under the workspace.\n *\n * External-convention caveat: the `.mcp.json` location/shape, the skills dir,\n * and the plugin-install command are verified against the installed `claude`\n * CLI. Where claude has no clean primitive (agentSkill by bare name) we no-op\n * with a warning instead of fabricating a command.\n */\nimport {\n  discoverSkillDirs,\n  isSecretRef,\n  resolveGitSkillDir,\n  resolveHarnessCwd,\n} from '@tanstack/ai-sandbox'\nimport type {\n  BearerRef,\n  SandboxHandle,\n  SecretRef,\n  WorkspaceProjection,\n  WorkspaceSkill,\n} from '@tanstack/ai-sandbox'\n\n/** POSIX single-quote escape for embedding a value in a shell command. */\nfunction shellQuote(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`\n}\n\n/** True when `value` is a `bearer(ref)` marker created by `@tanstack/ai-sandbox`. */\nfunction isBearerMarker(value: unknown): value is BearerRef {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    isSecretRef((value as { __bearerRef?: unknown }).__bearerRef)\n  )\n}\n\n/**\n * Resolve a single MCP header value: a `SecretRef` resolves to its plaintext, a\n * `bearer(ref)` marker resolves to `Bearer <plaintext>`, and a plain string is\n * passed through unchanged.\n */\nfunction resolveHeaderValue(\n  value: string | SecretRef | BearerRef,\n  resolveSecret: (ref: SecretRef) => string,\n): string {\n  if (isSecretRef(value)) return resolveSecret(value)\n  if (isBearerMarker(value)) return `Bearer ${resolveSecret(value.__bearerRef)}`\n  return value\n}\n\n/** A claude-format HTTP MCP server entry. */\ninterface ClaudeMcpServer {\n  type: 'http'\n  url: string\n  headers: Record<string, string>\n}\n\n/**\n * Build claude's project-scoped MCP config from the `{ kind: 'mcp' }` skills,\n * resolving every header value (SecretRef / bearer / string). Returns\n * `undefined` when there are no MCP skills so the caller can skip the write.\n */\nfunction buildMcpConfig(\n  skills: Array<WorkspaceSkill>,\n  resolveSecret: (ref: SecretRef) => string,\n): { mcpServers: Record<string, ClaudeMcpServer> } | undefined {\n  const mcpServers: Record<string, ClaudeMcpServer> = {}\n  let count = 0\n  for (const skill of skills) {\n    if (skill.kind !== 'mcp') continue\n    count += 1\n    const headers: Record<string, string> = {}\n    const rawHeaders = skill.config.headers ?? {}\n    for (const [name, value] of Object.entries(rawHeaders)) {\n      headers[name] = resolveHeaderValue(value, resolveSecret)\n    }\n    const rawUrl = skill.config['url']\n    const url = typeof rawUrl === 'string' ? rawUrl : ''\n    mcpServers[skill.name] = { type: 'http', url, headers }\n  }\n  return count > 0 ? { mcpServers } : undefined\n}\n\n/**\n * Write the project-scoped `.mcp.json`, re-resolving every secret. This runs on\n * EVERY projection call (never gated by the marker) so claude always reads the\n * current secret values and a snapshot can never serve a stale or rotated one.\n * With `snapshot:'after-run'` the file may still be captured in the image, so\n * secret-bearing MCP material is best used with the default `after-setup`\n * strategy. When there are no MCP skills the write is skipped.\n */\nasync function projectMcpServers(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  const config = buildMcpConfig(projection.skills, projection.resolveSecret)\n  if (config === undefined) return\n  const target = `${projection.root}/.mcp.json`\n  await handle.fs.write(target, JSON.stringify(config, null, 2))\n}\n\n/**\n * Ensure each cloned `gitSkill` repo is available under claude's project skills\n * dir (`<root>/.claude/skills/<basename>`) via a symlink, falling back to a\n * recursive copy on platforms without `ln -s`.\n */\nasync function projectGitSkills(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  const skillsDir = `${projection.root}/.claude/skills`\n  let madeDir = false\n  for (const skill of projection.skills) {\n    if (skill.kind !== 'git') continue\n    if (!madeDir) {\n      await handle.fs.mkdir(skillsDir)\n      madeDir = true\n    }\n    // Discover over virtual `/workspace` paths (handle.fs remaps). Remap only\n    // for shell `ln`/`cp`, where absolute paths must match the real workdir.\n    const source = skill.into ?? resolveGitSkillDir(projection.root, skill)\n    const discovered = await discoverSkillDirs(handle, source)\n    for (const { name, dir } of discovered) {\n      const target = resolveHarnessCwd(handle, `${skillsDir}/${name}`)\n      const realDir = resolveHarnessCwd(handle, dir)\n      const lnCmd = `ln -s ${shellQuote(realDir)} ${shellQuote(target)}`\n      const result = await handle.process.exec(lnCmd, { cwd: projection.root })\n      if (result.exitCode !== 0) {\n        const cpCmd = `cp -r ${shellQuote(realDir)} ${shellQuote(target)}`\n        const copied = await handle.process.exec(cpCmd, {\n          cwd: projection.root,\n        })\n        if (copied.exitCode !== 0) {\n          console.warn(\n            `[claude-code] failed to link gitSkill \"${skill.repo}\" into ${target}: ${copied.stderr.trim()}`,\n          )\n        }\n      }\n    }\n  }\n}\n\n/**\n * `agentSkill` references a public skill by bare name. Claude Code has no\n * primitive to fetch a skill from a bare name (skills resolve from local\n * `.claude/skills/` dirs and plugin marketplaces), so we warn and skip rather\n * than fabricate a command.\n */\nfunction projectAgentSkills(projection: WorkspaceProjection): void {\n  for (const skill of projection.skills) {\n    if (skill.kind !== 'agent-skill') continue\n    console.warn(\n      `[claude-code] agentSkill \"${skill.name}\" cannot be projected: Claude Code has ` +\n        'no command to install a public skill by bare name. Provide it as a gitSkill ' +\n        'or a plugin instead. Skipping.',\n    )\n  }\n}\n\n/**\n * Install each declared plugin via `claude plugin install <name>`. Plugin\n * installs are best-effort: a failure (no marketplace, network, …) warns but\n * never throws, so a missing plugin can't break the run.\n */\nasync function projectPlugins(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  for (const name of projection.plugins) {\n    const cmd = `claude plugin install ${shellQuote(name)}`\n    try {\n      const result = await handle.process.exec(cmd, { cwd: projection.root })\n      if (result.exitCode !== 0) {\n        console.warn(\n          `[claude-code] \"claude plugin install ${name}\" exited ${result.exitCode}: ${result.stderr.trim()}`,\n        )\n      }\n    } catch (error: unknown) {\n      const message = error instanceof Error ? error.message : String(error)\n      console.warn(\n        `[claude-code] failed to install plugin \"${name}\": ${message}`,\n      )\n    }\n  }\n}\n\n/**\n * Project a `WorkspaceProjection` into the Claude Code sandbox. Safe to call on\n * every `chatStream`. The secret-bearing `.mcp.json` is (re)written on every\n * call, re-resolving secrets, so claude always reads current values and a\n * snapshot can never serve a stale or rotated secret. The safe, idempotent,\n * non-secret operations (gitSkill links, plugin installs, agentSkill handling)\n * are guarded by a one-time marker so they run only on the first call after\n * create/restore.\n *\n * @param handle     - The sandbox handle (`fs` + `process`).\n * @param projection - The portable workspace inputs from `withSandbox`.\n */\nexport async function projectClaudeWorkspace(\n  handle: SandboxHandle,\n  projection: WorkspaceProjection,\n): Promise<void> {\n  // Always re-resolve and rewrite the secret-bearing MCP config so rotated\n  // secrets re-apply and snapshots can't serve stale values.\n  await projectMcpServers(handle, projection)\n\n  // Gate only the safe, idempotent, non-secret operations on the marker.\n  if (await handle.fs.exists(projection.markerPath)) return\n\n  await projectGitSkills(handle, projection)\n  projectAgentSkills(projection)\n  await projectPlugins(handle, projection)\n\n  await handle.fs.write(projection.markerPath, '')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,SAAS,WAAW,OAAuB;CACzC,OAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,EAAE;AAC1C;;AAGA,SAAS,eAAe,OAAoC;CAC1D,OACE,OAAO,UAAU,YACjB,UAAU,QACV,YAAa,MAAoC,WAAW;AAEhE;;;;;;AAOA,SAAS,mBACP,OACA,eACQ;CACR,IAAI,YAAY,KAAK,GAAG,OAAO,cAAc,KAAK;CAClD,IAAI,eAAe,KAAK,GAAG,OAAO,UAAU,cAAc,MAAM,WAAW;CAC3E,OAAO;AACT;;;;;;AAcA,SAAS,eACP,QACA,eAC6D;CAC7D,MAAM,aAA8C,CAAC;CACrD,IAAI,QAAQ;CACZ,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,MAAM,SAAS,OAAO;EAC1B,SAAS;EACT,MAAM,UAAkC,CAAC;EACzC,MAAM,aAAa,MAAM,OAAO,WAAW,CAAC;EAC5C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,UAAU,GACnD,QAAQ,QAAQ,mBAAmB,OAAO,aAAa;EAEzD,MAAM,SAAS,MAAM,OAAO;EAC5B,MAAM,MAAM,OAAO,WAAW,WAAW,SAAS;EAClD,WAAW,MAAM,QAAQ;GAAE,MAAM;GAAQ;GAAK;EAAQ;CACxD;CACA,OAAO,QAAQ,IAAI,EAAE,WAAW,IAAI,KAAA;AACtC;;;;;;;;;AAUA,eAAe,kBACb,QACA,YACe;CACf,MAAM,SAAS,eAAe,WAAW,QAAQ,WAAW,aAAa;CACzE,IAAI,WAAW,KAAA,GAAW;CAC1B,MAAM,SAAS,GAAG,WAAW,KAAK;CAClC,MAAM,OAAO,GAAG,MAAM,QAAQ,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC/D;;;;;;AAOA,eAAe,iBACb,QACA,YACe;CACf,MAAM,YAAY,GAAG,WAAW,KAAK;CACrC,IAAI,UAAU;CACd,KAAK,MAAM,SAAS,WAAW,QAAQ;EACrC,IAAI,MAAM,SAAS,OAAO;EAC1B,IAAI,CAAC,SAAS;GACZ,MAAM,OAAO,GAAG,MAAM,SAAS;GAC/B,UAAU;EACZ;EAGA,MAAM,SAAS,MAAM,QAAQ,mBAAmB,WAAW,MAAM,KAAK;EACtE,MAAM,aAAa,MAAM,kBAAkB,QAAQ,MAAM;EACzD,KAAK,MAAM,EAAE,MAAM,SAAS,YAAY;GACtC,MAAM,SAAS,kBAAkB,QAAQ,GAAG,UAAU,GAAG,MAAM;GAC/D,MAAM,UAAU,kBAAkB,QAAQ,GAAG;GAC7C,MAAM,QAAQ,SAAS,WAAW,OAAO,EAAE,GAAG,WAAW,MAAM;GAE/D,KAAI,MADiB,OAAO,QAAQ,KAAK,OAAO,EAAE,KAAK,WAAW,KAAK,CAAC,EAAA,CAC7D,aAAa,GAAG;IACzB,MAAM,QAAQ,SAAS,WAAW,OAAO,EAAE,GAAG,WAAW,MAAM;IAC/D,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK,OAAO,EAC9C,KAAK,WAAW,KAClB,CAAC;IACD,IAAI,OAAO,aAAa,GACtB,QAAQ,KACN,0CAA0C,MAAM,KAAK,SAAS,OAAO,IAAI,OAAO,OAAO,KAAK,GAC9F;GAEJ;EACF;CACF;AACF;;;;;;;AAQA,SAAS,mBAAmB,YAAuC;CACjE,KAAK,MAAM,SAAS,WAAW,QAAQ;EACrC,IAAI,MAAM,SAAS,eAAe;EAClC,QAAQ,KACN,6BAA6B,MAAM,KAAK,kJAG1C;CACF;AACF;;;;;;AAOA,eAAe,eACb,QACA,YACe;CACf,KAAK,MAAM,QAAQ,WAAW,SAAS;EACrC,MAAM,MAAM,yBAAyB,WAAW,IAAI;EACpD,IAAI;GACF,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK,KAAK,EAAE,KAAK,WAAW,KAAK,CAAC;GACtE,IAAI,OAAO,aAAa,GACtB,QAAQ,KACN,wCAAwC,KAAK,WAAW,OAAO,SAAS,IAAI,OAAO,OAAO,KAAK,GACjG;EAEJ,SAAS,OAAgB;GACvB,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACrE,QAAQ,KACN,2CAA2C,KAAK,KAAK,SACvD;EACF;CACF;AACF;;;;;;;;;;;;;AAcA,eAAsB,uBACpB,QACA,YACe;CAGf,MAAM,kBAAkB,QAAQ,UAAU;CAG1C,IAAI,MAAM,OAAO,GAAG,OAAO,WAAW,UAAU,GAAG;CAEnD,MAAM,iBAAiB,QAAQ,UAAU;CACzC,mBAAmB,UAAU;CAC7B,MAAM,eAAe,QAAQ,UAAU;CAEvC,MAAM,OAAO,GAAG,MAAM,WAAW,YAAY,EAAE;AACjD"}

package/dist/esm/adapters/text.d.ts

@@ -37,6 +37,12 @@ export interface ClaudeCodeTextConfig {
     streamPartials?: boolean;
     /** Extra environment variables for the claude process inside the sandbox. */
     env?: Record<string, string>;
+    /**
+     * `'api-key'` (default) injects `ANTHROPIC_API_KEY`.
+     * `'host'` uses `claude login` and does not inject the key.
+     * Not inferred from the sandbox.
+     */
+    authMode?: 'host' | 'api-key';
     /** Emit a `file.changed` CUSTOM event with the git diff after the run (default true). */
     emitDiff?: boolean;
 }
@@ -47,8 +53,10 @@ export declare class ClaudeCodeTextAdapter<TModel extends ClaudeCodeModel> exten
     constructor(config: ClaudeCodeTextConfig, model: TModel);
     private sandboxFrom;
     private workdir;
+    supportsCombinedToolsAndSchema(): boolean;
+    combinedStructuredOutputSource(): 'event';
     /** Build the `claude` command line (prompt goes via stdin, not argv). */
-    private buildCommand;
+    private buildArgv;
     /**
      * Build the permission-prompt resolver the host MCP bridge exposes to claude
      * (`--permission-prompt-tool`). Maps claude's permission request onto the

package/dist/esm/adapters/text.js

@@ -2,8 +2,9 @@ import { buildPrompt } from "../messages/prompt.js";
 import { translateSdkStream } from "../stream/translate.js";
 import { mapPolicyToClaudeFlags } from "./policy-map.js";
 import { projectClaudeWorkspace } from "./projection.js";
+import { CLAUDE_JSON_SCHEMA_PLACEHOLDER, CLAUDE_RUNNER_SOURCE } from "./claude-run-source.js";
 import { EventType, normalizeSystemPrompts } from "@tanstack/ai";
-import { toRunErrorRawEvent } from "@tanstack/ai/adapter-internals";
+import { appendOutputSchemaInstruction, toRunErrorRawEvent } from "@tanstack/ai/adapter-internals";
 import { BaseTextAdapter } from "@tanstack/ai/adapters";
 import { SandboxCapability, alignedIfAttaching, approvalId, buildApprovalRequestedEvent, createBridgeEventChannel, createRunScopedIdGen, encodeRunId, getSandbox, getSandboxDurability, getSandboxPolicy, getToolBridgeProvisioner, getWorkspaceProjection, journalOptionsFor, mergeChunkStreams, nodeHttpBridgeProvisioner, resolveApproval, resolveDurableRunId, resolveDurableThreadId, spawnNdjson } from "@tanstack/ai-sandbox";
 //#region src/adapters/text.ts
@@ -12,6 +13,25 @@ var DEFAULT_WORKDIR = "/workspace";
 function q(value) {
 	return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+/** Copy host Anthropic auth into the sandbox process. Docker `exec` Env replaces the container env, so a key set only at create time can vanish. */
+function hostClaudeAuthEnv() {
+	const env = {};
+	const apiKey = process.env.ANTHROPIC_API_KEY;
+	if (apiKey) env.ANTHROPIC_API_KEY = apiKey;
+	const authToken = process.env.ANTHROPIC_AUTH_TOKEN;
+	if (authToken) env.ANTHROPIC_AUTH_TOKEN = authToken;
+	return env;
+}
+/**
+* Windows Node often has USERPROFILE but no HOME. Claude then cannot find
+* `~/.claude.json` (the `claude login` file) and prints "Not logged in".
+*/
+function localProcessHomeEnv(provider) {
+	if (provider !== "local-process") return {};
+	if (process.env.HOME) return {};
+	const home = process.env.USERPROFILE;
+	return home ? { HOME: home } : {};
+}
 /** Format a host tool-bridge as claude's `--mcp-config` JSON. */
 function bridgeToMcpConfig(bridge) {
 	return JSON.stringify({ mcpServers: { [bridge.name]: {
@@ -36,39 +56,48 @@ var ClaudeCodeTextAdapter = class extends BaseTextAdapter {
 	workdir(options) {
 		return options.modelOptions?.cwd ?? this.adapterConfig.cwd ?? DEFAULT_WORKDIR;
 	}
+	supportsCombinedToolsAndSchema() {
+		return true;
+	}
+	combinedStructuredOutputSource() {
+		return "event";
+	}
 	/** Build the `claude` command line (prompt goes via stdin, not argv). */
-	buildCommand(options, resume, policyFlags, mcpConfigPath, permissionPromptTool) {
+	buildArgv(options, resume, policyFlags, mcpConfigPath, permissionPromptTool, hasJsonSchema) {
 		const config = this.adapterConfig;
 		const modelOptions = options.modelOptions;
-		const exe = config.claudeExecutable ?? "claude";
 		const args = [
+			...(config.claudeExecutable ?? "claude").split(" "),
+			"--setting-sources",
+			"user",
 			"-p",
 			"--output-format",
 			"stream-json",
 			"--verbose",
 			"--model",
-			q(this.model)
+			this.model
 		];
 		if (config.streamPartials !== false) args.push("--include-partial-messages");
-		if (resume !== void 0) args.push("--resume", q(resume));
+		if (resume !== void 0) args.push("--resume", resume);
 		const permissionMode = modelOptions?.permissionMode ?? config.permissionMode ?? policyFlags.permissionMode ?? "bypassPermissions";
-		args.push("--permission-mode", q(permissionMode));
+		args.push("--permission-mode", permissionMode);
 		const maxTurns = modelOptions?.maxTurns ?? config.maxTurns;
 		if (maxTurns !== void 0) args.push("--max-turns", String(maxTurns));
-		for (const dir of config.addDirs ?? []) args.push("--add-dir", q(dir));
+		for (const dir of config.addDirs ?? []) args.push("--add-dir", dir);
 		const allowedTools = [...modelOptions?.allowedTools ?? config.allowedTools ?? [], ...policyFlags.allowedTools];
-		if (allowedTools.length > 0) args.push("--allowedTools", q([...new Set(allowedTools)].join(",")));
+		if (allowedTools.length > 0) args.push("--allowedTools", [...new Set(allowedTools)].join(","));
 		const disallowedTools = [...modelOptions?.disallowedTools ?? config.disallowedTools ?? [], ...policyFlags.disallowedTools];
-		if (disallowedTools.length > 0) args.push("--disallowedTools", q([...new Set(disallowedTools)].join(",")));
+		if (disallowedTools.length > 0) args.push("--disallowedTools", [...new Set(disallowedTools)].join(","));
 		const systemPrompts = normalizeSystemPrompts(options.systemPrompts).map((prompt) => prompt.content).filter((content) => content.trim() !== "");
 		if (systemPrompts.length > 0) {
 			const joined = systemPrompts.join("\n\n");
 			const flag = config.systemPromptMode === "replace" ? "--system-prompt" : "--append-system-prompt";
-			args.push(flag, q(joined));
+			args.push(flag, joined);
 		}
-		if (mcpConfigPath !== void 0) args.push("--mcp-config", q(mcpConfigPath));
-		if (permissionPromptTool !== void 0) args.push("--permission-prompt-tool", q(permissionPromptTool));
-		return `${exe} ${args.join(" ")}`;
+		if (mcpConfigPath !== void 0) args.push("--mcp-config", mcpConfigPath);
+		if (hasJsonSchema) args.push("--json-schema", CLAUDE_JSON_SCHEMA_PLACEHOLDER);
+		if (permissionPromptTool !== void 0) args.push("--permission-prompt-tool", permissionPromptTool);
+		return args;
 	}
 	/**
 	* Build the permission-prompt resolver the host MCP bridge exposes to claude
@@ -166,7 +195,9 @@ var ClaudeCodeTextAdapter = class extends BaseTextAdapter {
 				...permission !== void 0 ? { permission } : {},
 				...options.abortController?.signal ? { signal: options.abortController.signal } : {}
 			});
-			const { prompt, resume } = buildPrompt(options.messages, options.modelOptions?.sessionId);
+			const built = buildPrompt(options.messages, options.modelOptions?.sessionId);
+			const resume = built.resume;
+			const prompt = options.outputSchema !== void 0 ? appendOutputSchemaInstruction(built.prompt, options.outputSchema) : built.prompt;
 			const runIdSegment = encodeRunId(runId);
 			let mcpConfigArg;
 			if (bridge) {
@@ -176,7 +207,21 @@ var ClaudeCodeTextAdapter = class extends BaseTextAdapter {
 				tempFiles.push(mcpConfigPath);
 				mcpConfigArg = mcpConfigFile;
 			}
-			const command = this.buildCommand(options, resume, mapPolicyToClaudeFlags(policy), mcpConfigArg, bridge && permission ? `mcp__${bridge.name}__${permission.toolName}` : void 0);
+			let jsonSchemaFile;
+			if (options.outputSchema !== void 0) {
+				jsonSchemaFile = `tanstack-output-schema-${runIdSegment}.json`;
+				const schemaPath = `${cwd}/${jsonSchemaFile}`;
+				await sandbox.fs.write(schemaPath, JSON.stringify(options.outputSchema));
+				tempFiles.push(schemaPath);
+			}
+			const runnerFile = `tanstack-claude-run-${runIdSegment}.mjs`;
+			await sandbox.fs.write(`${cwd}/${runnerFile}`, CLAUDE_RUNNER_SOURCE);
+			tempFiles.push(`${cwd}/${runnerFile}`);
+			const argv = this.buildArgv(options, resume, mapPolicyToClaudeFlags(policy), mcpConfigArg, bridge && permission ? `mcp__${bridge.name}__${permission.toolName}` : void 0, jsonSchemaFile !== void 0);
+			const argvFile = `tanstack-claude-argv-${runIdSegment}.json`;
+			await sandbox.fs.write(`${cwd}/${argvFile}`, JSON.stringify(argv));
+			tempFiles.push(`${cwd}/${argvFile}`);
+			const command = jsonSchemaFile === void 0 ? `node ${q(runnerFile)} ${q(argvFile)}` : `node ${q(runnerFile)} ${q(argvFile)} ${q(jsonSchemaFile)}`;
 			let runCommand = command;
 			let stdinInput = prompt;
 			if (sandbox.capabilities.writableStdin === false) {
@@ -190,12 +235,18 @@ var ClaudeCodeTextAdapter = class extends BaseTextAdapter {
 				provider: "claude-code",
 				model: this.model
 			});
+			const injectApiKey = (options.modelOptions?.authMode ?? this.adapterConfig.authMode ?? "api-key") === "api-key";
 			const journalOptions = journalOptionsFor(durability, runId);
 			const rawEvents = spawnNdjson(sandbox, runCommand, {
 				cwd,
 				...stdinInput !== void 0 ? { input: stdinInput } : {},
 				env: {
-					IS_SANDBOX: "1",
+					...sandbox.provider === "local-process" ? {} : {
+						IS_SANDBOX: "1",
+						CLAUDE_CODE_SANDBOXED: "1"
+					},
+					...injectApiKey ? hostClaudeAuthEnv() : {},
+					...localProcessHomeEnv(sandbox.provider),
 					...this.adapterConfig.env
 				},
 				...options.abortController?.signal ? { signal: options.abortController.signal } : options.request?.signal ? { signal: options.request.signal } : {},
@@ -211,6 +262,7 @@ var ClaudeCodeTextAdapter = class extends BaseTextAdapter {
 				threadId,
 				...options.parentRunId !== void 0 && { parentRunId: options.parentRunId },
 				genId: createRunScopedIdGen(runId),
+				...options.outputSchema ? { expectStructuredOutput: true } : {},
 				onSdkMessage: (message) => logger.provider(`provider=claude-code type=${message.type}`, { chunk: message })
 			}), channel.stream), durability, logger);
 			if (this.adapterConfig.emitDiff !== false) try {
@@ -256,7 +308,7 @@ var ClaudeCodeTextAdapter = class extends BaseTextAdapter {
 		}
 	}
 	structuredOutput(_options) {
-		return Promise.reject(/* @__PURE__ */ new Error("Structured output is not yet supported by the in-sandbox Claude Code adapter. Use a model adapter (e.g. anthropic) for structured output, or omit outputSchema."));
+		return Promise.reject(/* @__PURE__ */ new Error("This harness honors outputSchema on chat() in the same turn. Pass outputSchema to chat(), or use a model adapter for a one-shot extract."));
 	}
 };
 /**

package/dist/esm/adapters/text.js.map

@@ -1 +1 @@
-{"version":3,"file":"text.js","names":[],"sources":["../../../src/adapters/text.ts"],"sourcesContent":["import { EventType, normalizeSystemPrompts } from '@tanstack/ai'\nimport { toRunErrorRawEvent } from '@tanstack/ai/adapter-internals'\nimport { BaseTextAdapter } from '@tanstack/ai/adapters'\nimport {\n  SandboxCapability,\n  alignedIfAttaching,\n  approvalId,\n  buildApprovalRequestedEvent,\n  createBridgeEventChannel,\n  createRunScopedIdGen,\n  encodeRunId,\n  getSandbox,\n  getSandboxDurability,\n  getSandboxPolicy,\n  getToolBridgeProvisioner,\n  getWorkspaceProjection,\n  journalOptionsFor,\n  mergeChunkStreams,\n  nodeHttpBridgeProvisioner,\n  resolveApproval,\n  resolveDurableRunId,\n  resolveDurableThreadId,\n  spawnNdjson,\n} from '@tanstack/ai-sandbox'\nimport { buildPrompt } from '../messages/prompt'\nimport { translateSdkStream } from '../stream/translate'\nimport { mapPolicyToClaudeFlags } from './policy-map'\nimport { projectClaudeWorkspace } from './projection'\nimport type { ClaudePolicyFlags } from './policy-map'\nimport type {\n  BridgeEventChannel,\n  HostToolBridge,\n  PermissionToolResult,\n  SandboxHandle,\n  SandboxPolicy,\n} from '@tanstack/ai-sandbox'\nimport type {\n  StructuredOutputOptions,\n  StructuredOutputResult,\n} from '@tanstack/ai/adapters'\nimport type {\n  DefaultMessageMetadataByModality,\n  Modality,\n  StreamChunk,\n  TextOptions,\n} from '@tanstack/ai'\nimport type { ClaudeCodeModel } from '../model-meta'\nimport type { ClaudeCodeTextProviderOptions } from '../provider-options'\nimport type { AgentSdkMessage } from '../stream/sdk-types'\n\nexport type ClaudeCodePermissionMode =\n  | 'default'\n  | 'acceptEdits'\n  | 'bypassPermissions'\n  | 'plan'\n\nconst DEFAULT_WORKDIR = '/workspace'\n\nexport interface ClaudeCodeTextConfig {\n  /**\n   * Working directory inside the sandbox where `claude` runs. Defaults to\n   * `/workspace` (the conventional sandbox workspace root).\n   */\n  cwd?: string\n  /**\n   * Claude Code permission mode passed via `--permission-mode`. Defaults to\n   * `'bypassPermissions'` — a sandbox is isolated, so the agent is allowed to\n   * edit files and run commands without prompting. Tighten via `defineSandboxPolicy`\n   * / this option for less autonomy.\n   */\n  permissionMode?: ClaudeCodePermissionMode\n  /** Built-in tools the harness may use (`--allowedTools`). */\n  allowedTools?: Array<string>\n  /** Built-in tools removed from the harness (`--disallowedTools`). */\n  disallowedTools?: Array<string>\n  /** Extra directories the agent may access (`--add-dir`). */\n  addDirs?: Array<string>\n  /** Maximum harness-internal turns (`--max-turns`). */\n  maxTurns?: number\n  /**\n   * How `systemPrompts` from `chat()` are applied:\n   * - `'append'` (default): `--append-system-prompt` on top of the preset.\n   * - `'replace'`: `--system-prompt` as the entire system prompt.\n   */\n  systemPromptMode?: 'append' | 'replace'\n  /** Path/name of the claude executable inside the sandbox. Defaults to `claude`. */\n  claudeExecutable?: string\n  /** Emit token-level deltas via `--include-partial-messages` (default true). */\n  streamPartials?: boolean\n  /** Extra environment variables for the claude process inside the sandbox. */\n  env?: Record<string, string>\n  /** Emit a `file.changed` CUSTOM event with the git diff after the run (default true). */\n  emitDiff?: boolean\n}\n\n/** POSIX single-quote escape for embedding values in the `claude …` command. */\nfunction q(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`\n}\n\n/** Format a host tool-bridge as claude's `--mcp-config` JSON. */\nfunction bridgeToMcpConfig(bridge: HostToolBridge): string {\n  return JSON.stringify({\n    mcpServers: {\n      [bridge.name]: {\n        type: 'http',\n        url: bridge.url,\n        headers: { Authorization: `Bearer ${bridge.token}` },\n      },\n    },\n  })\n}\n\nexport class ClaudeCodeTextAdapter<\n  TModel extends ClaudeCodeModel,\n> extends BaseTextAdapter<\n  TModel,\n  ClaudeCodeTextProviderOptions,\n  ReadonlyArray<Modality> & readonly ['text'],\n  DefaultMessageMetadataByModality,\n  ReadonlyArray<string>,\n  unknown,\n  never\n> {\n  readonly name = 'claude-code' as const\n\n  // Harness adapter: requires a sandbox to run the agent CLI inside.\n  override readonly requires = [SandboxCapability] as const\n\n  private readonly adapterConfig: ClaudeCodeTextConfig\n\n  constructor(config: ClaudeCodeTextConfig, model: TModel) {\n    super({}, model)\n    this.adapterConfig = config\n  }\n\n  private sandboxFrom(\n    options: TextOptions<ClaudeCodeTextProviderOptions>,\n  ): SandboxHandle {\n    const ctx = options.capabilities\n    if (!ctx) {\n      throw new Error(\n        'Adapter \"claude-code\" requires a sandbox. Add withSandbox(defineSandbox({ ... })) ' +\n          'to chat() middleware (e.g. with the local-process or docker provider).',\n      )\n    }\n    return getSandbox(ctx)\n  }\n\n  private workdir(options: TextOptions<ClaudeCodeTextProviderOptions>): string {\n    return (\n      options.modelOptions?.cwd ?? this.adapterConfig.cwd ?? DEFAULT_WORKDIR\n    )\n  }\n\n  /** Build the `claude` command line (prompt goes via stdin, not argv). */\n  private buildCommand(\n    options: TextOptions<ClaudeCodeTextProviderOptions>,\n    resume: string | undefined,\n    policyFlags: ClaudePolicyFlags,\n    mcpConfigPath: string | undefined,\n    permissionPromptTool: string | undefined,\n  ): string {\n    const config = this.adapterConfig\n    const modelOptions = options.modelOptions\n    const exe = config.claudeExecutable ?? 'claude'\n\n    const args: Array<string> = [\n      '-p',\n      '--output-format',\n      'stream-json',\n      '--verbose',\n      '--model',\n      q(this.model),\n    ]\n\n    if (config.streamPartials !== false) args.push('--include-partial-messages')\n    if (resume !== undefined) args.push('--resume', q(resume))\n\n    // Precedence: per-call modelOptions > adapter config > policy > sandbox default.\n    const permissionMode =\n      modelOptions?.permissionMode ??\n      config.permissionMode ??\n      policyFlags.permissionMode ??\n      'bypassPermissions'\n    args.push('--permission-mode', q(permissionMode))\n\n    const maxTurns = modelOptions?.maxTurns ?? config.maxTurns\n    if (maxTurns !== undefined) args.push('--max-turns', String(maxTurns))\n\n    for (const dir of config.addDirs ?? []) args.push('--add-dir', q(dir))\n\n    const allowedTools = [\n      ...(modelOptions?.allowedTools ?? config.allowedTools ?? []),\n      ...policyFlags.allowedTools,\n    ]\n    if (allowedTools.length > 0) {\n      args.push('--allowedTools', q([...new Set(allowedTools)].join(',')))\n    }\n    const disallowedTools = [\n      ...(modelOptions?.disallowedTools ?? config.disallowedTools ?? []),\n      ...policyFlags.disallowedTools,\n    ]\n    if (disallowedTools.length > 0) {\n      args.push('--disallowedTools', q([...new Set(disallowedTools)].join(',')))\n    }\n\n    const systemPrompts = normalizeSystemPrompts(options.systemPrompts)\n      .map((prompt) => prompt.content)\n      .filter((content) => content.trim() !== '')\n    if (systemPrompts.length > 0) {\n      const joined = systemPrompts.join('\\n\\n')\n      const flag =\n        config.systemPromptMode === 'replace'\n          ? '--system-prompt'\n          : '--append-system-prompt'\n      args.push(flag, q(joined))\n    }\n\n    if (mcpConfigPath !== undefined) args.push('--mcp-config', q(mcpConfigPath))\n    if (permissionPromptTool !== undefined) {\n      args.push('--permission-prompt-tool', q(permissionPromptTool))\n    }\n\n    return `${exe} ${args.join(' ')}`\n  }\n\n  /**\n   * Build the permission-prompt resolver the host MCP bridge exposes to claude\n   * (`--permission-prompt-tool`). Maps claude's permission request onto the\n   * sandbox policy + client approvals; on an `ask` action with no decision yet,\n   * records an approval-requested event and denies (the client re-runs to grant).\n   */\n  private buildPermissionResolver(\n    policy: SandboxPolicy | undefined,\n    approvals: ReadonlyMap<string, boolean> | undefined,\n    scripts: Record<string, string> | undefined,\n    sink: Array<StreamChunk>,\n    threadId: string,\n    runId: string,\n  ): (input: { tool_name?: string; input?: unknown }) => PermissionToolResult {\n    const writeTools = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit'])\n    const networkTools = new Set(['WebFetch', 'WebSearch'])\n    return (request) => {\n      const toolName = request.tool_name ?? 'tool'\n      const cmdInput = request.input\n      const command =\n        toolName === 'Bash' &&\n        cmdInput !== null &&\n        typeof cmdInput === 'object' &&\n        'command' in cmdInput &&\n        typeof (cmdInput as { command?: unknown }).command === 'string'\n          ? (cmdInput as { command: string }).command\n          : undefined\n      const capability = writeTools.has(toolName)\n        ? 'fileWrite'\n        : networkTools.has(toolName)\n          ? 'network'\n          : undefined\n      const id = approvalId({\n        provider: 'claude-code',\n        kind: command !== undefined ? 'command' : (capability ?? 'tool'),\n        target: command ?? toolName,\n      })\n      const outcome = resolveApproval({\n        policy,\n        approvals,\n        id,\n        scripts,\n        ...(command !== undefined ? { command } : {}),\n        ...(capability !== undefined ? { capability } : {}),\n      })\n      if (outcome.needsApproval) {\n        sink.push(\n          buildApprovalRequestedEvent({\n            approvalId: id,\n            title: `Approve ${toolName}${command !== undefined ? `: ${command}` : ''}`,\n            threadId,\n            runId,\n            detail: { provider: 'claude-code', toolName },\n          }),\n        )\n        return {\n          behavior: 'deny',\n          message:\n            'Awaiting client approval. Approve in the UI and re-run to continue.',\n        }\n      }\n      return outcome.decision === 'allow'\n        ? { behavior: 'allow' }\n        : { behavior: 'deny', message: 'Denied by sandbox policy.' }\n    }\n  }\n\n  async *chatStream(\n    options: TextOptions<ClaudeCodeTextProviderOptions>,\n  ): AsyncIterable<StreamChunk> {\n    const { logger } = options\n    let bridge: HostToolBridge | undefined\n    let channel: BridgeEventChannel | undefined\n    const approvalRequests: Array<StreamChunk> = []\n    // Temp files written for the run (bridge MCP config, redirected prompt) that\n    // carry the bearer token / prompt; removed in `finally` so they don't linger\n    // in the sandbox after the run.\n    let cleanupSandbox: SandboxHandle | undefined\n    const tempFiles: Array<string> = []\n    try {\n      const sandbox = this.sandboxFrom(options)\n      cleanupSandbox = sandbox\n      const cwd = this.workdir(options)\n      // Durability comes from `withSandbox(sandbox, { runs, durability })`, read\n      // back off the capability bus. Absent it, everything below resolves to\n      // exactly today's behavior (no journal option, no alignment, and a\n      // generated `runId` when the caller didn't supply one).\n      const durability = options.capabilities\n        ? getSandboxDurability(options.capabilities, { optional: true })\n        : undefined\n      // The journaled path below derives its journal path and its\n      // message-id generator from `runId`. A resuming host must recompute\n      // the same `runId` to find the same journal file and reproduce the\n      // same translated ids — that's only possible when the caller supplies\n      // `runId` explicitly. `resolveDurableRunId` enforces that loudly (via\n      // `DurableRunIdRequiredError`) whenever durability is wired, and falls\n      // back to a fresh `this.generateId()` otherwise, preserving today's\n      // behavior for non-durable runs.\n      const runId = resolveDurableRunId(options.runId, {\n        durable: durability !== undefined,\n        adapter: 'claude-code',\n        fallback: () => this.generateId(),\n      })\n      // `threadId` is stamped on every chunk `translateSdkStream` emits, so an\n      // ATTACHING run that mints a fresh one replays a stream the stored log\n      // cannot match at index 0. `resolveDurableThreadId` refuses that up front\n      // instead of letting alignment discover it mid-stream; a durable FRESH run\n      // and a non-durable run both keep the generated fallback untouched.\n      const threadId = resolveDurableThreadId(options.threadId, {\n        durable: durability !== undefined,\n        attaching: durability?.attach === true,\n        adapter: 'claude-code',\n        fallback: () => this.generateId(),\n      })\n      // Surfaces custom events from bridged tools (e.g. code mode console logs)\n      // on this run's live output stream.\n      channel = createBridgeEventChannel({ model: this.model, threadId, runId })\n\n      // Idempotently project workspace skills/plugins/MCP into the sandbox in\n      // claude's native format (guarded by the projection marker file).\n      const projection = options.capabilities\n        ? getWorkspaceProjection(options.capabilities, { optional: true })\n        : undefined\n      if (projection) await projectClaudeWorkspace(sandbox, projection)\n\n      const policy = options.capabilities\n        ? getSandboxPolicy(options.capabilities, { optional: true })\n        : undefined\n\n      // A permission-prompt tool gates the agent's native tools when a policy\n      // can `ask`/`deny` (interactive approvals).\n      const permission =\n        policy !== undefined\n          ? {\n              toolName: 'approval_prompt',\n              resolve: this.buildPermissionResolver(\n                policy,\n                options.approvals,\n                projection?.scripts,\n                approvalRequests,\n                threadId,\n                runId,\n              ),\n            }\n          : undefined\n\n      // Bridge chat()-provided server tools (and/or the permission tool) into\n      // the sandbox over MCP.\n      const hasTools = options.tools !== undefined && options.tools.length > 0\n      if (hasTools || permission !== undefined) {\n        const provisioner =\n          (options.capabilities\n            ? getToolBridgeProvisioner(options.capabilities, { optional: true })\n            : undefined) ?? nodeHttpBridgeProvisioner\n        bridge = await provisioner.provision(options.tools ?? [], {\n          provider: sandbox.provider,\n          context: options.context,\n          emitCustomEvent: channel.emitCustomEvent,\n          ...(permission !== undefined ? { permission } : {}),\n          ...(options.abortController?.signal\n            ? { signal: options.abortController.signal }\n            : {}),\n        })\n      }\n\n      const { prompt, resume } = buildPrompt(\n        options.messages,\n        options.modelOptions?.sessionId,\n      )\n      // Both files below name themselves after `runId`, and durability makes\n      // `runId` CALLER-chosen. Raw, a `/` in it would silently turn each basename\n      // into a nested path (writing outside the intended directory, or failing on\n      // one that does not exist), `..` would climb out of that directory, and a\n      // long id would fail the spawn with `ENAMETOOLONG`. `encodeRunId` collapses\n      // any id to one bounded, injective path segment — the same encoder\n      // `journalPaths` uses, so these files and the journal agree on how a given\n      // id spells. Computed once so the two filenames cannot drift apart.\n      const runIdSegment = encodeRunId(runId)\n\n      // The bridge MCP config carries the per-run bearer token. Write it to a\n      // file and pass claude the PATH, so the token never appears in argv (where\n      // any process in the sandbox could read it via `ps` / `/proc/<pid>/cmdline`).\n      let mcpConfigArg: string | undefined\n      if (bridge) {\n        // Pass claude a path RELATIVE to its cwd (the real workdir the handle\n        // runs the process in). An absolute VIRTUAL path like `/workspace/…` is\n        // wrong wherever claude runs outside a sandbox that literally uses\n        // `/workspace` — e.g. local-process on Windows, where git-bash resolves\n        // `/workspace` to `C:\\Program Files\\Git\\workspace` and the file is \"not\n        // found\". The bare filename resolves correctly on every provider.\n        const mcpConfigFile = `.tanstack-mcp-bridge-${runIdSegment}.json`\n        const mcpConfigPath = `${cwd}/${mcpConfigFile}`\n        await sandbox.fs.write(mcpConfigPath, bridgeToMcpConfig(bridge))\n        tempFiles.push(mcpConfigPath)\n        mcpConfigArg = mcpConfigFile\n      }\n      const command = this.buildCommand(\n        options,\n        resume,\n        mapPolicyToClaudeFlags(policy),\n        mcpConfigArg,\n        bridge && permission\n          ? `mcp__${bridge.name}__${permission.toolName}`\n          : undefined,\n      )\n\n      // Deliver the prompt. The default feeds it over stdin (keeps it out of\n      // argv). Providers without a writable host→process stdin (e.g. Cloudflare)\n      // can't accept that write, so write the prompt to a file and redirect the\n      // CLI's stdin from it in-shell (`claude -p … < file`) — still out of argv.\n      let runCommand = command\n      let stdinInput: string | undefined = prompt\n      if (sandbox.capabilities.writableStdin === false) {\n        const promptPath = `/tmp/tanstack-claude-prompt-${runIdSegment}`\n        await sandbox.fs.write(promptPath, prompt)\n        tempFiles.push(promptPath)\n        runCommand = `${command} < ${q(promptPath)}`\n        stdinInput = undefined\n      }\n\n      logger.request(\n        `activity=chat provider=claude-code model=${this.model} sandbox=${sandbox.provider} messages=${options.messages.length} resume=${resume ?? 'none'}`,\n        { provider: 'claude-code', model: this.model },\n      )\n\n      const journalOptions = journalOptionsFor(durability, runId)\n      const rawEvents = spawnNdjson(sandbox, runCommand, {\n        cwd,\n        ...(stdinInput !== undefined ? { input: stdinInput } : {}),\n        // claude maps `bypassPermissions` to `--dangerously-skip-permissions`,\n        // which it refuses to run as root. Sandbox containers routinely run as\n        // root (Docker / Cloudflare), so set `IS_SANDBOX=1` — claude's\n        // documented escape hatch for skip-permissions in an isolated\n        // environment — merged over the sandbox env (a caller-provided value\n        // wins). Safe to set unconditionally; it is a no-op for stricter modes.\n        env: { IS_SANDBOX: '1', ...this.adapterConfig.env },\n        ...(options.abortController?.signal\n          ? { signal: options.abortController.signal }\n          : options.request?.signal\n            ? { signal: options.request.signal }\n            : {}),\n        onNonJsonLine: (line) =>\n          logger.provider(`provider=claude-code non-json line: ${line}`, {\n            chunk: line,\n          }),\n        // Journal + attach both come from the sandbox durability capability, so\n        // the attach route configures takeover by passing `attach: true` to\n        // `withSandbox` — `chat()` stays free of sandbox vocabulary. Omitted\n        // entirely (not passed as `undefined`) when the run isn't durable, so\n        // `spawnNdjson` takes its original, unjournaled path byte-for-byte.\n        ...(journalOptions === undefined ? {} : { journal: journalOptions }),\n      })\n\n      async function* asMessages(): AsyncIterable<AgentSdkMessage> {\n        for await (const event of rawEvents) yield event as AgentSdkMessage\n      }\n\n      // `mergeChunkStreams` splices `channel.stream` (host-tool-bridge CUSTOM\n      // events from LIVE tool execution) into the deterministic translator\n      // output. Those events do not occur on a replay, so a takeover's replay is\n      // NOT chunk-for-chunk identical to what the log holds. `alignedIfAttaching`\n      // handles it: alignment skips stored out-of-band CUSTOM entries within a\n      // bounded window (see `align.ts`), so a bridged-tool run can be taken over\n      // without a spurious `JournalReplayDivergedError` — while a genuine\n      // determinism regression still throws. The wrap goes OUTSIDE the merge:\n      // the stored log holds the previous host's merged output, so aligning the\n      // pre-merge translated stream alone would compare against a log it never\n      // produced. On a non-attaching run this is a pure passthrough (see\n      // `alignedIfAttaching`'s `attach` guard).\n      yield* alignedIfAttaching(\n        mergeChunkStreams(\n          translateSdkStream(asMessages(), {\n            model: this.model,\n            runId,\n            threadId,\n            ...(options.parentRunId !== undefined && {\n              parentRunId: options.parentRunId,\n            }),\n            // Deterministic on the journaled path: two translations of the same\n            // journal prefix from a fresh generator seeded with the same\n            // `runId` mint the same message ids (unlike `this.generateId()`,\n            // which mixes in `Date.now()` / `Math.random()`). See\n            // `createRunScopedIdGen` in `@tanstack/ai-sandbox`.\n            genId: createRunScopedIdGen(runId),\n            onSdkMessage: (message) =>\n              logger.provider(`provider=claude-code type=${message.type}`, {\n                chunk: message,\n              }),\n          }),\n          channel.stream,\n        ),\n        durability,\n        logger,\n      )\n\n      // Surface the working-tree diff so UIs can render what the agent changed.\n      if (this.adapterConfig.emitDiff !== false) {\n        try {\n          const diff = await sandbox.process.exec(`git -C ${q(cwd)} diff`, {\n            cwd,\n          })\n          if (diff.exitCode === 0 && diff.stdout.trim() !== '') {\n            yield {\n              type: EventType.CUSTOM,\n              name: 'file.changed',\n              value: { path: '.', diff: diff.stdout },\n              timestamp: Date.now(),\n              threadId,\n              runId,\n            }\n          }\n        } catch {\n          // not a git repo / git unavailable — skip the diff event\n        }\n      }\n\n      // Surface any pending approval requests (policy `ask` actions awaiting a\n      // client decision); the client approves and re-runs to continue.\n      for (const event of approvalRequests) yield event\n    } catch (error: unknown) {\n      const err = error as Error & { code?: string }\n      const rawEvent = toRunErrorRawEvent(error)\n      logger.errors('claude-code.chatStream fatal', {\n        error,\n        source: 'claude-code.chatStream',\n      })\n      yield {\n        type: EventType.RUN_ERROR,\n        model: options.model,\n        timestamp: Date.now(),\n        message: err.message || 'Unknown error occurred',\n        ...(err.code !== undefined && { code: err.code }),\n        ...(rawEvent !== undefined && { rawEvent }),\n        error: {\n          message: err.message || 'Unknown error occurred',\n          ...(err.code !== undefined && { code: err.code }),\n        },\n      }\n    } finally {\n      channel?.close()\n      if (bridge) await bridge.close()\n      // Remove the per-run token/prompt files. Best-effort: a cleanup failure\n      // must not mask the run's own outcome.\n      if (cleanupSandbox) {\n        for (const path of tempFiles) {\n          try {\n            await cleanupSandbox.fs.remove(path)\n          } catch {\n            // file already gone / sandbox torn down — nothing to clean up\n          }\n        }\n      }\n    }\n  }\n\n  structuredOutput(\n    _options: StructuredOutputOptions<ClaudeCodeTextProviderOptions>,\n  ): Promise<StructuredOutputResult<unknown>> {\n    return Promise.reject(\n      new Error(\n        'Structured output is not yet supported by the in-sandbox Claude Code adapter. ' +\n          'Use a model adapter (e.g. anthropic) for structured output, or omit outputSchema.',\n      ),\n    )\n  }\n}\n\n/**\n * Creates a Claude Code harness adapter that runs **inside a sandbox**.\n *\n * Unlike HTTP provider adapters, this is a *harness* adapter: it spawns the\n * `claude` CLI inside the sandbox provided by `withSandbox(...)` (the adapter\n * declares `requires: [SandboxCapability]`), streams its `stream-json` stdout\n * back as AG-UI events, and lets Claude Code run its own agent loop and native\n * tools (Bash, file edits, search, …) against the sandbox workspace. The\n * sandbox image must provide the `claude` executable and `ANTHROPIC_API_KEY`\n * in its environment (e.g. via `workspace.secrets`). The session id is\n * surfaced via a CUSTOM `claude-code.session-id` event so follow-up calls can\n * resume through `modelOptions.sessionId`.\n */\nexport function claudeCodeText<TModel extends ClaudeCodeModel>(\n  model: TModel,\n  config: ClaudeCodeTextConfig = {},\n): ClaudeCodeTextAdapter<TModel> {\n  return new ClaudeCodeTextAdapter(config, model)\n}\n"],"mappings":";;;;;;;;;AAwDA,IAAM,kBAAkB;;AAwCxB,SAAS,EAAE,OAAuB;CAChC,OAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,EAAE;AAC1C;;AAGA,SAAS,kBAAkB,QAAgC;CACzD,OAAO,KAAK,UAAU,EACpB,YAAY,GACT,OAAO,OAAO;EACb,MAAM;EACN,KAAK,OAAO;EACZ,SAAS,EAAE,eAAe,UAAU,OAAO,QAAQ;CACrD,EACF,EACF,CAAC;AACH;AAEA,IAAa,wBAAb,cAEU,gBAQR;CACA,OAAgB;CAGhB,WAA6B,CAAC,iBAAiB;CAE/C;CAEA,YAAY,QAA8B,OAAe;EACvD,MAAM,CAAC,GAAG,KAAK;EACf,KAAK,gBAAgB;CACvB;CAEA,YACE,SACe;EACf,MAAM,MAAM,QAAQ;EACpB,IAAI,CAAC,KACH,MAAM,IAAI,MACR,4JAEF;EAEF,OAAO,WAAW,GAAG;CACvB;CAEA,QAAgB,SAA6D;EAC3E,OACE,QAAQ,cAAc,OAAO,KAAK,cAAc,OAAO;CAE3D;;CAGA,aACE,SACA,QACA,aACA,eACA,sBACQ;EACR,MAAM,SAAS,KAAK;EACpB,MAAM,eAAe,QAAQ;EAC7B,MAAM,MAAM,OAAO,oBAAoB;EAEvC,MAAM,OAAsB;GAC1B;GACA;GACA;GACA;GACA;GACA,EAAE,KAAK,KAAK;EACd;EAEA,IAAI,OAAO,mBAAmB,OAAO,KAAK,KAAK,4BAA4B;EAC3E,IAAI,WAAW,KAAA,GAAW,KAAK,KAAK,YAAY,EAAE,MAAM,CAAC;EAGzD,MAAM,iBACJ,cAAc,kBACd,OAAO,kBACP,YAAY,kBACZ;EACF,KAAK,KAAK,qBAAqB,EAAE,cAAc,CAAC;EAEhD,MAAM,WAAW,cAAc,YAAY,OAAO;EAClD,IAAI,aAAa,KAAA,GAAW,KAAK,KAAK,eAAe,OAAO,QAAQ,CAAC;EAErE,KAAK,MAAM,OAAO,OAAO,WAAW,CAAC,GAAG,KAAK,KAAK,aAAa,EAAE,GAAG,CAAC;EAErE,MAAM,eAAe,CACnB,GAAI,cAAc,gBAAgB,OAAO,gBAAgB,CAAC,GAC1D,GAAG,YAAY,YACjB;EACA,IAAI,aAAa,SAAS,GACxB,KAAK,KAAK,kBAAkB,EAAE,CAAC,GAAG,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;EAErE,MAAM,kBAAkB,CACtB,GAAI,cAAc,mBAAmB,OAAO,mBAAmB,CAAC,GAChE,GAAG,YAAY,eACjB;EACA,IAAI,gBAAgB,SAAS,GAC3B,KAAK,KAAK,qBAAqB,EAAE,CAAC,GAAG,IAAI,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;EAG3E,MAAM,gBAAgB,uBAAuB,QAAQ,aAAa,CAAC,CAChE,KAAK,WAAW,OAAO,OAAO,CAAC,CAC/B,QAAQ,YAAY,QAAQ,KAAK,MAAM,EAAE;EAC5C,IAAI,cAAc,SAAS,GAAG;GAC5B,MAAM,SAAS,cAAc,KAAK,MAAM;GACxC,MAAM,OACJ,OAAO,qBAAqB,YACxB,oBACA;GACN,KAAK,KAAK,MAAM,EAAE,MAAM,CAAC;EAC3B;EAEA,IAAI,kBAAkB,KAAA,GAAW,KAAK,KAAK,gBAAgB,EAAE,aAAa,CAAC;EAC3E,IAAI,yBAAyB,KAAA,GAC3B,KAAK,KAAK,4BAA4B,EAAE,oBAAoB,CAAC;EAG/D,OAAO,GAAG,IAAI,GAAG,KAAK,KAAK,GAAG;CAChC;;;;;;;CAQA,wBACE,QACA,WACA,SACA,MACA,UACA,OAC0E;EAC1E,MAAM,6BAAa,IAAI,IAAI;GAAC;GAAS;GAAQ;GAAa;EAAc,CAAC;EACzE,MAAM,+BAAe,IAAI,IAAI,CAAC,YAAY,WAAW,CAAC;EACtD,QAAQ,YAAY;GAClB,MAAM,WAAW,QAAQ,aAAa;GACtC,MAAM,WAAW,QAAQ;GACzB,MAAM,UACJ,aAAa,UACb,aAAa,QACb,OAAO,aAAa,YACpB,aAAa,YACb,OAAQ,SAAmC,YAAY,WAClD,SAAiC,UAClC,KAAA;GACN,MAAM,aAAa,WAAW,IAAI,QAAQ,IACtC,cACA,aAAa,IAAI,QAAQ,IACvB,YACA,KAAA;GACN,MAAM,KAAK,WAAW;IACpB,UAAU;IACV,MAAM,YAAY,KAAA,IAAY,YAAa,cAAc;IACzD,QAAQ,WAAW;GACrB,CAAC;GACD,MAAM,UAAU,gBAAgB;IAC9B;IACA;IACA;IACA;IACA,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;IAC3C,GAAI,eAAe,KAAA,IAAY,EAAE,WAAW,IAAI,CAAC;GACnD,CAAC;GACD,IAAI,QAAQ,eAAe;IACzB,KAAK,KACH,4BAA4B;KAC1B,YAAY;KACZ,OAAO,WAAW,WAAW,YAAY,KAAA,IAAY,KAAK,YAAY;KACtE;KACA;KACA,QAAQ;MAAE,UAAU;MAAe;KAAS;IAC9C,CAAC,CACH;IACA,OAAO;KACL,UAAU;KACV,SACE;IACJ;GACF;GACA,OAAO,QAAQ,aAAa,UACxB,EAAE,UAAU,QAAQ,IACpB;IAAE,UAAU;IAAQ,SAAS;GAA4B;EAC/D;CACF;CAEA,OAAO,WACL,SAC4B;EAC5B,MAAM,EAAE,WAAW;EACnB,IAAI;EACJ,IAAI;EACJ,MAAM,mBAAuC,CAAC;EAI9C,IAAI;EACJ,MAAM,YAA2B,CAAC;EAClC,IAAI;GACF,MAAM,UAAU,KAAK,YAAY,OAAO;GACxC,iBAAiB;GACjB,MAAM,MAAM,KAAK,QAAQ,OAAO;GAKhC,MAAM,aAAa,QAAQ,eACvB,qBAAqB,QAAQ,cAAc,EAAE,UAAU,KAAK,CAAC,IAC7D,KAAA;GASJ,MAAM,QAAQ,oBAAoB,QAAQ,OAAO;IAC/C,SAAS,eAAe,KAAA;IACxB,SAAS;IACT,gBAAgB,KAAK,WAAW;GAClC,CAAC;GAMD,MAAM,WAAW,uBAAuB,QAAQ,UAAU;IACxD,SAAS,eAAe,KAAA;IACxB,WAAW,YAAY,WAAW;IAClC,SAAS;IACT,gBAAgB,KAAK,WAAW;GAClC,CAAC;GAGD,UAAU,yBAAyB;IAAE,OAAO,KAAK;IAAO;IAAU;GAAM,CAAC;GAIzE,MAAM,aAAa,QAAQ,eACvB,uBAAuB,QAAQ,cAAc,EAAE,UAAU,KAAK,CAAC,IAC/D,KAAA;GACJ,IAAI,YAAY,MAAM,uBAAuB,SAAS,UAAU;GAEhE,MAAM,SAAS,QAAQ,eACnB,iBAAiB,QAAQ,cAAc,EAAE,UAAU,KAAK,CAAC,IACzD,KAAA;GAIJ,MAAM,aACJ,WAAW,KAAA,IACP;IACE,UAAU;IACV,SAAS,KAAK,wBACZ,QACA,QAAQ,WACR,YAAY,SACZ,kBACA,UACA,KACF;GACF,IACA,KAAA;GAKN,IADiB,QAAQ,UAAU,KAAA,KAAa,QAAQ,MAAM,SAAS,KACvD,eAAe,KAAA,GAK7B,SAAS,QAHN,QAAQ,eACL,yBAAyB,QAAQ,cAAc,EAAE,UAAU,KAAK,CAAC,IACjE,KAAA,MAAc,0BAAA,CACO,UAAU,QAAQ,SAAS,CAAC,GAAG;IACxD,UAAU,QAAQ;IAClB,SAAS,QAAQ;IACjB,iBAAiB,QAAQ;IACzB,GAAI,eAAe,KAAA,IAAY,EAAE,WAAW,IAAI,CAAC;IACjD,GAAI,QAAQ,iBAAiB,SACzB,EAAE,QAAQ,QAAQ,gBAAgB,OAAO,IACzC,CAAC;GACP,CAAC;GAGH,MAAM,EAAE,QAAQ,WAAW,YACzB,QAAQ,UACR,QAAQ,cAAc,SACxB;GASA,MAAM,eAAe,YAAY,KAAK;GAKtC,IAAI;GACJ,IAAI,QAAQ;IAOV,MAAM,gBAAgB,wBAAwB,aAAa;IAC3D,MAAM,gBAAgB,GAAG,IAAI,GAAG;IAChC,MAAM,QAAQ,GAAG,MAAM,eAAe,kBAAkB,MAAM,CAAC;IAC/D,UAAU,KAAK,aAAa;IAC5B,eAAe;GACjB;GACA,MAAM,UAAU,KAAK,aACnB,SACA,QACA,uBAAuB,MAAM,GAC7B,cACA,UAAU,aACN,QAAQ,OAAO,KAAK,IAAI,WAAW,aACnC,KAAA,CACN;GAMA,IAAI,aAAa;GACjB,IAAI,aAAiC;GACrC,IAAI,QAAQ,aAAa,kBAAkB,OAAO;IAChD,MAAM,aAAa,+BAA+B;IAClD,MAAM,QAAQ,GAAG,MAAM,YAAY,MAAM;IACzC,UAAU,KAAK,UAAU;IACzB,aAAa,GAAG,QAAQ,KAAK,EAAE,UAAU;IACzC,aAAa,KAAA;GACf;GAEA,OAAO,QACL,4CAA4C,KAAK,MAAM,WAAW,QAAQ,SAAS,YAAY,QAAQ,SAAS,OAAO,UAAU,UAAU,UAC3I;IAAE,UAAU;IAAe,OAAO,KAAK;GAAM,CAC/C;GAEA,MAAM,iBAAiB,kBAAkB,YAAY,KAAK;GAC1D,MAAM,YAAY,YAAY,SAAS,YAAY;IACjD;IACA,GAAI,eAAe,KAAA,IAAY,EAAE,OAAO,WAAW,IAAI,CAAC;IAOxD,KAAK;KAAE,YAAY;KAAK,GAAG,KAAK,cAAc;IAAI;IAClD,GAAI,QAAQ,iBAAiB,SACzB,EAAE,QAAQ,QAAQ,gBAAgB,OAAO,IACzC,QAAQ,SAAS,SACf,EAAE,QAAQ,QAAQ,QAAQ,OAAO,IACjC,CAAC;IACP,gBAAgB,SACd,OAAO,SAAS,uCAAuC,QAAQ,EAC7D,OAAO,KACT,CAAC;IAMH,GAAI,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,eAAe;GACpE,CAAC;GAED,gBAAgB,aAA6C;IAC3D,WAAW,MAAM,SAAS,WAAW,MAAM;GAC7C;GAcA,OAAO,mBACL,kBACE,mBAAmB,WAAW,GAAG;IAC/B,OAAO,KAAK;IACZ;IACA;IACA,GAAI,QAAQ,gBAAgB,KAAA,KAAa,EACvC,aAAa,QAAQ,YACvB;IAMA,OAAO,qBAAqB,KAAK;IACjC,eAAe,YACb,OAAO,SAAS,6BAA6B,QAAQ,QAAQ,EAC3D,OAAO,QACT,CAAC;GACL,CAAC,GACD,QAAQ,MACV,GACA,YACA,MACF;GAGA,IAAI,KAAK,cAAc,aAAa,OAClC,IAAI;IACF,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,UAAU,EAAE,GAAG,EAAE,QAAQ,EAC/D,IACF,CAAC;IACD,IAAI,KAAK,aAAa,KAAK,KAAK,OAAO,KAAK,MAAM,IAChD,MAAM;KACJ,MAAM,UAAU;KAChB,MAAM;KACN,OAAO;MAAE,MAAM;MAAK,MAAM,KAAK;KAAO;KACtC,WAAW,KAAK,IAAI;KACpB;KACA;IACF;GAEJ,QAAQ,CAER;GAKF,KAAK,MAAM,SAAS,kBAAkB,MAAM;EAC9C,SAAS,OAAgB;GACvB,MAAM,MAAM;GACZ,MAAM,WAAW,mBAAmB,KAAK;GACzC,OAAO,OAAO,gCAAgC;IAC5C;IACA,QAAQ;GACV,CAAC;GACD,MAAM;IACJ,MAAM,UAAU;IAChB,OAAO,QAAQ;IACf,WAAW,KAAK,IAAI;IACpB,SAAS,IAAI,WAAW;IACxB,GAAI,IAAI,SAAS,KAAA,KAAa,EAAE,MAAM,IAAI,KAAK;IAC/C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;IACzC,OAAO;KACL,SAAS,IAAI,WAAW;KACxB,GAAI,IAAI,SAAS,KAAA,KAAa,EAAE,MAAM,IAAI,KAAK;IACjD;GACF;EACF,UAAU;GACR,SAAS,MAAM;GACf,IAAI,QAAQ,MAAM,OAAO,MAAM;GAG/B,IAAI,gBACF,KAAK,MAAM,QAAQ,WACjB,IAAI;IACF,MAAM,eAAe,GAAG,OAAO,IAAI;GACrC,QAAQ,CAER;EAGN;CACF;CAEA,iBACE,UAC0C;EAC1C,OAAO,QAAQ,uBACb,IAAI,MACF,iKAEF,CACF;CACF;AACF;;;;;;;;;;;;;;AAeA,SAAgB,eACd,OACA,SAA+B,CAAC,GACD;CAC/B,OAAO,IAAI,sBAAsB,QAAQ,KAAK;AAChD"}
+{"version":3,"file":"text.js","names":[],"sources":["../../../src/adapters/text.ts"],"sourcesContent":["import { EventType, normalizeSystemPrompts } from '@tanstack/ai'\nimport {\n  appendOutputSchemaInstruction,\n  toRunErrorRawEvent,\n} from '@tanstack/ai/adapter-internals'\nimport { BaseTextAdapter } from '@tanstack/ai/adapters'\nimport {\n  SandboxCapability,\n  alignedIfAttaching,\n  approvalId,\n  buildApprovalRequestedEvent,\n  createBridgeEventChannel,\n  createRunScopedIdGen,\n  encodeRunId,\n  getSandbox,\n  getSandboxDurability,\n  getSandboxPolicy,\n  getToolBridgeProvisioner,\n  getWorkspaceProjection,\n  journalOptionsFor,\n  mergeChunkStreams,\n  nodeHttpBridgeProvisioner,\n  resolveApproval,\n  resolveDurableRunId,\n  resolveDurableThreadId,\n  spawnNdjson,\n} from '@tanstack/ai-sandbox'\nimport { buildPrompt } from '../messages/prompt'\nimport { translateSdkStream } from '../stream/translate'\nimport { mapPolicyToClaudeFlags } from './policy-map'\nimport { projectClaudeWorkspace } from './projection'\nimport {\n  CLAUDE_JSON_SCHEMA_PLACEHOLDER,\n  CLAUDE_RUNNER_SOURCE,\n} from './claude-run-source'\n\nimport type { ClaudePolicyFlags } from './policy-map'\nimport type {\n  BridgeEventChannel,\n  HostToolBridge,\n  PermissionToolResult,\n  SandboxHandle,\n  SandboxPolicy,\n} from '@tanstack/ai-sandbox'\nimport type {\n  StructuredOutputOptions,\n  StructuredOutputResult,\n} from '@tanstack/ai/adapters'\nimport type {\n  DefaultMessageMetadataByModality,\n  Modality,\n  StreamChunk,\n  TextOptions,\n} from '@tanstack/ai'\nimport type { ClaudeCodeModel } from '../model-meta'\nimport type { ClaudeCodeTextProviderOptions } from '../provider-options'\nimport type { AgentSdkMessage } from '../stream/sdk-types'\n\nexport type ClaudeCodePermissionMode =\n  | 'default'\n  | 'acceptEdits'\n  | 'bypassPermissions'\n  | 'plan'\n\nconst DEFAULT_WORKDIR = '/workspace'\n\nexport interface ClaudeCodeTextConfig {\n  /**\n   * Working directory inside the sandbox where `claude` runs. Defaults to\n   * `/workspace` (the conventional sandbox workspace root).\n   */\n  cwd?: string\n  /**\n   * Claude Code permission mode passed via `--permission-mode`. Defaults to\n   * `'bypassPermissions'` — a sandbox is isolated, so the agent is allowed to\n   * edit files and run commands without prompting. Tighten via `defineSandboxPolicy`\n   * / this option for less autonomy.\n   */\n  permissionMode?: ClaudeCodePermissionMode\n  /** Built-in tools the harness may use (`--allowedTools`). */\n  allowedTools?: Array<string>\n  /** Built-in tools removed from the harness (`--disallowedTools`). */\n  disallowedTools?: Array<string>\n  /** Extra directories the agent may access (`--add-dir`). */\n  addDirs?: Array<string>\n  /** Maximum harness-internal turns (`--max-turns`). */\n  maxTurns?: number\n  /**\n   * How `systemPrompts` from `chat()` are applied:\n   * - `'append'` (default): `--append-system-prompt` on top of the preset.\n   * - `'replace'`: `--system-prompt` as the entire system prompt.\n   */\n  systemPromptMode?: 'append' | 'replace'\n  /** Path/name of the claude executable inside the sandbox. Defaults to `claude`. */\n  claudeExecutable?: string\n  /** Emit token-level deltas via `--include-partial-messages` (default true). */\n  streamPartials?: boolean\n  /** Extra environment variables for the claude process inside the sandbox. */\n  env?: Record<string, string>\n  /**\n   * `'api-key'` (default) injects `ANTHROPIC_API_KEY`.\n   * `'host'` uses `claude login` and does not inject the key.\n   * Not inferred from the sandbox.\n   */\n  authMode?: 'host' | 'api-key'\n  /** Emit a `file.changed` CUSTOM event with the git diff after the run (default true). */\n  emitDiff?: boolean\n}\n\n/** POSIX single-quote escape for embedding values in the `claude …` command. */\nfunction q(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`\n}\n\n/** Copy host Anthropic auth into the sandbox process. Docker `exec` Env replaces the container env, so a key set only at create time can vanish. */\nfunction hostClaudeAuthEnv(): Record<string, string> {\n  const env: Record<string, string> = {}\n  const apiKey = process.env.ANTHROPIC_API_KEY\n  if (apiKey) env.ANTHROPIC_API_KEY = apiKey\n  const authToken = process.env.ANTHROPIC_AUTH_TOKEN\n  if (authToken) env.ANTHROPIC_AUTH_TOKEN = authToken\n  return env\n}\n\n/**\n * Windows Node often has USERPROFILE but no HOME. Claude then cannot find\n * `~/.claude.json` (the `claude login` file) and prints \"Not logged in\".\n */\nfunction localProcessHomeEnv(provider: string): Record<string, string> {\n  if (provider !== 'local-process') return {}\n  if (process.env.HOME) return {}\n  const home = process.env.USERPROFILE\n  return home ? { HOME: home } : {}\n}\n\n/** Format a host tool-bridge as claude's `--mcp-config` JSON. */\nfunction bridgeToMcpConfig(bridge: HostToolBridge): string {\n  return JSON.stringify({\n    mcpServers: {\n      [bridge.name]: {\n        type: 'http',\n        url: bridge.url,\n        headers: { Authorization: `Bearer ${bridge.token}` },\n      },\n    },\n  })\n}\n\nexport class ClaudeCodeTextAdapter<\n  TModel extends ClaudeCodeModel,\n> extends BaseTextAdapter<\n  TModel,\n  ClaudeCodeTextProviderOptions,\n  ReadonlyArray<Modality> & readonly ['text'],\n  DefaultMessageMetadataByModality,\n  ReadonlyArray<string>,\n  unknown,\n  never\n> {\n  readonly name = 'claude-code' as const\n\n  // Harness adapter: requires a sandbox to run the agent CLI inside.\n  override readonly requires = [SandboxCapability] as const\n\n  private readonly adapterConfig: ClaudeCodeTextConfig\n\n  constructor(config: ClaudeCodeTextConfig, model: TModel) {\n    super({}, model)\n    this.adapterConfig = config\n  }\n\n  private sandboxFrom(\n    options: TextOptions<ClaudeCodeTextProviderOptions>,\n  ): SandboxHandle {\n    const ctx = options.capabilities\n    if (!ctx) {\n      throw new Error(\n        'Adapter \"claude-code\" requires a sandbox. Add withSandbox(defineSandbox({ ... })) ' +\n          'to chat() middleware (e.g. with the local-process or docker provider).',\n      )\n    }\n    return getSandbox(ctx)\n  }\n\n  private workdir(options: TextOptions<ClaudeCodeTextProviderOptions>): string {\n    return (\n      options.modelOptions?.cwd ?? this.adapterConfig.cwd ?? DEFAULT_WORKDIR\n    )\n  }\n\n  supportsCombinedToolsAndSchema(): boolean {\n    return true\n  }\n\n  combinedStructuredOutputSource(): 'event' {\n    return 'event'\n  }\n\n  /** Build the `claude` command line (prompt goes via stdin, not argv). */\n  private buildArgv(\n    options: TextOptions<ClaudeCodeTextProviderOptions>,\n    resume: string | undefined,\n    policyFlags: ClaudePolicyFlags,\n    mcpConfigPath: string | undefined,\n    permissionPromptTool: string | undefined,\n    hasJsonSchema: boolean,\n  ): Array<string> {\n    const config = this.adapterConfig\n    const modelOptions = options.modelOptions\n    const exeParts = (config.claudeExecutable ?? 'claude').split(' ')\n\n    // `--setting-sources user` before `-p`. Do not pass `--bare`: that flag\n    // skips stored `claude login` credentials and prints\n    // \"Not logged in · Please run /login\" (claude-code#51047).\n    // `-p` can take the next token as the prompt, so these flags stay first.\n    const args: Array<string> = [\n      ...exeParts,\n      '--setting-sources',\n      'user',\n      '-p',\n      '--output-format',\n      'stream-json',\n      '--verbose',\n      '--model',\n      this.model,\n    ]\n\n    if (config.streamPartials !== false) args.push('--include-partial-messages')\n    if (resume !== undefined) args.push('--resume', resume)\n\n    const permissionMode =\n      modelOptions?.permissionMode ??\n      config.permissionMode ??\n      policyFlags.permissionMode ??\n      'bypassPermissions'\n    args.push('--permission-mode', permissionMode)\n\n    const maxTurns = modelOptions?.maxTurns ?? config.maxTurns\n    if (maxTurns !== undefined) args.push('--max-turns', String(maxTurns))\n\n    for (const dir of config.addDirs ?? []) args.push('--add-dir', dir)\n\n    const allowedTools = [\n      ...(modelOptions?.allowedTools ?? config.allowedTools ?? []),\n      ...policyFlags.allowedTools,\n    ]\n    if (allowedTools.length > 0) {\n      args.push('--allowedTools', [...new Set(allowedTools)].join(','))\n    }\n    const disallowedTools = [\n      ...(modelOptions?.disallowedTools ?? config.disallowedTools ?? []),\n      ...policyFlags.disallowedTools,\n    ]\n    if (disallowedTools.length > 0) {\n      args.push('--disallowedTools', [...new Set(disallowedTools)].join(','))\n    }\n\n    const systemPrompts = normalizeSystemPrompts(options.systemPrompts)\n      .map((prompt) => prompt.content)\n      .filter((content) => content.trim() !== '')\n    if (systemPrompts.length > 0) {\n      const joined = systemPrompts.join('\\n\\n')\n      const flag =\n        config.systemPromptMode === 'replace'\n          ? '--system-prompt'\n          : '--append-system-prompt'\n      args.push(flag, joined)\n    }\n\n    if (mcpConfigPath !== undefined) args.push('--mcp-config', mcpConfigPath)\n    if (hasJsonSchema) {\n      args.push('--json-schema', CLAUDE_JSON_SCHEMA_PLACEHOLDER)\n    }\n    if (permissionPromptTool !== undefined) {\n      args.push('--permission-prompt-tool', permissionPromptTool)\n    }\n\n    return args\n  }\n\n  /**\n   * Build the permission-prompt resolver the host MCP bridge exposes to claude\n   * (`--permission-prompt-tool`). Maps claude's permission request onto the\n   * sandbox policy + client approvals; on an `ask` action with no decision yet,\n   * records an approval-requested event and denies (the client re-runs to grant).\n   */\n  private buildPermissionResolver(\n    policy: SandboxPolicy | undefined,\n    approvals: ReadonlyMap<string, boolean> | undefined,\n    scripts: Record<string, string> | undefined,\n    sink: Array<StreamChunk>,\n    threadId: string,\n    runId: string,\n  ): (input: { tool_name?: string; input?: unknown }) => PermissionToolResult {\n    const writeTools = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit'])\n    const networkTools = new Set(['WebFetch', 'WebSearch'])\n    return (request) => {\n      const toolName = request.tool_name ?? 'tool'\n      const cmdInput = request.input\n      const command =\n        toolName === 'Bash' &&\n        cmdInput !== null &&\n        typeof cmdInput === 'object' &&\n        'command' in cmdInput &&\n        typeof (cmdInput as { command?: unknown }).command === 'string'\n          ? (cmdInput as { command: string }).command\n          : undefined\n      const capability = writeTools.has(toolName)\n        ? 'fileWrite'\n        : networkTools.has(toolName)\n          ? 'network'\n          : undefined\n      const id = approvalId({\n        provider: 'claude-code',\n        kind: command !== undefined ? 'command' : (capability ?? 'tool'),\n        target: command ?? toolName,\n      })\n      const outcome = resolveApproval({\n        policy,\n        approvals,\n        id,\n        scripts,\n        ...(command !== undefined ? { command } : {}),\n        ...(capability !== undefined ? { capability } : {}),\n      })\n      if (outcome.needsApproval) {\n        sink.push(\n          buildApprovalRequestedEvent({\n            approvalId: id,\n            title: `Approve ${toolName}${command !== undefined ? `: ${command}` : ''}`,\n            threadId,\n            runId,\n            detail: { provider: 'claude-code', toolName },\n          }),\n        )\n        return {\n          behavior: 'deny',\n          message:\n            'Awaiting client approval. Approve in the UI and re-run to continue.',\n        }\n      }\n      return outcome.decision === 'allow'\n        ? { behavior: 'allow' }\n        : { behavior: 'deny', message: 'Denied by sandbox policy.' }\n    }\n  }\n\n  async *chatStream(\n    options: TextOptions<ClaudeCodeTextProviderOptions>,\n  ): AsyncIterable<StreamChunk> {\n    const { logger } = options\n    let bridge: HostToolBridge | undefined\n    let channel: BridgeEventChannel | undefined\n    const approvalRequests: Array<StreamChunk> = []\n    // Temp files written for the run (bridge MCP config, redirected prompt) that\n    // carry the bearer token / prompt; removed in `finally` so they don't linger\n    // in the sandbox after the run.\n    let cleanupSandbox: SandboxHandle | undefined\n    const tempFiles: Array<string> = []\n    try {\n      const sandbox = this.sandboxFrom(options)\n      cleanupSandbox = sandbox\n      const cwd = this.workdir(options)\n\n      // Durability comes from `withSandbox(sandbox, { runs, durability })`, read\n      // back off the capability bus. Absent it, everything below resolves to\n      // exactly today's behavior (no journal option, no alignment, and a\n      // generated `runId` when the caller didn't supply one).\n      const durability = options.capabilities\n        ? getSandboxDurability(options.capabilities, { optional: true })\n        : undefined\n      // The journaled path below derives its journal path and its\n      // message-id generator from `runId`. A resuming host must recompute\n      // the same `runId` to find the same journal file and reproduce the\n      // same translated ids — that's only possible when the caller supplies\n      // `runId` explicitly. `resolveDurableRunId` enforces that loudly (via\n      // `DurableRunIdRequiredError`) whenever durability is wired, and falls\n      // back to a fresh `this.generateId()` otherwise, preserving today's\n      // behavior for non-durable runs.\n      const runId = resolveDurableRunId(options.runId, {\n        durable: durability !== undefined,\n        adapter: 'claude-code',\n        fallback: () => this.generateId(),\n      })\n      // `threadId` is stamped on every chunk `translateSdkStream` emits, so an\n      // ATTACHING run that mints a fresh one replays a stream the stored log\n      // cannot match at index 0. `resolveDurableThreadId` refuses that up front\n      // instead of letting alignment discover it mid-stream; a durable FRESH run\n      // and a non-durable run both keep the generated fallback untouched.\n      const threadId = resolveDurableThreadId(options.threadId, {\n        durable: durability !== undefined,\n        attaching: durability?.attach === true,\n        adapter: 'claude-code',\n        fallback: () => this.generateId(),\n      })\n      // Surfaces custom events from bridged tools (e.g. code mode console logs)\n      // on this run's live output stream.\n      channel = createBridgeEventChannel({ model: this.model, threadId, runId })\n\n      // Idempotently project workspace skills/plugins/MCP into the sandbox in\n      // claude's native format (guarded by the projection marker file).\n      const projection = options.capabilities\n        ? getWorkspaceProjection(options.capabilities, { optional: true })\n        : undefined\n      if (projection) await projectClaudeWorkspace(sandbox, projection)\n\n      const policy = options.capabilities\n        ? getSandboxPolicy(options.capabilities, { optional: true })\n        : undefined\n\n      // A permission-prompt tool gates the agent's native tools when a policy\n      // can `ask`/`deny` (interactive approvals).\n      const permission =\n        policy !== undefined\n          ? {\n              toolName: 'approval_prompt',\n              resolve: this.buildPermissionResolver(\n                policy,\n                options.approvals,\n                projection?.scripts,\n                approvalRequests,\n                threadId,\n                runId,\n              ),\n            }\n          : undefined\n\n      // Bridge chat()-provided server tools (and/or the permission tool) into\n      // the sandbox over MCP.\n      const hasTools = options.tools !== undefined && options.tools.length > 0\n      if (hasTools || permission !== undefined) {\n        const provisioner =\n          (options.capabilities\n            ? getToolBridgeProvisioner(options.capabilities, { optional: true })\n            : undefined) ?? nodeHttpBridgeProvisioner\n        bridge = await provisioner.provision(options.tools ?? [], {\n          provider: sandbox.provider,\n          context: options.context,\n          emitCustomEvent: channel.emitCustomEvent,\n          ...(permission !== undefined ? { permission } : {}),\n          ...(options.abortController?.signal\n            ? { signal: options.abortController.signal }\n            : {}),\n        })\n      }\n\n      const built = buildPrompt(\n        options.messages,\n        options.modelOptions?.sessionId,\n      )\n      const resume = built.resume\n      const prompt =\n        options.outputSchema !== undefined\n          ? appendOutputSchemaInstruction(built.prompt, options.outputSchema)\n          : built.prompt\n      // Both files below name themselves after `runId`, and durability makes\n      // `runId` CALLER-chosen. Raw, a `/` in it would silently turn each basename\n      // into a nested path (writing outside the intended directory, or failing on\n      // one that does not exist), `..` would climb out of that directory, and a\n      // long id would fail the spawn with `ENAMETOOLONG`. `encodeRunId` collapses\n      // any id to one bounded, injective path segment — the same encoder\n      // `journalPaths` uses, so these files and the journal agree on how a given\n      // id spells. Computed once so the two filenames cannot drift apart.\n      const runIdSegment = encodeRunId(runId)\n\n      // The bridge MCP config carries the per-run bearer token. Write it to a\n      // file and pass claude the PATH, so the token never appears in argv (where\n      // any process in the sandbox could read it via `ps` / `/proc/<pid>/cmdline`).\n      let mcpConfigArg: string | undefined\n      if (bridge) {\n        // Pass claude a path RELATIVE to its cwd (the real workdir the handle\n        // runs the process in). An absolute VIRTUAL path like `/workspace/…` is\n        // wrong wherever claude runs outside a sandbox that literally uses\n        // `/workspace` — e.g. local-process on Windows, where git-bash resolves\n        // `/workspace` to `C:\\Program Files\\Git\\workspace` and the file is \"not\n        // found\". The bare filename resolves correctly on every provider.\n        const mcpConfigFile = `.tanstack-mcp-bridge-${runIdSegment}.json`\n        const mcpConfigPath = `${cwd}/${mcpConfigFile}`\n        await sandbox.fs.write(mcpConfigPath, bridgeToMcpConfig(bridge))\n        tempFiles.push(mcpConfigPath)\n        mcpConfigArg = mcpConfigFile\n      }\n      let jsonSchemaFile: string | undefined\n      if (options.outputSchema !== undefined) {\n        jsonSchemaFile = `tanstack-output-schema-${runIdSegment}.json`\n        const schemaPath = `${cwd}/${jsonSchemaFile}`\n        await sandbox.fs.write(schemaPath, JSON.stringify(options.outputSchema))\n        tempFiles.push(schemaPath)\n      }\n      const runnerFile = `tanstack-claude-run-${runIdSegment}.mjs`\n      await sandbox.fs.write(`${cwd}/${runnerFile}`, CLAUDE_RUNNER_SOURCE)\n      tempFiles.push(`${cwd}/${runnerFile}`)\n      const argv = this.buildArgv(\n        options,\n        resume,\n        mapPolicyToClaudeFlags(policy),\n        mcpConfigArg,\n        bridge && permission\n          ? `mcp__${bridge.name}__${permission.toolName}`\n          : undefined,\n        jsonSchemaFile !== undefined,\n      )\n      // Filenames only on the shell line. JSON (schema, system prompt, MCP\n      // config path) lives in the argv file so git-bash cannot retokenize it.\n      const argvFile = `tanstack-claude-argv-${runIdSegment}.json`\n      await sandbox.fs.write(`${cwd}/${argvFile}`, JSON.stringify(argv))\n      tempFiles.push(`${cwd}/${argvFile}`)\n      const command =\n        jsonSchemaFile === undefined\n          ? `node ${q(runnerFile)} ${q(argvFile)}`\n          : `node ${q(runnerFile)} ${q(argvFile)} ${q(jsonSchemaFile)}`\n\n      // Deliver the prompt. The default feeds it over stdin (keeps it out of\n      // argv). Providers without a writable host→process stdin (e.g. Cloudflare)\n      // can't accept that write, so write the prompt to a file and redirect the\n      // CLI's stdin from it in-shell (`claude -p … < file`) — still out of argv.\n      let runCommand = command\n      let stdinInput: string | undefined = prompt\n      if (sandbox.capabilities.writableStdin === false) {\n        const promptPath = `/tmp/tanstack-claude-prompt-${runIdSegment}`\n        await sandbox.fs.write(promptPath, prompt)\n        tempFiles.push(promptPath)\n        runCommand = `${command} < ${q(promptPath)}`\n        stdinInput = undefined\n      }\n\n      logger.request(\n        `activity=chat provider=claude-code model=${this.model} sandbox=${sandbox.provider} messages=${options.messages.length} resume=${resume ?? 'none'}`,\n        { provider: 'claude-code', model: this.model },\n      )\n\n      const authMode =\n        options.modelOptions?.authMode ??\n        this.adapterConfig.authMode ??\n        'api-key'\n      const injectApiKey = authMode === 'api-key'\n\n      const journalOptions = journalOptionsFor(durability, runId)\n      const rawEvents = spawnNdjson(sandbox, runCommand, {\n        cwd,\n        ...(stdinInput !== undefined ? { input: stdinInput } : {}),\n        // Isolated sandboxes often run as root. Claude refuses\n        // `--dangerously-skip-permissions` as root unless IS_SANDBOX=1.\n        // CLAUDE_CODE_SANDBOXED marks a real isolation boundary. Do not set\n        // either on local-process: that provider runs on the host.\n        env: {\n          ...(sandbox.provider === 'local-process'\n            ? {}\n            : {\n                IS_SANDBOX: '1',\n                CLAUDE_CODE_SANDBOXED: '1',\n              }),\n          ...(injectApiKey ? hostClaudeAuthEnv() : {}),\n          ...localProcessHomeEnv(sandbox.provider),\n          ...this.adapterConfig.env,\n        },\n        ...(options.abortController?.signal\n          ? { signal: options.abortController.signal }\n          : options.request?.signal\n            ? { signal: options.request.signal }\n            : {}),\n        onNonJsonLine: (line) =>\n          logger.provider(`provider=claude-code non-json line: ${line}`, {\n            chunk: line,\n          }),\n        // Journal + attach both come from the sandbox durability capability, so\n        // the attach route configures takeover by passing `attach: true` to\n        // `withSandbox` — `chat()` stays free of sandbox vocabulary. Omitted\n        // entirely (not passed as `undefined`) when the run isn't durable, so\n        // `spawnNdjson` takes its original, unjournaled path byte-for-byte.\n        ...(journalOptions === undefined ? {} : { journal: journalOptions }),\n      })\n\n      async function* asMessages(): AsyncIterable<AgentSdkMessage> {\n        for await (const event of rawEvents) yield event as AgentSdkMessage\n      }\n\n      // `mergeChunkStreams` splices `channel.stream` (host-tool-bridge CUSTOM\n      // events from LIVE tool execution) into the deterministic translator\n      // output. Those events do not occur on a replay, so a takeover's replay is\n      // NOT chunk-for-chunk identical to what the log holds. `alignedIfAttaching`\n      // handles it: alignment skips stored out-of-band CUSTOM entries within a\n      // bounded window (see `align.ts`), so a bridged-tool run can be taken over\n      // without a spurious `JournalReplayDivergedError` — while a genuine\n      // determinism regression still throws. The wrap goes OUTSIDE the merge:\n      // the stored log holds the previous host's merged output, so aligning the\n      // pre-merge translated stream alone would compare against a log it never\n      // produced. On a non-attaching run this is a pure passthrough (see\n      // `alignedIfAttaching`'s `attach` guard).\n      yield* alignedIfAttaching(\n        mergeChunkStreams(\n          translateSdkStream(asMessages(), {\n            model: this.model,\n            runId,\n            threadId,\n            ...(options.parentRunId !== undefined && {\n              parentRunId: options.parentRunId,\n            }),\n            // Deterministic on the journaled path: two translations of the same\n            // journal prefix from a fresh generator seeded with the same\n            // `runId` mint the same message ids (unlike `this.generateId()`,\n            // which mixes in `Date.now()` / `Math.random()`). See\n            // `createRunScopedIdGen` in `@tanstack/ai-sandbox`.\n            genId: createRunScopedIdGen(runId),\n            ...(options.outputSchema ? { expectStructuredOutput: true } : {}),\n            onSdkMessage: (message) =>\n              logger.provider(`provider=claude-code type=${message.type}`, {\n                chunk: message,\n              }),\n          }),\n          channel.stream,\n        ),\n        durability,\n        logger,\n      )\n\n      // Surface the working-tree diff so UIs can render what the agent changed.\n      if (this.adapterConfig.emitDiff !== false) {\n        try {\n          const diff = await sandbox.process.exec(`git -C ${q(cwd)} diff`, {\n            cwd,\n          })\n          if (diff.exitCode === 0 && diff.stdout.trim() !== '') {\n            yield {\n              type: EventType.CUSTOM,\n              name: 'file.changed',\n              value: { path: '.', diff: diff.stdout },\n              timestamp: Date.now(),\n              threadId,\n              runId,\n            }\n          }\n        } catch {\n          // not a git repo / git unavailable — skip the diff event\n        }\n      }\n\n      // Surface any pending approval requests (policy `ask` actions awaiting a\n      // client decision); the client approves and re-runs to continue.\n      for (const event of approvalRequests) yield event\n    } catch (error: unknown) {\n      const err = error as Error & { code?: string }\n      const rawEvent = toRunErrorRawEvent(error)\n      logger.errors('claude-code.chatStream fatal', {\n        error,\n        source: 'claude-code.chatStream',\n      })\n      yield {\n        type: EventType.RUN_ERROR,\n        model: options.model,\n        timestamp: Date.now(),\n        message: err.message || 'Unknown error occurred',\n        ...(err.code !== undefined && { code: err.code }),\n        ...(rawEvent !== undefined && { rawEvent }),\n        error: {\n          message: err.message || 'Unknown error occurred',\n          ...(err.code !== undefined && { code: err.code }),\n        },\n      }\n    } finally {\n      channel?.close()\n      if (bridge) await bridge.close()\n      // Remove the per-run token/prompt files. Best-effort: a cleanup failure\n      // must not mask the run's own outcome.\n      if (cleanupSandbox) {\n        for (const path of tempFiles) {\n          try {\n            await cleanupSandbox.fs.remove(path)\n          } catch {\n            // file already gone / sandbox torn down — nothing to clean up\n          }\n        }\n      }\n    }\n  }\n\n  structuredOutput(\n    _options: StructuredOutputOptions<ClaudeCodeTextProviderOptions>,\n  ): Promise<StructuredOutputResult<unknown>> {\n    return Promise.reject(\n      new Error(\n        'This harness honors outputSchema on chat() in the same turn. ' +\n          'Pass outputSchema to chat(), or use a model adapter for a one-shot extract.',\n      ),\n    )\n  }\n}\n\n/**\n * Creates a Claude Code harness adapter that runs **inside a sandbox**.\n *\n * Unlike HTTP provider adapters, this is a *harness* adapter: it spawns the\n * `claude` CLI inside the sandbox provided by `withSandbox(...)` (the adapter\n * declares `requires: [SandboxCapability]`), streams its `stream-json` stdout\n * back as AG-UI events, and lets Claude Code run its own agent loop and native\n * tools (Bash, file edits, search, …) against the sandbox workspace. The\n * sandbox image must provide the `claude` executable and `ANTHROPIC_API_KEY`\n * in its environment (e.g. via `workspace.secrets`). The session id is\n * surfaced via a CUSTOM `claude-code.session-id` event so follow-up calls can\n * resume through `modelOptions.sessionId`.\n */\nexport function claudeCodeText<TModel extends ClaudeCodeModel>(\n  model: TModel,\n  config: ClaudeCodeTextConfig = {},\n): ClaudeCodeTextAdapter<TModel> {\n  return new ClaudeCodeTextAdapter(config, model)\n}\n"],"mappings":";;;;;;;;;;AAgEA,IAAM,kBAAkB;;AA8CxB,SAAS,EAAE,OAAuB;CAChC,OAAO,IAAI,MAAM,QAAQ,MAAM,OAAO,EAAE;AAC1C;;AAGA,SAAS,oBAA4C;CACnD,MAAM,MAA8B,CAAC;CACrC,MAAM,SAAS,QAAQ,IAAI;CAC3B,IAAI,QAAQ,IAAI,oBAAoB;CACpC,MAAM,YAAY,QAAQ,IAAI;CAC9B,IAAI,WAAW,IAAI,uBAAuB;CAC1C,OAAO;AACT;;;;;AAMA,SAAS,oBAAoB,UAA0C;CACrE,IAAI,aAAa,iBAAiB,OAAO,CAAC;CAC1C,IAAI,QAAQ,IAAI,MAAM,OAAO,CAAC;CAC9B,MAAM,OAAO,QAAQ,IAAI;CACzB,OAAO,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;AAClC;;AAGA,SAAS,kBAAkB,QAAgC;CACzD,OAAO,KAAK,UAAU,EACpB,YAAY,GACT,OAAO,OAAO;EACb,MAAM;EACN,KAAK,OAAO;EACZ,SAAS,EAAE,eAAe,UAAU,OAAO,QAAQ;CACrD,EACF,EACF,CAAC;AACH;AAEA,IAAa,wBAAb,cAEU,gBAQR;CACA,OAAgB;CAGhB,WAA6B,CAAC,iBAAiB;CAE/C;CAEA,YAAY,QAA8B,OAAe;EACvD,MAAM,CAAC,GAAG,KAAK;EACf,KAAK,gBAAgB;CACvB;CAEA,YACE,SACe;EACf,MAAM,MAAM,QAAQ;EACpB,IAAI,CAAC,KACH,MAAM,IAAI,MACR,4JAEF;EAEF,OAAO,WAAW,GAAG;CACvB;CAEA,QAAgB,SAA6D;EAC3E,OACE,QAAQ,cAAc,OAAO,KAAK,cAAc,OAAO;CAE3D;CAEA,iCAA0C;EACxC,OAAO;CACT;CAEA,iCAA0C;EACxC,OAAO;CACT;;CAGA,UACE,SACA,QACA,aACA,eACA,sBACA,eACe;EACf,MAAM,SAAS,KAAK;EACpB,MAAM,eAAe,QAAQ;EAO7B,MAAM,OAAsB;GAC1B,IAPgB,OAAO,oBAAoB,SAAA,CAAU,MAAM,GAOxD;GACH;GACA;GACA;GACA;GACA;GACA;GACA;GACA,KAAK;EACP;EAEA,IAAI,OAAO,mBAAmB,OAAO,KAAK,KAAK,4BAA4B;EAC3E,IAAI,WAAW,KAAA,GAAW,KAAK,KAAK,YAAY,MAAM;EAEtD,MAAM,iBACJ,cAAc,kBACd,OAAO,kBACP,YAAY,kBACZ;EACF,KAAK,KAAK,qBAAqB,cAAc;EAE7C,MAAM,WAAW,cAAc,YAAY,OAAO;EAClD,IAAI,aAAa,KAAA,GAAW,KAAK,KAAK,eAAe,OAAO,QAAQ,CAAC;EAErE,KAAK,MAAM,OAAO,OAAO,WAAW,CAAC,GAAG,KAAK,KAAK,aAAa,GAAG;EAElE,MAAM,eAAe,CACnB,GAAI,cAAc,gBAAgB,OAAO,gBAAgB,CAAC,GAC1D,GAAG,YAAY,YACjB;EACA,IAAI,aAAa,SAAS,GACxB,KAAK,KAAK,kBAAkB,CAAC,GAAG,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;EAElE,MAAM,kBAAkB,CACtB,GAAI,cAAc,mBAAmB,OAAO,mBAAmB,CAAC,GAChE,GAAG,YAAY,eACjB;EACA,IAAI,gBAAgB,SAAS,GAC3B,KAAK,KAAK,qBAAqB,CAAC,GAAG,IAAI,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;EAGxE,MAAM,gBAAgB,uBAAuB,QAAQ,aAAa,CAAC,CAChE,KAAK,WAAW,OAAO,OAAO,CAAC,CAC/B,QAAQ,YAAY,QAAQ,KAAK,MAAM,EAAE;EAC5C,IAAI,cAAc,SAAS,GAAG;GAC5B,MAAM,SAAS,cAAc,KAAK,MAAM;GACxC,MAAM,OACJ,OAAO,qBAAqB,YACxB,oBACA;GACN,KAAK,KAAK,MAAM,MAAM;EACxB;EAEA,IAAI,kBAAkB,KAAA,GAAW,KAAK,KAAK,gBAAgB,aAAa;EACxE,IAAI,eACF,KAAK,KAAK,iBAAiB,8BAA8B;EAE3D,IAAI,yBAAyB,KAAA,GAC3B,KAAK,KAAK,4BAA4B,oBAAoB;EAG5D,OAAO;CACT;;;;;;;CAQA,wBACE,QACA,WACA,SACA,MACA,UACA,OAC0E;EAC1E,MAAM,6BAAa,IAAI,IAAI;GAAC;GAAS;GAAQ;GAAa;EAAc,CAAC;EACzE,MAAM,+BAAe,IAAI,IAAI,CAAC,YAAY,WAAW,CAAC;EACtD,QAAQ,YAAY;GAClB,MAAM,WAAW,QAAQ,aAAa;GACtC,MAAM,WAAW,QAAQ;GACzB,MAAM,UACJ,aAAa,UACb,aAAa,QACb,OAAO,aAAa,YACpB,aAAa,YACb,OAAQ,SAAmC,YAAY,WAClD,SAAiC,UAClC,KAAA;GACN,MAAM,aAAa,WAAW,IAAI,QAAQ,IACtC,cACA,aAAa,IAAI,QAAQ,IACvB,YACA,KAAA;GACN,MAAM,KAAK,WAAW;IACpB,UAAU;IACV,MAAM,YAAY,KAAA,IAAY,YAAa,cAAc;IACzD,QAAQ,WAAW;GACrB,CAAC;GACD,MAAM,UAAU,gBAAgB;IAC9B;IACA;IACA;IACA;IACA,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;IAC3C,GAAI,eAAe,KAAA,IAAY,EAAE,WAAW,IAAI,CAAC;GACnD,CAAC;GACD,IAAI,QAAQ,eAAe;IACzB,KAAK,KACH,4BAA4B;KAC1B,YAAY;KACZ,OAAO,WAAW,WAAW,YAAY,KAAA,IAAY,KAAK,YAAY;KACtE;KACA;KACA,QAAQ;MAAE,UAAU;MAAe;KAAS;IAC9C,CAAC,CACH;IACA,OAAO;KACL,UAAU;KACV,SACE;IACJ;GACF;GACA,OAAO,QAAQ,aAAa,UACxB,EAAE,UAAU,QAAQ,IACpB;IAAE,UAAU;IAAQ,SAAS;GAA4B;EAC/D;CACF;CAEA,OAAO,WACL,SAC4B;EAC5B,MAAM,EAAE,WAAW;EACnB,IAAI;EACJ,IAAI;EACJ,MAAM,mBAAuC,CAAC;EAI9C,IAAI;EACJ,MAAM,YAA2B,CAAC;EAClC,IAAI;GACF,MAAM,UAAU,KAAK,YAAY,OAAO;GACxC,iBAAiB;GACjB,MAAM,MAAM,KAAK,QAAQ,OAAO;GAMhC,MAAM,aAAa,QAAQ,eACvB,qBAAqB,QAAQ,cAAc,EAAE,UAAU,KAAK,CAAC,IAC7D,KAAA;GASJ,MAAM,QAAQ,oBAAoB,QAAQ,OAAO;IAC/C,SAAS,eAAe,KAAA;IACxB,SAAS;IACT,gBAAgB,KAAK,WAAW;GAClC,CAAC;GAMD,MAAM,WAAW,uBAAuB,QAAQ,UAAU;IACxD,SAAS,eAAe,KAAA;IACxB,WAAW,YAAY,WAAW;IAClC,SAAS;IACT,gBAAgB,KAAK,WAAW;GAClC,CAAC;GAGD,UAAU,yBAAyB;IAAE,OAAO,KAAK;IAAO;IAAU;GAAM,CAAC;GAIzE,MAAM,aAAa,QAAQ,eACvB,uBAAuB,QAAQ,cAAc,EAAE,UAAU,KAAK,CAAC,IAC/D,KAAA;GACJ,IAAI,YAAY,MAAM,uBAAuB,SAAS,UAAU;GAEhE,MAAM,SAAS,QAAQ,eACnB,iBAAiB,QAAQ,cAAc,EAAE,UAAU,KAAK,CAAC,IACzD,KAAA;GAIJ,MAAM,aACJ,WAAW,KAAA,IACP;IACE,UAAU;IACV,SAAS,KAAK,wBACZ,QACA,QAAQ,WACR,YAAY,SACZ,kBACA,UACA,KACF;GACF,IACA,KAAA;GAKN,IADiB,QAAQ,UAAU,KAAA,KAAa,QAAQ,MAAM,SAAS,KACvD,eAAe,KAAA,GAK7B,SAAS,QAHN,QAAQ,eACL,yBAAyB,QAAQ,cAAc,EAAE,UAAU,KAAK,CAAC,IACjE,KAAA,MAAc,0BAAA,CACO,UAAU,QAAQ,SAAS,CAAC,GAAG;IACxD,UAAU,QAAQ;IAClB,SAAS,QAAQ;IACjB,iBAAiB,QAAQ;IACzB,GAAI,eAAe,KAAA,IAAY,EAAE,WAAW,IAAI,CAAC;IACjD,GAAI,QAAQ,iBAAiB,SACzB,EAAE,QAAQ,QAAQ,gBAAgB,OAAO,IACzC,CAAC;GACP,CAAC;GAGH,MAAM,QAAQ,YACZ,QAAQ,UACR,QAAQ,cAAc,SACxB;GACA,MAAM,SAAS,MAAM;GACrB,MAAM,SACJ,QAAQ,iBAAiB,KAAA,IACrB,8BAA8B,MAAM,QAAQ,QAAQ,YAAY,IAChE,MAAM;GASZ,MAAM,eAAe,YAAY,KAAK;GAKtC,IAAI;GACJ,IAAI,QAAQ;IAOV,MAAM,gBAAgB,wBAAwB,aAAa;IAC3D,MAAM,gBAAgB,GAAG,IAAI,GAAG;IAChC,MAAM,QAAQ,GAAG,MAAM,eAAe,kBAAkB,MAAM,CAAC;IAC/D,UAAU,KAAK,aAAa;IAC5B,eAAe;GACjB;GACA,IAAI;GACJ,IAAI,QAAQ,iBAAiB,KAAA,GAAW;IACtC,iBAAiB,0BAA0B,aAAa;IACxD,MAAM,aAAa,GAAG,IAAI,GAAG;IAC7B,MAAM,QAAQ,GAAG,MAAM,YAAY,KAAK,UAAU,QAAQ,YAAY,CAAC;IACvE,UAAU,KAAK,UAAU;GAC3B;GACA,MAAM,aAAa,uBAAuB,aAAa;GACvD,MAAM,QAAQ,GAAG,MAAM,GAAG,IAAI,GAAG,cAAc,oBAAoB;GACnE,UAAU,KAAK,GAAG,IAAI,GAAG,YAAY;GACrC,MAAM,OAAO,KAAK,UAChB,SACA,QACA,uBAAuB,MAAM,GAC7B,cACA,UAAU,aACN,QAAQ,OAAO,KAAK,IAAI,WAAW,aACnC,KAAA,GACJ,mBAAmB,KAAA,CACrB;GAGA,MAAM,WAAW,wBAAwB,aAAa;GACtD,MAAM,QAAQ,GAAG,MAAM,GAAG,IAAI,GAAG,YAAY,KAAK,UAAU,IAAI,CAAC;GACjE,UAAU,KAAK,GAAG,IAAI,GAAG,UAAU;GACnC,MAAM,UACJ,mBAAmB,KAAA,IACf,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,MACnC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc;GAM9D,IAAI,aAAa;GACjB,IAAI,aAAiC;GACrC,IAAI,QAAQ,aAAa,kBAAkB,OAAO;IAChD,MAAM,aAAa,+BAA+B;IAClD,MAAM,QAAQ,GAAG,MAAM,YAAY,MAAM;IACzC,UAAU,KAAK,UAAU;IACzB,aAAa,GAAG,QAAQ,KAAK,EAAE,UAAU;IACzC,aAAa,KAAA;GACf;GAEA,OAAO,QACL,4CAA4C,KAAK,MAAM,WAAW,QAAQ,SAAS,YAAY,QAAQ,SAAS,OAAO,UAAU,UAAU,UAC3I;IAAE,UAAU;IAAe,OAAO,KAAK;GAAM,CAC/C;GAMA,MAAM,gBAHJ,QAAQ,cAAc,YACtB,KAAK,cAAc,YACnB,eACgC;GAElC,MAAM,iBAAiB,kBAAkB,YAAY,KAAK;GAC1D,MAAM,YAAY,YAAY,SAAS,YAAY;IACjD;IACA,GAAI,eAAe,KAAA,IAAY,EAAE,OAAO,WAAW,IAAI,CAAC;IAKxD,KAAK;KACH,GAAI,QAAQ,aAAa,kBACrB,CAAC,IACD;MACE,YAAY;MACZ,uBAAuB;KACzB;KACJ,GAAI,eAAe,kBAAkB,IAAI,CAAC;KAC1C,GAAG,oBAAoB,QAAQ,QAAQ;KACvC,GAAG,KAAK,cAAc;IACxB;IACA,GAAI,QAAQ,iBAAiB,SACzB,EAAE,QAAQ,QAAQ,gBAAgB,OAAO,IACzC,QAAQ,SAAS,SACf,EAAE,QAAQ,QAAQ,QAAQ,OAAO,IACjC,CAAC;IACP,gBAAgB,SACd,OAAO,SAAS,uCAAuC,QAAQ,EAC7D,OAAO,KACT,CAAC;IAMH,GAAI,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,eAAe;GACpE,CAAC;GAED,gBAAgB,aAA6C;IAC3D,WAAW,MAAM,SAAS,WAAW,MAAM;GAC7C;GAcA,OAAO,mBACL,kBACE,mBAAmB,WAAW,GAAG;IAC/B,OAAO,KAAK;IACZ;IACA;IACA,GAAI,QAAQ,gBAAgB,KAAA,KAAa,EACvC,aAAa,QAAQ,YACvB;IAMA,OAAO,qBAAqB,KAAK;IACjC,GAAI,QAAQ,eAAe,EAAE,wBAAwB,KAAK,IAAI,CAAC;IAC/D,eAAe,YACb,OAAO,SAAS,6BAA6B,QAAQ,QAAQ,EAC3D,OAAO,QACT,CAAC;GACL,CAAC,GACD,QAAQ,MACV,GACA,YACA,MACF;GAGA,IAAI,KAAK,cAAc,aAAa,OAClC,IAAI;IACF,MAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK,UAAU,EAAE,GAAG,EAAE,QAAQ,EAC/D,IACF,CAAC;IACD,IAAI,KAAK,aAAa,KAAK,KAAK,OAAO,KAAK,MAAM,IAChD,MAAM;KACJ,MAAM,UAAU;KAChB,MAAM;KACN,OAAO;MAAE,MAAM;MAAK,MAAM,KAAK;KAAO;KACtC,WAAW,KAAK,IAAI;KACpB;KACA;IACF;GAEJ,QAAQ,CAER;GAKF,KAAK,MAAM,SAAS,kBAAkB,MAAM;EAC9C,SAAS,OAAgB;GACvB,MAAM,MAAM;GACZ,MAAM,WAAW,mBAAmB,KAAK;GACzC,OAAO,OAAO,gCAAgC;IAC5C;IACA,QAAQ;GACV,CAAC;GACD,MAAM;IACJ,MAAM,UAAU;IAChB,OAAO,QAAQ;IACf,WAAW,KAAK,IAAI;IACpB,SAAS,IAAI,WAAW;IACxB,GAAI,IAAI,SAAS,KAAA,KAAa,EAAE,MAAM,IAAI,KAAK;IAC/C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;IACzC,OAAO;KACL,SAAS,IAAI,WAAW;KACxB,GAAI,IAAI,SAAS,KAAA,KAAa,EAAE,MAAM,IAAI,KAAK;IACjD;GACF;EACF,UAAU;GACR,SAAS,MAAM;GACf,IAAI,QAAQ,MAAM,OAAO,MAAM;GAG/B,IAAI,gBACF,KAAK,MAAM,QAAQ,WACjB,IAAI;IACF,MAAM,eAAe,GAAG,OAAO,IAAI;GACrC,QAAQ,CAER;EAGN;CACF;CAEA,iBACE,UAC0C;EAC1C,OAAO,QAAQ,uBACb,IAAI,MACF,0IAEF,CACF;CACF;AACF;;;;;;;;;;;;;;AAeA,SAAgB,eACd,OACA,SAA+B,CAAC,GACD;CAC/B,OAAO,IAAI,sBAAsB,QAAQ,KAAK;AAChD"}

package/dist/esm/provider-options.d.ts

@@ -26,5 +26,11 @@ export interface ClaudeCodeTextProviderOptions {
     disallowedTools?: Array<string>;
     /** Per-call override of the harness working directory. */
     cwd?: string;
+    /**
+     * `'api-key'` (default) injects `ANTHROPIC_API_KEY`.
+     * `'host'` uses `claude login`.
+     * Not inferred from the sandbox.
+     */
+    authMode?: 'host' | 'api-key';
 }
 export {};

package/dist/esm/stream/sdk-types.d.ts

@@ -71,6 +71,9 @@ export type SdkRawStreamEvent = {
     index: number;
     content_block: {
         type: string;
+        id?: string;
+        name?: string;
+        input?: unknown;
     };
 } | {
     type: 'content_block_delta';
@@ -79,6 +82,7 @@ export type SdkRawStreamEvent = {
         type: string;
         text?: string;
         thinking?: string;
+        partial_json?: string;
     };
 } | {
     type: 'content_block_stop';

package/dist/esm/stream/translate.d.ts

@@ -4,6 +4,12 @@ import { AgentSdkMessage } from './sdk-types.js';
 export declare const SESSION_ID_EVENT = "claude-code.session-id";
 /** Server name used for bridged TanStack tools (model sees `mcp__tanstack__<name>`). */
 export declare const BRIDGED_MCP_SERVER_NAME = "tanstack";
+/**
+ * Claude Code `--json-schema` injects a fake tool named StructuredOutput.
+ * The model "calls" it with the schema JSON. The result message may omit
+ * `structured_output`; harvest the tool input in that case.
+ */
+export declare const SYNTHETIC_STRUCTURED_OUTPUT_TOOL = "StructuredOutput";
 /** Claude Code-specific usage details attached to RUN_FINISHED usage. */
 export type ClaudeCodeProviderUsageDetails = {
     /** Total cost of the harness run in USD, as reported by Claude Code. */
@@ -19,6 +25,8 @@ export interface TranslateContext {
     onSessionId?: (sessionId: string) => void;
     /** Called for each raw SDK message, for logging. */
     onSdkMessage?: (message: AgentSdkMessage) => void;
+    /** Emit structured-output events from `result.structured_output`. */
+    expectStructuredOutput?: boolean;
 }
 /**
  * Strip the bridged MCP server prefix so tool-call events match the TanStack