@wix/pathgrade 1.0.25 → 1.0.26

package/dist/internal/direct-mcp-v2/claude-direct-mcp.js

@@ -0,0 +1,456 @@
+/* oxlint-disable anti-slop/no-unknown-parameters, anti-slop/no-runtime-typeof -- SDK messages and JSON-RPC responses are external trust boundaries. */
+import { randomBytes } from 'node:crypto';
+import { spawn as nodeSpawn } from 'node:child_process';
+import { mkdir, mkdtemp, realpath, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { createSdkMcpServer, query as sdkQuery, tool, } from '@anthropic-ai/claude-agent-sdk';
+import { z } from 'zod';
+import { createSandboxedClaudeSpawn } from '../../providers/sandboxed-claude-spawn.js';
+import { compileScenario } from './compiler.js';
+import { IdempotentTrialCleaner, persistTrialArtifact, TrialExecutionError, TrialResourceRegistry, scanBearerSurfaces } from './cleanup.js';
+import { PrivateReplayVault, replayPrivateEvidence, verifyEvidenceChain } from './evidence.js';
+import { ScenarioHostReducer } from './host-reducer.js';
+import { materializeProjection } from './materialize.js';
+import { projectEndpoints } from './projection.js';
+import { admitRuntimeProfile } from './runtime-profile.js';
+import { createInvocationBarrier, startScenarioHttpHost } from './scenario-http-host.js';
+import { CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE, CLAUDE_DIRECT_MCP_NORMALIZED_HANDSHAKE } from './claude-profile.js';
+export const CLAUDE_DIRECT_MCP_FLAG = 'PATHGRADE_INTERNAL_CLAUDE_DIRECT_MCP_V2';
+const disabledProfiles = new Map();
+export function isClaudeDirectMcpSelected(environment = process.env) {
+    const fingerprint = CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.profileFingerprint;
+    return environment[CLAUDE_DIRECT_MCP_FLAG] === '1' && !disabledProfiles.has(fingerprint);
+}
+export function claudeDirectMcpDisableReason() {
+    return disabledProfiles.get(CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.profileFingerprint);
+}
+/** Test-only reset for proving the fail-closed process latch. */
+// oxlint-disable-next-line inhuman/no-empty-wrappers -- This test seam exposes Map.clear without exposing mutable production state.
+export function __resetClaudeDirectMcpDisablementForTesting() {
+    disabledProfiles.clear();
+}
+export function mapClaudeProviderEnvironment(environment) {
+    const { APP_ANTHROPIC_API_KEY: appApiKey, APP_ANTHROPIC_BASE_URL: appBaseUrl, ...providerEnvironment } = environment;
+    const result = { ...providerEnvironment };
+    const apiKey = environment.ANTHROPIC_API_KEY ?? appApiKey;
+    const baseUrl = environment.ANTHROPIC_BASE_URL ?? appBaseUrl;
+    if (apiKey)
+        result.ANTHROPIC_API_KEY = apiKey;
+    if (baseUrl)
+        result.ANTHROPIC_BASE_URL = baseUrl;
+    return result;
+}
+export function assertClaudeProjectionIsolation(options) {
+    for (const record of options.records) {
+        const argv = record.args.join('\u0000');
+        const environment = Object.entries(record.environment).map(([name, value]) => `${name}=${value ?? ''}`).join('\u0000');
+        if (record.args.includes('--mcp-config'))
+            throw new Error('Claude child argv contained --mcp-config');
+        if (options.protectedValues.some((value) => value.length > 0 && (argv.includes(value) || environment.includes(value)))) {
+            throw new Error('Claude authenticated HTTP projection reached child argv or environment');
+        }
+    }
+    if (options.scans.some((entry) => entry.status !== 'clean'))
+        throw new Error('Claude authenticated HTTP projection reached a writable or unreadable surface');
+}
+export function createClaudeParentBridges(options) {
+    const bridges = {};
+    for (const projection of options.projections) {
+        if (projection.kind !== 'claude-parent-bridge')
+            throw new Error(`Unsupported Claude projection kind: ${projection.kind}`);
+        const { name, endpoint } = projection.server;
+        const declaredServer = options.artifact.canonicalIr.servers[name];
+        if (!declaredServer)
+            throw new Error(`Claude projection references undeclared server: ${name}`);
+        const tools = Object.entries(declaredServer.tools).map(([toolId, definition]) => {
+            const schema = z.fromJSONSchema(definition.inputSchema);
+            if (!(schema instanceof z.ZodObject))
+                throw new Error(`Claude tool schema is not an object: ${name}/${toolId}`);
+            // oxlint-disable-next-line anti-slop/no-shape-in-symbol-names -- `shape` is Zod's owned API for the field map required by the SDK tool helper.
+            return tool(toolId, definition.description, schema.shape, async (args, extra) => {
+                const signal = readAbortSignal(extra);
+                // SAFETY: Zod validated the SDK handler argument against the compiler-approved object schema immediately before invoking this handler.
+                const result = await forwardToolCall({ endpoint, serverId: name, toolId, args: args, signal });
+                options.observe?.({ serverId: name, toolId, result });
+                return result;
+            }, { alwaysLoad: true });
+        });
+        bridges[name] = createSdkMcpServer({ name, version: '2.0.0', alwaysLoad: true, tools });
+    }
+    return bridges;
+}
+export async function runClaudeDirectMcpTrial(options) {
+    const environment = options.environment ?? process.env;
+    const profile = CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE;
+    if (!isClaudeDirectMcpSelected(environment)) {
+        const reason = disabledProfiles.get(profile.profileFingerprint);
+        throw new Error(reason ? `Claude direct MCP disabled for admitted profile: ${reason}` : `${CLAUDE_DIRECT_MCP_FLAG} is disabled`);
+    }
+    try {
+        return await executeTrial({ ...options, environment });
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        disabledProfiles.set(profile.profileFingerprint, reason.slice(0, 500));
+        throw error;
+    }
+}
+async function executeTrial(options) {
+    const compiled = compileScenario(options.scenario);
+    if (!compiled.ok)
+        throw new Error(`Scenario compilation failed: ${JSON.stringify(compiled.diagnostics)}`);
+    const effectfulCase = findEffectfulSuccessCase(compiled.artifact);
+    const createdScratchParent = await mkdtemp(join(tmpdir(), 'pathgrade-claude-direct-mcp-'));
+    let scratchParent;
+    try {
+        scratchParent = await realpath(createdScratchParent);
+    }
+    catch (error) {
+        await rm(createdScratchParent, { recursive: true, force: true }).catch(() => undefined);
+        throw error;
+    }
+    const scratchPath = join(scratchParent, 'trial');
+    const workspacePath = join(scratchPath, 'workspace');
+    const homePath = join(scratchPath, 'home');
+    const tempPath = join(scratchPath, 'tmp');
+    try {
+        await mkdir(scratchPath);
+        await Promise.all([mkdir(workspacePath), mkdir(homePath), mkdir(tempPath)]);
+    }
+    catch (error) {
+        await rm(scratchParent, { recursive: true, force: true }).catch(() => undefined);
+        throw error;
+    }
+    const runtimeEnv = mapClaudeProviderEnvironment({ ...options.environment, HOME: homePath, TMPDIR: tempPath });
+    if (!runtimeEnv.ANTHROPIC_API_KEY) {
+        await rm(scratchParent, { recursive: true, force: true }).catch(() => undefined);
+        throw new Error('Claude live direct MCP requires ANTHROPIC_API_KEY (or APP_ANTHROPIC_API_KEY)');
+    }
+    const trialId = `claude-${randomBytes(12).toString('hex')}`;
+    const macKey = randomBytes(32);
+    const replayVault = new PrivateReplayVault(randomBytes(32));
+    const reducer = new ScenarioHostReducer(trialId, compiled.artifact, macKey, replayVault);
+    reducer.markCompiled();
+    const barrier = createInvocationBarrier(effectfulCase.caseId);
+    const host = await startScenarioHttpHost({ artifact: compiled.artifact, reducer, barrier, secretRef: 'claude-direct-mcp-trial-bearer' }).catch(async (error) => {
+        macKey.fill(0);
+        replayVault.dispose();
+        reducer.dispose();
+        await rm(scratchParent, { recursive: true, force: true }).catch(() => undefined);
+        throw error;
+    });
+    const registry = new TrialResourceRegistry();
+    let hostOpen = true;
+    let hostQuiescentBeforeCleanup = false;
+    registry.register({ opaqueId: 'scenario-host', kind: 'listener', close: async () => { await host.dispose(); hostOpen = false; }, isOpen: () => hostOpen });
+    registry.register({ opaqueId: 'scenario-transports', kind: 'transport', close: () => host.dispose(), isOpen: () => host.activeTransportCount() !== 0 });
+    const children = [];
+    const childRecords = [];
+    const childSpawn = (command, args, spawnOptions) => {
+        const child = nodeSpawn(command, args, { cwd: spawnOptions.cwd, env: spawnOptions.env, signal: spawnOptions.signal, stdio: ['pipe', 'pipe', 'pipe'] });
+        const index = children.push(child) - 1;
+        childRecords.push({ args: [command, ...args], environment: spawnOptions.env });
+        registry.register({ opaqueId: `claude-child-${index}`, kind: 'process', close: () => terminateChild(child), isOpen: () => child.exitCode === null });
+        return child;
+    };
+    const spawnClaudeCodeProcess = createSandboxedClaudeSpawn({ platform: process.platform, hostEnv: runtimeEnv, spawn: childSpawn });
+    const observations = [];
+    let persisted = false;
+    const cleaner = new IdempotentTrialCleaner({
+        registry,
+        scanRoots: [workspacePath, homePath, tempPath],
+        scratchPath,
+        approvedScratchParent: scratchParent,
+        bearer: host.bearer.toString(),
+        persistRedacted: async (report, phase) => {
+            if (!options.artifactDirectory) {
+                if (phase === 'final')
+                    persisted = true;
+                return;
+            }
+            const path = join(options.artifactDirectory, 'trial-evidence.json');
+            await mkdir(dirname(path), { recursive: true });
+            const value = { artifactDigest: compiled.artifact.artifactDigest, evidence: reducer.ledger.events(), cleanup: { ...report, scans: report.scans.map((entry) => ({ ...entry, path: entry.path.replace(scratchParent, '<scratch>') })) } };
+            await persistTrialArtifact(path, `${JSON.stringify(value)}\n`, phase);
+            if (phase === 'final')
+                persisted = true;
+        },
+        zeroBearer: () => { host.bearer.fill(0); macKey.fill(0); replayVault.dispose(); },
+    });
+    try {
+        const admission = await admitRuntimeProfile(CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE, {
+            provider: 'claude',
+            platform: process.platform,
+            architecture: process.arch,
+            environment: runtimeEnv,
+            forbiddenSecrets: [host.bearer.toString(), `Bearer ${host.bearer.toString()}`],
+            initializeControlPlane: async () => {
+                await options.initializeControlPlane?.();
+                if (typeof createSdkMcpServer !== 'function' || typeof (options.query ?? sdkQuery) !== 'function')
+                    throw new Error('Claude SDK parent bridge methods unavailable');
+                return { normalizedHandshake: CLAUDE_DIRECT_MCP_NORMALIZED_HANDSHAKE, capabilities: CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.requiredCapabilities, close: async () => undefined };
+            },
+        });
+        if (!admission.ok)
+            throw new Error(`RUNTIME_NOT_ADMITTED: ${admission.reason}`);
+        reducer.markAdmitted();
+        const projected = projectEndpoints(host.endpoints, admission.profile);
+        if (!Array.isArray(projected))
+            throw new Error(`Projection rejected: ${projected.reason}`);
+        const materialized = projected.map((plan) => materializeProjection(plan, {
+            resolve(secretRef) {
+                if (secretRef !== host.secretRef)
+                    throw new Error(`Unknown secret reference: ${secretRef}`);
+                return `Bearer ${host.bearer.toString()}`;
+            },
+        }));
+        const bridges = createClaudeParentBridges({ artifact: compiled.artifact, projections: materialized, observe: (entry) => observations.push(entry) });
+        for (const [name, bridge] of Object.entries(bridges)) {
+            let open = true;
+            registry.register({ opaqueId: `claude-sdk-bridge-${name}`, kind: 'transport', close: async () => { await bridge.instance.close(); open = false; }, isOpen: () => open });
+        }
+        reducer.markReady();
+        const query = options.query ?? sdkQuery;
+        const queryOptions = { query, runtimeEnv, workspacePath, model: options.model, profilePath: CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.command.absolutePath, mcpServers: bridges, spawnClaudeCodeProcess };
+        reducer.beginTurn('direct-call', 'claude');
+        const normal = await runQuery(queryOptions, `Invoke mcp__demo__${effectfulCase.pureToolId} exactly once with ${JSON.stringify(effectfulCase.pureArgs)}, then invoke mcp__demo__${effectfulCase.effectfulToolId} exactly once with ${JSON.stringify(effectfulCase.errorArgs)}. Wait for both results and do not use any other tool.`);
+        if (normal.status !== 'success')
+            throw new Error(`Claude direct MCP success/error turn ended as ${normal.status}`);
+        if (!observations.some((entry) => entry.toolId === effectfulCase.pureToolId && entry.result.isError !== true))
+            throw new Error('Claude parent bridge did not preserve direct MCP success');
+        if (!observations.some((entry) => entry.toolId === effectfulCase.effectfulToolId && entry.result.isError === true && readPathgradeCode(entry.result) !== undefined))
+            throw new Error('Claude parent bridge did not preserve structured scenario tool error');
+        reducer.finalize('settled');
+        reducer.beginTurn('cancelled-turn', 'claude');
+        const controller = new AbortController();
+        const cancelled = runQuery({ ...queryOptions, abortController: controller, resume: normal.sessionId }, `Invoke mcp__demo__${effectfulCase.effectfulToolId} exactly once with ${JSON.stringify(effectfulCase.successArgs)}. Wait for its result and do not use any other tool.`);
+        const entered = await withTimeout(Promise.race([barrier.reached().then(() => 'barrier'), cancelled.then((result) => `terminal:${result.status}`)]), 90_000, 'Claude produced neither a blocking MCP invocation nor a terminal');
+        if (entered !== 'barrier')
+            throw new Error(`Claude reached ${entered} before the blocking MCP transition`);
+        reducer.fence();
+        controller.abort();
+        reducer.abortUncommitted('provider-cancelled');
+        barrier.release();
+        const cancellation = await withTimeout(cancelled, 45_000, 'Claude cancelled query');
+        await host.waitForQuiescence(30_000);
+        hostQuiescentBeforeCleanup = host.activeTransportCount() === 0;
+        if (!hostQuiescentBeforeCleanup)
+            throw new Error('Scenario host was not quiescent after Claude cancellation');
+        if (!cancellation.cancelled)
+            throw new Error(`Claude cancellation terminal was ${cancellation.status}`);
+        reducer.observeProviderTerminal();
+        reducer.finalize('cancelled-clean');
+        reducer.beginTurn('post-cancel-reuse', 'claude');
+        const reused = await runQuery({ ...queryOptions, resume: normal.sessionId }, `Invoke mcp__demo__${effectfulCase.effectfulToolId} exactly once with ${JSON.stringify(effectfulCase.successArgs)}. Wait for its result and do not use any other tool.`);
+        if (reused.status !== 'success' || !observations.some((entry) => entry.toolId === effectfulCase.effectfulToolId && entry.result.isError !== true))
+            throw new Error('Post-cancel Claude parent bridge reuse failed');
+        reducer.finalize('settled');
+        const replay = replayPrivateEvidence({ artifact: compiled.artifact, evidence: reducer.ledger.events(), vault: replayVault, macKey });
+        if (!replay.ok || replay.poisoned || replay.finalState !== reducer.state)
+            throw new Error(`Private replay failed: ${replay.ok ? 'state mismatch' : replay.reason}`);
+        const chain = verifyEvidenceChain(reducer.ledger.events(), compiled.artifact.artifactDigest);
+        if (!chain.ok)
+            throw new Error(`Evidence chain failed: ${chain.reason}`);
+        const protectedValues = [host.bearer.toString(), `Bearer ${host.bearer.toString()}`, ...host.endpoints.map((endpoint) => endpoint.url)];
+        const projectionScans = (await Promise.all(protectedValues.map((value) => scanBearerSurfaces([workspacePath, homePath, tempPath], value)))).flat();
+        assertClaudeProjectionIsolation({ records: childRecords, scans: projectionScans, protectedValues });
+        reducer.dispose();
+        const cleanup = await cleaner.dispose();
+        await rm(scratchParent, { recursive: true, force: true });
+        if (!persisted || cleanup.failures.length > 0 || cleanup.bearerFound || !cleanup.scratchDeleted)
+            throw new Error(`CLEANUP_FAILED: ${JSON.stringify(cleanup.failures)}`);
+        return {
+            selected: true,
+            profileFingerprint: CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.profileFingerprint,
+            artifact: compiled.artifact,
+            evidence: reducer.ledger.events(),
+            checks: { runtimeAdmitted: true, secretFreeProject: true, directCall: true, structuredToolError: true, fencedCancellation: true, providerTerminal: true, hostQuiescent: hostQuiescentBeforeCleanup, postCancelReuse: true, privateReplay: true, cleanup: true },
+            cleanup,
+            cancellationStatus: cancellation.status,
+        };
+    }
+    catch (error) {
+        barrier.release();
+        try {
+            if (reducer.phase === 'ACTIVE')
+                reducer.fence();
+            if (reducer.phase === 'FENCING')
+                reducer.abortUncommitted('trial-failed');
+            if (!['DISPOSED', 'NEW', 'COMPILED', 'ADMITTED'].includes(reducer.phase))
+                reducer.finalize('poisoned', 'trial-failed');
+        }
+        catch (lifecycleFailure) {
+            void lifecycleFailure;
+        }
+        reducer.dispose();
+        let cleanupError;
+        try {
+            const report = await cleaner.dispose();
+            if (report.failures.length > 0 || report.bearerFound || !report.scratchDeleted)
+                cleanupError = new Error(`CLEANUP_FAILED: ${JSON.stringify(report.failures)}`);
+        }
+        catch (failure) {
+            cleanupError = failure instanceof Error ? failure : new Error(String(failure));
+        }
+        await rm(scratchParent, { recursive: true, force: true }).catch(() => undefined);
+        if (cleanupError)
+            throw new TrialExecutionError(error instanceof Error ? error.message : 'Claude direct MCP trial failed', { primary: error, secondary: [cleanupError] });
+        throw error;
+    }
+}
+async function forwardToolCall(options) {
+    const response = await fetch(options.endpoint.url, {
+        method: 'POST',
+        headers: { Authorization: options.endpoint.headers[0].value, accept: 'application/json, text/event-stream', 'content-type': 'application/json' },
+        body: JSON.stringify({ jsonrpc: '2.0', id: `${options.serverId}:${options.toolId}:${randomBytes(8).toString('hex')}`, method: 'tools/call', params: { name: options.toolId, arguments: options.args } }),
+        signal: options.signal,
+    });
+    if (!response.ok)
+        throw new Error(`Scenario host returned HTTP ${response.status}`);
+    const message = await readJsonRpcResponse(response);
+    if (message.error)
+        throw new Error(`Scenario host JSON-RPC ${String(message.error.code)}: ${String(message.error.message)}`);
+    if (!message.result)
+        throw new Error('Scenario host returned an invalid MCP tool result');
+    return message.result;
+}
+async function readJsonRpcResponse(response) {
+    if (!response.headers.get('content-type')?.includes('text/event-stream'))
+        return parseJsonRpcToolResponse(await response.json());
+    const messages = [];
+    for (const line of (await response.text()).split(/\r?\n/)) {
+        if (line.startsWith('data:'))
+            messages.push(parseJsonRpcToolResponse(JSON.parse(line.slice(5).trim())));
+    }
+    const message = messages.find((entry) => entry.result !== undefined || entry.error !== undefined);
+    if (message === undefined)
+        throw new Error('Scenario host returned no JSON-RPC message in its event stream');
+    return message;
+}
+function parseJsonRpcToolResponse(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Scenario host returned an invalid JSON-RPC response');
+    if ('error' in value) {
+        const error = value.error;
+        if (error === null || typeof error !== 'object' || Array.isArray(error))
+            throw new Error('Scenario host returned an invalid JSON-RPC error');
+        return { error: { code: 'code' in error && (typeof error.code === 'string' || typeof error.code === 'number') ? error.code : undefined, message: 'message' in error && typeof error.message === 'string' ? error.message : undefined } };
+    }
+    if (!('result' in value) || value.result === null || typeof value.result !== 'object' || Array.isArray(value.result) || !('content' in value.result) || !Array.isArray(value.result.content)) {
+        throw new Error('Scenario host returned an invalid MCP tool result');
+    }
+    // SAFETY: the MCP boundary check above establishes the required CallToolResult content array; optional fields remain provider-owned JSON.
+    return { result: value.result };
+}
+async function runQuery(options, prompt) {
+    const allow = async (_toolName, input) => ({ behavior: 'allow', updatedInput: input });
+    const sdkOptions = {
+        cwd: options.workspacePath,
+        env: options.runtimeEnv,
+        maxTurns: 8,
+        maxBudgetUsd: 0.25,
+        systemPrompt: 'Follow the direct MCP contract instruction exactly. Do not use shell, file, web, or unrelated tools.',
+        settingSources: [],
+        permissionMode: 'default',
+        allowedTools: Object.keys(options.mcpServers).flatMap((serverId) => [`mcp__${serverId}__inspect`, `mcp__${serverId}__advance`]),
+        canUseTool: allow,
+        mcpServers: options.mcpServers,
+        strictMcpConfig: true,
+        persistSession: true,
+        abortController: options.abortController,
+        pathToClaudeCodeExecutable: options.profilePath,
+        spawnClaudeCodeProcess: options.spawnClaudeCodeProcess,
+    };
+    if (options.resume)
+        sdkOptions.resume = options.resume;
+    const model = options.model ?? options.runtimeEnv.PATHGRADE_DIRECT_MCP_CLAUDE_MODEL ?? 'claude-haiku-4-5-20251001';
+    if (model)
+        sdkOptions.model = model;
+    let sessionId;
+    let status = 'missing-result';
+    try {
+        for await (const message of options.query({ prompt, options: sdkOptions })) {
+            if (message.session_id)
+                sessionId = message.session_id;
+            if (message.type === 'result')
+                status = message.subtype;
+        }
+        return { status, cancelled: status === 'error_during_execution' || status === 'error_max_turns', sessionId };
+    }
+    catch (error) {
+        const name = error instanceof Error ? error.name : '';
+        const text = error instanceof Error ? error.message : String(error);
+        const cancelled = name === 'AbortError' || name === 'CLAUDE_CODE_PROCESS_ERROR' || text === 'Claude Code process aborted by user';
+        if (!cancelled)
+            throw error;
+        return { status: text || name || 'aborted', cancelled: true, sessionId };
+    }
+}
+function readAbortSignal(extra) {
+    if (extra === null || typeof extra !== 'object' || !('signal' in extra) || !(extra.signal instanceof AbortSignal))
+        return undefined;
+    return extra.signal;
+}
+function readPathgradeCode(result) {
+    const structured = result.structuredContent;
+    if (!structured || typeof structured.pathgrade !== 'object' || structured.pathgrade === null || Array.isArray(structured.pathgrade) || !('code' in structured.pathgrade))
+        return undefined;
+    return typeof structured.pathgrade.code === 'string' ? structured.pathgrade.code : undefined;
+}
+function findEffectfulSuccessCase(artifact) {
+    const state = artifact.canonicalIr.states[artifact.canonicalIr.initialState];
+    const entries = Object.entries(state.tools);
+    const effectful = entries.find(([, candidate]) => candidate.effectful && candidate.cases.some((entry) => entry.transition && entry.outcome.kind === 'success' && 'exactArgs' in entry.when));
+    const error = entries.find(([, candidate]) => candidate.cases.some((entry) => entry.outcome.kind === 'tool-error' && 'exactArgs' in entry.when));
+    const pure = entries.find(([, candidate]) => !candidate.effectful && candidate.cases.some((entry) => entry.outcome.kind === 'success'));
+    if (!effectful || !error || !pure)
+        throw new Error('Claude vertical requires an effectful success, structured error, and pure success in the initial state');
+    const successCase = effectful[1].cases.find((entry) => entry.transition && entry.outcome.kind === 'success' && 'exactArgs' in entry.when);
+    const errorCase = error[1].cases.find((entry) => entry.outcome.kind === 'tool-error' && 'exactArgs' in entry.when);
+    const pureCase = pure[1].cases.find((entry) => entry.outcome.kind === 'success');
+    return {
+        caseId: successCase.id,
+        effectfulToolId: effectful[0].split('/')[1],
+        successArgs: 'exactArgs' in successCase.when ? successCase.when.exactArgs : {},
+        errorArgs: 'exactArgs' in errorCase.when ? errorCase.when.exactArgs : {},
+        pureToolId: pure[0].split('/')[1],
+        pureArgs: 'exactArgs' in pureCase.when ? pureCase.when.exactArgs : deriveArgs(pureCase.when.all),
+    };
+}
+function deriveArgs(predicates) {
+    const result = {};
+    for (const predicate of predicates)
+        if (predicate.pointer.startsWith('/') && 'equals' in predicate)
+            result[predicate.pointer.slice(1)] = predicate.equals;
+    return result;
+}
+async function terminateChild(child) {
+    if (child.exitCode !== null)
+        return;
+    child.kill('SIGTERM');
+    if (await waitForExit(child, 2_000))
+        return;
+    child.kill('SIGKILL');
+    if (!await waitForExit(child, 2_000))
+        throw new Error('Claude child did not exit after SIGKILL');
+}
+async function waitForExit(child, timeoutMs) {
+    if (child.exitCode !== null)
+        return true;
+    return new Promise((resolve) => {
+        const onExit = () => { clearTimeout(timer); resolve(true); };
+        const timer = setTimeout(() => { child.off('exit', onExit); resolve(false); }, timeoutMs);
+        child.once('exit', onExit);
+    });
+}
+async function withTimeout(promise, timeoutMs, message) {
+    let timer;
+    try {
+        return await Promise.race([promise, new Promise((_resolve, reject) => { timer = setTimeout(() => reject(new Error(message)), timeoutMs); })]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}

package/dist/internal/direct-mcp-v2/claude-profile.d.ts

@@ -0,0 +1,9 @@
+import type { RuntimeLock } from './runtime-lock.js';
+import type { JsonObject, RuntimeCapabilityProfile } from './types.js';
+export declare const CLAUDE_DIRECT_MCP_NORMALIZED_HANDSHAKE: JsonObject;
+/** Reviewed macOS arm64 pin captured by RFC 0006. Other platforms fail closed. */
+export declare const CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE: RuntimeCapabilityProfile;
+/** Code-owned relocatable identity lock for the admitted public Claude SDK slice. */
+export declare const CLAUDE_DIRECT_MCP_DARWIN_ARM64_LOCK: RuntimeLock;
+/** Resolve the bundled platform binary relative to the installed SDK package. */
+export declare function resolveClaudeScenarioExecutable(): Promise<string>;

package/dist/internal/direct-mcp-v2/claude-profile.js

@@ -0,0 +1,97 @@
+import { access, realpath } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+export const CLAUDE_DIRECT_MCP_NORMALIZED_HANDSHAKE = {
+    normalizerVersion: 1,
+    provider: 'claude',
+    sdkVersion: '0.2.141',
+    controlPlane: 'native-sdk-parent-bridge',
+    streamableHttp: true,
+    controlPlaneHeaders: true,
+    parentOwnedSdkMcp: true,
+    cancellation: 'abort-controller',
+    sdkMethods: ['createSdkMcpServer', 'query'],
+};
+/** Reviewed macOS arm64 pin captured by RFC 0006. Other platforms fail closed. */
+export const CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE = {
+    format: 'pathgrade-direct-mcp-runtime-profile-v1',
+    provider: 'claude',
+    platform: 'darwin',
+    architecture: 'arm64',
+    controlPlane: 'native-sdk-parent-bridge',
+    command: {
+        absolutePath: '/Users/nadavlac/projects/agent-evals/node_modules/@anthropic-ai/claude-agent-sdk-darwin-arm64/claude',
+        args: [],
+        versionArgs: ['--version'],
+    },
+    expectedVersion: '2.1.141 (Claude Code)',
+    artifacts: [
+        {
+            label: 'claude-agent-sdk-0.2.141',
+            absolutePath: '/Users/nadavlac/projects/agent-evals/node_modules/@anthropic-ai/claude-agent-sdk/sdk.mjs',
+            sha256: '48bde6aeabf7e71ad5528bf52c8feb1642c21f505ea2495c70f39db7df226d97',
+        },
+        {
+            label: 'claude-code-bundled-2.1.141',
+            absolutePath: '/Users/nadavlac/projects/agent-evals/node_modules/@anthropic-ai/claude-agent-sdk-darwin-arm64/claude',
+            sha256: '31ac95bb19a33b1d0cddd3f3ff594bf8bfd2be5051cd2af7867109641cab705e',
+        },
+        {
+            label: 'zod-4.3.6-commonjs-entry',
+            absolutePath: '/Users/nadavlac/projects/agent-evals/node_modules/zod/index.cjs',
+            sha256: '2a3455cecff4f7021c92d0a3e2e5fc170c0448dc5cc261160127e08f4888a9c2',
+        },
+    ],
+    requiredCapabilities: {
+        streamableHttp: true,
+        controlPlaneHeaders: true,
+        parentOwnedSdkMcp: true,
+        cancellation: 'abort-controller',
+    },
+    profileFingerprint: '463d1485d70e542cf2a356cae007469a7d94d0e848a26d9e9b7470dbc5262104',
+    runtimeCapabilityFingerprint: '990b779b75145c8d7bcc8cfebcb5b9c1aae30eb1436393b38e7e997941ecc162',
+};
+/** Code-owned relocatable identity lock for the admitted public Claude SDK slice. */
+export const CLAUDE_DIRECT_MCP_DARWIN_ARM64_LOCK = {
+    format: 'pathgrade-direct-mcp-runtime-lock-v1',
+    provider: 'claude',
+    platform: 'darwin',
+    architecture: 'arm64',
+    controlPlane: 'native-sdk-parent-bridge',
+    version: CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.expectedVersion,
+    commandArtifact: 'claude-code-bundled-2.1.141',
+    args: CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.command.args,
+    versionArgs: CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.command.versionArgs,
+    artifacts: [
+        {
+            id: 'claude-agent-sdk-0.2.141',
+            relativePath: '@anthropic-ai/claude-agent-sdk/sdk.mjs',
+            sha256: CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.artifacts[0].sha256,
+        },
+        {
+            id: 'claude-code-bundled-2.1.141',
+            relativePath: '@anthropic-ai/claude-agent-sdk-darwin-arm64/claude',
+            sha256: CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.artifacts[1].sha256,
+        },
+        {
+            id: 'zod-4.3.6-commonjs-entry',
+            relativePath: 'zod/index.cjs',
+            sha256: CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.artifacts[2].sha256,
+        },
+    ],
+    capabilities: CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.requiredCapabilities,
+    normalizedHandshakeSha256: CLAUDE_DIRECT_MCP_DARWIN_ARM64_PROFILE.runtimeCapabilityFingerprint,
+};
+/** Resolve the bundled platform binary relative to the installed SDK package. */
+export async function resolveClaudeScenarioExecutable() {
+    const sdkEntry = createRequire(import.meta.url).resolve('@anthropic-ai/claude-agent-sdk');
+    const candidate = join(dirname(sdkEntry), '..', 'claude-agent-sdk-darwin-arm64', 'claude');
+    try {
+        await access(candidate, constants.X_OK);
+        return realpath(candidate);
+    }
+    catch {
+        throw new Error('RUNTIME_NOT_ADMITTED: no bundled Claude executable was discovered');
+    }
+}

package/dist/internal/direct-mcp-v2/cleanup.d.ts

@@ -0,0 +1,62 @@
+export type TrackedResource = {
+    opaqueId: string;
+    kind: 'process' | 'descriptor' | 'socket' | 'listener' | 'transport' | 'invocation' | 'auth-copy';
+    close(): Promise<void>;
+    isOpen(): boolean;
+};
+export type ScanEntry = {
+    path: string;
+    status: 'clean' | 'bearer-found' | 'unreadable' | 'skipped';
+    reason?: string;
+};
+export type CleanupReport = {
+    scans: ScanEntry[];
+    released: string[];
+    failures: {
+        opaqueId: string;
+        reason: string;
+    }[];
+    scratchDeleted: boolean;
+    bearerFound: boolean;
+};
+export type TrialArtifactPhase = 'provisional' | 'final';
+export declare function persistTrialArtifact(path: string, content: string, phase: TrialArtifactPhase): Promise<void>;
+export declare class TrialResourceRegistry {
+    private readonly resources;
+    register(resource: TrackedResource): void;
+    entries(): readonly TrackedResource[];
+}
+export declare function scanBearerSurfaces(roots: readonly string[], bearer: string): Promise<ScanEntry[]>;
+export declare function cleanupTrial(options: {
+    registry: TrialResourceRegistry;
+    scanRoots: readonly string[];
+    scratchPath: string;
+    approvedScratchParent: string;
+    bearer: string;
+    persistRedacted(report: CleanupReport, phase: TrialArtifactPhase): Promise<void>;
+    zeroBearer?(): void;
+    removeScratch?(path: string): Promise<void>;
+}): Promise<CleanupReport>;
+export declare class IdempotentTrialCleaner {
+    private readonly options;
+    private result?;
+    constructor(options: Parameters<typeof cleanupTrial>[0]);
+    dispose(): Promise<CleanupReport>;
+}
+export declare class TrialExecutionError extends Error {
+    constructor(message: string, options: {
+        primary?: unknown;
+        secondary: readonly unknown[];
+    });
+    readonly secondary: readonly unknown[];
+}
+export declare function runWithUnconditionalSettlement<T>(options: {
+    sendTurn(): Promise<T>;
+    finalize(input: {
+        providerResult?: T;
+        providerError?: unknown;
+        cancellationRequested: boolean;
+    }): Promise<void>;
+    cleanup(): Promise<void>;
+    cancellationRequested?: boolean;
+}): Promise<T>;