@workbench-ai/agent-driver-anthropic-claude-code 0.0.44

package/dist/workbench-auth.d.ts

@@ -0,0 +1,69 @@
+export declare const CLAUDE_CODE_OAUTH_TOKEN_ENV = "CLAUDE_CODE_OAUTH_TOKEN";
+export interface ClaudeWorkbenchProviderAuthEnvVar {
+    name: string;
+    value: string;
+}
+export interface ClaudeWorkbenchBedrockEnvCollection {
+    entries: ClaudeWorkbenchProviderAuthEnvVar[];
+    missing: string[];
+}
+export interface ClaudeWorkbenchBedrockConnectEnvOptions {
+    env?: Record<string, string | undefined>;
+    flags?: Record<string, string | undefined>;
+    runCommand?: (command: string, args: readonly string[], env: Record<string, string | undefined>) => Promise<string>;
+}
+export declare const claudeWorkbenchProviderAuth: {
+    readonly apiKey: {
+        readonly envName: "ANTHROPIC_API_KEY";
+    };
+    readonly profile: {
+        readonly required: readonly [".claude.json"];
+        readonly optional: readonly [".claude/oauth-token", ".claude/.credentials.json"];
+        readonly alternatives: readonly [readonly [".claude/oauth-token", ".claude/.credentials.json"]];
+    };
+    readonly oauthToken: {
+        readonly envName: "CLAUDE_CODE_OAUTH_TOKEN";
+        readonly relativePath: ".claude/oauth-token";
+        readonly parse: typeof parseClaudeSetupTokenOutput;
+        readonly setup: {
+            readonly command: "claude";
+            readonly args: readonly ["setup-token"];
+            readonly prompt: "Claude Code needs a portable OAuth token for Workbench sandboxes. Starting `claude setup-token`.";
+            readonly envDenylist: readonly ["CLAUDE_CODE_OAUTH_TOKEN"];
+        };
+    };
+    readonly envAuth: {
+        readonly bedrock: {
+            readonly envAllowlist: readonly ["CLAUDE_CODE_USE_BEDROCK", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_BEARER_TOKEN_BEDROCK", "ANTHROPIC_MODEL", "ANTHROPIC_SMALL_FAST_MODEL"];
+            readonly collect: typeof collectClaudeWorkbenchBedrockEnv;
+            readonly collectFromConnectEnvironment: typeof collectClaudeWorkbenchBedrockConnectEnv;
+        };
+    };
+    readonly harnessDefaults: {
+        readonly config: {
+            readonly max_turns: 64;
+            readonly permission_mode: "bypassPermissions";
+        };
+    };
+    readonly toHarnessAuth: (auth: {
+        kind: "profile" | "api_key" | "bedrock";
+        root?: string;
+    }) => {
+        strategy: string;
+        ref: string;
+        path?: undefined;
+    } | {
+        strategy: string;
+        ref?: undefined;
+        path?: undefined;
+    } | {
+        strategy: string;
+        path: string;
+        ref?: undefined;
+    } | null;
+    readonly staleErrorPatterns: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
+};
+export declare function collectClaudeWorkbenchBedrockEnv(env: Record<string, string | undefined>): ClaudeWorkbenchBedrockEnvCollection;
+export declare function collectClaudeWorkbenchBedrockConnectEnv({ env, flags, runCommand, }?: ClaudeWorkbenchBedrockConnectEnvOptions): Promise<Record<string, string | undefined>>;
+export declare function parseClaudeSetupTokenOutput(output: string): string | null;
+//# sourceMappingURL=workbench-auth.d.ts.map

package/dist/workbench-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workbench-auth.d.ts","sourceRoot":"","sources":["../src/workbench-auth.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mCAAmC;IAClD,OAAO,EAAE,iCAAiC,EAAE,CAAC;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,uCAAuC;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3C,UAAU,CAAC,EAAE,CACX,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KACpC,OAAO,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA4ClB;QAClB,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;QACxC,IAAI,CAAC,EAAE,MAAM,CAAC;KACf;;;;;;;;;;;;;;CAkCO,CAAC;AAEX,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,mCAAmC,CA6BrC;AAED,wBAAsB,uCAAuC,CAAC,EAC5D,GAAiB,EACjB,KAAU,EACV,UAA8B,GAC/B,GAAE,uCAA4C,GAAG,OAAO,CACvD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CACnC,CAgCA;AAsFD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA0BzE"}

package/dist/workbench-auth.js

@@ -0,0 +1,212 @@
+import { spawn } from "node:child_process";
+export const CLAUDE_CODE_OAUTH_TOKEN_ENV = "CLAUDE_CODE_OAUTH_TOKEN";
+export const claudeWorkbenchProviderAuth = {
+    apiKey: {
+        envName: "ANTHROPIC_API_KEY",
+    },
+    profile: {
+        required: [".claude.json"],
+        optional: [".claude/oauth-token", ".claude/.credentials.json"],
+        alternatives: [[".claude/oauth-token", ".claude/.credentials.json"]],
+    },
+    oauthToken: {
+        envName: CLAUDE_CODE_OAUTH_TOKEN_ENV,
+        relativePath: ".claude/oauth-token",
+        parse: parseClaudeSetupTokenOutput,
+        setup: {
+            command: "claude",
+            args: ["setup-token"],
+            prompt: "Claude Code needs a portable OAuth token for Workbench sandboxes. Starting `claude setup-token`.",
+            envDenylist: [CLAUDE_CODE_OAUTH_TOKEN_ENV],
+        },
+    },
+    envAuth: {
+        bedrock: {
+            envAllowlist: [
+                "CLAUDE_CODE_USE_BEDROCK",
+                "AWS_ACCESS_KEY_ID",
+                "AWS_SECRET_ACCESS_KEY",
+                "AWS_SESSION_TOKEN",
+                "AWS_REGION",
+                "AWS_DEFAULT_REGION",
+                "AWS_BEARER_TOKEN_BEDROCK",
+                "ANTHROPIC_MODEL",
+                "ANTHROPIC_SMALL_FAST_MODEL",
+            ],
+            collect: collectClaudeWorkbenchBedrockEnv,
+            collectFromConnectEnvironment: collectClaudeWorkbenchBedrockConnectEnv,
+        },
+    },
+    harnessDefaults: {
+        config: {
+            max_turns: 64,
+            permission_mode: "bypassPermissions",
+        },
+    },
+    toHarnessAuth(auth) {
+        if (auth.kind === "api_key") {
+            return {
+                strategy: "secret_ref",
+                ref: "ANTHROPIC_API_KEY",
+            };
+        }
+        if (auth.kind === "bedrock") {
+            return {
+                strategy: "bedrock_env",
+            };
+        }
+        if (!auth.root) {
+            return null;
+        }
+        return {
+            strategy: "profile_path",
+            path: auth.root,
+        };
+    },
+    staleErrorPatterns: [
+        /not logged in/iu,
+        /login required/iu,
+        /authentication required/iu,
+        /failed to authenticate/iu,
+        /authentication_error/iu,
+        /api error:\s*401/iu,
+        /invalid.*session/iu,
+        /invalid bearer token/iu,
+        /session.*expired/iu,
+        /oauth.*expired/iu,
+        /unauthorized/iu,
+        /claude_code_oauth_token/iu,
+    ],
+};
+export function collectClaudeWorkbenchBedrockEnv(env) {
+    const usesBearerToken = Boolean(env.AWS_BEARER_TOKEN_BEDROCK?.trim());
+    const required = usesBearerToken
+        ? []
+        : ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
+    const missing = required.filter((name) => !env[name]?.trim());
+    const region = env.AWS_REGION?.trim() || env.AWS_DEFAULT_REGION?.trim();
+    if (!region) {
+        missing.push("AWS_REGION");
+    }
+    const entries = [
+        {
+            name: "CLAUDE_CODE_USE_BEDROCK",
+            value: "1",
+        },
+    ];
+    for (const name of claudeWorkbenchProviderAuth.envAuth.bedrock.envAllowlist) {
+        if (name === "CLAUDE_CODE_USE_BEDROCK") {
+            continue;
+        }
+        const value = env[name]?.trim();
+        if (value) {
+            entries.push({ name, value });
+        }
+    }
+    if (!entries.some((entry) => entry.name === "AWS_REGION") && region) {
+        entries.push({ name: "AWS_REGION", value: region });
+    }
+    return { entries, missing };
+}
+export async function collectClaudeWorkbenchBedrockConnectEnv({ env = process.env, flags = {}, runCommand = runCommandCapture, } = {}) {
+    const profile = flags["aws-profile"] ?? env.AWS_PROFILE;
+    const region = flags["aws-region"] ?? env.AWS_REGION ?? env.AWS_DEFAULT_REGION;
+    const direct = {
+        CLAUDE_CODE_USE_BEDROCK: "1",
+        AWS_ACCESS_KEY_ID: env.AWS_ACCESS_KEY_ID,
+        AWS_SECRET_ACCESS_KEY: env.AWS_SECRET_ACCESS_KEY,
+        AWS_SESSION_TOKEN: env.AWS_SESSION_TOKEN,
+        AWS_REGION: region,
+        AWS_DEFAULT_REGION: env.AWS_DEFAULT_REGION,
+        AWS_BEARER_TOKEN_BEDROCK: env.AWS_BEARER_TOKEN_BEDROCK,
+        ANTHROPIC_MODEL: env.ANTHROPIC_MODEL,
+        ANTHROPIC_SMALL_FAST_MODEL: env.ANTHROPIC_SMALL_FAST_MODEL,
+    };
+    if (direct.AWS_BEARER_TOKEN_BEDROCK ||
+        (direct.AWS_ACCESS_KEY_ID && direct.AWS_SECRET_ACCESS_KEY)) {
+        return direct;
+    }
+    if (!profile) {
+        return direct;
+    }
+    const profileRegion = region
+        ? undefined
+        : await exportAwsProfileRegion(profile, env, runCommand);
+    return {
+        ...direct,
+        ...(await exportAwsProfileCredentials(profile, env, runCommand)),
+        AWS_REGION: region ?? profileRegion,
+    };
+}
+async function exportAwsProfileCredentials(profile, env, runCommand) {
+    const output = await runCommand("aws", [
+        "configure",
+        "export-credentials",
+        "--format",
+        "env-no-export",
+        "--profile",
+        profile,
+    ], env);
+    const exported = {};
+    for (const line of output.split(/\r?\n/u)) {
+        const match = line.match(/^([A-Z0-9_]+)=(.*)$/u);
+        if (match) {
+            exported[match[1]] = match[2];
+        }
+    }
+    return exported;
+}
+async function exportAwsProfileRegion(profile, env, runCommand) {
+    const output = await runCommand("aws", ["configure", "get", "region", "--profile", profile], env).catch(() => "");
+    const region = output.trim();
+    return region.length > 0 ? region : undefined;
+}
+async function runCommandCapture(command, args, env) {
+    return await new Promise((resolve, reject) => {
+        const child = spawn(command, [...args], {
+            stdio: ["ignore", "pipe", "pipe"],
+            env: { ...process.env, ...env },
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout?.setEncoding("utf8");
+        child.stderr?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk;
+        });
+        child.on("error", reject);
+        child.on("exit", (code, signal) => {
+            if (code === 0) {
+                resolve(stdout);
+                return;
+            }
+            reject(new Error(`${command} ${args.join(" ")} exited with code ${code ?? "null"} signal ${signal ?? "null"}${stderr.trim() ? `: ${stderr.trim()}` : ""}.`));
+        });
+    });
+}
+export function parseClaudeSetupTokenOutput(output) {
+    const lines = output
+        .replace(/\x1B\[[0-?]*[ -/]*[@-~]/gu, "")
+        .replace(/\r/gu, "")
+        .split("\n");
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index]?.trim();
+        const firstSegment = line?.match(/sk-ant-oat\d{2}-[A-Za-z0-9_-]*/iu)?.[0];
+        if (!firstSegment) {
+            continue;
+        }
+        const segments = [firstSegment];
+        for (let continuationIndex = index + 1; continuationIndex < lines.length; continuationIndex += 1) {
+            const continuation = lines[continuationIndex]?.trim();
+            if (!continuation || !/^[A-Za-z0-9_-]+$/u.test(continuation)) {
+                break;
+            }
+            segments.push(continuation);
+        }
+        return segments.join("");
+    }
+    return null;
+}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@workbench-ai/agent-driver-anthropic-claude-code",
+  "version": "0.0.44",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/workbench-ai/workbench-monorepo.git",
+    "directory": "products/agent-drivers/packages/anthropic-claude-code"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./workbench-auth": {
+      "types": "./dist/workbench-auth.d.ts",
+      "default": "./dist/workbench-auth.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "zod": "^4.1.5",
+    "@workbench-ai/agent-driver": "0.0.44"
+  },
+  "devDependencies": {
+    "@types/node": "^24.3.1",
+    "prettier": "^3.6.2",
+    "typescript": "^5.9.2"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "format": "prettier --check 'src/**/*.ts'"
+  }
+}