crew-runner 0.0.0-stage → 0.2.0

package/src/acp.ts

@@ -0,0 +1,391 @@
+import { spawn, spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { existsSync, realpathSync } from "node:fs";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { Readable, Writable } from "node:stream";
+import { fileURLToPath } from "node:url";
+import * as acp from "@agentclientprotocol/sdk";
+import type { Claimed, RunEvent } from "./api.ts";
+import { promptFrom, type Outcome } from "./claude.ts";
+import { CLAUDE_DISALLOWED, CLAUDE_ENV, CLAUDE_PERMISSIONS, CLAUDE_TOOLS } from "./computer.ts";
+import { DISABLED_FEATURES } from "./codex.ts";
+import { claudeExecutable, killTree } from "./spawn.ts";
+import { assertGrant, openStudio, type StudioGrant } from "./studio.ts";
+import { MEDIA_TOOLS } from "./studio-mcp.ts";
+
+const STUDIO_NAME = "crew_studio";
+function studioServer(grant: StudioGrant): acp.McpServerStdio {
+  assertGrant(grant);
+  return { name: STUDIO_NAME, command: process.execPath, args: [fileURLToPath(new URL("../bin/crew-studio.mjs", import.meta.url)), "stdio", "--project", grant.root, "--expires", String(grant.expiresAt), "--allow-local-media"], env: [] };
+}
+export function mediaPermission(agent: AgentName, p: acp.RequestPermissionRequest, calls: ReadonlyMap<string, SeenCall>, grant?: StudioGrant): boolean {
+  if (!grant) return false;
+  try { assertGrant(grant); } catch { return false; }
+  if (agent === "claude") return MEDIA_TOOLS.some((tool) => p.toolCall.title === `mcp__${STUDIO_NAME}__${tool}`);
+  if (field(p._meta, "is_mcp_tool_approval") !== true || (p.toolCall.kind && p.toolCall.kind !== "execute")) return false;
+  const seen = calls.get(p.toolCall.toolCallId);
+  const raw = seen ? seen.rawInput : p.toolCall.rawInput;
+  const server = field(raw, seen ? "server" : "serverName");
+  return server === STUDIO_NAME && MEDIA_TOOLS.some((tool) => field(raw, "tool") === tool);
+}
+export function studioCodexConfig(pkg: RunPkg, memberServers: readonly string[], grant: StudioGrant): Record<string, unknown> {
+  // Codex recursively merges member settings. Do not re-enable an existing entry:
+  // inherited env/env_vars/cwd could execute member code in our owned stdio bridge.
+  if (memberServers.includes(STUDIO_NAME)) throw new Error("Rename the member crew_studio MCP server before enabling studio");
+  const cfg = codexConfig(pkg, memberServers);
+  const bridge = studioServer(grant);
+  return { ...cfg, mcp_servers: { ...(cfg.mcp_servers as Record<string, unknown>), [STUDIO_NAME]: { enabled: true, command: bridge.command, args: bridge.args } } };
+}
+
+// One Agent Client Protocol client for both vendors. We spawn a small adapter (claude-agent-acp or codex-acp) that
+// wraps the member's own signed-in app. The adapter holds the login. We never read the vendors' files, never call
+// `authenticate` (which could start a browser login) and never see a credential: if the app is signed out the
+// session simply fails to open and we report that.
+const MAX_TEXT = 100_000;
+const MAX_EVENT_TEXT = 20_000;
+const FLUSH_MS = 300;
+const CANCEL_GRACE_MS = 5_000;
+const MCP_NAME = "crew";
+const CLAUDE_TOOL_PREFIX = `mcp__${MCP_NAME}__`;
+
+export type AgentName = "claude" | "codex";
+
+type Launch = { command: string; args: string[]; env?: Record<string, string> };
+
+// Finds an installed adapter by walking up node_modules. require.resolve cannot be used: both packages only
+// declare an "import" export condition.
+function adapterFile(pkgName: string, file: string): string {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (;;) {
+    const p = join(dir, "node_modules", pkgName, file);
+    if (existsSync(p)) return p;
+    const up = dirname(dir);
+    if (up === dir) throw new Error(`${pkgName} is not installed`);
+    dir = up;
+  }
+}
+
+type RunPkg = Pick<Claimed, "instructions" | "mcp_url" | "token">;
+
+export type AgentSpec = {
+  label: string;
+  launch: (pkg: RunPkg, opts: { bin?: string }) => Launch;
+  // false = the launch config already carries our MCP server, so session/new sends none.
+  acpMcp: boolean;
+  // Fields added to session/new for this adapter.
+  sessionMeta: (pkg: Pick<Claimed, "instructions">) => Record<string, unknown> | undefined;
+  // Idle chat mode to force after session/new, or null.
+  mode: string | null;
+  allowTool: (p: acp.RequestPermissionRequest, calls: ReadonlyMap<string, SeenCall>) => boolean;
+};
+
+// Tool calls the agent announced in this session, by id. Some approvals carry only the id.
+export type SeenCall = { title: string; rawInput: unknown };
+
+const field = (v: unknown, key: string): unknown => (v && typeof v === "object" ? (v as Record<string, unknown>)[key] : undefined);
+
+// Claude names every MCP tool mcp__<server>__<tool> in the permission title. Anything else is a built-in tool.
+export function allowClaudeTool(p: acp.RequestPermissionRequest): boolean {
+  return (p.toolCall.title ?? "").startsWith(CLAUDE_TOOL_PREFIX);
+}
+
+// codex-acp marks MCP tool approvals with _meta.is_mcp_tool_approval. The approval usually carries only the id of a
+// tool call announced earlier with rawInput { server, tool }; a standalone one carries rawInput { serverName }.
+// Only our server passes. Commands, edits and anything else are refused.
+export function allowCodexTool(p: acp.RequestPermissionRequest, calls: ReadonlyMap<string, SeenCall>): boolean {
+  if (field(p._meta, "is_mcp_tool_approval") !== true) return false;
+  if (p.toolCall.kind && p.toolCall.kind !== "execute") return false;
+  const seen = calls.get(p.toolCall.toolCallId);
+  const server = seen ? field(seen.rawInput, "server") : field(p.toolCall.rawInput, "serverName");
+  return server === MCP_NAME;
+}
+
+// Codex also loads the member's own MCP servers from their config, and those tools run without asking us. We ask
+// the bundled Codex for the server names (never the files or values) and switch each one off for this session.
+// Ours goes in the same mcp_servers table: the adapter would replace the table if it added ours from session/new.
+// If the list fails the run fails: no lockdown, no run.
+const LIST_TIMEOUT_MS = 20_000;
+
+export function memberMcpNames(listJson: string): string[] {
+  const list: unknown = JSON.parse(listJson);
+  if (!Array.isArray(list)) throw new Error("codex mcp list returned no list");
+  // Already-off servers stay off, except our reserved name: even a disabled
+  // entry can carry inherited stdio settings and must be detected as a collision.
+  return list
+    .filter((s) => field(s, "enabled") !== false || field(s, "name") === STUDIO_NAME)
+    .map((s) => field(s, "name"))
+    .filter((n): n is string => typeof n === "string" && n !== MCP_NAME);
+}
+
+function listCodexMcp(): string[] {
+  const codex = createRequire(realpathSync(adapterFile("@agentclientprotocol/codex-acp", "dist/index.js"))).resolve("@openai/codex/bin/codex.js");
+  const r = spawnSync(process.execPath, [codex, "mcp", "list", "--json"], { cwd: tmpdir(), encoding: "utf8", timeout: LIST_TIMEOUT_MS, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] });
+  if (r.status !== 0) throw new Error("could not list Codex MCP servers");
+  return memberMcpNames(r.stdout);
+}
+
+export const CODEX_TOKEN_ENV = "CREW_MCP_TOKEN";
+
+export function codexConfig(pkg: RunPkg, memberServers: readonly string[]): Record<string, unknown> {
+  return {
+    features: Object.fromEntries(DISABLED_FEATURES.map((f) => [f, false])),
+    web_search: "disabled",
+    sandbox_mode: "read-only",
+    approval_policy: "on-request",
+    developer_instructions: pkg.instructions,
+    mcp_servers: {
+      ...Object.fromEntries(memberServers.map((n) => [n, { enabled: false }])),
+      [MCP_NAME]: { url: pkg.mcp_url, bearer_token_env_var: CODEX_TOKEN_ENV },
+    },
+  };
+}
+
+export const AGENTS: Record<AgentName, AgentSpec> = {
+  claude: {
+    label: "Claude Code",
+    launch: (_pkg, opts) => ({
+      command: process.execPath,
+      args: [adapterFile("@zed-industries/claude-agent-acp", "dist/index.js")],
+      // On Windows a .cmd shim cannot be started by the adapter, so it gets the real file the shim points at.
+      env: opts.bin ? { CLAUDE_CODE_EXECUTABLE: claudeExecutable(opts.bin) } : undefined,
+    }),
+    sessionMeta: (pkg) => ({
+      systemPrompt: pkg.instructions,
+      // No built-in tools, no member settings or project files, only the MCP server we pass.
+      claudeCode: { options: { tools: [], settingSources: [], strictMcpConfig: true } },
+    }),
+    // The member's own default mode could be "bypass permissions"; force the asking mode so our handler decides.
+    mode: "default",
+    acpMcp: true,
+    allowTool: allowClaudeTool,
+  },
+  codex: {
+    label: "Codex",
+    // The adapter takes Codex config as one JSON object. NO_BROWSER hides the browser login method, so a signed-out
+    // app fails instead of opening a login page.
+    launch: (pkg) => ({
+      command: process.execPath,
+      args: [adapterFile("@agentclientprotocol/codex-acp", "dist/index.js")],
+      env: {
+        CODEX_CONFIG: JSON.stringify(codexConfig(pkg, listCodexMcp())),
+        [CODEX_TOKEN_ENV]: pkg.token,
+        INITIAL_AGENT_MODE: "read-only",
+        NO_BROWSER: "1",
+      },
+    }),
+    sessionMeta: () => undefined,
+    mode: null,
+    acpMcp: false,
+    allowTool: allowCodexTool,
+  },
+};
+
+type Option = acp.RequestPermissionRequest["options"][number];
+
+// Pure policy: the option id to select, or null to cancel the request.
+export function decide(
+  spec: Pick<AgentSpec, "allowTool">,
+  p: acp.RequestPermissionRequest,
+  calls: ReadonlyMap<string, SeenCall> = new Map(),
+): { allowed: boolean; optionId: string | null } {
+  return optionFor(p, spec.allowTool(p, calls));
+}
+
+export function optionFor(p: acp.RequestPermissionRequest, allowed: boolean): { allowed: boolean; optionId: string | null } {
+  const pick = (kinds: string[], ids: string[]): Option | undefined =>
+    p.options.find((o) => kinds.includes(o.kind)) ?? p.options.find((o) => ids.includes(o.optionId));
+  // Always the one-shot option, never "always": the next call is judged on its own.
+  const o = allowed ? pick(["allow_once"], ["approved", "allow", "allow_once"]) : pick(["reject_once", "reject_always"], ["cancel", "reject", "denied", "abort"]);
+  return { allowed, optionId: o?.optionId ?? null };
+}
+
+export type RunAcpOptions = {
+  timeoutMs: number;
+  // Override how the adapter is started (tests). Defaults to the registry.
+  launch?: Launch;
+  // The member's own CLI path (CREW_CLAUDE_BIN), handed to the claude adapter.
+  bin?: string;
+  // Abort = run cancelled: session/cancel first, kill after a short grace.
+  signal?: AbortSignal;
+  // Explicit host-selected project only. Never read this authority from a cloud task/model.
+  studio?: StudioGrant;
+  // Standalone member-authored local session: no cloud tools or events.
+  studioOnly?: boolean;
+  // Computer mode (@mac, Claude Code only): Claude Code's own tools, from a scratch folder the caller owns, every tool request
+  // judged by `decide` (which may wait for the owner's card). No CrewCortex MCP server: the reply is the only output.
+  computer?: ComputerSession;
+};
+
+export type ComputerSession = {
+  cwd: string;
+  additionalDirectories: string[];
+  systemPrompt: string;
+  decide: (p: acp.RequestPermissionRequest, calls: ReadonlyMap<string, SeenCall>) => Promise<boolean>;
+};
+
+type Sink = (events: RunEvent[]) => Promise<void>;
+
+const failed = (error: string, inputTokens = 0, outputTokens = 0): Outcome => ({ status: "failed", text: "", inputTokens, outputTokens, error });
+
+export async function runAcp(agent: AgentName, pkg: Claimed, sink: Sink, opts: RunAcpOptions): Promise<Outcome> {
+  const originalSpec = AGENTS[agent];
+  const grant = opts.studio ? Object.freeze({ ...opts.studio }) : undefined;
+  const spec = grant ? { ...originalSpec, allowTool: (p: acp.RequestPermissionRequest, calls: ReadonlyMap<string, SeenCall>) =>
+    (!opts.studioOnly && originalSpec.allowTool(p, calls)) || mediaPermission(agent, p, calls, grant) } : originalSpec;
+  if (opts.computer && (agent !== "claude" || grant)) return failed("runner_failed");
+  const computer = opts.computer;
+  // Empty temp directory: even if a built-in tool were somehow on, there is nothing of the member's to touch.
+  // Computer mode works in the caller's scratch folder instead, which the caller removes.
+  const cwd = computer ? computer.cwd : await mkdtemp(join(tmpdir(), "crew-run-"));
+  let child: ReturnType<typeof spawn> | undefined;
+  let timer: NodeJS.Timeout | undefined;
+  let flushTimer: NodeJS.Timeout | undefined;
+  let graceTimer: NodeJS.Timeout | undefined;
+  let onAbort: (() => void) | undefined;
+  try {
+    if (grant) await openStudio(grant);
+    if (opts.studioOnly && !grant) throw new Error("Local studio consent required");
+    const launch = opts.launch ?? spec.launch(pkg, { bin: opts.bin });
+    if (agent === "codex" && grant) {
+      const config = studioCodexConfig(pkg, listCodexMcp(), grant);
+      // Absence would merge the member's enabled `crew` back into Codex settings.
+      if (opts.studioOnly) (config.mcp_servers as Record<string, unknown>)[MCP_NAME] = { enabled: false };
+      launch.env = { ...launch.env, CODEX_CONFIG: JSON.stringify(config) };
+    }
+    // POSIX: detached makes the adapter lead a process group, so killTree ends it and the app it started. Windows uses taskkill.
+    child = spawn(launch.command, launch.args, { cwd, stdio: ["pipe", "pipe", "ignore"], detached: process.platform !== "win32", windowsHide: true, env: { ...process.env, ...launch.env } });
+    const proc = child;
+    const exited = new Promise<never>((_, reject) => {
+      proc.on("error", () => reject(new Error("runner_failed")));
+      proc.on("close", () => reject(new Error("runner_failed")));
+    });
+    exited.catch(() => undefined);
+    const timedOut = new Promise<never>((_, reject) => {
+      timer = setTimeout(() => reject(new Error("runner_timeout")), opts.timeoutMs);
+    });
+    timedOut.catch(() => undefined);
+
+    // Serialised sink, text coalesced so a token stream is not one HTTP call per chunk.
+    let chain: Promise<void> = Promise.resolve();
+    const send = (events: RunEvent[]) => {
+      if (events.length) chain = chain.then(() => sink(events).catch(() => undefined));
+    };
+    const calls = new Map<string, SeenCall>();
+    let buffered = "";
+    let final = "";
+    const flush = () => {
+      clearTimeout(flushTimer);
+      flushTimer = undefined;
+      while (buffered) {
+        send([{ type: "text", text: buffered.slice(0, MAX_EVENT_TEXT) }]);
+        buffered = buffered.slice(MAX_EVENT_TEXT);
+      }
+    };
+    const onText = (t: string) => {
+      buffered += t;
+      final += t;
+      if (buffered.length >= MAX_EVENT_TEXT) flush();
+      else flushTimer ??= setTimeout(flush, FLUSH_MS);
+    };
+
+    const handleUpdate = (u: acp.SessionUpdate) => {
+      switch (u.sessionUpdate) {
+        case "agent_message_chunk":
+          if (u.content.type === "text") onText(u.content.text);
+          break;
+        case "tool_call":
+          calls.set(u.toolCallId, { title: u.title, rawInput: u.rawInput });
+          flush();
+          final = ""; // the answer is the text after the last tool call
+          send([{ type: "step", kind: "tool", name: u.title.slice(0, 200), input: u.rawInput }]);
+          break;
+        case "tool_call_update":
+          if (u.status === "completed" || u.status === "failed") {
+            flush();
+            send([{ type: "step", kind: "tool", output: u.rawOutput ?? u.content }]);
+          }
+          break;
+        case "plan":
+          send([{ type: "step", kind: "model", name: "plan", output: u.entries.map((e) => e.content) }]);
+          break;
+        default:
+          break;
+      }
+    };
+
+    const stream = acp.ndJsonStream(Writable.toWeb(proc.stdin!) as WritableStream<Uint8Array>, Readable.toWeb(proc.stdout!) as ReadableStream<Uint8Array>);
+
+    const session = acp
+      .client({ name: "crew-runner" })
+      .onRequest(acp.methods.client.session.requestPermission, async (ctx) => {
+        const d = computer ? optionFor(ctx.params, await computer.decide(ctx.params, calls).catch(() => false)) : decide(spec, ctx.params, calls);
+        return { outcome: d.optionId ? { outcome: "selected" as const, optionId: d.optionId } : { outcome: "cancelled" as const } };
+      })
+      .connectWith(stream, async (ctx) => {
+        await ctx.request(acp.methods.agent.initialize, {
+          protocolVersion: acp.PROTOCOL_VERSION,
+          // No file system or terminal for the agent: it can only use the MCP tools we hand it.
+          clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false },
+        });
+        const request: acp.NewSessionRequest = {
+          cwd,
+          mcpServers: computer ? [] : spec.acpMcp ? [
+            ...(!opts.studioOnly ? [{ type: "http" as const, name: MCP_NAME, url: pkg.mcp_url, headers: [{ name: "Authorization", value: `Bearer ${pkg.token}` }] }] : []),
+            ...(grant ? [studioServer(grant)] : []),
+          ] : [],
+          _meta: computer
+            ? { systemPrompt: computer.systemPrompt, claudeCode: { options: {
+              settingSources: [], strictMcpConfig: true, additionalDirectories: computer.additionalDirectories,
+              settings: { permissions: CLAUDE_PERMISSIONS }, tools: CLAUDE_TOOLS, disallowedTools: CLAUDE_DISALLOWED, env: CLAUDE_ENV,
+            } } }
+            : spec.sessionMeta(pkg),
+        };
+        const active = await ctx.buildSession(request).start();
+        try {
+          if (spec.mode) await ctx.request(acp.methods.agent.session.setMode, { sessionId: active.sessionId, modeId: spec.mode });
+          onAbort = () => {
+            void ctx.notify(acp.methods.agent.session.cancel, { sessionId: active.sessionId }).catch(() => undefined);
+            graceTimer = setTimeout(() => killTree(proc), CANCEL_GRACE_MS);
+          };
+          if (opts.signal?.aborted) onAbort();
+          else opts.signal?.addEventListener("abort", onAbort, { once: true });
+          void active.prompt(promptFrom(pkg.messages)).catch(() => undefined);
+          for (;;) {
+            const m = await active.nextUpdate();
+            if (m.kind === "stop") return m.response;
+            handleUpdate(m.update);
+          }
+        } finally {
+          active.dispose();
+        }
+      });
+    session.catch(() => undefined);
+
+    let response: acp.PromptResponse;
+    try {
+      response = await Promise.race([session, exited, timedOut]);
+    } catch (e) {
+      flush();
+      await chain;
+      return failed(e instanceof Error && e.message === "runner_timeout" ? "runner_timeout" : opts.signal?.aborted ? "runner_cancelled" : "runner_failed");
+    }
+    flush();
+    await chain;
+    const inputTokens = response.usage?.inputTokens ?? 0;
+    const outputTokens = response.usage?.outputTokens ?? 0;
+    if (response.stopReason === "cancelled") return failed("runner_cancelled", inputTokens, outputTokens);
+    if (response.stopReason !== "end_turn" && response.stopReason !== "max_tokens") return failed("runner_failed", inputTokens, outputTokens);
+    return { status: "completed", text: final.slice(0, MAX_TEXT), inputTokens, outputTokens };
+  } catch {
+    return failed("runner_failed");
+  } finally {
+    clearTimeout(timer);
+    clearTimeout(flushTimer);
+    clearTimeout(graceTimer);
+    if (onAbort) opts.signal?.removeEventListener("abort", onAbort);
+    if (child) killTree(child);
+    if (!computer) await rm(cwd, { recursive: true, force: true });
+  }
+}

package/src/api.ts

@@ -0,0 +1,87 @@
+import { CARD_DETAIL_MAX } from "./computer.ts";
+import type { Stored } from "./store.ts";
+
+export type Claimed = {
+  run_id: string;
+  instructions: string;
+  messages: { role: string; content: unknown }[];
+  mcp_url: string;
+  token: string;
+  // Only on a computer-mode claim (crew-runner start --computer): the workspace whose folder the run uses.
+  computer?: { workspace_slug: string };
+};
+
+export type ClaimMode = "default" | "computer";
+export type CardAnswer = "pending" | "approved" | "rejected" | "expired";
+
+export type RunEvent =
+  | { type: "text"; text: string }
+  | { type: "step"; kind: "model" | "tool"; name?: string; input?: unknown; output?: unknown };
+
+export type Complete = {
+  run_id: string;
+  status: "completed" | "failed";
+  text: string;
+  input_tokens?: number;
+  output_tokens?: number;
+  error?: string;
+};
+
+export function createApi(cfg: Stored, fetchImpl: typeof fetch = fetch) {
+  const call = (path: string, body: unknown, signal?: AbortSignal) =>
+    fetchImpl(`${cfg.appUrl}/api/runner/${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${cfg.token}` },
+      body: JSON.stringify(body),
+      signal,
+    });
+  return {
+    // true = this device token is accepted by the server.
+    async ping(): Promise<boolean> {
+      return (await call("ping", {})).ok;
+    },
+    // null = no work (204). Throws on auth or server errors so the loop can back off.
+    async claim(signal?: AbortSignal, mode: ClaimMode = "default"): Promise<Claimed | null> {
+      const res = await call("claim", mode === "computer" ? { mode } : {}, signal);
+      if (res.status === 204) return null;
+      if (!res.ok) throw new Error(`claim failed (${res.status})`);
+      return (await res.json()) as Claimed;
+    },
+    // Throws when the server did not take them (computer mode then refuses the step it could not record).
+    async events(runId: string, events: RunEvent[]): Promise<void> {
+      if (events.length === 0) return;
+      const res = await call("events", { run_id: runId, events });
+      if (!res.ok) throw new Error(`events failed (${res.status})`);
+    },
+    async complete(body: Complete): Promise<void> {
+      await call("complete", body);
+    },
+    // Computer mode: a confirmation card for the owner. Null when it could not be asked (the step is then refused).
+    async askOwner(runId: string, category: string, detail: string): Promise<string | null> {
+      // The policy refuses anything longer than a card shows; never cut what the owner approves.
+      if (detail.length > CARD_DETAIL_MAX) return null;
+      const res = await call("approval", { run_id: runId, category, detail });
+      if (!res.ok) return null;
+      const body = (await res.json()) as { approval_id?: unknown };
+      return typeof body.approval_id === "string" ? body.approval_id : null;
+    },
+    async ownerAnswer(runId: string, approvalId: string): Promise<CardAnswer | null> {
+      const res = await call("approval/status", { run_id: runId, approval_id: approvalId });
+      if (!res.ok) return null;
+      const body = (await res.json()) as { status?: unknown };
+      return body.status === "pending" || body.status === "approved" || body.status === "rejected" || body.status === "expired" ? body.status : null;
+    },
+    // Computer mode: is this run still running? false only when the server says so (the owner's off switch); null when
+    // it could not tell (network, an older server), which never stops a run.
+    async alive(runId: string): Promise<boolean | null> {
+      const res = await call("alive", { run_id: runId });
+      if (!res.ok) return null;
+      const body = (await res.json()) as { running?: unknown };
+      return typeof body.running === "boolean" ? body.running : null;
+    },
+    async revoke(): Promise<boolean> {
+      return (await call("revoke", {})).ok;
+    },
+  };
+}
+export type RunnerApi = ReturnType<typeof createApi>;

package/src/claude.ts

@@ -0,0 +1,155 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+import type { Claimed, RunEvent } from "./api.ts";
+import { invocation, spawnBin } from "./spawn.ts";
+
+// Drives the member's own `claude` app in print mode. We only run its public commands (--version, auth status)
+// and read its exit code. We never open its files or environment: whatever login it has stays inside it.
+const SUPPORTED_MAJOR = 2;
+const MIN_MINOR = 1;
+const MAX_TEXT = 100_000;
+
+export type Check = { ok: true; version: string } | { ok: false; message: string };
+
+// On Windows `bin` may be a .cmd shim; invocation() starts it through cmd.exe, never through a general shell.
+export const run = (bin: string, args: string[]): Promise<{ code: number; out: string }> =>
+  new Promise((resolve) => {
+    let inv;
+    try {
+      inv = invocation(bin, args);
+    } catch {
+      resolve({ code: 1, out: "" });
+      return;
+    }
+    execFile(inv.command, inv.args, { timeout: 20_000, windowsHide: true, windowsVerbatimArguments: inv.windowsVerbatimArguments }, (err, stdout) => {
+      const code = err ? (typeof err.code === "number" ? err.code : 1) : 0;
+      resolve({ code, out: String(stdout ?? "") });
+    });
+  });
+
+export function parseVersion(out: string): { major: number; minor: number; text: string } | null {
+  const m = /(\d+)\.(\d+)\.(\d+)/.exec(out);
+  if (!m) return null;
+  return { major: Number(m[1]), minor: Number(m[2]), text: `${m[1]}.${m[2]}.${m[3]}` };
+}
+
+export async function checkClaude(bin = "claude"): Promise<Check> {
+  const v = await run(bin, ["--version"]);
+  if (v.code !== 0) return { ok: false, message: "Claude Code is not installed. Install it, sign in, then run this again." };
+  const ver = parseVersion(v.out);
+  if (!ver) return { ok: false, message: "Could not read the Claude Code version." };
+  if (ver.major !== SUPPORTED_MAJOR || ver.minor < MIN_MINOR) {
+    return { ok: false, message: `Claude Code ${ver.text} is outside the supported range (${SUPPORTED_MAJOR}.${MIN_MINOR}.x and later ${SUPPORTED_MAJOR}.x). Update it.` };
+  }
+  const s = await run(bin, ["auth", "status"]);
+  let signedIn = s.code === 0;
+  try {
+    const json = JSON.parse(s.out) as { loggedIn?: unknown };
+    if (json.loggedIn === false) signedIn = false;
+  } catch {
+    // Not JSON: trust the exit code.
+  }
+  if (!signedIn) return { ok: false, message: "Claude Code is not signed in. Open it, sign in, then run this again." };
+  return { ok: true, version: ver.text };
+}
+
+// Only our MCP server is configured and every built-in file and shell tool is off, so the only tools are ours.
+export function buildArgs(pkg: Pick<Claimed, "instructions" | "mcp_url" | "token">): string[] {
+  const mcp = JSON.stringify({ mcpServers: { crew: { type: "http", url: pkg.mcp_url, headers: { Authorization: `Bearer ${pkg.token}` } } } });
+  return [
+    "-p",
+    "--output-format", "stream-json",
+    "--verbose",
+    "--mcp-config", mcp,
+    "--strict-mcp-config",
+    "--tools", "",
+    "--permission-mode", "dontAsk",
+    "--allowedTools", "mcp__crew",
+    "--system-prompt", pkg.instructions,
+  ];
+}
+
+export function promptFrom(messages: Claimed["messages"]): string {
+  return messages.map((m) => `${m.role}: ${typeof m.content === "string" ? m.content : JSON.stringify(m.content)}`).join("\n\n");
+}
+
+export type Outcome = { status: "completed" | "failed"; text: string; inputTokens: number; outputTokens: number; costMicroUsd?: number; error?: string };
+
+type Block = { type?: string; text?: string; name?: string; input?: unknown; content?: unknown };
+type Line = {
+  type?: string;
+  message?: { content?: Block[] };
+  result?: string;
+  is_error?: boolean;
+  total_cost_usd?: number;
+  usage?: { input_tokens?: number; output_tokens?: number };
+};
+
+// One stream-json line -> zero or more events for the server.
+export function eventsFromLine(line: Line): RunEvent[] {
+  const out: RunEvent[] = [];
+  const blocks = line.message?.content;
+  if (!Array.isArray(blocks)) return out;
+  for (const b of blocks) {
+    if (line.type === "assistant" && b.type === "tool_use") out.push({ type: "step", kind: "tool", name: b.name, input: b.input });
+    if (line.type === "user" && b.type === "tool_result") out.push({ type: "step", kind: "tool", output: b.content });
+  }
+  return out;
+}
+
+export async function runClaude(
+  pkg: Claimed,
+  sink: (events: RunEvent[]) => Promise<void>,
+  opts: { bin?: string; timeoutMs: number },
+): Promise<Outcome> {
+  // Empty temp directory: even if a built-in tool were somehow on, there is nothing of the member's to touch.
+  const cwd = await mkdtemp(join(tmpdir(), "crew-run-"));
+  let child;
+  try {
+    child = spawnBin(opts.bin ?? "claude", buildArgs(pkg), { cwd, stdio: ["pipe", "pipe", "ignore"] });
+  } catch {
+    // Windows .cmd shim given an argument it cannot carry (a line break in the instructions).
+    await rm(cwd, { recursive: true, force: true });
+    return { status: "failed", text: "", inputTokens: 0, outputTokens: 0, error: "runner_failed" };
+  }
+  const timer = setTimeout(() => child.kill("SIGKILL"), opts.timeoutMs);
+  child.stdin?.on("error", () => undefined);
+  child.stdin?.end(promptFrom(pkg.messages));
+
+  let result: Line | null = null;
+  const pending: Promise<void>[] = [];
+  const rl = createInterface({ input: child.stdout! });
+  rl.on("line", (raw) => {
+    let line: Line;
+    try {
+      line = JSON.parse(raw) as Line;
+    } catch {
+      return;
+    }
+    if (line.type === "result") result = line;
+    const events = eventsFromLine(line);
+    if (events.length) pending.push(sink(events).catch(() => undefined));
+  });
+  const code = await new Promise<number>((resolve) => {
+    child.on("error", () => resolve(127));
+    child.on("close", (c) => resolve(c ?? 1));
+  });
+  clearTimeout(timer);
+  await Promise.all(pending);
+  await rm(cwd, { recursive: true, force: true });
+
+  const r = result as Line | null;
+  if (!r || r.is_error || code !== 0) {
+    return { status: "failed", text: "", inputTokens: 0, outputTokens: 0, error: "runner_failed" };
+  }
+  return {
+    status: "completed",
+    text: (r.result ?? "").slice(0, MAX_TEXT),
+    inputTokens: r.usage?.input_tokens ?? 0,
+    outputTokens: r.usage?.output_tokens ?? 0,
+    costMicroUsd: undefined,
+  };
+}