veryfront 0.1.49 → 0.1.51

package/esm/src/workflow/blob/veryfront-cloud-storage.d.ts

@@ -0,0 +1,41 @@
+import * as dntShim from "../../../_dnt.shims.js";
+import type { BlobRef, BlobStorage, StoreBlobOptions } from "./types.js";
+export interface VeryfrontCloudBlobStorageConfig {
+    /** Veryfront API base URL. Defaults to the current Veryfront Cloud bootstrap. */
+    apiBaseUrl?: string;
+    /** Explicit Veryfront auth token or API key override. */
+    apiToken?: string;
+    /** Project slug override. Defaults to request-scoped or env bootstrap. */
+    projectSlug?: string;
+    /** Upload path prefix inside the project's uploads store. */
+    prefix?: string;
+    /** Default TTL in seconds for new blobs. Stored in sidecar metadata only. */
+    defaultTtl?: number;
+    /** Requested TTL in seconds for signed download URLs. */
+    downloadTtl?: number;
+    /** Time source for tests. */
+    now?: () => Date;
+}
+export declare class VeryfrontCloudBlobStorage implements BlobStorage {
+    private config;
+    constructor(config?: VeryfrontCloudBlobStorageConfig);
+    put(data: string | Uint8Array | dntShim.Blob | ReadableStream, options?: StoreBlobOptions): Promise<BlobRef>;
+    getStream(id: string): Promise<ReadableStream | null>;
+    getText(id: string): Promise<string | null>;
+    getBytes(id: string): Promise<Uint8Array | null>;
+    delete(id: string): Promise<void>;
+    exists(id: string): Promise<boolean>;
+    stat(id: string): Promise<BlobRef | null>;
+    private resolveConfig;
+    private assertSafeBlobId;
+    private getDataPath;
+    private getMetadataPath;
+    private uploadFile;
+    private getUploadMetadata;
+    private deleteUpload;
+    private getDownloadUrl;
+    private downloadUpload;
+    private downloadUploadText;
+    private requestJson;
+}
+//# sourceMappingURL=veryfront-cloud-storage.d.ts.map

package/esm/src/workflow/blob/veryfront-cloud-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"veryfront-cloud-storage.d.ts","sourceRoot":"","sources":["../../../../src/src/workflow/blob/veryfront-cloud-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAWlD,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA6CzE,MAAM,WAAW,+BAA+B;IAC9C,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AA6FD,qBAAa,yBAA0B,YAAW,WAAW;IAC3D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,GAAE,+BAAoC;IAIlD,GAAG,CACP,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,GAAG,cAAc,EACzD,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,OAAO,CAAC;IAkEb,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAKrD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAM3C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIpC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IA0B/C,OAAO,CAAC,aAAa;IA8BrB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,eAAe;YAKT,UAAU;YA2CV,iBAAiB;YAkBjB,YAAY;YAgBZ,cAAc;YAwBd,cAAc;YAuBd,kBAAkB;YASlB,WAAW;CAwC1B"}

package/esm/src/workflow/blob/veryfront-cloud-storage.js

@@ -0,0 +1,348 @@
+import * as dntShim from "../../../_dnt.shims.js";
+import { z } from "zod";
+import { agentLogger as logger } from "../../utils/index.js";
+import { API_ERROR, CONFIG_INVALID, INVALID_ARGUMENT } from "../../errors/index.js";
+const SAFE_BLOB_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
+import { getVeryfrontCloudAuthToken, getVeryfrontCloudBootstrap, getVeryfrontCloudProjectSlug, } from "../../platform/cloud/resolver.js";
+const DEFAULT_PREFIX = ".veryfront/blobs/";
+const DATA_SUFFIX = ".blob";
+const META_SUFFIX = ".meta.json";
+const UploadCreateResponseSchema = z.object({
+    file_upload_url: z.string().url(),
+    file_path: z.string(),
+    upload_id: z.string(),
+    required_headers: z.record(z.string()),
+});
+const UploadMetadataResponseSchema = z.object({
+    id: z.string(),
+    path: z.string(),
+    file_name: z.string(),
+    content_type: z.string().nullable(),
+    size: z.number(),
+    url: z.string().nullable(),
+    status: z.enum(["pending", "active", "failed"]),
+    visibility: z.enum(["project", "public", "private"]),
+    created_at: z.string(),
+    updated_at: z.string(),
+    deleted_at: z.string().nullable(),
+});
+const UploadSignedUrlResponseSchema = z.object({
+    signed_url: z.string().url(),
+    expires_at: z.string(),
+});
+const BlobMetadataSchema = z.object({
+    version: z.literal(1),
+    id: z.string(),
+    size: z.number().nonnegative(),
+    mimeType: z.string(),
+    createdAt: z.string(),
+    expiresAt: z.string().optional(),
+    metadata: z.record(z.string()).optional(),
+});
+function normalizePrefix(prefix) {
+    const value = (prefix ?? DEFAULT_PREFIX).trim().replace(/^\/+/, "");
+    if (!value)
+        return DEFAULT_PREFIX;
+    return value.endsWith("/") ? value : `${value}/`;
+}
+function joinUrl(base, path) {
+    return `${base.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
+}
+function mapBlobMetadataToRef(blob) {
+    return {
+        __kind: "blob",
+        id: blob.id,
+        size: blob.size,
+        mimeType: blob.mimeType,
+        createdAt: new Date(blob.createdAt),
+        expiresAt: blob.expiresAt ? new Date(blob.expiresAt) : undefined,
+        metadata: blob.metadata,
+    };
+}
+function mapUploadMetadataToRef(upload, id) {
+    return {
+        __kind: "blob",
+        id,
+        size: upload.size,
+        mimeType: upload.content_type ?? "application/octet-stream",
+        createdAt: new Date(upload.created_at),
+    };
+}
+async function attachSignedUrl(ref, path, resolved, getDownloadUrl) {
+    try {
+        const download = await getDownloadUrl(path, resolved);
+        return download ? { ...ref, url: download.signedUrl } : ref;
+    }
+    catch (error) {
+        logger.warn("Failed to resolve signed URL for cloud blob", {
+            id: ref.id,
+            path,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return ref;
+    }
+}
+async function normalizeUploadBody(data) {
+    if (typeof data === "string") {
+        const bytes = new TextEncoder().encode(data);
+        return { body: bytes, size: bytes.byteLength };
+    }
+    if (data instanceof Uint8Array) {
+        const bytes = Uint8Array.from(data);
+        return { body: bytes, size: bytes.byteLength };
+    }
+    if (data instanceof dntShim.Blob) {
+        return { body: data, size: data.size };
+    }
+    if (data instanceof ReadableStream) {
+        const bytes = new Uint8Array(await new dntShim.Response(data).arrayBuffer());
+        return { body: bytes, size: bytes.byteLength };
+    }
+    throw INVALID_ARGUMENT.create({
+        detail: "Unsupported data type for VeryfrontCloudBlobStorage",
+    });
+}
+export class VeryfrontCloudBlobStorage {
+    config;
+    constructor(config = {}) {
+        this.config = config;
+    }
+    async put(data, options = {}) {
+        const resolved = this.resolveConfig();
+        const id = options.id ?? dntShim.crypto.randomUUID();
+        const mimeType = options.mimeType ?? "application/octet-stream";
+        const { body, size } = await normalizeUploadBody(data);
+        const createdAt = resolved.now();
+        const ttl = options.ttl ?? resolved.defaultTtl;
+        const expiresAt = ttl ? new Date(createdAt.getTime() + ttl * 1000) : undefined;
+        const blobRef = {
+            __kind: "blob",
+            id,
+            size,
+            mimeType,
+            createdAt,
+            expiresAt,
+            metadata: options.metadata,
+        };
+        const metadataPayload = BlobMetadataSchema.parse({
+            version: 1,
+            id,
+            size,
+            mimeType,
+            createdAt: createdAt.toISOString(),
+            expiresAt: expiresAt?.toISOString(),
+            metadata: options.metadata,
+        });
+        const dataPath = this.getDataPath(id, resolved.prefix);
+        const metadataPath = this.getMetadataPath(id, resolved.prefix);
+        const metadataBytes = new TextEncoder().encode(JSON.stringify(metadataPayload));
+        await this.uploadFile(dataPath, mimeType, size, body, resolved);
+        try {
+            await this.uploadFile(metadataPath, "application/json", metadataBytes.byteLength, metadataBytes, resolved);
+        }
+        catch (error) {
+            logger.warn("Failed to upload blob metadata sidecar, cleaning up primary upload", {
+                id,
+                dataPath,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            try {
+                await this.deleteUpload(dataPath, resolved);
+            }
+            catch (cleanupError) {
+                logger.warn("Failed to clean up primary upload after metadata failure", {
+                    id,
+                    dataPath,
+                    error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError),
+                });
+            }
+            throw error;
+        }
+        return blobRef;
+    }
+    async getStream(id) {
+        const resolved = this.resolveConfig();
+        return this.downloadUpload(this.getDataPath(id, resolved.prefix), resolved);
+    }
+    async getText(id) {
+        const stream = await this.getStream(id);
+        if (!stream)
+            return null;
+        return new dntShim.Response(stream).text();
+    }
+    async getBytes(id) {
+        const stream = await this.getStream(id);
+        if (!stream)
+            return null;
+        return new Uint8Array(await new dntShim.Response(stream).arrayBuffer());
+    }
+    async delete(id) {
+        const resolved = this.resolveConfig();
+        await Promise.all([
+            this.deleteUpload(this.getMetadataPath(id, resolved.prefix), resolved, {
+                ignoreNotFound: true,
+            }),
+            this.deleteUpload(this.getDataPath(id, resolved.prefix), resolved, { ignoreNotFound: true }),
+        ]);
+    }
+    async exists(id) {
+        return (await this.stat(id)) !== null;
+    }
+    async stat(id) {
+        const resolved = this.resolveConfig();
+        const dataPath = this.getDataPath(id, resolved.prefix);
+        const metadataPath = this.getMetadataPath(id, resolved.prefix);
+        const metadataJson = await this.downloadUploadText(metadataPath, resolved);
+        if (metadataJson) {
+            try {
+                const ref = mapBlobMetadataToRef(BlobMetadataSchema.parse(JSON.parse(metadataJson)));
+                return await attachSignedUrl(ref, dataPath, resolved, this.getDownloadUrl.bind(this));
+            }
+            catch (error) {
+                logger.warn("Failed to parse blob metadata sidecar, falling back to upload metadata", {
+                    id,
+                    metadataPath,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        const upload = await this.getUploadMetadata(dataPath, resolved);
+        if (!upload)
+            return null;
+        const ref = mapUploadMetadataToRef(upload, id);
+        return await attachSignedUrl(ref, dataPath, resolved, this.getDownloadUrl.bind(this));
+    }
+    resolveConfig() {
+        const apiBaseUrl = this.config.apiBaseUrl ?? getVeryfrontCloudBootstrap().apiBaseUrl;
+        const apiToken = this.config.apiToken ?? getVeryfrontCloudAuthToken();
+        const projectSlug = this.config.projectSlug ?? getVeryfrontCloudProjectSlug();
+        if (!apiToken) {
+            throw CONFIG_INVALID.create({
+                detail: "VeryfrontCloudBlobStorage requires auth. Set VERYFRONT_API_TOKEN, provide request-scoped Veryfront credentials, or pass apiToken explicitly.",
+            });
+        }
+        if (!projectSlug) {
+            throw CONFIG_INVALID.create({
+                detail: "VeryfrontCloudBlobStorage requires a project slug. Set VERYFRONT_PROJECT_SLUG, provide request-scoped project context, or pass projectSlug explicitly.",
+            });
+        }
+        return {
+            apiBaseUrl,
+            apiToken,
+            projectSlug,
+            prefix: normalizePrefix(this.config.prefix),
+            defaultTtl: this.config.defaultTtl,
+            downloadTtl: this.config.downloadTtl,
+            now: this.config.now ?? (() => new Date()),
+        };
+    }
+    assertSafeBlobId(id) {
+        if (!SAFE_BLOB_ID_PATTERN.test(id)) {
+            throw INVALID_ARGUMENT.create({
+                detail: `Invalid blob id: "${id}". IDs must contain only alphanumeric characters, hyphens, and underscores.`,
+            });
+        }
+    }
+    getDataPath(id, prefix) {
+        this.assertSafeBlobId(id);
+        return `${prefix}${id}${DATA_SUFFIX}`;
+    }
+    getMetadataPath(id, prefix) {
+        this.assertSafeBlobId(id);
+        return `${prefix}${id}${META_SUFFIX}`;
+    }
+    async uploadFile(path, mimeType, size, body, resolved) {
+        const upload = UploadCreateResponseSchema.parse(await this.requestJson("POST", `/projects/${encodeURIComponent(resolved.projectSlug)}/uploads`, resolved, {
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                file_path: path,
+                content_type: mimeType,
+                size,
+            }),
+        }));
+        const headers = new dntShim.Headers(upload.required_headers);
+        if (!headers.has("Content-Type"))
+            headers.set("Content-Type", mimeType);
+        const response = await dntShim.fetch(upload.file_upload_url, {
+            method: "PUT",
+            headers,
+            body,
+        });
+        if (!response.ok) {
+            const errorBody = await response.text().catch(() => "");
+            throw API_ERROR.create({
+                detail: `Veryfront Cloud upload failed for "${path}": ${response.status} ${response.statusText}${errorBody ? ` - ${errorBody}` : ""}`,
+            });
+        }
+    }
+    async getUploadMetadata(path, resolved) {
+        const raw = await this.requestJson("GET", `/projects/${encodeURIComponent(resolved.projectSlug)}/uploads/${encodeURIComponent(path)}`, resolved, {
+            headers: { Accept: "application/json" },
+            allowNotFound: true,
+        });
+        if (!raw)
+            return null;
+        return UploadMetadataResponseSchema.parse(raw);
+    }
+    async deleteUpload(path, resolved, options = {}) {
+        await this.requestJson("DELETE", `/projects/${encodeURIComponent(resolved.projectSlug)}/uploads/${encodeURIComponent(path)}`, resolved, {
+            allowNotFound: options.ignoreNotFound,
+            expectEmptyBody: true,
+        });
+    }
+    async getDownloadUrl(path, resolved) {
+        const ttl = resolved.downloadTtl;
+        const query = ttl ? `?ttl=${encodeURIComponent(String(ttl))}` : "";
+        const raw = await this.requestJson("GET", `/projects/${encodeURIComponent(resolved.projectSlug)}/uploads/${encodeURIComponent(path)}/url${query}`, resolved, { allowNotFound: true });
+        if (!raw)
+            return null;
+        const parsed = UploadSignedUrlResponseSchema.parse(raw);
+        return {
+            signedUrl: parsed.signed_url,
+            expiresAt: new Date(parsed.expires_at),
+        };
+    }
+    async downloadUpload(path, resolved) {
+        const download = await this.getDownloadUrl(path, resolved);
+        if (!download)
+            return null;
+        const response = await dntShim.fetch(download.signedUrl);
+        if (response.status === 404)
+            return null;
+        if (!response.ok) {
+            const errorBody = await response.text().catch(() => "");
+            throw API_ERROR.create({
+                detail: `Veryfront Cloud download failed for "${path}": ${response.status} ${response.statusText}${errorBody ? ` - ${errorBody}` : ""}`,
+            });
+        }
+        return response.body;
+    }
+    async downloadUploadText(path, resolved) {
+        const stream = await this.downloadUpload(path, resolved);
+        if (!stream)
+            return null;
+        return new dntShim.Response(stream).text();
+    }
+    async requestJson(method, path, resolved, options = {}) {
+        const headers = new dntShim.Headers(options.headers);
+        headers.set("Authorization", `Bearer ${resolved.apiToken}`);
+        const response = await dntShim.fetch(joinUrl(resolved.apiBaseUrl, path), {
+            method,
+            headers,
+            body: options.body,
+        });
+        if (options.allowNotFound && response.status === 404) {
+            return null;
+        }
+        if (!response.ok) {
+            const errorBody = await response.text().catch(() => "");
+            throw API_ERROR.create({
+                detail: `Veryfront Cloud request failed: ${method} ${path} -> ${response.status} ${response.statusText}${errorBody ? ` - ${errorBody}` : ""}`,
+            });
+        }
+        if (options.expectEmptyBody || response.status === 204) {
+            return null;
+        }
+        return response.json();
+    }
+}

package/esm/src/workflow/claude-code/agent.d.ts

@@ -15,6 +15,17 @@ export interface AgentConfig {
     model?: string;
     /** Tool mode — maps to SDK permission modes */
     mode?: ClaudeCodeMode;
+    /**
+     * Explicitly opt in to `bypassPermissions` mode (unrestricted filesystem
+     * and shell access with no interactive prompts).
+     *
+     * When `true`, the agent runs with `permissionMode: "bypassPermissions"`
+     * regardless of `mode`. This is a server-side-only flag — it cannot be
+     * set from tool input schemas.
+     *
+     * @default false
+     */
+    bypassPermissions?: boolean;
     /** Maximum conversation turns before stopping */
     maxTurns?: number;
     /** Maximum budget in USD */
@@ -49,6 +60,10 @@ export declare function executeAgent(task: string, config?: AgentConfig): Promis
 /**
  * Create a reusable agent function with preset configuration.
  *
+ * **Security note:** `overrides` cannot set `bypassPermissions` — it is
+ * stripped before execution. Only `defaults` can enable bypass mode, so keep
+ * `defaults` server-controlled and never derived from untrusted input.
+ *
  * @example
  * ```typescript
  * const reviewer = createAgent({

package/esm/src/workflow/claude-code/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../../src/src/workflow/claude-code/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAInE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,+CAA+C;IAC/C,IAAI,CAAC,EAAE,cAAc,CAAC;IAEtB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,4BAA4B;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,6BAA6B;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,+CAA+C;IAC/C,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,wCAAwC;IACxC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,WAAgB,GACvB,OAAO,CAAC,gBAAgB,CAAC,CA+H3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CACzB,QAAQ,GAAE,WAAgB,GACzB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAGtE"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../../src/src/workflow/claude-code/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAInE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,+CAA+C;IAC/C,IAAI,CAAC,EAAE,cAAc,CAAC;IAEtB;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,4BAA4B;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,6BAA6B;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,+CAA+C;IAC/C,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,wCAAwC;IACxC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAiCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,WAAgB,GACvB,OAAO,CAAC,gBAAgB,CAAC,CA+H3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CACzB,QAAQ,GAAE,WAAgB,GACzB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAKtE"}

package/esm/src/workflow/claude-code/agent.js

@@ -12,16 +12,22 @@ import { importClaudeAgentSDK } from "../../platform/compat/opaque-deps.js";
 const logger = baseLogger.component("agent-sdk");
 const DEFAULT_MODEL = "claude-sonnet-4-5-20250929";
 /**
- * Map tool mode to SDK permission mode
+ * Map tool mode to SDK permission mode.
+ *
+ * `bypassPermissions` is only available when explicitly opted in via
+ * `config.bypassPermissions = true` — it cannot be selected from
+ * user-facing tool input schemas.
  */
-function resolvePermissionMode(mode) {
-    switch (mode) {
+function resolvePermissionMode(config) {
+    if (config.bypassPermissions === true) {
+        logger.warn("Agent running with bypassPermissions — unrestricted filesystem and shell access");
+        return "bypassPermissions";
+    }
+    switch (config.mode) {
         case "analysis":
             return "plan"; // read-only
         case "code":
             return "acceptEdits"; // can write files + run commands
-        case "full":
-            return "bypassPermissions"; // all tools, no prompts
         case "custom":
             return "default"; // user controls via allowedTools
         default:
@@ -64,7 +70,7 @@ export async function executeAgent(task, config = {}) {
                 cwd: config.cwd || cwd(),
                 maxTurns: config.maxTurns,
                 maxBudgetUsd: config.maxBudgetUsd,
-                permissionMode: resolvePermissionMode(config.mode),
+                permissionMode: resolvePermissionMode(config),
                 allowedTools: config.allowedTools,
                 additionalDirectories: config.additionalDirectories,
                 systemPrompt: config.systemPrompt
@@ -160,6 +166,10 @@ export async function executeAgent(task, config = {}) {
 /**
  * Create a reusable agent function with preset configuration.
  *
+ * **Security note:** `overrides` cannot set `bypassPermissions` — it is
+ * stripped before execution. Only `defaults` can enable bypass mode, so keep
+ * `defaults` server-controlled and never derived from untrusted input.
+ *
  * @example
  * ```typescript
  * const reviewer = createAgent({
@@ -171,5 +181,8 @@ export async function executeAgent(task, config = {}) {
  * ```
  */
 export function createAgent(defaults = {}) {
-    return (task, overrides = {}) => executeAgent(task, { ...defaults, ...overrides });
+    return (task, overrides = {}) => {
+        const { bypassPermissions: _, ...safeOverrides } = overrides;
+        return executeAgent(task, { ...defaults, ...safeOverrides });
+    };
 }

package/esm/src/workflow/claude-code/event-publisher.d.ts

@@ -35,6 +35,8 @@ export declare class RedisEventPublisher implements ClaudeCodeEventPublisher, Cl
     constructor(config: RedisEventPublisherConfig);
     private ensureInitialized;
     private getChannel;
+    private getPublishClient;
+    private getSubscribeClient;
     publish(event: ClaudeCodeEvent): Promise<void>;
     subscribe(runId: string, handler: ClaudeCodeEventHandler): Promise<() => void>;
     close(): Promise<void>;

package/esm/src/workflow/claude-code/event-publisher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event-publisher.d.ts","sourceRoot":"","sources":["../../../../src/src/workflow/claude-code/event-publisher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AAMpB;;;GAGG;AACH,qBAAa,oBAAqB,YAAW,wBAAwB,EAAE,yBAAyB;IAC9F,OAAO,CAAC,QAAQ,CAAkD;IAClE,OAAO,CAAC,cAAc,CAAqC;IAE3D,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAiBrC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IAW9E,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,IAAI;IAOzD,KAAK,IAAI,IAAI;CAId;AAMD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gBAAgB;IAChB,GAAG,EAAE,MAAM,CAAC;IAEZ,8CAA8C;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAeD,qBAAa,mBAAoB,YAAW,wBAAwB,EAAE,yBAAyB;IAC7F,OAAO,CAAC,MAAM,CAAsC;IACpD,OAAO,CAAC,aAAa,CAA4B;IACjD,OAAO,CAAC,eAAe,CAA4B;IACnD,OAAO,CAAC,WAAW,CAAS;gBAEhB,MAAM,EAAE,yBAAyB;YAQ/B,iBAAiB;IAc/B,OAAO,CAAC,UAAU;IAIZ,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB9C,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IAyB9E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAU7B;AAMD;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,wBAAwB;IAChE,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,UAAU,CAA4D;IAC9E,OAAO,CAAC,MAAM,CAAS;IAEvB;;OAEG;IACH,YAAY,IAAI,cAAc,CAAC,UAAU,CAAC;IAY1C,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAOrC,KAAK,IAAI,IAAI;CAOd;AAMD;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,wBAAwB;IACzD,OAAO,CAAC,QAAQ;gBAAR,QAAQ,EAAE,sBAAsB;IAEpD,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAIrC,KAAK,IAAI,IAAI;CAGd;AAMD;;GAEG;AACH,qBAAa,mBAAoB,YAAW,wBAAwB;IAClE,OAAO,CAAC,UAAU,CAA6B;gBAEnC,GAAG,UAAU,EAAE,wBAAwB,EAAE;IAI/C,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,YAAY,CAAC,SAAS,EAAE,wBAAwB,GAAG,IAAI;IAIvD,eAAe,CAAC,SAAS,EAAE,wBAAwB,GAAG,IAAI;CAM3D;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE;IACP,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,UAAU,CAAC;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,sBAAsB,CAAC;CACnC,GACA,wBAAwB,CAuB1B"}
+{"version":3,"file":"event-publisher.d.ts","sourceRoot":"","sources":["../../../../src/src/workflow/claude-code/event-publisher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AASpB;;;GAGG;AACH,qBAAa,oBAAqB,YAAW,wBAAwB,EAAE,yBAAyB;IAC9F,OAAO,CAAC,QAAQ,CAAkD;IAClE,OAAO,CAAC,cAAc,CAAqC;IAE3D,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAiBrC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IAW9E,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,IAAI;IAOzD,KAAK,IAAI,IAAI;CAId;AAMD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gBAAgB;IAChB,GAAG,EAAE,MAAM,CAAC;IAEZ,8CAA8C;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAeD,qBAAa,mBAAoB,YAAW,wBAAwB,EAAE,yBAAyB;IAC7F,OAAO,CAAC,MAAM,CAAsC;IACpD,OAAO,CAAC,aAAa,CAA4B;IACjD,OAAO,CAAC,eAAe,CAA4B;IACnD,OAAO,CAAC,WAAW,CAAS;gBAEhB,MAAM,EAAE,yBAAyB;YAQ/B,iBAAiB;IAc/B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,kBAAkB;IAOpB,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB9C,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IA4B9E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAY7B;AAMD;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,wBAAwB;IAChE,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,UAAU,CAA4D;IAC9E,OAAO,CAAC,MAAM,CAAS;IAEvB;;OAEG;IACH,YAAY,IAAI,cAAc,CAAC,UAAU,CAAC;IAY1C,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAOrC,KAAK,IAAI,IAAI;CAOd;AAMD;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,wBAAwB;IACzD,OAAO,CAAC,QAAQ;gBAAR,QAAQ,EAAE,sBAAsB;IAEpD,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAIrC,KAAK,IAAI,IAAI;CAGd;AAMD;;GAEG;AACH,qBAAa,mBAAoB,YAAW,wBAAwB;IAClE,OAAO,CAAC,UAAU,CAA6B;gBAEnC,GAAG,UAAU,EAAE,wBAAwB,EAAE;IAI/C,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,YAAY,CAAC,SAAS,EAAE,wBAAwB,GAAG,IAAI;IAIvD,eAAe,CAAC,SAAS,EAAE,wBAAwB,GAAG,IAAI;CAM3D;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE;IACP,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,UAAU,CAAC;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,sBAAsB,CAAC;CACnC,GACA,wBAAwB,CAuB1B"}

package/esm/src/workflow/claude-code/event-publisher.js

@@ -3,6 +3,9 @@
  *
  * Provides different ways to publish Claude Code events for streaming.
  */
+import { logger as baseLogger } from "../../utils/index.js";
+import { INVALID_ARGUMENT } from "../../errors/index.js";
+const logger = baseLogger.component("redis-event-publisher");
 // =============================================================================
 // In-Memory Publisher (for testing/single-process)
 // =============================================================================
@@ -73,35 +76,51 @@ export class RedisEventPublisher {
     getChannel(runId) {
         return `${this.config.channelPrefix}:events:${runId}`;
     }
+    getPublishClient() {
+        if (!this.publishClient) {
+            throw new Error("Redis publish client not initialized");
+        }
+        return this.publishClient;
+    }
+    getSubscribeClient() {
+        if (!this.subscribeClient) {
+            throw new Error("Redis subscribe client not initialized");
+        }
+        return this.subscribeClient;
+    }
     async publish(event) {
         await this.ensureInitialized();
         const channel = event.runId
             ? this.getChannel(event.runId)
             : `${this.config.channelPrefix}:events:global`;
         const message = JSON.stringify(event);
-        await this.publishClient.publish(channel, message);
+        await this.getPublishClient().publish(channel, message);
         if (this.config.debug) {
-            console.log(`[RedisEventPublisher] Published to ${channel}:`, event.type);
+            logger.info("Published event", { channel, eventType: event.type });
         }
     }
     async subscribe(runId, handler) {
         await this.ensureInitialized();
         const channel = this.getChannel(runId);
+        const subscribeClient = this.getSubscribeClient();
         const listener = (message) => {
             try {
-                const event = JSON.parse(message);
+                const parsed = JSON.parse(message);
+                if (!parsed || typeof parsed !== "object")
+                    return;
+                const event = parsed;
                 handler(event);
             }
             catch (error) {
-                console.error("[RedisEventPublisher] Failed to parse event:", error);
+                logger.error("Failed to parse event", error);
             }
         };
-        await this.subscribeClient.subscribe(channel, listener);
+        await subscribeClient.subscribe(channel, listener);
         if (this.config.debug) {
-            console.log(`[RedisEventPublisher] Subscribed to ${channel}`);
+            logger.info("Subscribed to channel", { channel });
         }
         return async () => {
-            await this.subscribeClient.unsubscribe(channel);
+            await subscribeClient.unsubscribe(channel);
         };
     }
     async close() {
@@ -111,6 +130,8 @@ export class RedisEventPublisher {
             this.publishClient?.quit(),
             this.subscribeClient?.quit(),
         ]);
+        this.publishClient = null;
+        this.subscribeClient = null;
         this.initialized = false;
     }
 }
@@ -211,17 +232,17 @@ export function createEventPublisher(options) {
             return new MemoryEventPublisher();
         case "redis":
             if (!options.redisUrl) {
-                throw new Error("Redis URL required for redis publisher");
+                throw INVALID_ARGUMENT.create({ detail: "Redis URL required for redis publisher" });
             }
             return new RedisEventPublisher({ url: options.redisUrl });
         case "callback":
             if (!options.callback) {
-                throw new Error("Callback required for callback publisher");
+                throw INVALID_ARGUMENT.create({ detail: "Callback required for callback publisher" });
             }
             return new CallbackEventPublisher(options.callback);
         case "sse":
             return new SSEEventPublisher();
         default:
-            throw new Error(`Unknown publisher type: ${options.type}`);
+            throw INVALID_ARGUMENT.create({ detail: `Unknown publisher type: ${options.type}` });
     }
 }

package/esm/src/workflow/claude-code/react/use-claude-code-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-claude-code-stream.d.ts","sourceRoot":"","sources":["../../../../../src/src/workflow/claude-code/react/use-claude-code-stream.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,4CAA4C;IAC5C,WAAW,EAAE,OAAO,CAAC;IAErB,2CAA2C;IAC3C,SAAS,EAAE,OAAO,CAAC;IAEnB,+BAA+B;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IAEzB,iCAAiC;IACjC,aAAa,EAAE,MAAM,CAAC;IAEtB,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IAEb,2CAA2C;IAC3C,WAAW,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,GAAG,IAAI,CAAC;IAET,sCAAsC;IACtC,SAAS,EAAE,KAAK,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IAEH,2CAA2C;IAC3C,YAAY,EAAE,KAAK,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IAEH,mCAAmC;IACnC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAEhC,6BAA6B;IAC7B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,iCAAiC;IACjC,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IAEZ,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IAEd,4BAA4B;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,6BAA6B;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,2BAA2B;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,yBAAyB;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,oCAAoC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,gBAAgB;IAChB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,0BAA0B,GAClC,wBAAwB,GAAG;IAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB,CAmNA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,IAAI,CAAC,0BAA0B,EAAE,kBAAkB,GAAG,iBAAiB,CAAC,GAChF;IACD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAGA"}
+{"version":3,"file":"use-claude-code-stream.d.ts","sourceRoot":"","sources":["../../../../../src/src/workflow/claude-code/react/use-claude-code-stream.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASrE;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,4CAA4C;IAC5C,WAAW,EAAE,OAAO,CAAC;IAErB,2CAA2C;IAC3C,SAAS,EAAE,OAAO,CAAC;IAEnB,+BAA+B;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IAEzB,iCAAiC;IACjC,aAAa,EAAE,MAAM,CAAC;IAEtB,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IAEb,2CAA2C;IAC3C,WAAW,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,GAAG,IAAI,CAAC;IAET,sCAAsC;IACtC,SAAS,EAAE,KAAK,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IAEH,2CAA2C;IAC3C,YAAY,EAAE,KAAK,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IAEH,mCAAmC;IACnC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAEhC,6BAA6B;IAC7B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,iCAAiC;IACjC,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IAEZ,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IAEd,4BAA4B;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,6BAA6B;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,2BAA2B;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,yBAAyB;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,oCAAoC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,gBAAgB;IAChB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,0BAA0B,GAClC,wBAAwB,GAAG;IAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB,CAqNA;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,IAAI,CAAC,0BAA0B,EAAE,kBAAkB,GAAG,iBAAiB,CAAC,GAChF;IACD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAGA"}

package/esm/src/workflow/claude-code/react/use-claude-code-stream.js

@@ -5,6 +5,11 @@
  */
 import * as dntShim from "../../../../_dnt.shims.js";
 import { useCallback, useEffect, useRef, useState } from "react";
+import { REQUEST_ERROR } from "../../../errors/index.js";
+/** Default delay before reconnecting after disconnect */
+const DEFAULT_RECONNECT_DELAY_MS = 1_000;
+/** Default maximum number of events to retain in history */
+const DEFAULT_MAX_EVENT_HISTORY = 100;
 /**
  * React hook for streaming Claude Code execution
  *
@@ -41,7 +46,7 @@ import { useCallback, useEffect, useRef, useState } from "react";
  * ```
  */
 export function useClaudeCodeStream(options) {
-    const { url, runId, autoConnect = true, autoReconnect = true, maxReconnectAttempts = 5, reconnectDelay = 1000, keepEventHistory = false, maxEventHistory = 100, onEvent, onConnect, onDisconnect, onError, onComplete, } = options;
+    const { url, runId, autoConnect = true, autoReconnect = true, maxReconnectAttempts = 5, reconnectDelay = DEFAULT_RECONNECT_DELAY_MS, keepEventHistory = false, maxEventHistory = DEFAULT_MAX_EVENT_HISTORY, onEvent, onConnect, onDisconnect, onError, onComplete, } = options;
     const [state, setState] = useState({
         isConnected: false,
         isRunning: false,
@@ -150,7 +155,10 @@ export function useClaudeCodeStream(options) {
         };
         eventSource.onmessage = (e) => {
             try {
-                const event = JSON.parse(e.data);
+                const parsed = JSON.parse(e.data);
+                if (!parsed || typeof parsed !== "object")
+                    return;
+                const event = parsed;
                 processEvent(event);
             }
             catch (error) {
@@ -168,7 +176,7 @@ export function useClaudeCodeStream(options) {
                 }, reconnectDelay * reconnectAttemptsRef.current);
             }
             else {
-                onError?.(new Error("Connection failed"));
+                onError?.(REQUEST_ERROR.create({ detail: "Connection failed" }));
             }
         };
         eventSourceRef.current = eventSource;