dex-agents-claude-sdk-cli 0.6.0__tar.gz

dex_agents_claude_sdk_cli-0.6.0/LICENSE

@@ -0,0 +1,105 @@
+# License
+
+Copyright (c) 2026 Super Durable, Inc.
+
+Portions of this software are licensed as follows:
+
+- Legacy Materials remain under their original licenses as described in
+  `LEGACY_NOTICES.md`.
+- Third-Party Materials remain under the licenses provided by their owners.
+- The `docs/` and `examples/` directories are not licensed under the
+  Sustainable Use License and retain their existing licensing status.
+- All other material owned or licensable by Super Durable, Inc. is available
+  under the Sustainable Use License below.
+
+See `LEGACY_NOTICES.md` for the applicable legacy and third-party notices.
+
+## Sustainable Use License
+
+Version 1.0
+
+### Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+### Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations below.
+
+### Limitations
+
+You may use or modify the software only for your own internal business purposes
+or for non-commercial or personal use. You may distribute the software or
+provide it to others only if you do so free of charge for non-commercial
+purposes. You may not alter, remove, or obscure any licensing, copyright, or
+other notices of the licensor in the software. Any use of the licensor's
+trademarks is subject to applicable law.
+
+### Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software.
+
+If you or your company make any written claim that the software infringes or
+contributes to infringement of any patent, your patent license for the software
+granted under these terms ends immediately. If your company makes such a claim,
+your patent license ends immediately for work on behalf of your company.
+
+### Notices
+
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms. If you modify the software, you must
+include in any modified copies of the software a prominent notice stating that
+you have modified the software.
+
+### No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+### Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your license will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your license will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your license
+to terminate automatically and permanently.
+
+### No Liability
+
+As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.
+
+### Definitions
+
+The "licensor" is the entity offering these terms.
+
+The "software" is the software the licensor makes available under these terms,
+including any portion of it.
+
+"You" refers to the individual or entity agreeing to these terms.
+
+"Your company" is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
+Control means ownership of substantially all the assets of an entity, or the
+power to direct its management and policies by vote, contract, or otherwise.
+Control can be direct or indirect.
+
+"Your license" is the license granted to you for the software under these
+terms.
+
+"Use" means anything you do with the software requiring your license.
+
+"Trademark" means trademarks, service marks, and similar rights.

dex_agents_claude_sdk_cli-0.6.0/PKG-INFO

@@ -0,0 +1,138 @@
+Metadata-Version: 2.4
+Name: dex-agents-claude-sdk-cli
+Version: 0.6.0
+Summary: The dex-agents-claude-sdk command: a durable Claude Agent SDK agent in your terminal
+Author: Super Durable
+License-Expression: LicenseRef-Sustainable-Use-1.0
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Typing :: Typed
+Requires-Dist: claude-agent-sdk>=0.2.176,<0.3
+Requires-Dist: dex-agents==0.6.0
+Requires-Dist: dex-agents-claude-agent-sdk==0.6.0
+Requires-Dist: dex-agents-cli-core==0.6.0
+Requires-Dist: dex-python-sdk==1.45.0
+Requires-Python: >=3.11
+Project-URL: Homepage, https://github.com/superdurable/dex/tree/main/agents/cli/python/claude-sdk
+Project-URL: Repository, https://github.com/superdurable/dex
+Project-URL: Changelog, https://github.com/superdurable/dex/blob/main/agents/CHANGELOG.md
+Description-Content-Type: text/markdown
+
+# dex-agents-claude-sdk-cli
+
+`dex-agents-claude-sdk-cli` provides the `dex-agents-claude-sdk` command. It
+runs a [Claude Agent SDK](https://github.com/anthropics/claude-agent-sdk-python)
+agent as a durable Dex agent session and chats with it in your terminal. The
+shared CLI core, [`dex-agents-cli-core`](../core/README.md), starts or reuses
+`dexcli dev`, connects the connectors MCP server, and runs the Worker. This
+package only builds the agent with the
+[Claude Agent SDK adapter](../../../python/claude-agent-sdk/README.md).
+
+The TypeScript package `@superdurable/dex-agents-claude-sdk-cli` provides the
+same command with the same behavior.
+
+## Running it
+
+The command needs Python 3.11 or later and an Anthropic API key:
+
+```bash
+export ANTHROPIC_API_KEY=sk-ant-...
+uvx --from dex-agents-claude-sdk-cli dex-agents-claude-sdk
+```
+
+The first run asks the `init` questions and writes
+`~/.dex/agents/claude-sdk.yaml`. Then type a message at the `>` prompt. Approve
+or reject tool calls with `y` or `n`, and press Ctrl-D to exit. The session
+stays in Dex, and the command prints the `--resume` line that continues it.
+See the [CLI core README](../core/README.md#running-a-command) for every
+subcommand and option, and [`agents/cli`](../../README.md) for the
+configuration file.
+
+The command passes its environment to Claude Code unchanged and never stores
+the key.
+
+## Configuration
+
+The model defaults to `claude-opus-5-5`; set `model` in the file or pass
+`--model` to change it. `system_prompt` replaces the default instructions.
+The `claude` section has no options yet, and any key in it is a configuration
+error.
+
+## Local tools
+
+Claude Code's own tools replace the CLI core's `files`, `shell`, and
+`web_fetch` tools. The CLI core's browser tools and connector tools stay.
+
+| `local_tools` group | Claude Code tools | Approval |
+| --- | --- | --- |
+| `files` | `Read`, `Grep`, `Glob` | No |
+| `files` | `Write`, `Edit` | Every call |
+| `shell` | `Bash` | Unless `local_tools.shell.allow` has the whole command text. A background command always waits. |
+| `web_fetch` | `WebFetch` | No |
+
+- Each turn offers only the tools whose group the turn switches on, after
+  the session settings narrow the file. A switched-off group's tools are not
+  offered, and a call of one is refused. One exception: a resumed segment
+  also lists the Claude Code tools the turn already recorded calls of, so the
+  CLI can replay those records; a new call of such a tool is still refused
+  while its group is off.
+- `approval.always` adds approval to any of these tools by name, such as
+  `Read`.
+- Claude Code runs in the workspace. The file tools refuse a path outside it,
+  after resolving `~`, symbolic links, and relative paths, and refuse any
+  path with `..`. A dangling symbolic link counts as the target it would
+  create. A `Glob` pattern or a `Grep` `glob` must not contain `..` at all,
+  and an absolute one must start inside the workspace. `Bash` is not confined:
+  an approved command runs with your permissions.
+- Claude Code reads no settings files, so their allow rules cannot skip an
+  approval. Its other tools, such as subagents, are not offered.
+- The command uses only these Claude Code tools, the CLI core's browser
+  tools, and the connector tools. It loads no MCP servers and no claude.ai
+  connectors from your Claude Code configuration or login, such as a
+  workspace `.mcp.json` or the Gmail connector of a claude.ai account.
+  External tools come only from the Dex connectors, which Dex approves and
+  records as Steps.
+- An approved call is checked again in its tool Step, on the Worker that runs
+  it, with that Worker's configuration file narrowed by the turn's session
+  settings. It fails without running when its group is off there or its path
+  is outside the workspace, and the model sees why. The session settings
+  count as the turn started with them, so a change takes effect from the next
+  turn.
+- These tools run inside the Claude Code CLI, not in their own Dex Steps. A
+  Worker that dies during a turn segment runs the segment again, so a tool
+  call in it can run twice. Connector and browser tools run in their own
+  Steps and are recorded.
+
+## Images
+
+`/image <path>` attaches an image file to the next message. The command gives
+the Claude Agent SDK adapter the media store of `media.store`, so the model sees the
+image, and images that tools return go to the same store. See
+[Images](../../README.md#images).
+
+## Development
+
+Develop with uv 0.12.2. The package resolves `dex-agents`, the adapter, and
+the CLI core from this repository by path. `ci.sh` installs the locked
+dependencies, checks lint and types, and runs the tests against a private
+`dexcli dev`:
+
+```bash
+cd agents/cli/python/claude-sdk
+DEXCLI=/path/to/dexcli ./ci.sh
+```
+
+The tests run the command in a pseudo-terminal with a private home. The
+bundled Claude Code CLI calls `tests/mock_messages_api.py`, a scripted
+Messages API on 127.0.0.1; a refused proxy stops any other request. A fake
+connectors MCP server serves a connector read and write. The tests cover a
+chat turn and `--resume`, a connector read and an approved connector write
+that runs once, `Read`, `Glob`, `Grep`, and `WebFetch` without approval,
+`Write`, `Edit`, and `Bash` after approval, an allow-listed command run in the
+workspace and an allow-listed background command that still waits, paths and
+patterns that leave the workspace, a dangling link to outside, session
+settings that switch the shell off, an approved call that the Worker running
+it refuses after its file switched the group off, and the environment that
+reaches Claude Code with and without a key.

dex_agents_claude_sdk_cli-0.6.0/README.md

@@ -0,0 +1,116 @@
+# dex-agents-claude-sdk-cli
+
+`dex-agents-claude-sdk-cli` provides the `dex-agents-claude-sdk` command. It
+runs a [Claude Agent SDK](https://github.com/anthropics/claude-agent-sdk-python)
+agent as a durable Dex agent session and chats with it in your terminal. The
+shared CLI core, [`dex-agents-cli-core`](../core/README.md), starts or reuses
+`dexcli dev`, connects the connectors MCP server, and runs the Worker. This
+package only builds the agent with the
+[Claude Agent SDK adapter](../../../python/claude-agent-sdk/README.md).
+
+The TypeScript package `@superdurable/dex-agents-claude-sdk-cli` provides the
+same command with the same behavior.
+
+## Running it
+
+The command needs Python 3.11 or later and an Anthropic API key:
+
+```bash
+export ANTHROPIC_API_KEY=sk-ant-...
+uvx --from dex-agents-claude-sdk-cli dex-agents-claude-sdk
+```
+
+The first run asks the `init` questions and writes
+`~/.dex/agents/claude-sdk.yaml`. Then type a message at the `>` prompt. Approve
+or reject tool calls with `y` or `n`, and press Ctrl-D to exit. The session
+stays in Dex, and the command prints the `--resume` line that continues it.
+See the [CLI core README](../core/README.md#running-a-command) for every
+subcommand and option, and [`agents/cli`](../../README.md) for the
+configuration file.
+
+The command passes its environment to Claude Code unchanged and never stores
+the key.
+
+## Configuration
+
+The model defaults to `claude-opus-5-5`; set `model` in the file or pass
+`--model` to change it. `system_prompt` replaces the default instructions.
+The `claude` section has no options yet, and any key in it is a configuration
+error.
+
+## Local tools
+
+Claude Code's own tools replace the CLI core's `files`, `shell`, and
+`web_fetch` tools. The CLI core's browser tools and connector tools stay.
+
+| `local_tools` group | Claude Code tools | Approval |
+| --- | --- | --- |
+| `files` | `Read`, `Grep`, `Glob` | No |
+| `files` | `Write`, `Edit` | Every call |
+| `shell` | `Bash` | Unless `local_tools.shell.allow` has the whole command text. A background command always waits. |
+| `web_fetch` | `WebFetch` | No |
+
+- Each turn offers only the tools whose group the turn switches on, after
+  the session settings narrow the file. A switched-off group's tools are not
+  offered, and a call of one is refused. One exception: a resumed segment
+  also lists the Claude Code tools the turn already recorded calls of, so the
+  CLI can replay those records; a new call of such a tool is still refused
+  while its group is off.
+- `approval.always` adds approval to any of these tools by name, such as
+  `Read`.
+- Claude Code runs in the workspace. The file tools refuse a path outside it,
+  after resolving `~`, symbolic links, and relative paths, and refuse any
+  path with `..`. A dangling symbolic link counts as the target it would
+  create. A `Glob` pattern or a `Grep` `glob` must not contain `..` at all,
+  and an absolute one must start inside the workspace. `Bash` is not confined:
+  an approved command runs with your permissions.
+- Claude Code reads no settings files, so their allow rules cannot skip an
+  approval. Its other tools, such as subagents, are not offered.
+- The command uses only these Claude Code tools, the CLI core's browser
+  tools, and the connector tools. It loads no MCP servers and no claude.ai
+  connectors from your Claude Code configuration or login, such as a
+  workspace `.mcp.json` or the Gmail connector of a claude.ai account.
+  External tools come only from the Dex connectors, which Dex approves and
+  records as Steps.
+- An approved call is checked again in its tool Step, on the Worker that runs
+  it, with that Worker's configuration file narrowed by the turn's session
+  settings. It fails without running when its group is off there or its path
+  is outside the workspace, and the model sees why. The session settings
+  count as the turn started with them, so a change takes effect from the next
+  turn.
+- These tools run inside the Claude Code CLI, not in their own Dex Steps. A
+  Worker that dies during a turn segment runs the segment again, so a tool
+  call in it can run twice. Connector and browser tools run in their own
+  Steps and are recorded.
+
+## Images
+
+`/image <path>` attaches an image file to the next message. The command gives
+the Claude Agent SDK adapter the media store of `media.store`, so the model sees the
+image, and images that tools return go to the same store. See
+[Images](../../README.md#images).
+
+## Development
+
+Develop with uv 0.12.2. The package resolves `dex-agents`, the adapter, and
+the CLI core from this repository by path. `ci.sh` installs the locked
+dependencies, checks lint and types, and runs the tests against a private
+`dexcli dev`:
+
+```bash
+cd agents/cli/python/claude-sdk
+DEXCLI=/path/to/dexcli ./ci.sh
+```
+
+The tests run the command in a pseudo-terminal with a private home. The
+bundled Claude Code CLI calls `tests/mock_messages_api.py`, a scripted
+Messages API on 127.0.0.1; a refused proxy stops any other request. A fake
+connectors MCP server serves a connector read and write. The tests cover a
+chat turn and `--resume`, a connector read and an approved connector write
+that runs once, `Read`, `Glob`, `Grep`, and `WebFetch` without approval,
+`Write`, `Edit`, and `Bash` after approval, an allow-listed command run in the
+workspace and an allow-listed background command that still waits, paths and
+patterns that leave the workspace, a dangling link to outside, session
+settings that switch the shell off, an approved call that the Worker running
+it refuses after its file switched the group off, and the environment that
+reaches Claude Code with and without a key.

dex_agents_claude_sdk_cli-0.6.0/pyproject.toml

@@ -0,0 +1,113 @@
+[project]
+name = "dex-agents-claude-sdk-cli"
+version = "0.6.0"
+description = "The dex-agents-claude-sdk command: a durable Claude Agent SDK agent in your terminal"
+readme = "README.md"
+license = "LicenseRef-Sustainable-Use-1.0"
+license-files = ["LICENSE"]
+requires-python = ">=3.11"
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Typing :: Typed",
+]
+dependencies = [
+    "claude-agent-sdk>=0.2.176,<0.3",
+    "dex-agents==0.6.0",
+    "dex-agents-claude-agent-sdk==0.6.0",
+    "dex-agents-cli-core==0.6.0",
+    "dex-python-sdk==1.45.0",
+]
+
+[[project.authors]]
+name = "Super Durable"
+
+[project.scripts]
+dex-agents-claude-sdk = "dex_agents_claude_sdk_cli:run"
+
+[project.urls]
+Homepage = "https://github.com/superdurable/dex/tree/main/agents/cli/python/claude-sdk"
+Repository = "https://github.com/superdurable/dex"
+Changelog = "https://github.com/superdurable/dex/blob/main/agents/CHANGELOG.md"
+
+[dependency-groups]
+dev = [
+    "mypy>=1.15,<2",
+    "pexpect>=4.9,<5",
+    "pytest>=8.3,<9",
+    "pytest-asyncio>=0.26,<2",
+    "ruff>=0.8,<0.9",
+]
+
+[build-system]
+requires = ["uv_build>=0.12.2,<0.13"]
+build-backend = "uv_build"
+
+[tool.uv]
+required-version = "==0.12.2"
+
+[tool.uv.sources.dex-agents]
+path = "../../../python/core"
+editable = true
+
+[tool.uv.sources.dex-agents-claude-agent-sdk]
+path = "../../../python/claude-agent-sdk"
+editable = true
+
+[tool.uv.sources.dex-agents-cli-core]
+path = "../core"
+editable = true
+
+[tool.ruff]
+target-version = "py311"
+line-length = 100
+
+[tool.ruff.lint]
+select = [
+    "E",
+    "F",
+    "W",
+    "I",
+    "B",
+    "UP",
+    "ASYNC",
+    "RUF",
+]
+ignore = [
+    "ASYNC109",
+    "ASYNC110",
+    "ASYNC220",
+    "ASYNC221",
+]
+
+[tool.ruff.lint.isort]
+known-first-party = [
+    "dex_agents",
+    "dex_agents_claude_agent_sdk",
+    "dex_agents_claude_sdk_cli",
+    "dex_agents_cli_core",
+    "tests",
+]
+
+[tool.mypy]
+python_version = "3.11"
+strict = true
+files = [
+    "src",
+    "tests",
+]
+
+[[tool.mypy.overrides]]
+module = [
+    "pexpect",
+    "pexpect.*",
+]
+ignore_missing_imports = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["."]
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "session"
+asyncio_default_test_loop_scope = "session"

dex_agents_claude_sdk_cli-0.6.0/pyproject.toml.orig

@@ -0,0 +1,86 @@
+[project]
+name = "dex-agents-claude-sdk-cli"
+# Every agents package shares one version; agents/script/stamp_agents_release_version.py sets it.
+version = "0.6.0"
+description = "The dex-agents-claude-sdk command: a durable Claude Agent SDK agent in your terminal"
+authors = [{name = "Super Durable"}]
+readme = "README.md"
+license = "LicenseRef-Sustainable-Use-1.0"
+license-files = ["LICENSE"]
+requires-python = ">=3.11"
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Typing :: Typed",
+]
+dependencies = [
+    "claude-agent-sdk>=0.2.176,<0.3",
+    "dex-agents==0.6.0",
+    "dex-agents-claude-agent-sdk==0.6.0",
+    "dex-agents-cli-core==0.6.0",
+    "dex-python-sdk==1.45.0",
+]
+
+[project.scripts]
+dex-agents-claude-sdk = "dex_agents_claude_sdk_cli:run"
+
+[project.urls]
+Homepage = "https://github.com/superdurable/dex/tree/main/agents/cli/python/claude-sdk"
+Repository = "https://github.com/superdurable/dex"
+Changelog = "https://github.com/superdurable/dex/blob/main/agents/CHANGELOG.md"
+
+[dependency-groups]
+dev = [
+    "mypy>=1.15,<2",
+    "pexpect>=4.9,<5",
+    "pytest>=8.3,<9",
+    "pytest-asyncio>=0.26,<2",
+    "ruff>=0.8,<0.9",
+]
+
+[build-system]
+requires = ["uv_build>=0.12.2,<0.13"]
+build-backend = "uv_build"
+
+[tool.uv]
+required-version = "==0.12.2"
+
+[tool.uv.sources]
+dex-agents = { path = "../../../python/core", editable = true }
+dex-agents-claude-agent-sdk = { path = "../../../python/claude-agent-sdk", editable = true }
+dex-agents-cli-core = { path = "../core", editable = true }
+
+[tool.ruff]
+target-version = "py311"
+line-length = 100
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "B", "UP", "ASYNC", "RUF"]
+# Test helpers poll files and spawn children on purpose.
+ignore = ["ASYNC109", "ASYNC110", "ASYNC220", "ASYNC221"]
+
+[tool.ruff.lint.isort]
+known-first-party = [
+    "dex_agents",
+    "dex_agents_claude_agent_sdk",
+    "dex_agents_claude_sdk_cli",
+    "dex_agents_cli_core",
+    "tests",
+]
+
+[tool.mypy]
+python_version = "3.11"
+strict = true
+files = ["src", "tests"]
+
+[[tool.mypy.overrides]]
+module = ["pexpect", "pexpect.*"]
+ignore_missing_imports = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["."]
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "session"
+asyncio_default_test_loop_scope = "session"

dex_agents_claude_sdk_cli-0.6.0/src/dex_agents_claude_sdk_cli/__init__.py

@@ -0,0 +1,65 @@
+# Copyright (c) 2026 Super Durable, Inc.
+#
+# Licensed under the Sustainable Use License 1.0.
+# You may not use this file except in compliance with the License.
+# See the LICENSE file in the repository root.
+#
+# SPDX-License-Identifier: LicenseRef-Sustainable-Use-1.0
+
+"""The ``dex-agents-claude-sdk`` command: a Claude Agent SDK agent in the terminal.
+
+It builds the agent session Flow with the Claude Agent SDK adapter and runs
+it with the shared Dex Agents CLI core. See the package README.
+"""
+
+import dex_agents_cli_core  # noqa: F401  # first: it configures gRPC before anything imports it
+
+# isort: split
+
+import sys
+
+from dex_agents_claude_sdk_cli.harness import (
+    CLAUDE_CODE_LOCAL_TOOLS,
+    CLAUDE_SDK_CLI_FLOW_TYPE,
+    DEFAULT_CLAUDE_MODEL,
+    DEFAULT_INSTRUCTIONS,
+    ClaudeCodeLocalTools,
+    ClaudeSdkHarness,
+    validate_claude_section,
+)
+from dex_agents_cli_core import ConfigError, command_name, run_agent_cli
+
+__all__ = [
+    "CLAUDE_CODE_LOCAL_TOOLS",
+    "CLAUDE_SDK_CLI_FLOW_TYPE",
+    "DEFAULT_CLAUDE_MODEL",
+    "DEFAULT_INSTRUCTIONS",
+    "ClaudeCodeLocalTools",
+    "ClaudeSdkHarness",
+    "main",
+    "run",
+    "validate_claude_section",
+]
+
+
+def main(argv: list[str] | None = None) -> int:
+    """Run the command and return its exit code.
+
+    Args:
+        argv: The arguments without the program name; ``None`` reads ``sys.argv``.
+
+    Returns:
+        0 on success, 1 for a failure at run time, and 2 for a usage or
+        configuration error, such as a key in the ``claude`` section.
+    """
+    harness = ClaudeSdkHarness()
+    try:
+        return run_agent_cli(harness, argv)
+    except ConfigError as error:
+        print(f"{command_name(harness)}: {error}", file=sys.stderr)
+        return 2
+
+
+def run() -> None:
+    """Run the command from its console script and exit with its code."""
+    raise SystemExit(main())

dex_agents_claude_sdk_cli-0.6.0/src/dex_agents_claude_sdk_cli/__main__.py

@@ -0,0 +1,14 @@
+# Copyright (c) 2026 Super Durable, Inc.
+#
+# Licensed under the Sustainable Use License 1.0.
+# You may not use this file except in compliance with the License.
+# See the LICENSE file in the repository root.
+#
+# SPDX-License-Identifier: LicenseRef-Sustainable-Use-1.0
+
+"""``python -m dex_agents_claude_sdk_cli`` runs the ``dex-agents-claude-sdk`` command."""
+
+from dex_agents_claude_sdk_cli import run
+
+if __name__ == "__main__":
+    run()

dex_agents_claude_sdk_cli-0.6.0/src/dex_agents_claude_sdk_cli/harness.py

@@ -0,0 +1,410 @@
+# Copyright (c) 2026 Super Durable, Inc.
+#
+# Licensed under the Sustainable Use License 1.0.
+# You may not use this file except in compliance with the License.
+# See the LICENSE file in the repository root.
+#
+# SPDX-License-Identifier: LicenseRef-Sustainable-Use-1.0
+
+"""The Claude Agent SDK harness: a session Flow with Claude Code's own local tools."""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+from collections.abc import Mapping
+from contextvars import ContextVar
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+import dex_agents_cli_core  # noqa: F401  # first: it configures gRPC before anything imports it
+
+# isort: split
+
+from claude_agent_sdk import ClaudeAgentOptions
+
+from dex_agents import (
+    AgentSessionFlow,
+    AgentSessionOptions,
+    AgentTracingOptions,
+    AgentTurnContext,
+    AgentTurnOutcome,
+    DeferredToolExecution,
+    DeferredToolOutcome,
+    RunModelLimit,
+    ToolEffect,
+    ToolExecutionError,
+    ToolPolicy,
+)
+from dex_agents_claude_agent_sdk import (
+    ClaudeAgentOptionsContext,
+    ClaudeAgentRunner,
+    ClaudeCodeToolDenial,
+)
+from dex_agents_cli_core import (
+    ConfigError,
+    EffectiveConfig,
+    HarnessContext,
+    LocalToolGroup,
+    current_turn_config,
+    is_local_tool_group_enabled,
+    is_shell_command_approval_required,
+    resolve_turn_tool_policy,
+)
+
+#: The Flow type of the command's sessions, before the CLI core namespaces it.
+CLAUDE_SDK_CLI_FLOW_TYPE = "DexAgentsClaudeSdkCliSession"
+
+#: The model the command uses when the configuration file sets none.
+DEFAULT_CLAUDE_MODEL = "claude-opus-5-5"
+
+#: The instructions the agent gets when the configuration sets none.
+DEFAULT_INSTRUCTIONS = (
+    "You are a helpful assistant. Use your tools to work with the files and commands "
+    "in your working directory and with the connected services."
+)
+
+
+@dataclass(frozen=True)
+class _ClaudeCodeLocalTool:
+    group: LocalToolGroup
+    effect: ToolEffect
+    is_approval_required: bool
+    path_argument: str | None
+
+
+# Claude Code's tools that replace the CLI core's files, shell, and web_fetch groups.
+CLAUDE_CODE_LOCAL_TOOLS: Mapping[str, _ClaudeCodeLocalTool] = {
+    "Read": _ClaudeCodeLocalTool(LocalToolGroup.FILES, ToolEffect.READ, False, "file_path"),
+    "Grep": _ClaudeCodeLocalTool(LocalToolGroup.FILES, ToolEffect.READ, False, "path"),
+    "Glob": _ClaudeCodeLocalTool(LocalToolGroup.FILES, ToolEffect.READ, False, "path"),
+    "Write": _ClaudeCodeLocalTool(
+        LocalToolGroup.FILES, ToolEffect.IDEMPOTENT_WRITE, True, "file_path"
+    ),
+    "Edit": _ClaudeCodeLocalTool(
+        LocalToolGroup.FILES, ToolEffect.NON_IDEMPOTENT_WRITE, True, "file_path"
+    ),
+    "Bash": _ClaudeCodeLocalTool(LocalToolGroup.SHELL, ToolEffect.NON_IDEMPOTENT_WRITE, True, None),
+    "WebFetch": _ClaudeCodeLocalTool(LocalToolGroup.WEB_FETCH, ToolEffect.READ, False, None),
+}
+_RUNNING_TURN: ContextVar[AgentTurnContext] = ContextVar("dex_agents_claude_sdk_cli_turn")
+# OSC, then CSI (Claude Code resets the cursor with one on exit), then other escapes.
+_TERMINAL_CONTROL_SEQUENCE = re.compile(
+    r"\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)"
+    r"|\x1b\[[0-?]*[ -/]*[@-~]"
+    r"|\x1b[ -/]*[0-~]"
+    r"|[\x00-\x08\x0b-\x1f\x7f]"
+)
+_GLOB_CHARACTERS = frozenset("*?[{")
+# The input field of each file tool that holds a glob pattern.
+_GLOB_PATTERN_ARGUMENTS = {"Glob": "pattern", "Grep": "glob"}
+
+
+class ClaudeSdkHarness:
+    """The ``dex-agents-claude-sdk`` command: a Claude Agent SDK agent in the terminal.
+
+    Claude Code's own Read, Grep, Glob, Write, Edit, Bash, and WebFetch tools
+    replace the CLI core's ``files``, ``shell``, and ``web_fetch`` groups; the
+    CLI core's browser tools and connector tools stay. Each turn offers only
+    the Claude Code tools whose group the turn switches on, plus, in a
+    resumed segment, the tools of calls the turn already recorded, so their
+    records replay; new calls of a switched-off tool are refused. The
+    workspace is the working directory. Reads run at once, Write, Edit, and
+    Bash wait for approval, and a Bash command whose whole text is in the
+    shell allow list runs at once. File tools refuse paths outside the
+    workspace.
+    """
+
+    name = "claude-sdk"
+    config_section = "claude"
+    flow_type = CLAUDE_SDK_CLI_FLOW_TYPE
+    default_model: str | None = DEFAULT_CLAUDE_MODEL
+    replaced_local_tools = frozenset(
+        {LocalToolGroup.FILES, LocalToolGroup.SHELL, LocalToolGroup.WEB_FETCH}
+    )
+
+    def create_session_flow(self, context: HarnessContext) -> AgentSessionFlow:
+        """Build the Claude agent session Flow from the effective configuration.
+
+        Args:
+            context: The configuration, workspace, and tool sources.
+
+        Returns:
+            The Flow, with ``context.flow_type`` as its type.
+
+        Raises:
+            ConfigError: If the ``claude`` section has a key; it has no options yet.
+        """
+        validate_claude_section(context.harness_options)
+        local_tools = ClaudeCodeLocalTools(context)
+        runner = _ReauthorizingClaudeAgentRunner(
+            context,
+            local_tools,
+            local_tools.build_options,
+            tool_sources=context.tool_sources,
+            claude_code_tool_permission=local_tools.decide_tool_call,
+            media_store=context.media_store,
+        )
+        return AgentSessionFlow(
+            runner,
+            flow_type=context.flow_type,
+            options=AgentSessionOptions(
+                tool_policies={},
+                default_tool_effect=ToolEffect.UNCLASSIFIED,
+                tracing=AgentTracingOptions(),
+                run_model_limit=RunModelLimit(),
+                summary_attributes_indexed=context.is_session_summary_indexed,
+            ),
+        )
+
+
+def validate_claude_section(options: Mapping[str, Any]) -> None:
+    """Reject every key of the ``claude`` section, which has no options yet.
+
+    Args:
+        options: The section, ``{}`` when the file omits it.
+
+    Raises:
+        ConfigError: ``schema`` with the first key's JSON Pointer.
+    """
+    for key in sorted(options):
+        escaped = key.replace("~", "~0").replace("/", "~1")
+        raise ConfigError("schema", f"/claude/{escaped}", keyword="additionalProperties")
+
+
+class ClaudeCodeLocalTools:
+    """Apply the CLI core's local tool rules to Claude Code's own tools."""
+
+    def __init__(self, context: HarnessContext) -> None:
+        """Bind the rules to one command's configuration and workspace.
+
+        Args:
+            context: The harness context.
+        """
+        self._context = context
+        self._workspace = Path(os.path.realpath(context.workspace))
+
+    def build_options(self, options_context: ClaudeAgentOptionsContext) -> ClaudeAgentOptions:
+        """Return one turn segment's options: the turn's model, instructions, and tools.
+
+        .. versionchanged:: 0.6.0
+           The options load no MCP servers or claude.ai connectors from the
+           user's Claude Code configuration or login.
+
+        Args:
+            options_context: The segment's Flow ID, turn ID, and attempt.
+
+        Returns:
+            Options with the Claude Code tools the turn switches on and the
+            tools of calls the turn already recorded, the workspace as
+            ``cwd``, no settings files, and no MCP servers or claude.ai
+            connectors from the user's Claude Code configuration. The environment
+            passes through unchanged, so ``ANTHROPIC_API_KEY`` or the
+            machine's Claude Code login reaches the CLI. The CLI's standard
+            error goes to the command's log file, never to the chat terminal.
+
+        Raises:
+            RuntimeError: Outside a model call, which never happens.
+        """
+        turn = current_turn_config()
+        turn_context = _RUNNING_TURN.get(None)
+        if turn is None or turn_context is None:
+            raise RuntimeError("the Claude options need the running turn's configuration")
+        # A resumed CLI must find a recorded call's tool to replay it; new calls stay denied.
+        recorded_tool_names = {record.tool_name for record in turn_context.tool_calls.values()}
+        return ClaudeAgentOptions(
+            model=turn.model,
+            system_prompt=turn.instructions or DEFAULT_INSTRUCTIONS,
+            tools=[
+                tool_name
+                for tool_name, tool in CLAUDE_CODE_LOCAL_TOOLS.items()
+                if is_local_tool_group_enabled(turn, tool.group) or tool_name in recorded_tool_names
+            ],
+            cwd=str(self._context.workspace),
+            # Settings files could allow tools before the session's policy sees them.
+            setting_sources=[],
+            # External tools come only from the Dex connectors, never the user's MCP config.
+            strict_mcp_config=True,
+            settings=json.dumps({"disableClaudeAiConnectors": True}, separators=(",", ":")),
+            # An inherited terminal would get the CLI's control sequences in the chat.
+            stderr=ClaudeCodeStderrLog.for_command_log().write_line,
+        )
+
+    def decide_tool_call(
+        self, turn: AgentTurnContext, tool_name: str, tool_input: Mapping[str, Any]
+    ) -> ToolPolicy | ClaudeCodeToolDenial | None:
+        """Decide one call of a Claude Code tool in the model call.
+
+        Args:
+            turn: The ``RunModel`` context.
+            tool_name: The tool's Claude Code name.
+            tool_input: The call's input.
+
+        Returns:
+            The call's policy, or a denial for a switched-off tool or a path
+            outside the workspace.
+        """
+        turn_config = self._context.resolve_turn(turn.session_settings)
+        tool = CLAUDE_CODE_LOCAL_TOOLS.get(tool_name)
+        if tool is None:
+            return ClaudeCodeToolDenial(f"{tool_name} is not available in this session")
+        refusal = self.refusal_reason(turn_config, tool_name, tool_input)
+        if refusal is not None:
+            return ClaudeCodeToolDenial(refusal)
+        is_approval_required = tool.is_approval_required
+        if tool_name == "Bash":
+            # A background command outlives the turn, so it always waits for approval.
+            is_approval_required = (
+                is_shell_command_approval_required(turn_config, str(tool_input.get("command", "")))
+                or tool_input.get("run_in_background") is True
+            )
+        return resolve_turn_tool_policy(
+            turn, tool_name, tool.effect, is_approval_required, turn_config
+        )
+
+    def refusal_reason(
+        self, turn_config: EffectiveConfig, tool_name: str, tool_input: Mapping[str, Any]
+    ) -> str | None:
+        """Return why a call of a Claude Code tool must not run, or ``None``.
+
+        Args:
+            turn_config: The configuration of the call's turn.
+            tool_name: The tool's Claude Code name.
+            tool_input: The call's input.
+
+        Returns:
+            The reason when the turn switches the tool's group off or a file
+            tool names a path outside the workspace; ``None`` otherwise.
+        """
+        tool = CLAUDE_CODE_LOCAL_TOOLS.get(tool_name)
+        if tool is None:
+            return None
+        if not is_local_tool_group_enabled(turn_config, tool.group):
+            return f"{tool_name} is switched off for this session"
+        paths = []
+        if tool.path_argument is not None and isinstance(tool_input.get(tool.path_argument), str):
+            paths.append(str(tool_input[tool.path_argument]))
+        pattern_argument = _GLOB_PATTERN_ARGUMENTS.get(tool_name)
+        pattern = None if pattern_argument is None else tool_input.get(pattern_argument)
+        if isinstance(pattern, str):
+            # Brace expansion can produce .. from any part of a pattern, so none may contain it.
+            if ".." in pattern:
+                return f"{tool_name} may only use paths inside the workspace {self._workspace}"
+            paths.append(_glob_base(pattern))
+        for path in paths:
+            if not self._is_inside_workspace(path):
+                return f"{tool_name} may only use paths inside the workspace {self._workspace}"
+        return None
+
+    def _is_inside_workspace(self, path_text: str) -> bool:
+        if ".." in Path(path_text).parts:
+            return False
+        candidate = Path(os.path.expanduser(path_text))
+        if not candidate.is_absolute():
+            candidate = self._workspace / candidate
+        # realpath also follows a dangling link to the target it would create.
+        resolved = Path(os.path.realpath(candidate))
+        return resolved == self._workspace or self._workspace in resolved.parents
+
+
+class ClaudeCodeStderrLog:
+    """Append the Claude Code CLI's standard error lines to the command's log file.
+
+    Each line loses its terminal control sequences and goes to the log in the
+    command's log format. A failed write drops the line: unlike a logging
+    handler, it never reports the failure on the chat terminal.
+    """
+
+    def __init__(self, log_path: Path | None, formatter: logging.Formatter) -> None:
+        """Write to one log file.
+
+        Args:
+            log_path: The log file, or ``None`` to drop every line.
+            formatter: The format of each line, the log file's own.
+        """
+        self._log_path = log_path
+        self._formatter = formatter
+
+    @classmethod
+    def for_command_log(cls) -> ClaudeCodeStderrLog:
+        """Return a log that writes to the file of the root logger's file handler.
+
+        Returns:
+            A log for that file in its handler's format, or one that drops
+            every line when the root logger has no file handler.
+        """
+        for handler in logging.getLogger().handlers:
+            if isinstance(handler, logging.FileHandler):
+                return cls(Path(handler.baseFilename), handler.formatter or logging.Formatter())
+        return cls(None, logging.Formatter())
+
+    def write_line(self, line: str) -> None:
+        """Append one standard error line, without its control sequences.
+
+        Args:
+            line: The line as the CLI wrote it. A line that is empty without
+                its control sequences is dropped.
+        """
+        text = _TERMINAL_CONTROL_SEQUENCE.sub("", line).strip()
+        if not text or self._log_path is None:
+            return
+        record = logging.LogRecord(
+            __name__, logging.INFO, __file__, 0, "Claude Code stderr: %s", (text,), None
+        )
+        try:
+            with self._log_path.open("a", encoding="utf-8") as log_file:
+                log_file.write(self._formatter.format(record) + "\n")
+        except OSError:
+            # The chat terminal must never show this line, so a failed write loses it.
+            return
+
+
+def _glob_base(pattern: str) -> str:
+    """Return the leading directories of a glob pattern, before its first glob character."""
+    parts: list[str] = []
+    for part in Path(pattern).parts:
+        if _GLOB_CHARACTERS & set(part):
+            break
+        parts.append(part)
+    return str(Path(*parts)) if parts else "."
+
+
+class _ReauthorizingClaudeAgentRunner(ClaudeAgentRunner):
+    """Give the options their turn, and check an approved Claude Code tool call in its tool Step."""
+
+    def __init__(
+        self,
+        context: HarnessContext,
+        local_tools: ClaudeCodeLocalTools,
+        *args: Any,
+        **kwargs: Any,
+    ) -> None:
+        super().__init__(*args, **kwargs)
+        self._context = context
+        self._local_tools = local_tools
+
+    async def run_model_step(self, turn: AgentTurnContext) -> AgentTurnOutcome:
+        token = _RUNNING_TURN.set(turn)
+        try:
+            return await super().run_model_step(turn)
+        finally:
+            _RUNNING_TURN.reset(token)
+
+    async def execute_deferred_tool_call(self, call: DeferredToolExecution) -> DeferredToolOutcome:
+        tool_name = call.tool_call.tool_name
+        if tool_name in CLAUDE_CODE_LOCAL_TOOLS:
+            permissions = self._context.resolve_tool_step_permissions(call)
+            refusal = self._local_tools.refusal_reason(
+                permissions, tool_name, _tool_input(call.tool_call.arguments)
+            )
+            if refusal is not None:
+                raise ToolExecutionError(f"{refusal}; the call did not run")
+        return await super().execute_deferred_tool_call(call)
+
+
+def _tool_input(arguments: str) -> Mapping[str, Any]:
+    parsed = json.loads(arguments)
+    return parsed if isinstance(parsed, dict) else {}