# Claude restricted execution — 2026-09-26

The source-preview `claudeCode()` text adapter was checked with the official
Linux x64 **Claude Code 2.1.282** binary. SHA256:
`3afe8535c0cc33f0e24f7b25dab7a1727b8b592196f8496a8bc302ba2161eed3`.
The native installation and the pinned official npm platform package produced
the same executable hash. Other versions and operating systems are not covered
by this qualification.

## Actual-native offline checks

The production adapter ran the actual CLI in Bubblewrap with the real home
hidden, synthetic OAuth credentials and external networking disabled. A trusted
test-only launcher selected a loopback Messages endpoint. It seeded hostile
user/project hooks, MCP configuration, memory and fallback settings before launch.
No real provider account or external inference was used. The checks passed:

- Partial SSE text arrives through native `stream-json` without duplicate final
  text. Input, cache and output counts normalize correctly.
- CLI `total_cost_usd` maps to `apiEquivalentCostUsd`; actual `costUsd` remains
  absent. The native estimate is not a subscription charge.
- Cancelling after a partial token closes the upstream stream, stops the owned
  native process group and removes its temporary working directory.
- A model refusal remains on the explicitly selected model. The native runtime
  may retry that same model; the fixture observed two requests on refusal and
  no alternative model/account/billing route.
- An unsolicited tool proposal is rejected. Seeded shell/hooks/MCP markers are
  absent, ambient memory never enters a model request, and the effective API
  tool inventory is empty.
- No session transcript remains in the selected native account profile.

The harness records cases, binary/adapter hashes and source revision, without
credential bodies, headers or raw provider diagnostics. It also runs the
[metadata-only catalog fixture](/docs/validation/claude-catalog-2026-09-26). Both suites run in
a separate Prometheus-only CI job using a checksum-verified native package and
an offline container. Test watchdogs do not become production run deadlines.

```sh
npm run build
python3 scripts/test-claude-catalog-native.py \
  --binary /absolute/path/to/claude --suite adapter --receipt /tmp/claude.json
```

## Selected local account

The user authorized inexpensive provider checks. The existing local first-party
Claude sign-in reported 14 aliases/resolved IDs, including the exact inexpensive
model **`claude-haiku-4-5-20251001`**. Only that model was used, for two synthetic
requests: a short acknowledgement and cancellation after the first text delta.
Both streaming and cancellation passed. No research, email or brand data was sent.
No sign-in, subscription setting, execution grant or shared host was changed.

The completed request reported 3,615 input tokens, 54 output tokens, zero cached
input tokens and **$0.003885 API-equivalent cost**. This is the native CLI's
estimate, not an actual bill or the two-request total. The cancelled run supplied
no final counts, so its usage remains unknown. Both events were accepted and read
back from the existing native Usagestat backend in a separate private fixture
instance; no replacement usage database or accounting implementation was added.

This evidence qualifies the tested account/model at that time. It does not mark
the other reported models as tested, guarantee future quota, or prove that every
account can use the same route. Metadata refresh still exposes all native-reported
models and does not submit a prompt.

## Authentication and deployment

The adapter invokes the unmodified native CLI with the end user's selected
account profile. The runtime owns credential access and refresh; AgenticDriver
does not extract OAuth tokens. Application-owned tools remain unavailable on
this text adapter. SDK history is replayed as text; native session continuation
is not advertised. The controls are not an OS sandbox, and native administrator
policy remains authoritative.

Anthropic documents subprocess use with `-p`, structured/partial streaming, and
signal cancellation. It identifies CLI cost fields as client estimates.
[Programmatic CLI guidance](https://code.claude.com/docs/en/headless).
Restricted mode, safe mode, empty tools/MCP configuration, disabled hooks/memory
and session persistence, plus an empty fallback chain are the tested controls.
[CLI flags](https://code.claude.com/docs/en/cli-reference),
[fallback settings](https://code.claude.com/docs/en/model-config#automatic-model-fallback).

Current guidance separates noninteractive Agent SDK/`claude -p` usage from the
interactive subscription allowance. Eligible users can opt into a monthly SDK
credit; further usage depends on their separately enabled usage credits. The SDK
neither enables this billing option nor interprets a saved login as remaining
credit. [Claude plan and SDK billing](https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan).

The Agent SDK documentation still requires prior approval for third-party
developers to offer Claude.ai login or rate limits in their products. This local
account test does not establish that approval. A conventional hosted application
should use the explicit Anthropic API connection unless its provider-approved
deployment says otherwise. AgenticDriver does not implement consumer OAuth,
pool account credentials, or fall back from a subscription route to an API key.
[Agent SDK integration requirements](https://code.claude.com/docs/en/agent-sdk/overview),
[native authentication](https://code.claude.com/docs/en/iam).