Claude restricted execution — 2026-09-26

The source-preview claudeCode() text adapter was checked with the official Linux x64 Claude Code 2.1.282 binary. SHA256: 3afe8535c0cc33f0e24f7b25dab7a1727b8b592196f8496a8bc302ba2161eed3. The native installation and the pinned official npm platform package produced the same executable hash. Other versions and operating systems are not covered by this qualification.

Actual-native offline checks#

The production adapter ran the actual CLI in Bubblewrap with the real home hidden, synthetic OAuth credentials and external networking disabled. A trusted test-only launcher selected a loopback Messages endpoint. It seeded hostile user/project hooks, MCP configuration, memory and fallback settings before launch. No real provider account or external inference was used. The checks passed:

• Partial SSE text arrives through native stream-json without duplicate final text. Input, cache and output counts normalize correctly.
• CLI total_cost_usd maps to apiEquivalentCostUsd; actual costUsd remains absent. The native estimate is not a subscription charge.
• Cancelling after a partial token closes the upstream stream, stops the owned native process group and removes its temporary working directory.
• A model refusal remains on the explicitly selected model. The native runtime may retry that same model; the fixture observed two requests on refusal and no alternative model/account/billing route.
• An unsolicited tool proposal is rejected. Seeded shell/hooks/MCP markers are absent, ambient memory never enters a model request, and the effective API tool inventory is empty.
• No session transcript remains in the selected native account profile.

The harness records cases, binary/adapter hashes and source revision, without credential bodies, headers or raw provider diagnostics. It also runs the metadata-only catalog fixture. Both suites run in a separate Prometheus-only CI job using a checksum-verified native package and an offline container. Test watchdogs do not become production run deadlines.

npm run build
python3 scripts/test-claude-catalog-native.py \
  --binary /absolute/path/to/claude --suite adapter --receipt /tmp/claude.json

Selected local account#

The user authorized inexpensive provider checks. The existing local first-party Claude sign-in reported 14 aliases/resolved IDs, including the exact inexpensive model claude-haiku-4-5-20251001. Only that model was used, for two synthetic requests: a short acknowledgement and cancellation after the first text delta. Both streaming and cancellation passed. No research, email or brand data was sent. No sign-in, subscription setting, execution grant or shared host was changed.

The completed request reported 3,615 input tokens, 54 output tokens, zero cached input tokens and $0.003885 API-equivalent cost. This is the native CLI's estimate, not an actual bill or the two-request total. The cancelled run supplied no final counts, so its usage remains unknown. Both events were accepted and read back from the existing native Usagestat backend in a separate private fixture instance; no replacement usage database or accounting implementation was added.

This evidence qualifies the tested account/model at that time. It does not mark the other reported models as tested, guarantee future quota, or prove that every account can use the same route. Metadata refresh still exposes all native-reported models and does not submit a prompt.

Authentication and deployment#

The adapter invokes the unmodified native CLI with the end user's selected account profile. The runtime owns credential access and refresh; AgenticDriver does not extract OAuth tokens. Application-owned tools remain unavailable on this text adapter. SDK history is replayed as text; native session continuation is not advertised. The controls are not an OS sandbox, and native administrator policy remains authoritative.

Anthropic documents subprocess use with -p, structured/partial streaming, and signal cancellation. It identifies CLI cost fields as client estimates. Programmatic CLI guidance. Restricted mode, safe mode, empty tools/MCP configuration, disabled hooks/memory and session persistence, plus an empty fallback chain are the tested controls. CLI flags, fallback settings.

Current guidance separates noninteractive Agent SDK/claude -p usage from the interactive subscription allowance. Eligible users can opt into a monthly SDK credit; further usage depends on their separately enabled usage credits. The SDK neither enables this billing option nor interprets a saved login as remaining credit. Claude plan and SDK billing.

The Agent SDK documentation still requires prior approval for third-party developers to offer Claude.ai login or rate limits in their products. This local account test does not establish that approval. A conventional hosted application should use the explicit Anthropic API connection unless its provider-approved deployment says otherwise. AgenticDriver does not implement consumer OAuth, pool account credentials, or fall back from a subscription route to an API key. Agent SDK integration requirements, native authentication.