feat: add Claude Code CLI adapter

[hculap]

Summary

Adds a Claude Code CLI adapter for Harbor that uses the user's existing OAuth session — no API key needed.

• agent-claude-code.py — Harbor adapter that runs claude CLI on the host machine
• Dockerfile.claude-code — lightweight base image (no Node.js/Claude Code in container)
• program-claude-code.md — meta-agent directive for iterating on this variant

Architecture

Unlike the SDK-based adapters, this variant runs Claude Code CLI on the host (same as agent.py runs OpenAI SDK host-side). The flow:

Host machine                          Docker container
┌──────────────────┐                  ┌──────────────────┐
│ Harbor calls     │                  │ Task environment  │
│ AutoAgent.run()  │──download_dir──> │ /task/files/      │
│                  │                  │ /task/output/     │
│ claude CLI runs  │                  │                   │
│ (OAuth session)  │                  │ Verifier runs     │
│ writes to tmpdir │──upload_dir───>  │ checks /task/     │
└──────────────────┘                  └──────────────────┘

1. Harbor spins up a container per task
2. Adapter downloads pre-existing files from container via download_dir
3. claude --print --output-format stream-json runs host-side in a temp dir
4. Claude reads instruction, writes output files using its own tools
5. Adapter syncs output files back via upload_dir
6. Harbor runs the verifier inside the container

Setup

# 1. Install Claude Code CLI (if not already)
npm install -g @anthropic-ai/claude-code

# 2. Login (uses your existing Claude subscription, no API key)
claude login

# 3. Build the base image
docker build -f Dockerfile.claude-code -t autoagent-base .

# 4. Run tasks
uv run harbor run -p tasks/ --agent-import-path agent-claude-code:AutoAgent -o jobs

No .env file, no ANTHROPIC_API_KEY, no API billing — uses your Claude subscription via OAuth.

Test results

Full Docker + Harbor e2e pipeline with 4 baseline tasks (hello-world, fibonacci, csv-analysis, git-log):

Task	Score	Turns	Cost	Duration
hello-world	1.0	2	$0.05	7s
fibonacci	1.0	3	$0.05	14s
csv-analysis	1.0	3	$0.05	13s
git-log	1.0	2	$0.04	15s
Total	4/4		$0.19	36s

Note: These are baseline validation tasks to prove the adapter works end-to-end
through the full Harbor pipeline. Real benchmark results (e.g. swe-bench-verified,
featurebench, dabstep) would be a natural next step for contributor testing.

Safety & timeout controls

Control	Default	Purpose
MAX_TURNS	30	Limits conversation turns
MAX_BUDGET_USD	1.0	Cost cap per task
TIMEOUT_SEC	540	Hard kill after 9 minutes
PERMISSION_MODE	bypassPermissions	Configurable permission level

Security note: The CLI runs on the host (not sandboxed in Docker) with bypassPermissions.
Only run on trusted task sets.

Meta-agent iteration surface

The editable section exposes:

• SYSTEM_PROMPT — agent instructions
• MODEL — sonnet/haiku/opus
• MAX_TURNS — turn budget
• MAX_BUDGET_USD — cost cap per task
• TIMEOUT_SEC — hard timeout for CLI process
• PERMISSION_MODE — CLI permission level
• ALLOWED_TOOLS — restrict Claude's tool set
• CLI_EXTRA_FLAGS — additional CLI flags
• build_cli_args() — full CLI invocation strategy

Test plan

• Build Dockerfile and verify imports
• Run single task locally with claude --print
• Verify ATIF-v1.6 trajectory format
• Full Harbor e2e: 4/4 baseline tasks pass with Docker pipeline
• Run on real benchmark suite (contributor testing)

🤖 Generated with Claude Code

[hculap]

@kevinrgu Hey! Would love your review on this. Adds a Claude Code CLI adapter that uses OAuth (no API key needed). 4/4 Harbor e2e tasks pass. Happy to run on a real benchmark suite if you point me to one.