Run Claude Code with its native tools and prompt

[SaladDay]

Summary

Claude Code now runs with its native defaults. The adapter overrides a native default only where unattended cloud operation needs it, and each override carries its reason in the adapter.

• Workspace placements:
  • The native claude_code tool preset runs, minus the tools that can't work unattended:
    • AskUserQuestion (no one answers).
    • CronCreate/CronDelete/CronList, ScheduleWakeup, Monitor and Workflow (no Turn leaves scheduled, monitoring or workflow work behind).
    • ListAgents (it reaches other Sessions' native processes on the host).
  • Agent and SendMessage are present only with Subagent observation. A workspace oac_worker inherits the parent's native tools.
  • WebSearch and WebFetch are present unless the Session sets web_search mode: disabled.
  • Native setting sources and MCP discovery load as they do locally.
  • Native telemetry and error reporting are restored.
  • At initialization, every tool Core declared must be present: functions, selected MCP tools, Skill, ToolSearch, StructuredOutput, and Task/SendMessage with Subagents, plus every declared Skill in the init skill list. Native settings may add tools but cannot remove these; a project that disables Core's Skill plugin fails the Turn.
• environment: none: still keeps no built-in tools, strict MCP configuration and empty setting sources, since the host's settings, memory files and MCP servers belong to no Session.
• Every placement: the auto-updater and background tasks stay off through flag settings, which outrank user and project settings, so no settings file can turn them back on.
• System prompt: on a workspace, the native claude_code preset with the Agent's instructions appended. On environment: none the instructions stay the whole prompt, because the preset describes tools that profile does not have.
• Search Items: native WebSearch and WebFetch calls are projected as web_search_call Items with search and open_page actions.
• MCP allowed_tools subsets:
  • Before start, the adapter lists each subset server's tools with that server's own bearer and passes the unselected ones in native disallowedTools, so the model never sees them.
  • The PreToolUse hook still denies anything unselected.
  • A failed listing, or a listing that repeats a cursor, fails the Turn.
  • The bridge starts with Node's --use-env-proxy, so the listing honours the operator's proxy while native tools, which do not inherit the flag, keep their local environment. The bridge's readiness check now requires Node 22.21 or 24.5, the first versions with the flag, and the build script's separate Node 20 check is gone. Shipped Runtimes use 22.22.0 and 22.23.1.
• Repository trust: a workspace loads the repository's native Claude Code settings and hooks, as a local run does, so they run with the Session's provider key. The model's commands could already read that key. The model execution contract now says to attach only repositories trusted with the key; keeping provider keys out of the workspace altogether is a separate change.
• MiniMax Code: drops the permissionMode and sandbox overrides, which equal the native defaults.
• The compatibility notes, tool policy, environments, subagents and Harness onboarding pages (EN and zh), the adapter README and the MiniMax Code Runtime guide describe the new behavior.

Checks

• pnpm test in packages/claude-sdk-adapter: 179 passed. This includes a two-server bearer isolation test against real local MCP servers and the workspace function-presence check.

• go vet and go test for claudesdk, mcode and harnessconfig.

• Native probe against a fake model API: a project .claude/settings.json that sets CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=0 brings back Bash run_in_background without flag settings; with them the parameter stays absent.

• make check-docs and the website translation tests.

• Live at 5996e557: TestLiveClaudeWorkspaceFactory with MiniMax-M3 through MiniMax's Anthropic endpoint, Claude Code 2.1.269, Node 22.22.2. These steps passed with the native preset and appended instructions:

  • Native Bash success and failure observations.
  • Cancellation once the command's effect was visible; the effects stopped.
  • Continuation of the same native Session in a fresh process using native Read and Edit.

  Two steps fail identically on baseline 867eb97f, so they predate this change and are left for a follow-up:

  • The workspace directory lister lists symlinked directories that the test expects it to deny.
  • The missing-history step: the previous Turn's native process appends its last transcript entries after the Turn reports done. Those entries recreate the history in the emptied state directory.

• Not run: public-API acceptance through Core on a workspace placement. It needs a hosted Docker or self-hosted Linux node running this revision.