feat(harness): Initial Claude Code Support by supreme-gg-gg · Pull Request #2602 · kagent-dev/kagent

supreme-gg-gg · 2026-08-27T17:41:12Z

Basic support for running Claude Code on Substrate and add extensible interfaces for future harness like Codex.

Add a native Claude harness that runs the pinned Claude Code CLI and supports A2A streaming, cancellation, session resume, and durable state.
Add Claude template compilation for Anthropic, Amazon Bedrock, and Vertex AI, and shared local subagents
Add Claude support for remote MCP servers, standalone skills, and plugin-provided skills, with runtime-neutral resource materialization and configuration warnings.
Wire the Claude harness into the controller and build/release pipelines, including its container image and configurable controller logging.
Add comprehensive unit and E2E coverage for Claude interactions, persistence, fork and resume, cancellation, built-in tools, subagent routing, and MCP calls.
Merge adjacent streamed text parts in the UI so Claude responses render as continuous messages.

supreme-gg-gg · 2026-08-27T21:32:00Z

+- [x] Durable Claude session resume between turns
+- [x] Claude Code built-in tools
+- [x] Shared local subagents
+- [x] Standalone skills and plugin-provided skills


Note to reviewer: This short list summarizes what has been done and what will come next for Claude harness.
Plugin provided skills are not entirely working due to #2604

supreme-gg-gg · 2026-08-27T22:01:54Z

Codex review

[P1] Terminate the entire Claude process group — go/harness/claude/internal/driver/process.go:206-213

When a turn is canceled or parsing/event delivery fails while Claude has spawned a built-in tool process, signaling and killing only cmd.Process leaves its child processes running. Those orphaned commands can continue modifying the durable workspace or consuming resources after the task is reported canceled; start Claude in its own process group and terminate the group instead.

When I was working on #2602 I noticed some UI code was redundant after removal in #2598. This PR removes them --------- Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

Charlesthebird

I tested the UI fixes here and they are working well 🎉 - I haven't tested the claude harness parts though.

EItanya

Initial review

EItanya · 2026-08-29T15:05:30Z

There is too much happening in this PR for a focused review. Please split the ToolService / RemoteMCPServer / MCPServer changes into a separate PR and keep this one scoped to the Claude harness work. Those changes have their own catalog, reconciliation, lifecycle, and UI implications and need focused review and testing on their own.

supreme-gg-gg · 2026-08-31T15:10:11Z

I've moved the service and MCP discovery changes to #2639 which I tested separately from this as well, this PR is now focused on Claude changes

EItanya · 2026-08-31T18:08:51Z

        run: |
          echo "Cache key: ${{ needs.setup.outputs.cache-key }}"
-          make build-controller build-golang-adk
+          make build-controller build-golang-adk build-claude-harness


In the future we should add -j here so we can parallelize these builds across the runner CPUs

EItanya · 2026-08-31T18:09:39Z

 	Server AgentTemplateTypedLocalReference `json:"server"`
-	// +kubebuilder:validation:MinItems=1
+	// Tools optionally limits which server tools are exposed. An omitted or empty
+	// list exposes every tool. Harnesses that cannot enforce a partial selection


Does claude not allow filtering?

not directly with an allowed tools option, but I guess we can do this conversely with disallow tools? See this comment

One issue I can see with this is that since this is just emulating allowlist, if MCP server adds a new tool after compilation but before discovery / reconciliation catches up, the new tool is not denied (despite not being allowed) for a given window

Let's take this as a follow-up, good to get something merged for now

EItanya · 2026-08-31T18:10:13Z

+      matchLabels:
+        kagent.dev/e2e-runtime: claude
+---
+apiVersion: kagent.dev/v1alpha3


We have the kagent template below and not the claude one, why?

Claude agent templates are created by a helper function in the test file, since it relies on test-time generated mock modelconfig name

EItanya · 2026-08-31T18:20:29Z

Renamed e2e tests accordingly

EItanya · 2026-08-31T18:22:48Z


-type MCPConfig struct {
+// ADKPaths adds the plugin data destination needed by ADK MCP servers.
+type ADKPaths struct {


Should this be in adk specific code?

I agree, I've moved them to ADK module, agentplugin is now runtime-neutral see b739599

EItanya · 2026-08-31T18:23:09Z

+	return err
+}
+
+func materializeForADK(ctx context.Context, resources agentplugin.Resources, paths ADKPaths) (mcpConfig, error) {


Same comment

EItanya · 2026-08-31T18:24:06Z

+	useBedrockEnv       = "CLAUDE_CODE_USE_BEDROCK"
+	useVertexEnv        = "CLAUDE_CODE_USE_VERTEX"
+	awsRegionEnv        = "AWS_REGION"
+	awsAccessKeyEnv     = "AWS_ACCESS_KEY_ID"
+	awsSecretKeyEnv     = "AWS_SECRET_ACCESS_KEY"
+	awsSessionTokenEnv  = "AWS_SESSION_TOKEN"
+	awsBedrockTokenEnv  = "AWS_BEARER_TOKEN_BEDROCK"
+	anthropicAPIKeyEnv  = "ANTHROPIC_API_KEY"
+	anthropicBaseURLEnv = "ANTHROPIC_BASE_URL"
+	vertexProjectEnv    = "ANTHROPIC_VERTEX_PROJECT_ID"
+	vertexRegionEnv     = "CLOUD_ML_REGION"


Once egress policy is supported we should move everything there

Yes definitely

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

supreme-gg-gg · 2026-09-01T04:33:12Z

A simple demo of Claude Code with Bedrock, also tested with Vertex

input.mov

EItanya

A couple of things need following up on:

Need more code comments, things can be pretty hard to follow
Need to decide on a policy for validating fields which can't apply to certain harnesses. I tend to favor letting it through and logging
I noticed in the video that it takes a couple seconds to respond, I think we need to switch to memory snapshot for Claude since it's node.

EItanya · 2026-09-01T10:55:11Z

          RUNTIME_DIGEST=$(docker buildx imagetools inspect "localhost:5001/kagent-dev/kagent/golang-adk:${VERSION}" | awk '$1 == "Digest:" { print $2; exit }')
          test -n "$RUNTIME_DIGEST"
          export KAGENT_E2E_RUNTIME_IMAGE="localhost:5001/kagent-dev/kagent/golang-adk@${RUNTIME_DIGEST}"
+          CLAUDE_DIGEST=$(docker buildx imagetools inspect "localhost:5001/kagent-dev/kagent/claude-harness:${VERSION}" | awk '$1 == "Digest:" { print $2; exit }')


Not blocking, I don't want to end up in a situation like last release where the controller build was completely blocked on these dependencies

EItanya · 2026-09-01T10:56:10Z

 	if state.Revision == nil || state.RevisionID.IsZero() {
 		return r.cleanupUnreferencedRevisions(ctx)
 	}
+	for _, warning := range state.Revision.Warnings {


In the future can we bubble these up to a status somewhere? Or just somewhere that's more easily trackable

EItanya · 2026-09-01T10:58:31Z

+			"Claude RemoteMCPServer %q cannot verify selected tools %v because no current discovered tool set is available; exposing the whole server",
+			server.Name, selected,


This should be a warning not a failfast

EItanya · 2026-09-01T10:59:54Z

+	if !server.Spec.TLS.IsEmpty() {
+		return "", v2translator.NewValidationError("Claude RemoteMCPServer %q does not support custom TLS configuration", server.Name)
+	}
+	if server.Spec.Timeout != nil && server.Spec.Timeout.Duration != 30*time.Second {
+		return "", v2translator.NewValidationError("Claude RemoteMCPServer %q supports only the default 30s timeout", server.Name)
+	}
+	if server.Spec.TerminateOnClose != nil && !*server.Spec.TerminateOnClose {
+		return "", v2translator.NewValidationError("Claude RemoteMCPServer %q requires terminateOnClose", server.Name)
+	}


Similar to the above I actually think these are more akin to warnings than errors, i don't think it's worth failing translation for this. let's fix these in a follow-up

Moved these to a warning field on AgentTemplate status

EItanya · 2026-09-01T11:03:01Z

+	claudeConfigDirEnv              = "CLAUDE_CONFIG_DIR"
+	disableUpdatesEnv               = "DISABLE_UPDATES"
+	googleApplicationCredentialsEnv = "GOOGLE_APPLICATION_CREDENTIALS"


There are so many lists of env vars for claude, can we centrailze them?

EItanya · 2026-09-01T11:05:15Z

+	}
+}
+
+type boundedBuffer struct {


Something like this doesn't exist in the stdlib?

Unfortunately there isn't anything in io or bufio that does this, there are also bounded buffer utils implemented elsewhere in the codebase as well

EItanya · 2026-09-01T11:06:06Z

+	if _, err := tmp.Write(b); err != nil {
+		_ = tmp.Close()
+		return fmt.Errorf("write temporary session state: %w", err)
+	}
+	if err := tmp.Sync(); err != nil {
+		_ = tmp.Close()
+		return fmt.Errorf("sync temporary session state: %w", err)
+	}
+	if err := tmp.Close(); err != nil {
+		return fmt.Errorf("close temporary session state: %w", err)
+	}
+	if err := os.Rename(tmpName, s.path); err != nil {
+		return fmt.Errorf("replace session state: %w", err)
+	}


There's no os stdlib fn for this? Seems fairly common

stdlib only provides individual file ops nothing like atomic write file

EItanya · 2026-09-01T11:06:50Z

+	data state
+}
+
+func New(durableDir string) (*Store, error) {


Again more comments, It's not clear how this fits into the picture

EItanya · 2026-09-01T11:07:51Z

+
+// Runner is the execution capability consumed by the A2A supervisor.
+type Runner interface {
+	Run(context.Context, runtime.Turn, runtime.EventSink) (runtime.Outcome, error)


Do you think we'll be able to re-use this for codex, or is that wishful thinking?

Yes this will be reusable see #2645

Runs Codex on top of Substrate. Reuses most plumbings from Claude harness, plus some refactoring, and address some follow-up comments on #2602. Feature coverage for Codex is identical to Claude Code right now, and is mostly in parity with Kagent's own ADK harness. The harness driver uses Codex App Server (JSON-RPC over stdio). ## What Changed - Adds Codex as a supported Harness, including controller compilation, runtime image, and release packaging. - Runs Codex with approvals set to never and native sandboxing set to danger-full-access; the Substrate Actor is intentionally the security boundary. - Supports OpenAI Responses and Bedrock gpt-* models, Streamable HTTP MCP servers, selected skills/plugins, and Shared agents; unsupported provider and runtime options are rejected during compilation. - Adds non-blocking compilation warnings to `AgentTemplate` harness status; Claude now reports ignored MCP TLS, timeout, and terminateOnClose settings there instead of rejecting the template. - Moves native continuation persistence and process/file security helpers into a shared runtime layer used by both Codex and Claude, while keeping harness-specific protocol behavior separate. ## Validation - Unit test coverage for Codex - Cluster E2E coverage for Codex - Manual verification (see below recording) --------- Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io> Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io> Co-authored-by: Eitan Yarmush <eitan.yarmush@solo.io>

…untimes (#2663) ## Summary Restores distributed tracing for the v2 controller and the established kagent runtime. - Initialize the controller tracer provider before constructing the instrumented gRPC server. - Forward controller `OTEL_*` variables into kagent runtime revisions; tracing configuration therefore participates in the revision digest. - Add focused coverage for tracer registration and OTEL environment forwarding. <img width="1920" height="959" alt="jaeger-trace" src="https://github.com/user-attachments/assets/6005119d-fb6e-4f55-846b-6399bb9e50f6" /> ## Verification - `go test ./core/...` - `make -C go lint` - Focused tests: `go test ./core/internal/telemetry ./core/v2/translator ./core/v2/translator/kagent ./core/v2/translator/claude` - Kind smoke test: a kagent-harness invocation produces one connected Jaeger trace from `kagent-controller` into the actor. ## Deferred Claude harness tracing needs runtime telemetry initialization and its mock E2E fixture/image from #2602. That work will be handled with the new harness rather than broaden this controller regression fix. --------- Signed-off-by: Cody Hartsook <cody.hartsook@solo.io>

github-actions Bot added the enhancement New feature or request label Aug 27, 2026

supreme-gg-gg mentioned this pull request Aug 27, 2026

[BUG] MCP servers never appear in the list — nothing writes the toolserver table since the legacy reconciler was removed #2603

Closed

supreme-gg-gg commented Aug 27, 2026

View reviewed changes

Comment thread go/core/internal/controller/remotemcpserver/reconciler.go

Comment thread go/core/cmd/controller-v2/main.go

supreme-gg-gg force-pushed the feat/claude-harness branch from e59e0a4 to 312dfe6 Compare August 27, 2026 21:22

supreme-gg-gg mentioned this pull request Aug 27, 2026

chore: cleanup session paths from UI #2607

Merged

supreme-gg-gg commented Aug 27, 2026

View reviewed changes

supreme-gg-gg marked this pull request as ready for review August 27, 2026 21:34

supreme-gg-gg requested review from a team, Charlesthebird and peterj as code owners August 27, 2026 21:34

github-actions Bot added enhancement New feature or request and removed enhancement New feature or request labels Aug 27, 2026

This was referenced Aug 28, 2026

fix: wire the system service into controller-v2 #2614

Closed

[BUG] Agents page cannot load: controller-v2 never wires the system service, so ListNamespaces always returns INTERNAL #2613

Closed

fix: preserve A2A transcript order #2591

Merged

Charlesthebird approved these changes Aug 28, 2026

View reviewed changes

Charlesthebird enabled auto-merge (squash) August 28, 2026 15:35

Charlesthebird disabled auto-merge August 28, 2026 15:36

EItanya force-pushed the main branch from 28d7572 to bf0ba9d Compare August 28, 2026 16:02

EItanya reviewed Aug 28, 2026

View reviewed changes

supreme-gg-gg force-pushed the feat/claude-harness branch from 47759d9 to 1a6da57 Compare August 28, 2026 17:03

EItanya reviewed Aug 28, 2026

View reviewed changes

Comment thread go/adk/pkg/a2a/executor.go Outdated

Comment thread go/harness/claude/internal/driver/process_group_other.go Outdated

Comment thread go/harness/claude/internal/session/store.go Outdated

supreme-gg-gg force-pushed the feat/claude-harness branch from 88b1568 to eabf1c1 Compare August 31, 2026 14:52

github-actions Bot added enhancement New feature or request and removed enhancement New feature or request labels Aug 31, 2026

EItanya reviewed Aug 31, 2026

View reviewed changes

supreme-gg-gg added 13 commits August 31, 2026 18:34

claude initial commit

08c16ed

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

mcp, skills, plugins, fixes to claude

27daee7

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

rebase and go mod

0996619

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

add claude code docs

0a0c552

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

fix lint and test

8b5b10c

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

fix claude e2e mcp tests

c83bf4c

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

fix codex review comments

06249f5

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

e2e: add fork and resume

c835032

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

review comments

f4eba20

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

add timeout to claude

991566e

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

review comments

f402b97

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

test rename

9c7d701

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

refactor agentplugin for better modularity

b739599

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

supreme-gg-gg force-pushed the feat/claude-harness branch from b1d9b2d to b739599 Compare August 31, 2026 22:39

fix artifact streaming chat

9a9265e

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

supreme-gg-gg mentioned this pull request Sep 1, 2026

feat(harness): Initial Codex Support #2645

Merged

supreme-gg-gg added 2 commits August 31, 2026 22:38

update claude tests

05abbf2

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

fix claude streaming dedup

2c98991

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>

EItanya approved these changes Sep 1, 2026

View reviewed changes

EItanya merged commit 051a1ae into kagent-dev:main Sep 1, 2026
41 of 46 checks passed

github-actions Bot added enhancement New feature or request and removed enhancement New feature or request labels Sep 1, 2026

codyhartsook mentioned this pull request Sep 1, 2026

fix(otel): restore distributed tracing for the controller and agent runtimes #2663

Merged

		"Claude RemoteMCPServer %q cannot verify selected tools %v because no current discovered tool set is available; exposing the whole server",
		server.Name, selected,

Uh oh!

Conversation

supreme-gg-gg commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

supreme-gg-gg commented Aug 27, 2026

Codex review

Uh oh!

Charlesthebird left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

EItanya left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

EItanya commented Aug 29, 2026

Uh oh!

supreme-gg-gg commented Aug 31, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

supreme-gg-gg commented Sep 1, 2026

Uh oh!

EItanya left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

supreme-gg-gg commented Aug 27, 2026 •

edited

Loading

Charlesthebird left a comment •

edited

Loading