feat(worker): ClaudeCodeAdapter runs claude -p stream-json in the per-user box

apps/agent-worker/src/runtime/auth.ts

@@ -0,0 +1,20 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+
+// Normalize + pretty-print an auth JSON blob before writing it with owner-only
+// permissions. Shared by the credential-writing adapters (Claude, and available
+// to Codex/OpenCode). `label` names the source in the parse-error message.
+export const writeJsonFile = async (
+  filePath: string,
+  content: string,
+  label = 'auth',
+) => {
+  let normalized = content.trim();
+  try {
+    normalized = `${JSON.stringify(JSON.parse(normalized), null, 2)}\n`;
+  } catch {
+    throw new Error(`${label} JSON is not valid JSON.`);
+  }
+  await mkdir(path.dirname(filePath), { recursive: true });
+  await writeFile(filePath, normalized, { mode: 0o600 });
+};