refactor: decouple hunt from Claude Agent SDK, run on Vercel AI SDK

AGENTS.md

@@ -28,7 +28,7 @@ Opfor is an open-source red-teaming toolkit for AI agents and MCP servers. It ge
 opfor/
 ├── core/                          # @keyvaluesystems/agent-opfor-core — shared engine (npm workspace, compiled to core/dist/)
 │   └── src/
-│       ├── autonomous/            # Autonomous red-teaming orchestration (orchestrator, prompts, tools, state, report, knowledge). Optional trace-aware testing lives in lib/telemetry.ts (grounding + per-thread trace-id propagation + finding/get_trace enrichment), reusing core/src/telemetry/
+│       ├── autonomous/            # Autonomous red-teaming orchestration (orchestrator, prompts, tools, state, report, knowledge). The agent loop runs in-process on the Vercel AI SDK's ToolLoopAgent (orchestrator/agentLoop.ts) — provider-agnostic, no subprocess. Optional trace-aware testing lives in lib/telemetry.ts (grounding + per-thread trace-id propagation + finding/get_trace enrichment), reusing core/src/telemetry/
 │       ├── catalog/               # discoverEvaluators.ts, loadCatalog.ts — YAML evaluator/suite discovery
 │       ├── config/                # types.ts, schema.ts (Zod), evaluatorsLayout.ts, skillsLayout.ts, resolveTelemetryEnv.ts, loadPrompt.ts
 │       ├── execute/               # Run orchestration: runAll.ts (thin orchestrator) → evaluatorLoop.ts → attackRunner.ts (Template Method) + agentAttackDriver.ts/mcpAttackDriver.ts; plus aggregate.ts, baselineScanner.ts, runListener.ts, runAllBrowser.ts, types.ts
@@ -182,6 +182,9 @@ npm test                          # vitest in core/
 | `core/src/config/schema.ts`                                    | Zod schemas for `McpServerConfigSchema` discriminated union (stdio/url) + LLM model config                                                                                                                                                                                                                                                                                 |
 | `core/src/config/evaluatorsLayout.ts`                          | `getRepoRoot()` / `getEvaluatorsDir(category)` / `getSuitesDir(category)` — resolves the repo/package root and `evaluators/{agent\|mcp}/`, `suites/{agent\|mcp}/`, and the shared `data/` dir at runtime (monorepo dev + bundled installs). Use these instead of hardcoding paths.                                                                                         |
 | `core/src/autonomous/knowledge/vulnClasses.ts`                 | `HUNT_VULN_CLASS_CATEGORIES` + `loadVulnClasses()` — derives `opfor hunt`'s vulnerability classes from the allow-listed `evaluators/agent/<category>/README.md` files.                                                                                                                                                                                                     |
+| `core/src/autonomous/orchestrator/agentLoop.ts`                | Hunt's agent loop. Adapts the runtime-agnostic red-team tools to an AI SDK `ToolSet` and builds each role's `ToolLoopAgent`. Tool grants are enforced by construction — an ungranted tool isn't in that agent's toolset at all.                                                                                                                                            |
+| `core/src/autonomous/tools/defineTool.ts`                      | `defineTool()` (aliased `tool`) — the runtime-agnostic tool definition every hunt tool uses. Deliberately carries no agent-runtime dependency, so the same toolset can run under Node and (later) a browser bundle.                                                                                                                                                        |
+| `core/src/autonomous/tools/dispatch.ts`                        | `dispatch_operator` / `dispatch_scout` — subagent spawning as ordinary tools. Several dispatch calls emitted in one step run concurrently, which is how a wave executes.                                                                                                                                                                                                   |
 | `core/src/config/skillsLayout.ts`                              | `getSkillOpforSetupRoot(category)` — resolves `skills/{agent\|mcp}-redteaming/opfor-setup/` for SKILL.md and catalog.json                                                                                                                                                                                                                                                  |
 | `core/src/catalog/discoverEvaluators.ts`                       | Discovers evaluators from YAML files (directory-form and flat-file); ignores `*.test.yaml` fixtures                                                                                                                                                                                                                                                                        |
 | `core/src/config/loadSkillCatalog.ts`                          | Reads evaluator metadata + suite lists from skill catalog.json (used by skills/MCP mode)                                                                                                                                                                                                                                                                                   |

README.md

@@ -163,7 +163,7 @@ This catches what input/output testing misses — PII that leaks into a tool cal
 
 ## Autonomous Red-Teaming
 
-`opfor hunt` skips the config file entirely. Give it an endpoint and an objective, and a multi-agent system — commander, operators, scout — runs an adaptive attack campaign on its own: recon, strategy, multi-turn probing, report. Unlike `opfor run`, the agents run on Claude only (via a Claude API key, `claude setup-token`, or your local `claude login` session) — your target can be anything.
+`opfor hunt` skips the config file entirely. Give it an endpoint and an objective, and a multi-agent system — commander, operators, scout — runs an adaptive attack campaign on its own: recon, strategy, multi-turn probing, report. The agents run on any supported LLM provider (Claude by default, via `--brain-provider`) — and your target can be anything.
 
 ```bash
 opfor hunt \

core/package.json

@@ -106,21 +106,7 @@
     "yaml": "^2.8.3",
     "zod": "^4.0.0"
   },
-  "peerDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.165",
-    "@anthropic-ai/sdk": "^0.100.1"
-  },
-  "peerDependenciesMeta": {
-    "@anthropic-ai/claude-agent-sdk": {
-      "optional": true
-    },
-    "@anthropic-ai/sdk": {
-      "optional": true
-    }
-  },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.165",
-    "@anthropic-ai/sdk": "^0.100.1",
     "@types/node": "^24.0.0",
     "typescript": "^5.8.3"
   }

core/src/autonomous/lib/budget.ts

@@ -1,26 +1,28 @@
 // Cost/rate guardrails for an autonomous run.
-
+//
+// Cost is estimated from token usage via the shared `pricing/` table. Hunt used to carry its own
+// hardcoded opus/sonnet/haiku price map that silently priced every unrecognized model as Sonnet —
+// harmless while hunt was Claude-only, wrong the moment it can run on any provider.
+//
+// Note there is no longer a server-authoritative total to correct drift against (the Claude Agent
+// SDK supplied one; the AI SDK does not), so `spentUsd` is an estimate throughout. It is
+// cache-aware, which is what dominates accuracy on a long run with a large static system prompt.
+
+import type { LanguageModel } from "ai";
 import { RateLimiter } from "../../lib/rateLimiter.js";
-
-// Approximate Claude pricing in USD per million tokens (as of mid-2025).
-// Used to estimate running cost from streaming token counts before the SDK
-// emits a final total_cost_usd. The result message corrects any drift.
-const MODEL_PRICES: Record<
-  string,
-  { inputPerM: number; outputPerM: number; cacheWritePerM: number; cacheReadPerM: number }
-> = {
-  opus: { inputPerM: 15, outputPerM: 75, cacheWritePerM: 18.75, cacheReadPerM: 1.5 },
-  sonnet: { inputPerM: 3, outputPerM: 15, cacheWritePerM: 3.75, cacheReadPerM: 0.3 },
-  haiku: { inputPerM: 0.8, outputPerM: 4, cacheWritePerM: 1.0, cacheReadPerM: 0.08 },
-};
-const DEFAULT_PRICES = MODEL_PRICES.sonnet;
-
-function resolvePrices(modelHint?: string) {
-  if (!modelHint) return DEFAULT_PRICES;
-  const lower = modelHint.toLowerCase();
-  if (lower.includes("opus")) return MODEL_PRICES.opus;
-  if (lower.includes("haiku")) return MODEL_PRICES.haiku;
-  return MODEL_PRICES.sonnet;
+import { TokenTracker } from "../../execute/tokenTracker.js";
+import { estimateRunCost } from "../../pricing/estimateCost.js";
+
+/** Token usage as the AI SDK reports it on a completed step. */
+export interface StepUsage {
+  inputTokens?: number;
+  outputTokens?: number;
+  totalTokens?: number;
+  inputTokenDetails?: {
+    noCacheTokens?: number;
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
+  };
 }
 
 export interface BudgetGuardOptions {
@@ -36,8 +38,8 @@ export interface BudgetGuardOptions {
   maxDepth?: number;
   /**
    * Hard ceiling on total target sends across the whole run — the DETERMINISTIC, real-time cost
-   * backstop. The USD ceiling is only known after SDK result messages (it lags and overshoots);
-   * this caps work as it happens. Defaults to ~20 sends per budget-USD (≈$0.05/send), or 200.
+   * backstop. The USD ceiling is an estimate that lags actual spend; this caps work as it happens.
+   * Defaults to ~20 sends per budget-USD (≈$0.05/send), or 200.
    */
   maxTotalSends?: number;
 }
@@ -49,9 +51,9 @@ export class BudgetGuard {
   readonly maxForksPerThread: number;
   readonly maxDepth: number;
   readonly maxTotalSends: number;
+  /** Per-model token accounting; also feeds the report's usage stats. */
+  readonly tokens = new TokenTracker();
   private readonly rateLimiter: RateLimiter;
-  private lastKnownCostUsd = 0;
-  private accumulatedTokenCostUsd = 0;
   private sendsUsed = 0;
 
   constructor(opts: BudgetGuardOptions) {
@@ -102,7 +104,7 @@ export class BudgetGuard {
 
   /**
    * Whether a fork is allowed: bounded by total tree size and per-parent fan-out. (True
-   * concurrency is already governed by the SDK's subagent cap; these are the runaway backstops.)
+   * concurrency is already governed by the dispatch wave size; these are the runaway backstops.)
    */
   forkAllowed(totalThreads: number, childrenOfParent: number): { ok: boolean; reason?: string } {
     if (totalThreads >= this.maxTotalThreads) {
@@ -117,52 +119,48 @@ export class BudgetGuard {
     return { ok: true };
   }
 
-  /** Record the latest known cumulative cost (from SDK result/usage messages). Corrects estimation drift. */
-  recordCost(costUsd: number): void {
-    if (Number.isFinite(costUsd) && costUsd > this.lastKnownCostUsd) {
-      this.lastKnownCostUsd = costUsd;
-      // Keep accumulated estimate in sync so it doesn't double-count after correction.
-      if (costUsd > this.accumulatedTokenCostUsd) {
-        this.accumulatedTokenCostUsd = costUsd;
-      }
-    }
-  }
-
   /**
-   * Accumulate token usage from a streaming assistant message. Updates `lastKnownCostUsd`
-   * so `isOverBudget()` can fire mid-stream rather than only after result messages.
-   * Uses a model price table — drift is corrected when `recordCost()` receives the
-   * server's authoritative `total_cost_usd` from the final result message.
+   * Accumulate usage from one completed agent step, attributed to the model that served it so
+   * each model is priced at its own rate. `model` is the AI SDK model instance — `createModel()`
+   * records its provider/model identity, which is what the tracker resolves.
    */
-  recordTokenUsage(
-    usage: {
-      inputTokens: number;
-      outputTokens: number;
-      cacheCreationInputTokens: number;
-      cacheReadInputTokens: number;
-    },
-    modelHint?: string
-  ): void {
-    const prices = resolvePrices(modelHint);
-    const cost =
-      (usage.inputTokens * prices.inputPerM +
-        usage.outputTokens * prices.outputPerM +
-        usage.cacheCreationInputTokens * prices.cacheWritePerM +
-        usage.cacheReadInputTokens * prices.cacheReadPerM) /
-      1_000_000;
-    this.accumulatedTokenCostUsd += cost;
-    if (this.accumulatedTokenCostUsd > this.lastKnownCostUsd) {
-      this.lastKnownCostUsd = this.accumulatedTokenCostUsd;
-    }
+  recordUsage(usage: StepUsage | undefined, model: LanguageModel, role: string): void {
+    if (!usage) return;
+    const details = usage.inputTokenDetails;
+    const cache =
+      details &&
+      (details.noCacheTokens !== undefined ||
+        details.cacheReadTokens !== undefined ||
+        details.cacheWriteTokens !== undefined)
+        ? {
+            noCache: details.noCacheTokens ?? 0,
+            cacheRead: details.cacheReadTokens ?? 0,
+            cacheWrite: details.cacheWriteTokens ?? 0,
+          }
+        : undefined;
+
+    this.tokens.record(
+      {
+        inputTokens: usage.inputTokens,
+        outputTokens: usage.outputTokens,
+        totalTokens: usage.totalTokens,
+        cache,
+      },
+      { model, role }
+    );
   }
 
+  /**
+   * Estimated spend so far, in USD. Models the price table doesn't know contribute 0 — the
+   * estimate is a lower bound, which is why `maxTotalSends` exists as the hard backstop.
+   */
   get spentUsd(): number {
-    return this.lastKnownCostUsd;
+    return estimateRunCost(this.tokens.breakdown)?.totalUsd ?? 0;
   }
 
-  /** True when a hard USD ceiling is configured and has been reached. */
+  /** True when a hard USD ceiling is configured and the estimate has reached it. */
   isOverBudget(): boolean {
-    return this.budgetUsd !== undefined && this.lastKnownCostUsd >= this.budgetUsd;
+    return this.budgetUsd !== undefined && this.spentUsd >= this.budgetUsd;
   }
 
   /** Whether a thread may take another turn. */

core/src/autonomous/lib/models.ts

@@ -1,8 +1,28 @@
-// Model-alias resolution shared across the autonomous runner (self_check verifier,
-// trace-curation model, …). Maps short aliases to full Anthropic ids, honoring the
-// ANTHROPIC_DEFAULT_*_MODEL gateway overrides.
+// Brain-model resolution for the autonomous runner.
+//
+// "Brain" = the LLM driving the commander / operator / scout / verifier agents, as opposed to
+// the TARGET under attack. Hunt used to hardcode Claude here; it now resolves through the same
+// provider registry `opfor run` uses, so any supported provider can drive a hunt.
 
-/** Resolve a model alias to a full Anthropic API model id, respecting gateway env-var overrides. */
+import type { LlmConfig, ProviderName } from "../../config/types.js";
+import { PROVIDER_ENV_VARS, PROVIDER_DEFAULTS } from "../../providers/factory.js";
+
+/** Provider-level config for the agent brain. Per-agent model ids live on HuntOptions. */
+export interface BrainConfig {
+  provider: ProviderName;
+  /** Env var NAME holding the key. Defaults to the provider's conventional var. */
+  apiKeyEnv?: string;
+  /** Gateway / self-hosted base URL. */
+  baseURL?: string;
+}
+
+/**
+ * Resolve a Claude model alias to a full Anthropic id, honoring the gateway overrides.
+ *
+ * Aliases are Anthropic-only by design: `sonnet` means nothing to OpenAI or Groq, so other
+ * providers take a literal model id. Kept so existing `--commander-model sonnet` invocations
+ * and the documented ANTHROPIC_DEFAULT_*_MODEL pins keep working.
+ */
 export function resolveModelId(model: string): string {
   switch (model) {
     case "opus":
@@ -15,3 +35,20 @@ export function resolveModelId(model: string): string {
       return model; // assume a full id was provided
   }
 }
+
+/**
+ * Build the `LlmConfig` for one brain agent. Alias expansion applies only to Anthropic;
+ * an empty model falls back to the provider's default.
+ */
+export function brainLlmConfig(brain: BrainConfig, model: string): LlmConfig {
+  const resolved =
+    brain.provider === "anthropic"
+      ? resolveModelId(model)
+      : model || PROVIDER_DEFAULTS[brain.provider];
+  return {
+    provider: brain.provider,
+    model: resolved,
+    apiKeyEnv: brain.apiKeyEnv ?? PROVIDER_ENV_VARS[brain.provider],
+    baseURL: brain.baseURL,
+  };
+}

core/src/autonomous/lib/types.ts

@@ -3,6 +3,7 @@
 
 import type { SessionConfig } from "../../execute/types.js";
 import type { TelemetryConfig } from "../../config/types.js";
+import type { BrainConfig } from "./models.js";
 
 /** How the target HTTP agent maintains conversation state. */
 export type TargetMode = "stateless" | "stateful";
@@ -12,7 +13,7 @@ export type TargetKind = "http" | "local-script";
 
 /**
  * Transport configuration for the target agent under test.
- * The agent (Claude SDK) never sees these values — tools hold the client.
+ * The brain agents never see these values — tools hold the client.
  */
 export interface TargetConfig {
   /** Display name (defaults to the endpoint host, or the script's basename for local-script). */
@@ -54,7 +55,12 @@ export interface TargetConfig {
 export interface HuntOptions {
   target: TargetConfig;
   objective: string;
-  /** Commander model (alias like "opus"/"sonnet" or full id). */
+  /**
+   * Provider/credentials for the agent brain (commander, operator, scout, verifier).
+   * Independent of the target — the target can be any model or agent.
+   */
+  brain: BrainConfig;
+  /** Commander model. Anthropic aliases ("opus"/"sonnet"/"haiku") or a full provider model id. */
   commanderModel: string;
   /** Operator subagent model. */
   operatorModel: string;