@bitkyc08/opencodex 2.42.0 → 2.43.0

package/src/server/responses-undeclared-tool-guard.ts

@@ -1,5 +1,6 @@
 import {
   CODE_MODE_EXEC_TOOL_NAME,
+  dottedToolName,
   namespacedToolName,
   normalizeDeclaredToolName,
 } from "../types";
@@ -74,16 +75,40 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 
-function addWireToolName(names: Set<string>, tool: unknown, namespace?: string): void {
-  if (!isPlainObject(tool)) return;
+/**
+ * A dotted spelling is a safe alias only when it cannot ALSO be read as some other identity's
+ * canonical `ns__name`.
+ *
+ * `{namespace: "x__y", name: "z"}` produces the dotted spelling "x__y.z", which is exactly the
+ * canonical wire name of `{namespace: "x", name: "y.z"}`. If only the latter is declared, an
+ * echoed call for the former would still find "x__y.z" in the declared set and be authorized as
+ * a tool the caller never granted. Requiring both halves to be free of the `__` separator keeps
+ * a dotted alias from ever impersonating a canonical name.
+ */
+function dottedAliasIsUnambiguous(namespace: string, name: string): boolean {
+  return !namespace.includes("__") && !name.includes("__");
+}
+
+function wireToolInnerName(tool: unknown): string | undefined {
+  if (!isPlainObject(tool)) return undefined;
   const nestedFunction = tool.type === "function" && isPlainObject(tool.function)
     ? tool.function
     : undefined;
-  const name = typeof tool.name === "string" && tool.name.length > 0
+  return typeof tool.name === "string" && tool.name.length > 0
     ? tool.name
     : typeof nestedFunction?.name === "string" && nestedFunction.name.length > 0
       ? nestedFunction.name
       : undefined;
+}
+
+function addWireToolName(
+  names: Set<string>,
+  tool: unknown,
+  namespace?: string,
+  ambiguousDottedAliases?: ReadonlySet<string>,
+): void {
+  if (!isPlainObject(tool)) return;
+  const name = wireToolInnerName(tool);
   if (!name) return;
   // Codex routes MCP calls by an explicit `namespace` field, so the same tool is reachable
   // as a bare inner name or as the flattened form; accept both rather than guess which
@@ -93,6 +118,17 @@ function addWireToolName(names: Set<string>, tool: unknown, namespace?: string):
     return;
   }
   names.add(namespacedToolName(namespace, name));
+  // Some routed providers echo the flattened wire name with a dot (`ns.name`, observed with
+  // muse-spark via opencode-go) instead of `ns__name`. It is the same tool identity, so register
+  // the dotted spelling too, mirroring `toolChoiceAliases` (#3402) -- but only while that
+  // spelling names exactly one declared tool. Dots are legal inside both a namespace and a
+  // name, so two distinct identities can flatten onto one dotted alias; accepting it then would
+  // authorize a call the caller never declared under that identity. Ambiguous aliases fall back
+  // to the unambiguous `ns__name` form.
+  const dotted = dottedToolName(namespace, name);
+  if (dottedAliasIsUnambiguous(namespace, name) && !ambiguousDottedAliases?.has(dotted)) {
+    names.add(dotted);
+  }
   // `exec` is the one name that also switches on nested-helper normalization, so a bare alias
   // for a namespaced MCP tool would silently authorize `exec_command`/`shell_command`/
   // `apply_patch` the request never declared. Every other inner name keeps the bare alias.
@@ -118,19 +154,65 @@ export function currentTurnWireToolCatalogBody(
   return { ...body, input: body.input.slice(start) };
 }
 
-function addWireToolSpecs(names: Set<string>, specs: unknown): void {
+function addWireToolSpecs(
+  names: Set<string>,
+  specs: unknown,
+  ambiguousDottedAliases?: ReadonlySet<string>,
+): void {
   if (!Array.isArray(specs)) return;
   for (const spec of specs) {
     if (!isPlainObject(spec)) continue;
     if (spec.type === "namespace" && Array.isArray(spec.tools)) {
       const namespace = typeof spec.name === "string" ? spec.name : undefined;
-      for (const inner of spec.tools) addWireToolName(names, inner, namespace);
+      for (const inner of spec.tools) addWireToolName(names, inner, namespace, ambiguousDottedAliases);
       continue;
     }
-    addWireToolName(names, spec);
+    addWireToolName(names, spec, undefined, ambiguousDottedAliases);
   }
 }
 
+/**
+ * Dotted aliases that more than one declared identity would claim, plus dotted aliases that
+ * collide with a canonical or bare declared name.
+ *
+ * Resolved over the WHOLE catalog before any name is registered, so which identity "wins" can
+ * never depend on declaration order -- an order the caller controls.
+ */
+function collectAmbiguousDottedAliases(specGroups: readonly unknown[]): Set<string> {
+  const owners = new Map<string, string | null>();
+  const claim = (alias: string, identity: string): void => {
+    const owner = owners.get(alias);
+    if (owner === undefined) owners.set(alias, identity);
+    else if (owner !== identity) owners.set(alias, null);
+  };
+  for (const specs of specGroups) {
+    if (!Array.isArray(specs)) continue;
+    for (const spec of specs) {
+      if (!isPlainObject(spec)) continue;
+      if (spec.type === "namespace" && Array.isArray(spec.tools)) {
+        const namespace = typeof spec.name === "string" ? spec.name : undefined;
+        if (!namespace || namespace === BUILTIN_FUNCTIONS_NAMESPACE) continue;
+        for (const inner of spec.tools) {
+          const name = wireToolInnerName(inner);
+          if (!name) continue;
+          const identity = JSON.stringify([namespace, name]);
+          claim(dottedToolName(namespace, name), identity);
+          // A canonical or bare name already owned by a different identity poisons the dotted
+          // alias that would shadow it.
+          claim(namespacedToolName(namespace, name), identity);
+          claim(name, identity);
+        }
+        continue;
+      }
+      const name = wireToolInnerName(spec);
+      if (name) claim(name, JSON.stringify([undefined, name]));
+    }
+  }
+  const ambiguous = new Set<string>();
+  for (const [alias, owner] of owners) if (owner === null) ambiguous.add(alias);
+  return ambiguous;
+}
+
 /**
  * Tool names the OUTBOUND Responses body actually declared.
  *
@@ -142,15 +224,17 @@ function addWireToolSpecs(names: Set<string>, specs: unknown): void {
 export function collectDeclaredWireToolNames(body: unknown): Set<string> {
   const names = new Set<string>();
   if (!isPlainObject(body)) return names;
-  addWireToolSpecs(names, body.tools);
+  const specGroups: unknown[] = [body.tools];
   if (Array.isArray(body.input)) {
     for (const item of body.input) {
       if (
         isPlainObject(item)
         && (item.type === "additional_tools" || item.type === "tool_search_output")
-      ) addWireToolSpecs(names, item.tools);
+      ) specGroups.push(item.tools);
     }
   }
+  const ambiguousDottedAliases = collectAmbiguousDottedAliases(specGroups);
+  for (const specs of specGroups) addWireToolSpecs(names, specs, ambiguousDottedAliases);
   return names;
 }
 
@@ -293,7 +377,15 @@ function undeclaredNameInItem(
   if (typeof item.namespace === "string") {
     // Namespaced calls are matched by their full wire name only — never legacy-normalize
     // them, or an undeclared namespaced `exec_command` could slip through as bare `exec`.
+    // Both flattened spellings (`ns__name` and the dotted `ns.name` some providers echo,
+    // #3402) name the same tool identity.
     if (declared.has(namespacedToolName(item.namespace, name))) return undefined;
+    // Only consult the dotted spelling when it cannot double as another identity's canonical
+    // name; otherwise a stranger's `ns__name` would authorize this call.
+    if (
+      dottedAliasIsUnambiguous(item.namespace, name)
+      && declared.has(dottedToolName(item.namespace, name))
+    ) return undefined;
     return name;
   }
   const effectiveName = normalizeDeclaredToolName(name, declared);

package/src/server/safe-response-headers.ts

@@ -0,0 +1,23 @@
+const SAFE_RESPONSE_HEADER_EXACT = new Set([
+  "retry-after", "x-request-id", "openai-request-id", "x-codex-turn-state",
+  "openai-model", "x-models-etag", "x-reasoning-included",
+  "x-codex-credits-has-credits", "x-codex-credits-unlimited", "x-codex-credits-balance",
+  "x-codex-promo-message", "x-codex-safety-buffering-enabled", "x-codex-safety-buffering-faster-model",
+]);
+
+/** Response metadata may carry only the same non-credential headers as native WS errors. */
+export function isSafeResponseHeader(name: string): boolean {
+  const lower = name.toLowerCase();
+  return SAFE_RESPONSE_HEADER_EXACT.has(lower)
+    || lower.startsWith("x-ratelimit-")
+    || /^x-codex(?:-[a-z0-9-]+)?-(primary|secondary|tertiary)-(used-percent|window-minutes|reset-at)$/.test(lower)
+    || /^x-codex(?:-[a-z0-9-]+)?-limit-name$/.test(lower);
+}
+
+export function safeResponseHeaders(headers: Headers): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [name, value] of headers) {
+    if (isSafeResponseHeader(name)) out[name.toLowerCase()] = value;
+  }
+  return out;
+}

package/src/server/search.ts

@@ -19,6 +19,9 @@ import {
   CodexThreadAffinityExpiredError,
 } from "../codex/auth-context";
 import { codexAccountNamespaceForModel } from "../codex/account-namespace-match";
+import { NATIVE_RESERVE_MODEL } from "../codex/catalog/native-models";
+import { isCodexReserveRequestEligible } from "../codex/loopback-target";
+import type { DataPlaneAdmission } from "./auth-cors";
 import { formatCodexProviderForLog } from "../codex/routing";
 import { signalWithTimeout } from "../lib/abort";
 import { readBoundedResponseBytes } from "../lib/bounded-body";
@@ -52,6 +55,7 @@ export async function handleSearch(
   config: OcxConfig,
   logCtx: RequestLogContext,
   turnAdmissionLease?: AdmissionLease,
+  admission?: DataPlaneAdmission,
 ): Promise<Response> {
   try { validateForwardAdmissionCredential(req.headers, config); }
   catch (err) {
@@ -93,6 +97,10 @@ export async function handleSearch(
     }
   }
 
+  if (isCodexReserveRequestEligible(config, admission) && (exactAccount?.modelId ?? model) === NATIVE_RESERVE_MODEL) {
+    return formatErrorResponse(400, "invalid_request_error",
+      "Luna Reserve compatibility is only available as a conversation model, not the standalone search relay. Choose another search model.");
+  }
   const candidates = listOpenAiForwardSidecarCandidates(config);
   if (candidates.length === 0) {
     return formatErrorResponse(
@@ -107,6 +115,7 @@ export async function handleSearch(
   try {
     upstream = await resolveFirstUsableOpenAiSidecar(candidates, req.headers, config, {
       exactAccount,
+      admission,
       beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
     });
     if (!upstream) {

package/src/server/subagent-models-startup.ts

@@ -0,0 +1,27 @@
+import { mutatePersistedConfig } from "../config";
+import { migrateSubagentModels } from "../config/subagent-models";
+import type { OcxConfig } from "../types";
+
+/** Rebase the upgrade on disk so another startup cannot shift the roster twice. */
+export function migrateStartupSubagentModels(config: OcxConfig): OcxConfig {
+  const projection = { ...config };
+  if (!migrateSubagentModels(projection)) return config;
+  try {
+    const outcome = mutatePersistedConfig(fresh => ({
+      changed: migrateSubagentModels(fresh),
+      value: fresh,
+    }));
+    if (outcome.status === "unavailable") {
+      console.warn(`[subagent-models-migration] Persistence unavailable (${outcome.reason}); using the upgraded roster in memory only.`);
+    } else {
+      // Called before live consumers are initialized: later startup saves must
+      // use the whole rebased document, not stale unrelated fields from loadConfig.
+      return outcome.value;
+    }
+  } catch {
+    // A contended coordinator or failed atomic write must not prevent proxy startup.
+    // Do not log the exception: filesystem errors may contain private paths.
+    console.warn("[subagent-models-migration] Persistence failed; using the upgraded roster in memory only.");
+  }
+  return projection;
+}

package/src/server/system-env-shell.ts

@@ -0,0 +1,238 @@
+import { accessSync, constants, readFileSync, writeFileSync, unlinkSync, mkdirSync, statSync } from "node:fs";
+import { delimiter, join } from "node:path";
+import { getConfigDir } from "../config";
+import { resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
+import { PROXY_MARKER, defaultAuthDetectDeps, detectClaudeAuth, ownAdmissionTokens, type AuthDetectDeps } from "../claude/auth-detect";
+import { resolveClaudeAuthMode } from "../claude/auth-mode";
+import { ANTHROPIC_PARENT_ENV_SLOTS, trustedNodeLauncherContext, type AnthropicParentEnvSlot } from "../cli/launcher-context";
+import type { OcxConfig } from "../types";
+import { recordOwnedConfigPath } from "../lib/config-ownership";
+
+/**
+ * Does the opencodex dummy marker belong in the system environment?
+ *
+ * Keyed on the SAME resolver `ocx claude` uses, so an auto config with no Claude auth
+ * also reaches plain `claude` launches — before this, auto-absent users got nothing
+ * from auto-connect and the feature looked broken for exactly the people it helps
+ * (devlog 260726_claude_auth_auto/035).
+ *
+ * NOTE this is a SNAPSHOT: the file only changes when this runs (proxy start, `ocx
+ * ensure`, or a settings save). `ocx claude` re-resolves live on every launch.
+ */
+export type SystemEnvDeps = {
+  /** Test seam; production uses the authenticated Node-launcher context. */
+  preBunAnthropicSlots?: readonly AnthropicParentEnvSlot[] | null;
+  /** Test seam for auth sources; `env` and `ownTokens` stay bound below. */
+  authDetect?: Omit<Partial<AuthDetectDeps>, "env" | "ownTokens">;
+};
+
+/**
+ * Bun may synthesize Anthropic variables from a project `.env` before this module runs.
+ * Only values recorded by the plain-Node launcher are trusted as parent exports. Direct
+ * Bun/service launches have no proof-bound slot list, so they fail closed and let the
+ * file/keychain auth sources decide instead of allowing dotenv to select subscription mode.
+ */
+function systemEnvAnthropicEnv(
+  env: NodeJS.ProcessEnv,
+  preBunAnthropicSlots: readonly AnthropicParentEnvSlot[] | null | undefined,
+): NodeJS.ProcessEnv {
+  const trustedSlots = preBunAnthropicSlots === undefined
+    ? trustedNodeLauncherContext()?.anthropicEnvSlots ?? []
+    : preBunAnthropicSlots ?? [];
+  const exported = new Set<AnthropicParentEnvSlot>(trustedSlots);
+  const sanitized = { ...env };
+  for (const name of ANTHROPIC_PARENT_ENV_SLOTS) {
+    if (sanitized[name] !== undefined && !exported.has(name)) delete sanitized[name];
+  }
+  return sanitized;
+}
+
+export function systemEnvMarkerMode(config: OcxConfig, deps: SystemEnvDeps = {}): "proxy" | "subscription" {
+  const env = systemEnvAnthropicEnv(process.env, deps.preBunAnthropicSlots);
+  const ownTokens = ownAdmissionTokens(config);
+  return resolveClaudeAuthMode(config, detectClaudeAuth({
+    ...defaultAuthDetectDeps(env, ownTokens),
+    ...(deps.authDetect ?? {}),
+    env: () => env,
+    ownTokens,
+  })).markerMode;
+}
+
+// ---------------------------------------------------------------------------
+// Shell-hook env file: written on inject, sourced by the shell hook in .zshrc.
+// This works for ALL new shells immediately, unlike launchctl setenv which only
+// reaches processes launched directly by launchd (not Terminal.app children).
+// ---------------------------------------------------------------------------
+
+export function getShellEnvFilePath(): string {
+  return join(getConfigDir(), "claude-env.sh");
+}
+
+function shellValue(value: string): string {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+
+export function writeShellEnvFile(
+  port: number,
+  config: OcxConfig,
+  modelEnv: Record<string, string> = {},
+  auto?: AutoContextMode,
+  deps: SystemEnvDeps = {},
+): void {
+  const lines = [
+    `# Generated by opencodex — do not edit manually`,
+    `export ANTHROPIC_BASE_URL=${shellValue(`http://127.0.0.1:${port}`)}`,
+    `export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=${shellValue("1")}`,
+  ];
+  // New lever keys are CONDITIONAL exports (audit 139 R2#1): a value the user already
+  // exported in their shell wins even though launchctl knows nothing about it.
+  const conditional = (name: string, value: string) =>
+    `[ -z "\${${name}+x}" ] && export ${name}=${shellValue(value)}`;
+  if (systemEnvMarkerMode(config, deps) === "proxy") {
+    if (config.apiKeys?.length) {
+      lines.push(`export ANTHROPIC_AUTH_TOKEN=${shellValue(config.apiKeys[0].key)}`);
+    } else {
+      lines.push(conditional("ANTHROPIC_AUTH_TOKEN", PROXY_MARKER));
+    }
+  }
+  // Model slots (default + tiers + legacy small-fast) with [1m] applied (devlog 260712 B2).
+  if (modelEnv.ANTHROPIC_MODEL) {
+    lines.push(`export ANTHROPIC_MODEL=${shellValue(modelEnv.ANTHROPIC_MODEL)}`);
+  } else if (config.claudeCode?.model) {
+    lines.push(`export ANTHROPIC_MODEL=${shellValue(config.claudeCode.model)}`);
+  }
+  for (const [name, value] of Object.entries(modelEnv)) {
+    if (name === "ANTHROPIC_MODEL") continue;
+    lines.push(conditional(name, value));
+  }
+  const maxCtx = config.claudeCode?.maxContextTokens;
+  if (typeof maxCtx === "number" && Number.isFinite(maxCtx) && maxCtx > 0) {
+    lines.push(conditional("CLAUDE_CODE_MAX_CONTEXT_TOKENS", String(Math.floor(maxCtx))));
+    lines.push(conditional("DISABLE_COMPACT", "1"));
+  }
+  // Auto-context (devlog 260712 020): same contract as `ocx claude` / launchctl.
+  const autoShell = auto ?? resolveAutoContext(config.claudeCode);
+  if (autoShell.enabled) lines.push(conditional("CLAUDE_CODE_AUTO_COMPACT_WINDOW", String(autoShell.compactWindow)));
+  if (config.claudeCode?.alwaysEnableEffort === true) {
+    lines.push(conditional("CLAUDE_CODE_ALWAYS_ENABLE_EFFORT", "1"));
+  }
+  const shellEnvPath = getShellEnvFilePath();
+  recordOwnedConfigPath(getConfigDir(), shellEnvPath);
+  mkdirSync(getConfigDir(), { recursive: true, mode: 0o700 });
+  writeFileSync(shellEnvPath, lines.join("\n") + "\n", { encoding: "utf8", mode: 0o600 });
+}
+
+export function removeShellEnvFile(): void {
+  try { unlinkSync(getShellEnvFilePath()); } catch { /* already gone */ }
+}
+
+// ---------------------------------------------------------------------------
+// .zshrc hook auto-install: adds a one-liner that sources claude-env.sh.
+// Idempotent — skips if the hook line already exists.
+// ---------------------------------------------------------------------------
+
+const SHELL_HOOK_MARKER = "# opencodex claude-env hook";
+const SHELL_HOOK_LINE = `${SHELL_HOOK_MARKER}\n[ -f ~/.opencodex/claude-env.sh ] && source ~/.opencodex/claude-env.sh`;
+
+export function installShellHook(): { installed: boolean; reason?: string } {
+  if (process.platform !== "darwin") return { installed: false, reason: "not macOS" };
+  const home = process.env.HOME;
+  if (!home) return { installed: false, reason: "no HOME" };
+  const zshrcPath = join(home, ".zshrc");
+  try {
+    let content = "";
+    try { content = readFileSync(zshrcPath, "utf8"); } catch { /* file doesn't exist yet */ }
+    if (content.includes(SHELL_HOOK_MARKER)) return { installed: false, reason: "already installed" };
+    const addition = `\n${SHELL_HOOK_LINE}\n`;
+    writeFileSync(zshrcPath, content + addition, { encoding: "utf8", mode: 0o644 });
+    return { installed: true };
+  } catch (err) {
+    return { installed: false, reason: `write failed: ${err instanceof Error ? err.message : String(err)}` };
+  }
+}
+
+export function uninstallShellHook(): { removed: boolean; reason?: string } {
+  if (process.platform !== "darwin") return { removed: false, reason: "not macOS" };
+  const home = process.env.HOME;
+  if (!home) return { removed: false, reason: "no HOME" };
+  const zshrcPath = join(home, ".zshrc");
+  try {
+    const content = readFileSync(zshrcPath, "utf8");
+    if (!content.includes(SHELL_HOOK_MARKER)) return { removed: false, reason: "not installed" };
+    // Match CR?LF, not LF alone. A .zshrc with CRLF line endings — ordinary on a home
+    // directory an editor or another OS has touched — did not match, so the file was
+    // rewritten unchanged and the caller was told the hook was removed. Reporting success
+    // while the hook still sources on every new shell is the worse of the two failures.
+    const cleaned = content.replace(/\r?\n?# opencodex claude-env hook\r?\n\[.*claude-env\.sh.*(?:\r?\n)?/g, "\n");
+    // Verify instead of assuming: if the marker survives, the block is shaped in a way this
+    // pattern does not own, and the honest answer is failure rather than a silent no-op.
+    if (cleaned.includes(SHELL_HOOK_MARKER)) {
+      return { removed: false, reason: "hook block present but not in the expected shape; remove it manually" };
+    }
+    writeFileSync(zshrcPath, cleaned, { encoding: "utf8", mode: 0o644 });
+    return { removed: true };
+  } catch (error) {
+    if (error && typeof error === "object" && (error as { code?: unknown }).code === "ENOENT") {
+      return { removed: false, reason: "not installed" };
+    }
+    return { removed: false, reason: "read/write failed" };
+  }
+}
+
+/** Whether a real `claude` executable is discoverable from this process's PATH. */
+export function claudeCodeCliInstalled(pathValue = process.env.PATH): boolean {
+  if (!pathValue) return false;
+  for (const directory of pathValue.split(delimiter)) {
+    // An empty PATH segment means the current directory. Do not let the proxy treat a
+    // workspace-local file as a durable user installation.
+    if (!directory) continue;
+    const candidate = join(directory, "claude");
+    try {
+      if (!statSync(candidate).isFile()) continue;
+      accessSync(candidate, constants.X_OK);
+      return true;
+    } catch {
+      // Keep scanning PATH after missing, non-file, and non-executable entries.
+    }
+  }
+  return false;
+}
+
+/**
+ * Keep the shell hook aligned with the integration that can actually consume it.
+ * Claude Desktop uses its own profile and does not source `.zshrc`; this hook exists
+ * only for plain Claude Code CLI launches.
+ *
+ * Reconciliation is PATH-sensitive by construction: "Claude Code is installed" is answered
+ * from the PATH of whichever process calls this. A launchd/service context with a stripped
+ * PATH can therefore fail to see a `claude` the user's interactive shell finds, and this will
+ * remove the hook. That is the intended failure direction — removing an OpenCodex-owned block
+ * is reversible on the next foreground `ocx start`, whereas leaving a hook pointing at an
+ * uninstalled CLI is the stale state this reconciliation exists to clear. Only the block
+ * carrying our own marker is ever touched; user lines are preserved.
+ */
+export function reconcileShellHook(systemEnvInjected: boolean): {
+  changed: boolean;
+  state: "installed" | "absent" | "failed";
+  reason?: string;
+} {
+  if (process.platform !== "darwin") return { changed: false, state: "absent", reason: "not macOS" };
+  if (systemEnvInjected && claudeCodeCliInstalled()) {
+    const result = installShellHook();
+    if (result.installed) return { changed: true, state: "installed" };
+    if (result.reason === "already installed") {
+      return { changed: false, state: "installed", reason: result.reason };
+    }
+    return { changed: false, state: "failed", reason: result.reason ?? "install failed" };
+  }
+
+  const result = uninstallShellHook();
+  if (!result.removed && result.reason !== "not installed") {
+    return { changed: false, state: "failed", reason: result.reason ?? "remove failed" };
+  }
+  return {
+    changed: result.removed,
+    state: "absent",
+    reason: systemEnvInjected ? "Claude Code not installed" : "system environment inactive",
+  };
+}